WordPress.org
Get WordPress

Make WordPress Core

Changes between Initial Version and Version 1 of Ticket #34178, comment 4


Ignore:
Timestamp:
10/06/2015 11:46:58 PM (10 years ago)
Author:
jeremyfelt
Comment:

Legend:

Unmodified
Added
Removed
Modified

  • Ticket #34178, comment 4

    initial v1  
    1 `<style>` is one of the HTML tags allowed for a user with the `unfiltered_html` capability. I can imagine cases where site owners use the text widget specifically to insert inline style - however wise/unwise that may be. :)
     1`<style>` is one of the HTML tags allowed for a user with the `unfiltered_html` capability. I can imagine cases where site owners use the text widget specifically to insert internal stylesheets - however wise/unwise that may be. :)
    22
    33One method to approach this would be extra sanitization via filter (see `widget_text`) in a plugin. There are likely others as well, including replacing the default text widget provided by WordPress with a more custom one. Adding extra sanitization to remove `<style>` by default is not something that we can do here.