WordPress.org

Make WordPress Core


Ignore:
Timestamp:
12/12/2018 11:11:33 PM (11 months ago)
Author:
pento
Message:

KSES: Conditionally remove the <form> element from $allowedposttags.

To avoid backwards compatibility issues, <form> is re-added if a custom filter has added the <input> or <select> elements to $allowedposttags.

File:
1 edited

Legend:

Unmodified
Added
Removed
  • branches/5.0/src/wp-includes/kses.php

    r43813 r43994  
    187187            'lang' => true,
    188188            'xml:lang' => true,
    189         ),
    190         'form' => array(
    191             'action' => true,
    192             'accept' => true,
    193             'accept-charset' => true,
    194             'enctype' => true,
    195             'method' => true,
    196             'name' => true,
    197             'target' => true,
    198189        ),
    199190        'h1' => array(
     
    614605 *
    615606 * @since 3.5.0
     607 * @since 5.0.1 `form` removed as allowable HTML tag.
    616608 *
    617609 * @global array $allowedposttags
     
    642634        case 'post':
    643635            /** This filter is documented in wp-includes/kses.php */
    644             return apply_filters( 'wp_kses_allowed_html', $allowedposttags, $context );
     636            $tags = apply_filters( 'wp_kses_allowed_html', $allowedposttags, $context );
     637
     638            // 5.0.1 removed the `<form>` tag, allow it if a filter is allowing it's sub-elements `<input>` or `<select>`.
     639            if ( ! CUSTOM_TAGS && ! isset( $tags['form'] ) && ( isset( $tags['input'] ) || isset( $tags['select'] ) ) ) {
     640                $tags = $allowedposttags;
     641
     642                $tags['form'] = array(
     643                    'action' => true,
     644                    'accept' => true,
     645                    'accept-charset' => true,
     646                    'enctype' => true,
     647                    'method' => true,
     648                    'name' => true,
     649                    'target' => true,
     650                );
     651
     652                /** This filter is documented in wp-includes/kses.php */
     653                $tags = apply_filters( 'wp_kses_allowed_html', $tags, $context );
     654            }
     655
     656            return $tags;
    645657
    646658        case 'user_description':
Note: See TracChangeset for help on using the changeset viewer.