Changeset 58361

Timestamp:

06/07/2024 04:48:42 PM (6 months ago)

Author:

westonruter

Message:

General: Fix array format for allowed HTML passed into wp_kses() for wp_trigger_error().

Kses requires an associative array of allowed HTML.

See #57686. Follow-up to [56707].

Props thelovekesh, westonruter.
Fixes #61318.

Location:

trunk

Files:

• src/wp-includes/functions.php (modified) (1 diff)
• tests/phpunit/tests/functions/wpTriggerError.php (modified) (1 diff)

trunk/src/wp-includes/functions.php

@@ -6069 +6069 @@
         $message,
         array(
-            'a' => array( 'href' ),
-            'br',
-            'code',
-            'em',
-            'strong',
+            'a'      => array( 'href' => true ),
+            'br'     => array(),
+            'code'   => array(),
+            'em'     => array(),
+            'strong' => array(),
         ),
         array( 'http', 'https' )

trunk/tests/phpunit/tests/functions/wpTriggerError.php

@@ -83 +83 @@
     public function data_should_trigger_error() {
         return array(
-            'function name and message are given' => array(
+            'function name and message are given'          => array(
                 'function_name'    => 'some_function',
                 'message'          => 'expected the function name and message',
                 'expected_message' => 'some_function(): expected the function name and message',
             ),
-            'message is given'                    => array(
+            'message is given'                             => array(
                 'function_name'    => '',
                 'message'          => 'expect only the message',
                 'expected_message' => 'expect only the message',
             ),
-            'function name is given'              => array(
+            'function name is given'                       => array(
                 'function_name'    => 'some_function',
                 'message'          => '',
                 'expected_message' => 'some_function(): ',
             ),
+            'allowed HTML elements are present in message' => array(
+                'function_name'    => 'some_function',
+                'message'          => '<strong>expected</strong> the function name and message',
+                'expected_message' => 'some_function(): <strong>expected</strong> the function name and message',
+            ),
+            'HTML links are present in message'            => array(
+                'function_name'    => 'some_function',
+                'message'          => '<a href="https://example.com">expected the function name and message</a>',
+                'expected_message' => 'some_function(): <a href="https://example.com">expected the function name and message</a>',
+            ),
+            'disallowed HTML elements are present in message' => array(
+                'function_name'    => 'some_function',
+                'message'          => '<script>alert("expected the function name and message")</script>',
+                'expected_message' => 'some_function(): alert("expected the function name and message")',
+            ),
         );
     }