Make WordPress Core

Timestamp:
03/08/2019 10:04:50 PM (6 years ago)
Author:
desrosj
Message:

Privacy: Be less restrictive of the HTML tags allowed in user data exports.

Previously, only a and br tags were allowed in the value table cell for each field included in the HTML file generated when a user is exporting their personal data. Instead of relying on a hardcoded list of allowed tags, the wp_kses() call in wp_privacy_generate_personal_data_export_group_html() will now fallback to the default list of allowed tags (which includes i, strong, em, and other basic HTML formatting tags).

Also, a new context of personal_data_export will now be passed to the wp_kses() call. As a result, the list of HTML tags and attributes allowed in the export file can now be filtered using the wp_kses_allowed_html filter and checking for the personal_data_export context.

Fixes #44044.
Props tz-media, desrosj, pento, birgire, garrett-eclipse.

File:
1 added

Note: See TracChangeset for help on using the changeset viewer.