Context Navigation

Changes between Version 1 and Version 2 of Ticket #33102, comment 42

v1	v2
31	31	}}}
32	32
33		I understand this is to prevent malicious use of the shortcode syntax. As you suggested, there could be a less drastic way, by '''allowing trusted users to continue using shortcodes in HTML attributes'''. I imagine it can be allowed inside posts whose author has sufficient capability. The same goes for nested shortcodes, and if do_shortcode() is used inside PHP templates, well, if they can run PHP then they already have sufficient privileges, so it should be safe to allow the use of shortcodes inside HTML attributes. (..unless untrusted content is put through do_shortcode..hmm..)
	33	I understand this is to prevent malicious use of the shortcode syntax. As you suggested, there could be a less drastic way, by '''allowing trusted users to continue using shortcodes in HTML attributes'''. I imagine it can be allowed inside posts whose author has sufficient capability. The same goes for nested shortcodes, and if do_shortcode() is used inside PHP templates, well, if they can run PHP then they already have sufficient privileges, so it should be safe to allow the use of shortcodes inside HTML attributes. (Edit: ..unless untrusted content is put through do_shortcode..hmm..)
34	34
35	35	The question is, how will `do_shortcode()` determine if the content came from an untrusted user with insufficient privileges. It seems to me that this is the only context when it's necessary to prevent this shortcode use case.