Changeset 55781 for branches/5.6/src/wp-includes/blocks.php

Timestamp:

05/16/2023 03:40:27 PM (2 years ago)

Author:

audrasjb

Message:

Grouped backports to the 5.6 branch.

• Media: Prevent CSRF setting attachment thumbnails.
• Embeds: Add protocol validation for WordPress Embed code.
• I18N: Introduce sanitization function for locale.
• Editor: Ensure block comments are of a valid form.

Merges [55760-55764] to the 5.6 branch.
Props dd32, isabel_brison, martinkrcho, matveb, ocean90, paulkevan, peterwilsoncc, timothyblynjacobs, xknown, youknowriad.

File:

• branches/5.6/src/wp-includes/blocks.php (modified) (2 diffs)

branches/5.6/src/wp-includes/blocks.php

@@ -488 +488 @@
     $result = '';
 
+    if ( false !== strpos( $text, '<!--' ) && false !== strpos( $text, '--->' ) ) {
+        $text = preg_replace_callback( '%<!--(.*?)--->%', '_filter_block_content_callback', $text );
+    }
+
     $blocks = parse_blocks( $text );
     foreach ( $blocks as $block ) {
@@ -495 +499 @@
 
     return $result;
+}
+
+/**
+ * Callback used for regular expression replacement in filter_block_content().
+ *
+ * @private
+ * @since 6.2.1
+ *
+ * @param array $matches Array of preg_replace_callback matches.
+ * @return string Replacement string.
+ */
+function _filter_block_content_callback( $matches ) {
+    return '<!--' . rtrim( $matches[1], '-' ) . '-->';
 }