Changeset 44016

Timestamp:

12/12/2018 11:57:07 PM (6 years ago)

Author:

pento

Message:

KSES: Conditionally remove the <form> element from $allowedposttags.

To avoid backwards compatibility issues, <form> is re-added if a custom filter has added the <input> or <select> elements to $allowedposttags.

Merges [43994] to the 3.9 branch.

Location:

branches/3.9

Files:

• . (modified) (1 prop)
• src/wp-includes/kses.php (modified) (3 diffs)

branches/3.9/src/wp-includes/kses.php

@@ -160 +160 @@
             'lang' => true,
             'xml:lang' => true,
-        ),
-        'form' => array(
-            'action' => true,
-            'accept' => true,
-            'accept-charset' => true,
-            'enctype' => true,
-            'method' => true,
-            'name' => true,
-            'target' => true,
         ),
         'h1' => array(
@@ -570 +561 @@
  *
  * @since 3.5.0
+ * @since 5.0.1 `form` removed as allowable HTML tag.
  *
  * @param string $context The context for which to retrieve tags. Allowed values are
@@ -594 +586 @@
         case 'post':
             /** This filter is documented in wp-includes/kses.php */
-            return apply_filters( 'wp_kses_allowed_html', $allowedposttags, $context );
-            break;
+            $tags = apply_filters( 'wp_kses_allowed_html', $allowedposttags, $context );
+
+            // 5.0.1 removed the `<form>` tag, allow it if a filter is allowing it's sub-elements `<input>` or `<select>`.
+            if ( ! CUSTOM_TAGS && ! isset( $tags['form'] ) && ( isset( $tags['input'] ) || isset( $tags['select'] ) ) ) {
+                $tags = $allowedposttags;
+
+                $tags['form'] = array(
+                    'action' => true,
+                    'accept' => true,
+                    'accept-charset' => true,
+                    'enctype' => true,
+                    'method' => true,
+                    'name' => true,
+                    'target' => true,
+                );
+
+                /** This filter is documented in wp-includes/kses.php */
+                $tags = apply_filters( 'wp_kses_allowed_html', $tags, $context );
+            }
+
+            return $tags;
         case 'user_description':
         case 'pre_user_description':