Changeset 58361

Timestamp:

06/07/2024 04:48:42 PM (2 years ago)

Author:

westonruter

Message:

General: Fix array format for allowed HTML passed into wp_kses() for wp_trigger_error().

Kses requires an associative array of allowed HTML.

See #57686. Follow-up to [56707].

Props thelovekesh, westonruter.
Fixes #61318.

Location:

trunk

Files:

• src/wp-includes/functions.php (modified) (1 diff)
• tests/phpunit/tests/functions/wpTriggerError.php (modified) (1 diff)

trunk/src/wp-includes/functions.php

@@ -6069 +6069 @@
                 $message,
                 array(
-                        'a' => array( 'href' ),
-                        'br',
-                        'code',
-                        'em',
-                        'strong',
+                        'a'      => array( 'href' => true ),
+                        'br'     => array(),
+                        'code'   => array(),
+                        'em'     => array(),
+                        'strong' => array(),
                 ),
                 array( 'http', 'https' )

trunk/tests/phpunit/tests/functions/wpTriggerError.php

@@ -83 +83 @@
         public function data_should_trigger_error() {
                 return array(
-                        'function name and message are given' => array(
+                        'function name and message are given'          => array(
                                 'function_name'    => 'some_function',
                                 'message'          => 'expected the function name and message',
                                 'expected_message' => 'some_function(): expected the function name and message',
                         ),
-                        'message is given'                    => array(
+                        'message is given'                             => array(
                                 'function_name'    => '',
                                 'message'          => 'expect only the message',
                                 'expected_message' => 'expect only the message',
                         ),
-                        'function name is given'              => array(
+                        'function name is given'                       => array(
                                 'function_name'    => 'some_function',
                                 'message'          => '',
                                 'expected_message' => 'some_function(): ',
                         ),
+                        'allowed HTML elements are present in message' => array(
+                                'function_name'    => 'some_function',
+                                'message'          => '<strong>expected</strong> the function name and message',
+                                'expected_message' => 'some_function(): <strong>expected</strong> the function name and message',
+                        ),
+                        'HTML links are present in message'            => array(
+                                'function_name'    => 'some_function',
+                                'message'          => '<a href="https://example.com">expected the function name and message</a>',
+                                'expected_message' => 'some_function(): <a href="https://example.com">expected the function name and message</a>',
+                        ),
+                        'disallowed HTML elements are present in message' => array(
+                                'function_name'    => 'some_function',
+                                'message'          => '<script>alert("expected the function name and message")</script>',
+                                'expected_message' => 'some_function(): alert("expected the function name and message")',
+                        ),
                 );
         }