Changeset 43994

Timestamp:

12/12/2018 11:11:33 PM (8 years ago)

Author:

pento

Message:

KSES: Conditionally remove the <form> element from $allowedposttags.

To avoid backwards compatibility issues, <form> is re-added if a custom filter has added the <input> or <select> elements to $allowedposttags.

File:

• branches/5.0/src/wp-includes/kses.php (modified) (3 diffs)

branches/5.0/src/wp-includes/kses.php

@@ -187 +187 @@
                         'lang' => true,
                         'xml:lang' => true,
-                ),
-                'form' => array(
-                        'action' => true,
-                        'accept' => true,
-                        'accept-charset' => true,
-                        'enctype' => true,
-                        'method' => true,
-                        'name' => true,
-                        'target' => true,
                 ),
                 'h1' => array(
@@ -614 +605 @@
  *
  * @since 3.5.0
+ * @since 5.0.1 `form` removed as allowable HTML tag.
  *
  * @global array $allowedposttags
@@ -642 +634 @@
                 case 'post':
                         /** This filter is documented in wp-includes/kses.php */
-                        return apply_filters( 'wp_kses_allowed_html', $allowedposttags, $context );
+                        $tags = apply_filters( 'wp_kses_allowed_html', $allowedposttags, $context );
+
+                        // 5.0.1 removed the `<form>` tag, allow it if a filter is allowing it's sub-elements `<input>` or `<select>`.
+                        if ( ! CUSTOM_TAGS && ! isset( $tags['form'] ) && ( isset( $tags['input'] ) || isset( $tags['select'] ) ) ) {
+                                $tags = $allowedposttags;
+
+                                $tags['form'] = array(
+                                        'action' => true,
+                                        'accept' => true,
+                                        'accept-charset' => true,
+                                        'enctype' => true,
+                                        'method' => true,
+                                        'name' => true,
+                                        'target' => true,
+                                );
+
+                                /** This filter is documented in wp-includes/kses.php */
+                                $tags = apply_filters( 'wp_kses_allowed_html', $tags, $context );
+                        }
+
+                        return $tags;
 
                 case 'user_description':