Changeset 56839 for trunk

Timestamp:

10/12/2023 12:56:38 PM (14 months ago)

Author:

jorbin

Message:

Editor: Harden the display of footnotes.

Props: jorgefilipecosta, peterwilsoncc, costdev, xknown, jorbin.

File:

• trunk/src/wp-includes/blocks.php (modified) (1 diff)

trunk/src/wp-includes/blocks.php

@@ -1947 +1947 @@
     return null;
 }
+
+/**
+ * Strips all HTML from the content of footnotes, and sanitizes the ID.
+ * This function expects slashed data on the footnotes content.
+ *
+ * @access private
+ * @since 6.3.2
+ *
+ * @param string $footnotes JSON encoded string of an array containing the content and ID of each footnote.
+ * @return string Filtered content without any HTML on the footnote content and with the sanitized id.
+ */
+function _wp_filter_post_meta_footnotes( $footnotes ) {
+    $footnotes_decoded   = json_decode( $footnotes, true );
+    if ( ! is_array( $footnotes_decoded ) ) {
+        return '';
+    }
+    $footnotes_sanitized = array();
+    foreach ( $footnotes_decoded as $footnote ) {
+        if ( ! empty( $footnote['content'] ) && ! empty( $footnote['id'] ) ) {
+            $footnotes_sanitized[] = array(
+                'id'      => sanitize_key( $footnote['id'] ),
+                'content' => wp_unslash( wp_filter_post_kses( wp_slash( $footnote['content'] ) ) ),
+            );
+        }
+    }
+    return wp_json_encode( $footnotes_sanitized );
+}
+
+/**
+ * Adds the filters to filter footnotes meta field.
+ *
+ * @access private
+ * @since 6.3.2
+ */
+function _wp_footnotes_kses_init_filters() {
+    add_filter( 'sanitize_post_meta_footnotes', '_wp_filter_post_meta_footnotes' );
+}
+
+/**
+ * Removes the filters that filter footnotes meta field.
+ *
+ * @access private
+ * @since 6.3.2
+ */
+function _wp_footnotes_remove_filters() {
+    remove_filter( 'sanitize_post_meta_footnotes', '_wp_filter_post_meta_footnotes' );
+}
+
+/**
+ * Registers the filter of footnotes meta field if the user does not have unfiltered_html capability.
+ *
+ * @access private
+ * @since 6.3.2
+ */
+function _wp_footnotes_kses_init() {
+    _wp_footnotes_remove_filters();
+    if ( ! current_user_can( 'unfiltered_html' ) ) {
+        _wp_footnotes_kses_init_filters();
+    }
+}
+
+/**
+ * Initializes footnotes meta field filters when imported data should be filtered.
+ *
+ * This filter is the last being executed on force_filtered_html_on_import.
+ * If the input of the filter is true it means we are in an import situation and should
+ * enable kses, independently of the user capabilities.
+ * So in that case we call _wp_footnotes_kses_init_filters;
+ *
+ * @access private
+ * @since 6.3.2
+ *
+ * @param string $arg Input argument of the filter.
+ * @return string Input argument of the filter.
+ */
+function _wp_footnotes_force_filtered_html_on_import_filter( $arg ) {
+    // force_filtered_html_on_import is true we need to init the global styles kses filters.
+    if ( $arg ) {
+        _wp_footnotes_kses_init_filters();
+    }
+    return $arg;
+}
+
+add_action( 'init', '_wp_footnotes_kses_init' );
+add_action( 'set_current_user', '_wp_footnotes_kses_init' );
+add_filter( 'force_filtered_html_on_import', '_wp_footnotes_force_filtered_html_on_import_filter', 999 );