WordPress.org

Make WordPress Core

Opened 4 years ago

Closed 3 years ago

Last modified 3 years ago

#16466 closed defect (bug) (fixed)

HTML in comments results in invalid XML in comments feed

Reported by: barry Owned by: markjaquith
Milestone: 3.5 Priority: normal
Severity: normal Version:
Component: Feeds Keywords: has-patch 3.2-early commit
Focuses: Cc:

Description

HTML in comments results in invalid XML in comments feed

Patch attached

Attachments (2)

16466.diff (749 bytes) - added by barry 4 years ago.
16466.2.diff (784 bytes) - added by nacin 4 years ago.
Patch from bazza, diff'd from root, and without trailing spaces.

Download all attachments as: .zip

Change History (7)

@barry4 years ago

comment:1 @hakre4 years ago

atom comment feed already uses CDATA

@nacin4 years ago

Patch from bazza, diff'd from root, and without trailing spaces.

comment:2 @nacin4 years ago

  • Keywords has-patch 3.2-early added
  • Milestone changed from Awaiting Review to Future Release

Looks good.

comment:3 @nacin3 years ago

  • Component changed from General to Feeds
  • Keywords commit added
  • Milestone changed from Future Release to 3.5

comment:4 @markjaquith3 years ago

  • Owner set to markjaquith
  • Resolution set to fixed
  • Status changed from new to closed

In [21238]:

Use a CDATA section for RSS2 comments feeds, so HTML in comments doesn't kill XML validation. props bazza. fixes #16466

comment:5 @mdgl3 years ago

We have a default filter of esc_html() declared against comment_text_rss() so shouldn't this have already solved the problem?

That said, we're using CDATA blocks in most related areas (e.g. post content, excerpts), so perhaps it's more consistent to use them here as well.

An issue remains however in the use of comment_text_rss() as this doesn't apply all of the expected filters (e.g. wpautop). I suspect it might be better to deprecate comment_text_rss() and use just comment_text() as elsewhere in the RSS2 and Atom feeds. See also #21753 for a similar issue with the use of excerpts in feeds.

Note: See TracTickets for help on using tickets.