Allow basic inline HTML tags and attributes in sidebar description on "Widgets" page

[flixos90]

When registering a sidebar, it can sometimes be useful to use simple HTML in the description for it, like a link or emphasized text. For example, I wanted to add a message like the following:

__( 'In order for this sidebar to be active, you need to enable it first. You can do so <a href="...">in the Customizer</a>.', 'my-theme' ) (the link would point to the respective area in the Customizer)

However, all HTML in sidebar descriptions is currently escaped on the Widgets page in the admin, which makes this impossible (generally, anytime when using the wp_sidebar_description() function). Using basic inline tags and attributes should be allowed. Strangely enough it is supported in the Customizer already, where this content is not escaped. So it should be similar on the admin page.

Instead of simply removing the esc_html() call in wp_sidebar_description(), I think a more secure way would be to replace it with wp_kses_data() to still make sure only those valid tags and attributes pass.

[westonruter]

Yeah, this makes sense to me.

[anonymized_11892634]

Could we also extend this to descriptions in wp_widget_description() too? https://core.trac.wordpress.org/browser/tags/4.9/src/wp-includes/widgets.php#L401

I'd like to link to a screenshot highlighting where a a particular widget section is shown on the front end.

[anonymized_11892634]

...wait, I misread this and the original patch already does what I need. Ignore me 😁

Any chance we can push this to a 4.9 release rather than waiting for 5.0?

[flixos90]

42608.2.diff​ uses a more appropriate wp_kses() call using sidebar_description as context which will internally ensure that tags from the global $allowedtags are allowed in this case.

@philclothier

Any chance we can push this to a 4.9 release rather than waiting for 5.0?

I agree that makes sense.

[flixos90]

In 43275:

Widgets: Allow basic inline tags in wp_sidebar_description().

The customizer has allowed HTML in sidebar descriptions since adding support for sidebars. This change ensures that basic HTML is also allowed for them in the widgets admin screen.

Fixes #42608.

[flixos90]

This needs to be backported to 4.9.7.

[SergeyBiryukov]

In 43302:

Widgets: Allow basic inline tags in wp_sidebar_description().

The customizer has allowed HTML in sidebar descriptions since adding support for sidebars. This change ensures that basic HTML is also allowed for them in the widgets admin screen.

Props flixos90.
Merges [43275] to the 4.9 branch.
Fixes #42608.

[desrosj]

Moving all tickets in 4.9.7 to 4.9.8.

[SergeyBiryukov]

Moving already backported tickets back to 4.9.7.