diff --git a/src/wp-includes/formatting.php b/src/wp-includes/formatting.php index 82205744fe..5006bb183b 100644 --- a/src/wp-includes/formatting.php +++ b/src/wp-includes/formatting.php @@ -203,7 +203,11 @@ function wptexturize($text, $reset = false) { . '|' . '\[' // Find start of shortcode. . '\[?' // Shortcodes may begin with [[ - . '[^\[\]<>]+' // Shortcodes do not contain other shortcodes or HTML elements. + . '(?:' + . '[^\[\]<>]' // Shortcodes do not contain other shortcodes. + . '|' + . '<.+?>' // HTML elements permitted. Prevents matching ] before >. + . ')+' . '\]' // Find end of shortcode. . '\]?' // Shortcodes may end with ]] . ')/s'; @@ -220,12 +224,12 @@ function wptexturize($text, $reset = false) { _wptexturize_pushpop_element( $curl, $no_texturize_tags_stack, $no_texturize_tags, '<', '>' ); } - } elseif ( '[' === $first && 1 === preg_match( '/^\[[^\[\]<>]+\]$/', $curl ) ) { + } elseif ( '[' === $first && 1 === preg_match( '/^\[(?:[^\[\]<>]|<.+?>)+\]$/', $curl ) ) { // This is a shortcode delimeter. _wptexturize_pushpop_element( $curl, $no_texturize_shortcodes_stack, $no_texturize_shortcodes, '[', ']' ); - } elseif ( '[' === $first && 1 === preg_match( '/^\[\[?[^\[\]<>]+\]\]?$/', $curl ) ) { + } elseif ( '[' === $first && 1 === preg_match( '/^\[\[?(?:[^\[\]<>]|<.+?>)+\]\]?$/', $curl ) ) { // This is an escaped shortcode delimeter. // Do not texturize. diff --git a/tests/phpunit/tests/formatting/WPTexturize.php b/tests/phpunit/tests/formatting/WPTexturize.php index 14048deac6..2196134939 100644 --- a/tests/phpunit/tests/formatting/WPTexturize.php +++ b/tests/phpunit/tests/formatting/WPTexturize.php @@ -1145,6 +1145,10 @@ class Tests_Formatting_WPTexturize extends WP_UnitTestCase { function data_tag_avoidance() { return array( + array( + '[ is it wise to maybe ]', + '[ is it wise to maybe ]', + ), array( '[ photos by this guy ]', '[ photos by this guy ]', @@ -1194,8 +1198,8 @@ class Tests_Formatting_WPTexturize extends WP_UnitTestCase { '[gallery …', ), array( + '[gallery
...]', // This tag is still valid. Shortcode 'attributes' are not considered in the initial parsing of shortcodes, and HTML is allowed. '[gallery
...]', - '[gallery
…]', ), array( '
', @@ -1234,8 +1238,8 @@ class Tests_Formatting_WPTexturize extends WP_UnitTestCase { '[/gallery ...]]', ), array( + '[[gallery
...]]', // This gets parsed as an escaped shortcode with embedded HTML. Brains may explode. '[[gallery
...]]', - '[[gallery
…]]', ), array( '
',