Make WordPress Core


Ignore:
Timestamp:
03/08/2019 10:04:50 PM (5 years ago)
Author:
desrosj
Message:

Privacy: Be less restrictive of the HTML tags allowed in user data exports.

Previously, only a and br tags were allowed in the value table cell for each field included in the HTML file generated when a user is exporting their personal data. Instead of relying on a hardcoded list of allowed tags, the wp_kses() call in wp_privacy_generate_personal_data_export_group_html() will now fallback to the default list of allowed tags (which includes i, strong, em, and other basic HTML formatting tags).

Also, a new context of personal_data_export will now be passed to the wp_kses() call. As a result, the list of HTML tags and attributes allowed in the export file can now be filtered using the wp_kses_allowed_html filter and checking for the personal_data_export context.

Fixes #44044.
Props tz-media, desrosj, pento, birgire, garrett-eclipse.

File:
1 edited

Legend:

Unmodified
Added
Removed
  • trunk/src/wp-admin/includes/file.php

    r44635 r44824  
    19571957 */
    19581958function wp_privacy_generate_personal_data_export_group_html( $group_data ) {
    1959     $allowed_tags      = array(
    1960         'a'  => array(
    1961             'href'   => array(),
    1962             'target' => array(),
    1963         ),
    1964         'br' => array(),
    1965     );
    1966     $allowed_protocols = array( 'http', 'https' );
    1967     $group_html        = '';
    1968 
    1969     $group_html .= '<h2>' . esc_html( $group_data['group_label'] ) . '</h2>';
     1959    $group_html  = '<h2>' . esc_html( $group_data['group_label'] ) . '</h2>';
    19701960    $group_html .= '<div>';
    19711961
     
    19761966        foreach ( (array) $group_item_data as $group_item_datum ) {
    19771967            $value = $group_item_datum['value'];
    1978             // If it looks like a link, make it a link
     1968            // If it looks like a link, make it a link.
    19791969            if ( false === strpos( $value, ' ' ) && ( 0 === strpos( $value, 'http://' ) || 0 === strpos( $value, 'https://' ) ) ) {
    19801970                $value = '<a href="' . esc_url( $value ) . '">' . esc_html( $value ) . '</a>';
     
    19831973            $group_html .= '<tr>';
    19841974            $group_html .= '<th>' . esc_html( $group_item_datum['name'] ) . '</th>';
    1985             $group_html .= '<td>' . wp_kses( $value, $allowed_tags, $allowed_protocols ) . '</td>';
     1975            $group_html .= '<td>' . wp_kses( $value, 'personal_data_export' ) . '</td>';
    19861976            $group_html .= '</tr>';
    19871977        }
Note: See TracChangeset for help on using the changeset viewer.