Changeset 43813 for branches/5.0/src/wp-includes/kses.php

Timestamp:

10/24/2018 01:18:38 AM (8 months ago)

Author:

pento

Message:

KSES: Allow the download attribute on <a> tags.

To avoid this being a vector for bypassing the filetypes that are allowed to be uploaded, this attribute is only allowed to be added without a value.

Props kalpshit, arshidkv12, welcher, peterwilsoncc, marina_wp, pento.
See #44724.

File:

• branches/5.0/src/wp-includes/kses.php (modified) (1 diff)

branches/5.0/src/wp-includes/kses.php

@@ -67 +67 @@
             'name' => true,
             'target' => true,
+            'download' => array(
+                'valueless' => 'y',
+            ),
         ),
         'abbr' => array(),