WordPress.org
Get WordPress

Make WordPress Core

Opened 6 years ago

Closed 6 years ago

Last modified 6 years ago

#52961 closed defect (bug) (fixed)

Add 'object-position' as an allowed CSS attribute

Reported by: Mamaduka Owned by: SergeyBiryukov
Priority: normal Milestone: 5.7.1
Component: Formatting Version: 5.7
Severity: normal Keywords: has-patch commit fixed-major
Cc: Focuses:

Description

Cover Block uses the object-position CSS attribute since 5.7. This caused a recovery loop for non-admin users.

Related:

Change History (9)

This ticket was mentioned in ​PR #1156 on ​WordPress/wordpress-develop by ​Mamaduka.
6 years ago #1

  • Keywords has-patch added

Trac ticket: https://core.trac.wordpress.org/ticket/52961
Related: WordPress/gutenberg#30243

#2 follow-up: @mukesh27
6 years ago

Hi there!

Patch looks fine to me. Do we need unite test for this?

#3 in reply to: ↑ 2 @Mamaduka
6 years ago

Thanks, @mukesh27, for the review.

Patch looks fine to me. Do we need unite test for this?

I don't think so, I just checked KSES unit tests, and only a few attributes have unit tests.

#4 @SergeyBiryukov
6 years ago

  • Milestone Awaiting Review → 5.7.1

#5 @SergeyBiryukov
6 years ago

  • Version → 5.7

#6 @SergeyBiryukov
6 years ago

  • Owner set to SergeyBiryukov
  • Resolution → fixed
  • Status new → closed

In 50634:

KSES: Add object-position to the list of safe CSS properties.

This resolves an issue with the Cover block, where the object-position property is removed from the content when a non-admin user saves the post, leading to block recovery loop.

Props Mamaduka, aristath.
Fixes #52961.

#7 @SergeyBiryukov
6 years ago

  • Keywords commit fixed-major added
  • Resolution fixed
  • Status closed → reopened

Reopening for backporting to the 5.7 branch.

#8 @SergeyBiryukov
6 years ago

  • Resolution → fixed
  • Status reopened → closed

In 50649:

KSES: Add object-position to the list of safe CSS properties.

This resolves an issue with the Cover block, where the object-position property is removed from the content when a non-admin user saves the post, leading to block recovery loop.

Props Mamaduka, aristath.
Merges [50634] to the 5.7 branch.
Fixes #52961.

​Mamaduka commented on ​PR #1156:
6 years ago #9

Closing this as it got merged in the core. See https://core.trac.wordpress.org/changeset/50649

P.S. Thanks, @SergeyBiryukov.

Note: See TracTickets for help on using tickets.