Make WordPress Core

Opened 19 years ago

Closed 18 years ago

#5533 closed defect (bug) (duplicate)

When rich editor is enabled, post's content is not properly escaped

Reported by: xknown Owned by:
Priority: normal Milestone:
Component: General Version: 2.3.1
Severity: normal Keywords:
Cc: Focuses:

Description

If an user has unfiltered_html capability and rich editor is enabled on his profile, post's content is not properly escaped.

Steps to reproduce the problem:

  1. Write a new post/page using the "code" view with the following content </textarea><script>alert(123)</script>
  2. Press "Save and Continue editing" button.

It seems the problem is on ​line 691 of wp-includes/post.php.

Change History (1)

#1 @ryan
18 years ago

  • Milestone 2.6
  • Resolution → duplicate
  • Status new → closed

Fixed for #6449

Note: See TracTickets for help on using tickets.