Changeset 43727 for branches/5.0/src/wp-includes/kses.php

Timestamp:

10/15/2018 05:21:04 AM (6 years ago)

Author:

peterwilsoncc

Message:

KSES: Allow HTML data-* attributes.

Add global support for HTML attributes prefixed data- for authors and contributors, as required by the new editor.

Props azaozz, peterwilsoncc.
Fixes #33121.

File:

• branches/5.0/src/wp-includes/kses.php (modified) (5 diffs)

branches/5.0/src/wp-includes/kses.php

@@ -855 +855 @@
  *
  * @since 4.2.3
+ * @since 5.0.0 Add support for `data-*` wildcard attributes.
  *
  * @param string $name The attribute name. Returns empty string when not allowed.
@@ -865 +866 @@
  */
 function wp_kses_attr_check( &$name, &$value, &$whole, $vless, $element, $allowed_html ) {
-    $allowed_attr = $allowed_html[strtolower( $element )];
+    $allowed_attr = $allowed_html[ strtolower( $element ) ];
 
     $name_low = strtolower( $name );
+
     if ( ! isset( $allowed_attr[$name_low] ) || '' == $allowed_attr[$name_low] ) {
-        $name = $value = $whole = '';
-        return false;
+        /*
+         * Allow `data-*` attributes.
+         *
+         * When specifying `$allowed_html`, the attribute name should be set as
+         * `data-*` (not to be mixed with the HTML 4.0 `data` attribute, see
+         * https://www.w3.org/TR/html40/struct/objects.html#adef-data).
+         *
+         * Note: the attribute name should only contain `A-Za-z0-9_-` chars,
+         * double hyphens `--` are not accepted by WordPress.
+         */
+        if ( strpos( $name_low, 'data-' ) === 0 && ! empty( $allowed_attr['data-*'] ) && preg_match( '/^data(?:-[a-z0-9_]+)+$/', $name_low, $match ) ) {
+            /*
+             * Add the whole attribute name to the allowed attributes and set any restrictions
+             * for the `data-*` attribute values for the current element.
+             */
+            $allowed_attr[ $match[0] ] = $allowed_attr['data-*'];
+        } else {
+            $name = $value = $whole = '';
+            return false;
+        }
     }
 
@@ -885 +905 @@
     }
 
-    if ( is_array( $allowed_attr[$name_low] ) ) {
+    if ( is_array( $allowed_attr[ $name_low ] ) ) {
         // there are some checks
         foreach ( $allowed_attr[$name_low] as $currkey => $currval ) {
@@ -1809 +1829 @@
  *
  * @since 3.5.0
+ * @since 5.0.0 Add support for `data-*` wildcard attributes.
  * @access private
  *
@@ -1821 +1842 @@
         'title' => true,
         'role' => true,
+        'data-*' => true,
     );