Changes between Initial Version and Version 1 of Ticket #65717, comment 3
- Timestamp:
- 08/04/2026 04:58:28 PM (2 months ago)
Legend:
- Unmodified
- Added
- Removed
- Modified
-
Ticket #65717, comment 3
initial v1 5 5 on the one hand, we are discussing in this ticket an attribute which ought to be globally allowed because we expect unprivileged authors to add accessibility attributes and don’t want to reject those. on the other hand, `wp_kses()` is a security system meant to prevent unsafe or unrecognized behaviors. 6 6 7 The HTML specification now has [ sanitization mechanisms](https://html.spec.whatwg.org/#sanitization-algorithms)which may be worth exploring to see how browsers are handling this.7 The HTML specification now has [https://html.spec.whatwg.org/#sanitization-algorithms sanitization mechanisms] which may be worth exploring to see how browsers are handling this. 8 8 9 9 It would need to be verified though that someone without `unfiltered_html` can safely set `autofocus` and that won’t cause issues. //Then// it would need to be discussed if `wp_kses()` should add implicit special-cases for things like this, which would remove some control from the calling code (since `wp_kses()` is currently general purpose).
![(please configure the [header_logo] section in trac.ini)](/chrome/site/your_project_logo.png)