From a3cd85eefd72e58ce9fac6b8428c96bd89eddfaf Mon Sep 17 00:00:00 2001
From: Gary Pendergast <gary@pento.net>
Date: Thu, 19 Nov 2015 23:31:26 +0000
Subject: [PATCH] Texturize: Only convert `&` to `&#038;` within text nodes.

Previously, `&` would be converted everywhere, which caused problems when it was converted within a `<script>`, for example.

`convert_chars()` is now removed from the `the_content` filter, as it was doing the same job as `wptexturize()`.

KSES correctly handles converting `&` within HTML attributes, so there's no need for `wptexturize()` and `convert_chars()` to do the same job.

Fixes #34698.


Built from https://develop.svn.wordpress.org/trunk@35709


git-svn-id: http://core.svn.wordpress.org/trunk@35673 1a063a9b-81f0-0310-95a4-ce76da25c4cd
---
 wp-includes/default-filters.php | 1 -
 wp-includes/formatting.php      | 7 ++++---
 wp-includes/version.php         | 2 +-
 3 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/wp-includes/default-filters.php b/wp-includes/default-filters.php
index 75ca351c20..0cd9e5c6a6 100644
--- a/wp-includes/default-filters.php
+++ b/wp-includes/default-filters.php
@@ -131,7 +131,6 @@ add_filter( 'the_title', 'trim'          );
 
 add_filter( 'the_content', 'wptexturize'                       );
 add_filter( 'the_content', 'convert_smilies'                   );
-add_filter( 'the_content', 'convert_chars'                     );
 add_filter( 'the_content', 'wpautop'                           );
 add_filter( 'the_content', 'shortcode_unautop'                 );
 add_filter( 'the_content', 'prepend_attachment'                );
diff --git a/wp-includes/formatting.php b/wp-includes/formatting.php
index be20e8b036..5261acb75e 100644
--- a/wp-includes/formatting.php
+++ b/wp-includes/formatting.php
@@ -276,12 +276,13 @@ function wptexturize( $text, $reset = false ) {
 				// Searching for a digit is 10 times more expensive than for the x, so we avoid doing this one!
 				$curl = preg_replace( '/\b(\d(?(?<=0)[\d\.,]+|[\d\.,]*))x(\d[\d\.,]*)\b/', '$1&#215;$2', $curl );
 			}
+
+			// Replace each & with &#038; unless it already looks like an entity.
+			$curl = preg_replace( '/&(?!#(?:\d+|x[a-f0-9]+);|[a-z1-4]{1,8};)/i', '&#038;', $curl );
 		}
 	}
-	$text = implode( '', $textarr );
 
-	// Replace each & with &#038; unless it already looks like an entity.
-	return preg_replace( '/&(?!#(?:\d+|x[a-f0-9]+);|[a-z1-4]{1,8};)/i', '&#038;', $text );
+	return implode( '', $textarr );
 }
 
 /**
diff --git a/wp-includes/version.php b/wp-includes/version.php
index 8731c4fe08..24d5725a4c 100644
--- a/wp-includes/version.php
+++ b/wp-includes/version.php
@@ -4,7 +4,7 @@
  *
  * @global string $wp_version
  */
-$wp_version = '4.4-beta4-35708';
+$wp_version = '4.4-beta4-35709';
 
 /**
  * Holds the WordPress DB revision, increments when changes are made to the WordPress DB schema.