Context Navigation

← Previous Ticket
Next Ticket →

#48549 closed defect (bug) (fixed)

wp_kses_attr_check: add isset before accessing array key

Reported by:	tristanleboss	Owned by:	SergeyBiryukov
Priority:	normal	Milestone:	5.4
Component:	Formatting	Version:	5.2.4
Severity:	normal	Keywords:	has-patch
Cc:		Focuses:

Description

In file wp-includes/kses.php, the first line of the function wp_kses_attr_check tries to use a function argument directly as an array key without any check if it exists. This throws a notice in PHP if the key doesn't exists.

As this function is publicly available, I think it would be a cool idea to do some check before using the variable as an array key.

<?php
function wp_kses_attr_check( &$name, &$value, &$whole, $vless, $element, $allowed_html ) {
        $allowed_attr = $allowed_html[ strtolower( $element ) ];

Attachments (1)

48549.diff (648 bytes ) - added by krynes 7 years ago.

Download all attachments as: .zip

Change History (4)

@krynes
7 years ago

Attachment 48549.diff added

#1 @krynes
7 years ago

Keywords has-patch added; needs-patch removed

#2 @SergeyBiryukov
7 years ago

Component General → Formatting
Milestone Awaiting Review → 5.4
Owner set to SergeyBiryukov
Status new → reviewing

#3 @SergeyBiryukov
7 years ago

Resolution → fixed
Status reviewing → closed

In 46959:

Formatting: Return early from wp_kses_attr_check() if the element is not in the list of allowed elements and attributes.

Props krynes, tristanleboss.
Fixes #48549.

Note: See TracTickets for help on using tickets.

Download in other formats:

Make WordPress Core