IntenseWebs/WordPress
3
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Formatting: Return early from wp_kses_attr_check() if the element is not in the list of allowed elements and attributes.

Browse Source 
Props krynes, tristanleboss.
Fixes #48549.
Built from https://develop.svn.wordpress.org/trunk@46959


git-svn-id: http://core.svn.wordpress.org/trunk@46759 1a063a9b-81f0-0310-95a4-ce76da25c4cd
This commit is contained in:
Sergey Biryukov
2019-12-14 15:53:06 +00:00
parent 8260786e64
commit 1b675c6e4a
2 changed files with 12 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
wp-includes/kses.php
View File

@@ -1152,9 +1152,18 @@ function wp_kses_attr( $element, $attr, $allowed_html, $allowed_protocols ) {
* @return bool Whether or not the attribute is allowed.
*/
function wp_kses_attr_check( &$name, &$value, &$whole, $vless, $element, $allowed_html ) {
$allowed_attr = $allowed_html[ strtolower( $element ) ];
$name_low = strtolower( $name );
$element_low = strtolower( $element );
if ( ! isset( $allowed_html[ $element_low ] ) ) {
$name = '';
$value = '';
$whole = '';
return false;
}
$allowed_attr = $allowed_html[ $element_low ];
$name_low = strtolower( $name );
if ( ! isset( $allowed_attr[ $name_low ] ) || '' == $allowed_attr[ $name_low ] ) {
/*
* Allow `data-*` attributes.