Changeset 56707

Timestamp:

09/26/2023 12:36:50 PM (12 months ago)

Author:

hellofromTonya

Message:

General: Use wp_kses() in wp_trigger_error().

Uses wp_kses() instead of esc_html() to allow a list of HTML tags and protocols in the message rather than escaping them.

Why? To retain message readability in the browser and server logs, especially given that Core itself adds HTML to messages in functions, e.g. _doing_it_wrong() and each of the _deprecated_*() functions.

HTML tags allowed:

• a href
• br
• code
• em
• strong

Protocols allowed: http and https.

To inform extenders, it also documents that any other HTML tags or protocols need to be escaped before passing the message to this function to avoid them being stripped from the message.

Follow-up to [56530], [56705].

Props azaozz, costdev, flixos90, hellofromTonya, peterwilsoncc.
Fixes #57686.

File:

• trunk/src/wp-includes/functions.php (modified) (2 diffs)

trunk/src/wp-includes/functions.php

@@ -5989 +5989 @@
  * @param string $function_name The function that triggered the error.
  * @param string $message       The message explaining the error.
+ *                              The message can contain allowed HTML 'a' (with href), 'code',
+ *                              'br', 'em', and 'strong' tags and http or https protocols.
+ *                              If it contains other HTML tags or protocols, the message should be escaped
+ *                              before passing to this function to avoid being stripped {@see wp_kses()}.
  * @param int    $error_level   Optional. The designated error type for this error.
  *                              Only works with E_USER family of constants. Default E_USER_NOTICE.
@@ -6016 +6020 @@
     }
 
-    /*
-     * If the message appears in the browser, then it needs to be escaped.
-     * Note the warning in the `trigger_error()` PHP manual.
-     * @link https://www.php.net/manual/en/function.trigger-error.php
-     */
-    $message = esc_html( $message );
+    $message = wp_kses(
+        $message,
+        array(
+            'a' => array( 'href' ),
+            'br',
+            'code',
+            'em',
+            'strong',
+        ),
+        array( 'http', 'https' )
+    );
 
     trigger_error( $message, $error_level );