wp_kses kills < !-- more --> from xmlrpc posted entries

[tsimmons]

I couldn't find the exact point where it happens, but somewhere when XMLRPC posted entries are being processed, the

<!--more-->

tags are being stripped which gets rid of the "more..." link and instead displays the entire post on the indexes. I tracked it down to somewhere in the nested functions called in kses.php, somewhere after line 55:

	return wp_kses_split($string, $allowed_html_fixed, $allowed_protocols);

[tsimmons]

Okay, after more digging, I found it is in wp_kses_split2() on line 101:

if (!preg_match('%^<\s*(/\s*)?([a-zA-Z0-9]+)([^>]*)>?$%', $string, $matches))

This always strips the <!--more--> tags. My regular expression skillz are way down right now (mighty tired after long night ...)

Sorry I can't offer a fix right off ...

[tsimmons]

I can't take credit for this, but how does the fix from ​http://mu.wordpress.org/forums/topic/450 sound? Add three lines to the function at line 101:

	if (preg_match('%^<!--[^>-]+-->$%', $string))
		return $string;
	# Allow HTML comments

[tsimmons]

Proposed patch

[skeltoac]

No, this expression will miss valid comments such as this:
<!--my-awesome-comment-->

[tsimmons]

New version of suggested patch

[tsimmons]

I have attached a new proposed fix, based on Owen's suggestion in wp-testers. It works for me !!

[masquerade]

Based on the patch above (untested), the following would pass right through.

&lt;!--something--&gt;&lt;script&gt;malicious code&lt;/script&gt;&lt;!--somethingelse--&gt;

[masquerade]

Er, pretend that didn't get mangled

<!--something--><script>malicious code</script><!--somethingelse-->

[ringmaster]

Can you fix this by adding a ? to the regex in the first replacement block? Like:

return preg_replace('%(<!--.*?-->)|(<'.# EITHER: <

[ryan]

(In [3417]) Pass comments through kses. Props tsimmons. fixes #2130 #2167

[ryan]

[3418]

[skeltoac]

That last patch is broken: the first regex is missing a () so the eval never gets the right string.

perfect-comments.diff fixes that and more carefully filters the contents of the comment. Now, if a comment is left unclosed, it will be closed at the end of the string. Also, nested comments and uneven open/close markers are fixed. Comments are rock-solid.

[ryan]

(In [3429]) kses regex tweakage for better comment filtering. fixes #2130

[(none)]

Milestone 2.0.1 deleted