sergiotarxz/Wordpress
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Formatting: Return early from wp_kses_attr_check() if the element is not in the list of allowed elements and attributes.

Browse Source 
Props krynes, tristanleboss.
Fixes #48549.

git-svn-id: https://develop.svn.wordpress.org/trunk@46959 602fd350-edb4-49c9-b593-d223f7449a82
This commit is contained in:
Sergey Biryukov 2019-12-14 15:51:33 +00:00
parent 1440dab429
commit b202cb423a
1 changed files with 11 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
src/wp-includes/kses.php
View File

@ -1152,9 +1152,18 @@ function wp_kses_attr( $element, $attr, $allowed_html, $allowed_protocols ) {
* @return bool Whether or not the attribute is allowed.
*/
function wp_kses_attr_check( &$name, &$value, &$whole, $vless, $element, $allowed_html ) {
$allowed_attr = $allowed_html[ strtolower( $element ) ];
$name_low = strtolower( $name );
$element_low = strtolower( $element );
if ( ! isset( $allowed_html[ $element_low ] ) ) {
$name = '';
$value = '';
$whole = '';
return false;
}
$allowed_attr = $allowed_html[ $element_low ];
$name_low = strtolower( $name );
if ( ! isset( $allowed_attr[ $name_low ] ) || '' == $allowed_attr[ $name_low ] ) {
/*
* Allow `data-*` attributes.