Changeset 63114 for branches/4.8/src/wp-includes/kses.php

Timestamp:

08/06/2026 07:57:42 PM (2 months ago)

Author:

desrosj

Message:

Security: Backport the WordPress 7.0.3 security fixes to the 4.8 branch.

• Users: Ensure a proper email address is used before sending email confirmations.
• Formatting: Prevent stack overflow in safecss_filter_attr.
• Multisite: Enforce the active signup policy for existing users.
• HTTP API: Improve compliance with IPv4 Special-Purpose Address Space.
• Users: Prevent Usernames from mangling HTML
• Canonical: Only redirect for publicly viewable post types.
• Administration: When wp_is_large_user_count(), ensure that the post author is always added to author dropdown.

Merges [63060],[63061],[63062],[63063],[63064],[63065],[63067] to the 4.8 branch.

Props xknown, westonruter, jeremyfelt, peterwilsoncc, paulkevan, lucasbustamante, jorbin, desrosj, vortfu, dmsnell, johnbillion, ehtis, batmoo, lancewillett, jonsurrell.

File:

• branches/4.8/src/wp-includes/kses.php (modified) (1 diff)

branches/4.8/src/wp-includes/kses.php

@@ -1756 +1756 @@
         $css = str_replace(array("\n","\r","\t"), '', $css);
 
-        if ( preg_match( '%[\\\\(&=}]|/\*%', $css ) ) // remove any inline css containing \ ( & } = or comments
+        if ( 0 !== preg_match( '%[\\\\(&=}]|/\*%', $css ) ) // remove any inline css containing \ ( & } = or comments
                 return '';