Opened 19 years ago
Closed 18 years ago
#5533 closed defect (bug) (duplicate)
When rich editor is enabled, post's content is not properly escaped
| Reported by: | xknown | Owned by: | |
|---|---|---|---|
| Priority: | normal | Milestone: | |
| Component: | General | Version: | 2.3.1 |
| Severity: | normal | Keywords: | |
| Cc: | Focuses: |
Description
If an user has unfiltered_html capability and rich editor is enabled on his profile, post's content is not properly escaped.
Steps to reproduce the problem:
- Write a new post/page using the "code" view with the following content
</textarea><script>alert(123)</script> - Press "Save and Continue editing" button.
It seems the problem is on line 691 of wp-includes/post.php.
Note:
See TracTickets
for help on using tickets.
![(please configure the [header_logo] section in trac.ini)](/chrome/site/your_project_logo.png)
Fixed for #6449