kses should be applied to some kind of diff so as to not filter out post content that previously existed

[niedzielski]

As an administrator user, I have no difficulties using HTML in my entries. However, an author user on my blog recently reported a problem. He attempted to center text using the alignment button in visual editor, or even typing in the code manually. This produced code like this:
<p style="text-align: center;">foo</p>

Unfortunately, any time he saves, the system reduces the code to this:
<p style="center;">foo</p>

Which doesn't work. When I try it as an administrator user, it works fine. When I log in under his username, I have the same problem.

I am using WordPress version 2.5.1.

[mrmist]

Just confirming this is in 2.6.

Also affects "contributer" level.

[ryan]

Probably the same problem as in #6888 and #5917

[ryan]

(In [8671]) Apply kses bad-protocol checks only to URI typed attributes. Props takayukister. fixes #5917 #6888 #6910 #7512

[niedzielski]

I am having this same issue with embedded flash.

Reproduction:
1: Set a user to author level.
2: Login as this user.
3: Make a new post.
4: Click insert / edit embedded media.
5: Enter ​http://www.youtube.com/watch?v=vda2RAEuW_g in the file / URL field.
6: Click ok.
7: A yellow box for the video appears in the post, but doesn't show on preview or update. If you leave and then edit the post, the yellow box will be stripped.

Note: The above procedure works fine when the user is raised from author to editor status.

[Denis-de-Bernardy]

switching from kses, to html purifier (​http://htmlpurifier.org/) would almost certainly fix this.

[Denis-de-Bernardy]

See in particular:

​http://htmlpurifier.org/comparison.html

[Denis-de-Bernardy]

itching to close this one as invalid. the real issue is that kses should filter only newly inserted content. but that might be opening pandora's box.

[Denis-de-Bernardy]

per above comment - ​http://core.trac.wordpress.org/ticket/6910#comment:8