Changeset 62531

Timestamp:

06/19/2026 11:02:30 AM (19 hours ago)

Author:

afercia

Message:

KSES: Add command and commandfor to the list of allowed attributes for buttons.

Developed in: ​https://github.com/WordPress/wordpress-develop/pull/11483

Props pratiknawkar94, joedolson, westonruter, afercia.

Fixes #64576.

Location:

trunk

Files:

• src/wp-includes/kses.php (modified) (1 diff)
• tests/phpunit/tests/kses.php (modified) (1 diff)

trunk/src/wp-includes/kses.php

@@ -110 +110 @@
         'br'         => array(),
         'button'     => array(
+            'command'             => true,
+            'commandfor'          => true,
             'disabled'            => true,
             'name'                => true,

trunk/tests/phpunit/tests/kses.php

@@ -1930 +1930 @@
 
     /**
+     * Test that Invoker Commands API attributes are preserved on buttons in post content.
+     *
+     * @ticket 64576
+     */
+    public function test_wp_kses_button_invoker_command_attributes() {
+        $html = '<button type="button" commandfor="my-popover" command="toggle-popover">Toggle</button><div id="my-popover" popover>Content</div>';
+
+        $this->assertEqualHTML( $html, wp_kses_post( $html ) );
+    }
+
+    /**
      * Test that object tags are allowed under limited circumstances.
      *