Changeset 6767

Timestamp:

02/09/2008 07:29:36 AM (17 years ago)

Author:

ryan

Message:

htmlspecialchars when loading content into html editor. Props DD32 and andy. fixes #5796

Location:

trunk/wp-includes

Files:

• formatting.php (modified) (1 diff)
• general-template.php (modified) (1 diff)

trunk/wp-includes/formatting.php

@@ -1112 +1112 @@
 }
 
+function wp_htmledit_pre($output) {
+    if ( !empty($output) )
+        $output = htmlspecialchars($output, ENT_NOQUOTES); // convert only < > &
+
+    return apply_filters('htmledit_pre', $output);
+}
+
 function clean_url( $url, $protocols = null, $context = 'display' ) {
     $original_url = $url;

trunk/wp-includes/general-template.php

@@ -933 +933 @@
         if ( 'tinymce' == $wp_default_editor )
             add_filter('the_editor_content', 'wp_richedit_pre');
+        else if ( 'html' == $wp_default_editor )
+            add_filter('the_editor_content', 'wp_htmledit_pre');
 
         //  The following line moves the border so that the active button "attaches" to the toolbar. Only IE needs it.