Strip Shortcodes from untrusted comment authors

[kdzwinel]

I don't know really where to post it. I don't use wordpress, I've just found xss bug in comments on my friends site. Details here:

​http://wordpress.org/support/topic/353104?replies=2

BTW
I don't understand how you can make people to read this:
​http://codex.wordpress.org/Submitting_Bugs
And then submit bugs using trac, which is definitely not the most intuitive software for non-developers. It is really discouraging, I guess 10% of people who want to submit a bug gets here.

[scribu]

This trac is reserved for bugs with WordPress itself. I've replied on the topic.

Related to non-developers being able to submit bugs easily, I'm not sure that's necessarily something we want to encourage.

They should post on the support forums, from which moderators can open valid tickets.

[Denis-de-Bernardy]

Re-opening this, because I think there's a genuine issue here.

We ought to strip shortcodes from comments unless they're inserted by trusted users.

[miqrogroove]

I agree with scribu on this one. shortcodes.php only hooks the_content(). Shortcodes are already ignored in all comments.

[ShaneF]

Replying to miqrogroove:

I agree with scribu on this one. shortcodes.php only hooks the_content(). Shortcodes are already ignored in all comments.

By default. A plugin author can always add comments to allow their shortcode to be used there.