Changeset 12506

Timestamp:

03/28/2023 06:29:16 AM (19 months ago)

Author:

dd32

Message:

Plugin Directory: Author Notice: Enforce a smaller set of HTML tags.

This results in <span>'s and various hidden styles from being saved.

See #6880.

File:

• sites/trunk/wordpress.org/public_html/wp-content/plugins/plugin-directory/admin/metabox/class-author-notice.php (modified) (3 diffs)

sites/trunk/wordpress.org/public_html/wp-content/plugins/plugin-directory/admin/metabox/class-author-notice.php

@@ -12 +12 @@
     const DEFAULT_TEXT  = '<p>This is a message that will be displayed on the top of the plugins page to plugin authors, even if the plugin is closed. To edit, simply click and type.</p>';
     const POST_META_KEY = '_author_notice';
+
+    /**
+     * The HTML allowed in the author notice.
+     */
+    const ALLOWED_TAGS = [
+        'p'      => true,
+        'strong' => true,
+        'em'     => true,
+        'a'      => [
+            'href' => true,
+        ],
+        'i'      => true,
+        'b'      => true,
+        'br'     => true,
+        'code'   => true,
+        'pre'    => true,
+        'ul'     => true,
+        'ol'     => true,
+        'li'     => true,
+    ];
 
     /**
@@ -46 +66 @@
 
         <div id="author-notice-texteditable" class="inline notice notice-alt notice-<?php echo esc_attr( $notice['type'] ); ?>" contentEditable="true">
-            <?php echo wp_kses_post( $notice['html'] ); ?>
+            <?php echo wp_kses( $notice['html'], self::ALLOWED_TAGS ); ?>
         </div>
 
@@ -97 +117 @@
             $new_author_notice         = wp_unslash( $_REQUEST['author_notice'] );
             $new_author_notice['type'] = sanitize_key( $new_author_notice['type'] );
-            $new_author_notice['html'] = wp_kses_post( trim( $new_author_notice['html'] ) );
+            $new_author_notice['html'] = wp_kses( trim( $new_author_notice['html'] ), self::ALLOWED_TAGS );
 
             // Check it's not empty with tags removed.