WordPress.org

Make WordPress Core


Ignore:
Timestamp:
10/24/2018 01:18:38 AM (8 months ago)
Author:
pento
Message:

KSES: Allow the download attribute on <a> tags.

To avoid this being a vector for bypassing the filetypes that are allowed to be uploaded, this attribute is only allowed to be added without a value.

Props kalpshit, arshidkv12, welcher, peterwilsoncc, marina_wp, pento.
See #44724.

File:
1 edited

Legend:

Unmodified
Added
Removed
  • branches/5.0/src/wp-includes/kses.php

    r43781 r43813  
    6767            'name' => true,
    6868            'target' => true,
     69            'download' => array(
     70                'valueless' => 'y',
     71            ),
    6972        ),
    7073        'abbr' => array(),
Note: See TracChangeset for help on using the changeset viewer.