Changeset 51675 for trunk/src/wp-includes/kses.php

Timestamp:

08/26/2021 07:27:59 PM (3 years ago)

Author:

johnbillion

Message:

Security: Correct the inline docs for the wp_kses_allowed_html filter.

Props peterwilsoncc

Fixes #53597

File:

• trunk/src/wp-includes/kses.php (modified) (3 diffs)

trunk/src/wp-includes/kses.php

@@ -847 +847 @@
  * @param string|array $context The context for which to retrieve tags. Allowed values are 'post',
  *                              'strip', 'data', 'entities', or the name of a field filter such as
- *                              'pre_user_description'.
+ *                              'pre_user_description', or an array of allowed HTML elements and attributes.
  * @return array Array of allowed HTML tags and their allowed attributes.
  */
@@ -854 +854 @@
 
     if ( is_array( $context ) ) {
+        // When `$context` is an array it's actually an array of allowed HTML elements and attributes.
+        $html    = $context;
+        $context = 'explicit';
+
         /**
          * Filters the HTML tags that are allowed for a given context.
@@ -859 +863 @@
          * @since 3.5.0
          *
-         * @param array[]|string $context      Context to judge allowed tags by.
-         * @param string         $context_type Context name.
+         * @param array[] $html    Allowed HTML tags.
+         * @param string  $context Context name.
          */
-        return apply_filters( 'wp_kses_allowed_html', $context, 'explicit' );
+        return apply_filters( 'wp_kses_allowed_html', $html, $context );
     }