Changeset 12506 for sites/trunk/wordpress.org/public_html/wp-content/plugins/plugin-directory/admin/metabox/class-author-notice.php

Timestamp:

03/28/2023 06:29:16 AM (3 years ago)

Author:

dd32

Message:

Plugin Directory: Author Notice: Enforce a smaller set of HTML tags.

This results in <span>'s and various hidden styles from being saved.

See #6880.

File:

• sites/trunk/wordpress.org/public_html/wp-content/plugins/plugin-directory/admin/metabox/class-author-notice.php (modified) (3 diffs)

sites/trunk/wordpress.org/public_html/wp-content/plugins/plugin-directory/admin/metabox/class-author-notice.php

@@ -12 +12 @@
         const DEFAULT_TEXT  = '<p>This is a message that will be displayed on the top of the plugins page to plugin authors, even if the plugin is closed. To edit, simply click and type.</p>';
         const POST_META_KEY = '_author_notice';
+
+        /**
+         * The HTML allowed in the author notice.
+         */
+        const ALLOWED_TAGS = [
+                'p'      => true,
+                'strong' => true,
+                'em'     => true,
+                'a'      => [
+                        'href' => true,
+                ],
+                'i'      => true,
+                'b'          => true,
+                'br'     => true,
+                'code'   => true,
+                'pre'    => true,
+                'ul'     => true,
+                'ol'     => true,
+                'li'     => true,
+        ];
 
         /**
@@ -46 +66 @@
 
                 <div id="author-notice-texteditable" class="inline notice notice-alt notice-<?php echo esc_attr( $notice['type'] ); ?>" contentEditable="true">
-                        <?php echo wp_kses_post( $notice['html'] ); ?>
+                        <?php echo wp_kses( $notice['html'], self::ALLOWED_TAGS ); ?>
                 </div>
 
@@ -97 +117 @@
                         $new_author_notice         = wp_unslash( $_REQUEST['author_notice'] );
                         $new_author_notice['type'] = sanitize_key( $new_author_notice['type'] );
-                        $new_author_notice['html'] = wp_kses_post( trim( $new_author_notice['html'] ) );
+                        $new_author_notice['html'] = wp_kses( trim( $new_author_notice['html'] ), self::ALLOWED_TAGS );
 
                         // Check it's not empty with tags removed.