Changeset 46959

Timestamp:

12/14/2019 03:51:33 PM (5 years ago)

Author:

SergeyBiryukov

Message:

Formatting: Return early from wp_kses_attr_check() if the element is not in the list of allowed elements and attributes.

Props krynes, tristanleboss.
Fixes #48549.

File:

• trunk/src/wp-includes/kses.php (modified) (1 diff)

trunk/src/wp-includes/kses.php

@@ -1153 +1153 @@
  */
 function wp_kses_attr_check( &$name, &$value, &$whole, $vless, $element, $allowed_html ) {
-    $allowed_attr = $allowed_html[ strtolower( $element ) ];
-
-    $name_low = strtolower( $name );
+    $name_low    = strtolower( $name );
+    $element_low = strtolower( $element );
+
+    if ( ! isset( $allowed_html[ $element_low ] ) ) {
+        $name  = '';
+        $value = '';
+        $whole = '';
+        return false;
+    }
+
+    $allowed_attr = $allowed_html[ $element_low ];
+
     if ( ! isset( $allowed_attr[ $name_low ] ) || '' == $allowed_attr[ $name_low ] ) {
         /*