Changeset 44824

Timestamp:

03/08/2019 10:04:50 PM (6 years ago)

Author:

desrosj

Message:

Privacy: Be less restrictive of the HTML tags allowed in user data exports.

Previously, only a and br tags were allowed in the value table cell for each field included in the HTML file generated when a user is exporting their personal data. Instead of relying on a hardcoded list of allowed tags, the wp_kses() call in wp_privacy_generate_personal_data_export_group_html() will now fallback to the default list of allowed tags (which includes i, strong, em, and other basic HTML formatting tags).

Also, a new context of personal_data_export will now be passed to the wp_kses() call. As a result, the list of HTML tags and attributes allowed in the export file can now be filtered using the wp_kses_allowed_html filter and checking for the personal_data_export context.

Fixes #44044.
Props tz-media, desrosj, pento, birgire, garrett-eclipse.

Location:

trunk

Files:

• src/wp-admin/includes/file.php (modified) (3 diffs)
• tests/phpunit/tests/privacy/wpPrivacyGeneratePersonalDataExportGroupHtml.php (added)

trunk/src/wp-admin/includes/file.php

@@ -1957 +1957 @@
  */
 function wp_privacy_generate_personal_data_export_group_html( $group_data ) {
-    $allowed_tags      = array(
-        'a'  => array(
-            'href'   => array(),
-            'target' => array(),
-        ),
-        'br' => array(),
-    );
-    $allowed_protocols = array( 'http', 'https' );
-    $group_html        = '';
-
-    $group_html .= '<h2>' . esc_html( $group_data['group_label'] ) . '</h2>';
+    $group_html  = '<h2>' . esc_html( $group_data['group_label'] ) . '</h2>';
     $group_html .= '<div>';
 
@@ -1976 +1966 @@
         foreach ( (array) $group_item_data as $group_item_datum ) {
             $value = $group_item_datum['value'];
-            // If it looks like a link, make it a link
+            // If it looks like a link, make it a link.
             if ( false === strpos( $value, ' ' ) && ( 0 === strpos( $value, 'http://' ) || 0 === strpos( $value, 'https://' ) ) ) {
                 $value = '<a href="' . esc_url( $value ) . '">' . esc_html( $value ) . '</a>';
@@ -1983 +1973 @@
             $group_html .= '<tr>';
             $group_html .= '<th>' . esc_html( $group_item_datum['name'] ) . '</th>';
-            $group_html .= '<td>' . wp_kses( $value, $allowed_tags, $allowed_protocols ) . '</td>';
+            $group_html .= '<td>' . wp_kses( $value, 'personal_data_export' ) . '</td>';
             $group_html .= '</tr>';
         }