Changeset 51414

Timestamp:

07/13/2021 05:57:04 AM (5 years ago)

Author:

peterwilsoncc

Message:

Widgets: Validate HTML before saving block widgets.

Props talldanwp, noisysocks, kevin940726, peterwilsoncc.

Location:

trunk/src/wp-includes

Files:

• class-wp-customize-widgets.php (modified) (1 diff)
• widgets/class-wp-widget-block.php (modified) (1 diff)

trunk/src/wp-includes/class-wp-customize-widgets.php

@@ -1420 +1420 @@
                         $widget_object = $wp_widget_factory->get_widget_object( $id_base );
                         if ( ! empty( $widget_object->widget_options['show_instance_in_rest'] ) ) {
+                                if ( 'block' === $id_base && ! current_user_can( 'unfiltered_html' ) ) {
+                                        // The content of the 'block' widget is not filtered on the
+                                        // fly while editing. Filter the content here to prevent
+                                        // vulnerabilities.
+                                        $value['raw_instance']['content'] = wp_kses_post( $value['raw_instance']['content'] );
+                                }
+
                                 return $value['raw_instance'];
                         }

trunk/src/wp-includes/widgets/class-wp-widget-block.php

@@ -179 +179 @@
          */
         public function update( $new_instance, $old_instance ) {
-                $instance            = array_merge( $this->default_instance, $old_instance );
-                $instance['content'] = $new_instance['content'];
+                $instance = array_merge( $this->default_instance, $old_instance );
+
+                if ( current_user_can( 'unfiltered_html' ) ) {
+                        $instance['content'] = $new_instance['content'];
+                } else {
+                        $instance['content'] = wp_kses_post( $new_instance['content'] );
+                }
 
                 return $instance;