Index: /opt/lampp/htdocs/wp-trunk/wp-includes/kses.php
===================================================================
--- /opt/lampp/htdocs/wp-trunk/wp-includes/kses.php	(revision 6914)
+++ /opt/lampp/htdocs/wp-trunk/wp-includes/kses.php	(working copy)
@@ -45,7 +45,8 @@
 		'address' => array(),
 		'a' => array(
 			'class' => array (),
-			'href' => array (),
+			'href' => array (
+				'type' => 'uri'),
 			'id' => array (),
 			'title' => array (),
 			'rel' => array (),
@@ -61,7 +62,8 @@
 		'big' => array(),
 		'blockquote' => array(
 			'id' => array (),
-			'cite' => array (),
+			'cite' => array (
+				'type' => 'uri'),
 			'class' => array(),
 			'lang' => array(),
 			'xml:lang' => array()),
@@ -110,7 +112,8 @@
 			'face' => array (),
 			'size' => array ()),
 		'form' => array(
-			'action' => array (),
+			'action' => array (
+				'type' => 'uri'),
 			'accept' => array (),
 			'accept-charset' => array (),
 			'enctype' => array (),
@@ -149,14 +152,17 @@
 			'class' => array (),
 			'height' => array (),
 			'hspace' => array (),
-			'longdesc' => array (),
+			'longdesc' => array (
+				'type' => 'uri'),
 			'vspace' => array (),
-			'src' => array (),
+			'src' => array (
+				'type' => 'uri'),
 			'style' => array (),
 			'width' => array ()),
 		'ins' => array(
 			'datetime' => array (),
-			'cite' => array ()),
+			'cite' => array (
+				'type' => 'uri')),
 		'kbd' => array(),
 		'label' => array(
 			'for' => array ()),
@@ -176,7 +182,8 @@
 			'style' => array(),
 			'width' => array ()),
 		'q' => array(
-			'cite' => array ()),
+			'cite' => array (
+				'type' => 'uri')),
 		's' => array(),
 		'span' => array (
 			'class' => array (),
@@ -282,7 +289,8 @@
 	 */
 	$allowedtags = array(
 		'a' => array(
-			'href' => array (),
+			'href' => array (
+				'type' => 'uri'),
 			'title' => array ()),
 		'abbr' => array(
 			'title' => array ()),
@@ -290,7 +298,8 @@
 			'title' => array ()),
 		'b' => array(),
 		'blockquote' => array(
-			'cite' => array ()),
+			'cite' => array (
+				'type' => 'uri')),
 		//	'br' => array(),
 		'cite' => array (),
 		'code' => array(),
@@ -305,7 +314,8 @@
 		//	'ol' => array(),
 		//	'p' => array(),
 		'q' => array(
-			'cite' => array ()),
+			'cite' => array (
+				'type' => 'uri')),
 		'strike' => array(),
 		'strong' => array(),
 		//	'sub' => array(),
@@ -498,6 +508,12 @@
 		# there are no checks
 
 		else {
+			# sanitize string from bad protocols
+			if ('y' != $arreach['vless'] && 'uri' == $current['type']) {
+				$arreach['value'] = wp_kses_bad_protocol($arreach['value'], $allowed_protocols);
+				$arreach['whole'] = sprintf('%s="%s"', $arreach['name'], $arreach['value']);
+			}
+
 			# there are some checks
 			$ok = true;
 			foreach ($current as $currkey => $currval)
@@ -580,7 +596,7 @@
 				if (preg_match('/^"([^"]*)"(\s+|$)/', $attr, $match))
 					# "value"
 					{
-					$thisval = wp_kses_bad_protocol($match[1], $allowed_protocols);
+					$thisval = $match[1];
 
 					$attrarr[] = array ('name' => $attrname, 'value' => $thisval, 'whole' => "$attrname=\"$thisval\"", 'vless' => 'n');
 					$working = 1;
@@ -592,7 +608,7 @@
 				if (preg_match("/^'([^']*)'(\s+|$)/", $attr, $match))
 					# 'value'
 					{
-					$thisval = wp_kses_bad_protocol($match[1], $allowed_protocols);
+					$thisval = $match[1];
 
 					$attrarr[] = array ('name' => $attrname, 'value' => $thisval, 'whole' => "$attrname='$thisval'", 'vless' => 'n');
 					$working = 1;
@@ -604,7 +620,7 @@
 				if (preg_match("%^([^\s\"']+)(\s+|$)%", $attr, $match))
 					# value
 					{
-					$thisval = wp_kses_bad_protocol($match[1], $allowed_protocols);
+					$thisval = $match[1];
 
 					$attrarr[] = array ('name' => $attrname, 'value' => $thisval, 'whole' => "$attrname=\"$thisval\"", 'vless' => 'n');
 					# We add quotes to conform to W3C's HTML spec.