mirror_php/wordpress
1
0
Fork 0
mirror of git://develop.git.wordpress.org/ synced 2025-03-20 12:00:03 +01:00
Code Issues Actions 15 Packages Projects Releases Wiki Activity

HTML API: Indicate when WordPress rejects attribute updates.

Browse Source 
When setting an an attribute value in the HTML API, WordPress may reject
an update based on rules in `kses`. In these cases, the return value from
an escaping function will be an empty string, and the HTML API should
reject the update. Unfortunately, it currently reports that it updates the
attribute but sets an empty string value, which is misleading.

In this patch, the HTML API will refuse the attribute update and return
false to indicate as much when WordPress rejects the updates.

Developed in https://github.com/wordpress/wordpress-develop/pull/7114
Discussed in https://core.trac.wordpress.org/ticket/61719

Follow-up to [58472].

Props: amitraj2203, dmsnell, mukesh27.
Fixes #61719.


git-svn-id: https://develop.svn.wordpress.org/trunk@58844 602fd350-edb4-49c9-b593-d223f7449a82
This commit is contained in:
Dennis Snell 2024-08-02 22:57:46 +00:00
parent 0e06e2b522
commit 0c46e2a0b4
1 changed files with 6 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
src/wp-includes/html-api/class-wp-html-tag-processor.php
View File

@ -3197,6 +3197,12 @@ class WP_HTML_Tag_Processor {
* @see https://html.spec.whatwg.org/#attributes-3
*/
$escaped_new_value = in_array( $comparable_name, wp_kses_uri_attributes() ) ? esc_url( $value ) : esc_attr( $value );
// If the escaping functions wiped out the update, reject it and indicate it was rejected.
if ( '' === $escaped_new_value && '' !== $value ) {
return false;
}
$updated_attribute = "{$name}=\"{$escaped_new_value}\"";
}