Twenty Fifteen: HTML characters in the color scheme CSS are escaped.

[iamtakashi]

HTML characters in the color scheme CSS in the head is escaped for example:

input[type="button"]

.pingback .comment-body > a,

This causes that some of color scheme specific styles are broken.

[iamtakashi]

Remove Sanitization Callback from Color Scheme CSS setting.

[iandstewart]

In 30398:

Twenty Fifteen: escaping here breaks color schemes.

Props celloexpressions, iamtakashi, fixes #30409.

[nacin]

esc_html() is not a sanitization function. Please never do what [30398] un-did. :-)

[iamtakashi]

Replying to nacin:

esc_html() is not a sanitization function. Please never do what [30398] un-did. :-)

Do we need to use something else? CSS shouldn't need escaping though is this good idea to use wp_filter_nohtml_kses? I'm asking this because a theme check reports the setting missing a sanitisation.

[lancewillett]

Core doesn't have sanitize_css so ...

@nacin I know you added a smiley but "Please never do" isn't helpful without an alternative suggestion.

[lancewillett]

Discussing today in Slack, next step is to work with 30409.patch approach — remove the theme_mod and instead generate the CSS from a shared JS/PHP template. See also notes at https://core.trac.wordpress.org/ticket/29988#comment:18

[georgestephanis]

https://core.trac.wordpress.org/attachment/ticket/30409/30409.2.diff is what I'm thinking -- store the css in a function that can interpolate either JS tokens for wp.template to use, or colors, for outputting directly to the front-end.

[ocean90]

@todo preview

[ocean90]

30409.4.diff​ and 30409.5.diff​ are based on 30409.2.diff​.

In .4 the CSS generation is still done in the control and then send to the Previewer. Sending an event to the preview is easy (see #27666/[29048]), capturing the event not because the preview is still private. The patch will change this, otherwise we have to do something like trunk/src/wp-includes/js/customize-preview-widgets.js@29051#L107​.

In .5 I moved the CSS generation to the preview. Since the script depends on Iris we have to move Iris out of is_admin().

[georgestephanis]

Just uploaded 30409.4.1.diff and 30409.5.1.diff -- based off the prior respective patches, they just move the derivative color logic into the twentyfifteen_get_color_scheme_css function, so only the six color scheme colors need to be passed in, rather than calculating before passing. If they are passed, though, it will override any internal calculations.

Had a light discussion with @ocean90 in slack here as to this relocation of the calculations: ​https://wordpress.slack.com/archives/core-themes/p1418478625000200

[lancewillett]

Should we use sanitize_hex_color on the hex values that aren't the rdba values?

Testing 30409.4.1.diff passes, color schemes save and correct CSS is served inline as expected.

[ocean90]

iamtakashi: sidebar_textcolor should be 100% - $color_scheme[4] and secondary_sidebar_textcolor` should be the one with 70%.

[nacin]

OK, let's get the latest patch in. Exception:

• The change to src/wp-includes/js/customize-preview.js should be done in its own commit, preferably its own quick ticket.

Things I still don't like, and would consider adjustments to:

• The editable colors being 0, 1, and 4, rather than 0, 1, and 2. This is far too magical and I have no idea what it means.
• Using numeric arrays for color definitions when it's really important for others to understand what is what, but associative arrays internally when it doesn't matter as much.
• Lots of really complicated stuff in a default theme. Lots of opportunities to simplify.

And while I am here, things that are definitely fixable:

• Far, far too much unnecessary use of esc_html(), especially on translated strings.
• Lots of things are pluggable that shouldn't be.

[ocean90]

In 30891:

Customizer: Export Preview instance to wp.customize.preview.

see #30409, #30726.

[ocean90]

In 30893:

Twenty Fifteen: Don't save unfiltered CSS in a setting.

Introduce twentyfifteen_get_color_scheme_css( $colors ) which will be used for Underscore/Backbone and the PHP side. Let twentyfifteen_color_scheme_css() handle the color calculation on PHP side.

see #30409.

[johnbillion]

In 30923:

Customizer: Export Preview instance to wp.customize.preview.

Merges [30891] to the 4.1 branch.

see #30409, #30726.

[johnbillion]

In 30927:

Twenty Fifteen: Don't save unfiltered CSS in a setting.

Introduce twentyfifteen_get_color_scheme_css( $colors ) which will be used for Underscore/Backbone and the PHP side. Let twentyfifteen_color_scheme_css() handle the color calculation on PHP side.

Merges [30893] to the 4.1 branch.

Fixes #30409.
Props ocean90