Changeset 51414 for trunk/src/wp-includes/widgets/class-wp-widget-block.php

Timestamp:

07/13/2021 05:57:04 AM (3 years ago)

Author:

peterwilsoncc

Message:

Widgets: Validate HTML before saving block widgets.

Props talldanwp, noisysocks, kevin940726, peterwilsoncc.

File:

• trunk/src/wp-includes/widgets/class-wp-widget-block.php (modified) (1 diff)

trunk/src/wp-includes/widgets/class-wp-widget-block.php

@@ -179 +179 @@
      */
     public function update( $new_instance, $old_instance ) {
-        $instance            = array_merge( $this->default_instance, $old_instance );
-        $instance['content'] = $new_instance['content'];
+        $instance = array_merge( $this->default_instance, $old_instance );
+
+        if ( current_user_can( 'unfiltered_html' ) ) {
+            $instance['content'] = $new_instance['content'];
+        } else {
+            $instance['content'] = wp_kses_post( $new_instance['content'] );
+        }
 
         return $instance;