Changeset 52052

Timestamp:

11/08/2021 09:23:34 PM (3 years ago)

Author:

jorgefilipecosta

Message:

Add: Global styles user content escaping.

This commit adds global styles user content escaping. In addition, it ports the logic on the Gutenberg plugin implemented on WordPress/gutenberg#28061 to the core.
The logic tries to follow what was done for standard post content.

See #54336.
Props oandregal.

File:

• trunk/src/wp-includes/kses.php (modified) (3 diffs)

trunk/src/wp-includes/kses.php

@@ -2083 +2083 @@
 
 /**
+ * Sanitizes global styles user content removing unsafe rules.
+ *
+ * @param string $data Post content to filter.
+ * @return string Filtered post content with unsafe rules removed.
+ */
+function wp_filter_global_styles_post( $data ) {
+    $decoded_data        = json_decode( wp_unslash( $data ), true );
+    $json_decoding_error = json_last_error();
+    if (
+        JSON_ERROR_NONE === $json_decoding_error &&
+        is_array( $decoded_data ) &&
+        isset( $decoded_data['isGlobalStylesUserThemeJSON'] ) &&
+        $decoded_data['isGlobalStylesUserThemeJSON']
+    ) {
+        unset( $decoded_data['isGlobalStylesUserThemeJSON'] );
+
+        $data_to_encode = WP_Theme_JSON::remove_insecure_properties( $decoded_data );
+
+        $data_to_encode['isGlobalStylesUserThemeJSON'] = true;
+        return wp_slash( wp_json_encode( $data_to_encode ) );
+    }
+    return $data;
+}
+
+/**
  * Sanitizes content for allowed HTML tags for post content.
  *
@@ -2152 +2177 @@
     // Post filtering.
     add_filter( 'content_save_pre', 'wp_filter_post_kses' );
+    add_filter( 'content_save_pre', 'wp_filter_global_styles_post' );
     add_filter( 'excerpt_save_pre', 'wp_filter_post_kses' );
     add_filter( 'content_filtered_save_pre', 'wp_filter_post_kses' );
+    add_filter( 'content_filtered_save_pre', 'wp_filter_global_styles_post' );
 }
 
@@ -2178 +2205 @@
     // Post filtering.
     remove_filter( 'content_save_pre', 'wp_filter_post_kses' );
+    remove_filter( 'content_save_pre', 'wp_filter_global_styles_post' );
     remove_filter( 'excerpt_save_pre', 'wp_filter_post_kses' );
     remove_filter( 'content_filtered_save_pre', 'wp_filter_post_kses' );
+    remove_filter( 'content_filtered_save_pre', 'wp_filter_global_styles_post' );
 }