Skip to:
Content

BuddyPress.org

Changeset 12067


Ignore:
Timestamp:
05/06/2018 10:47:08 AM (6 years ago)
Author:
imath
Message:

BP Nouveau: restrict the allowed HTML tags for Messages.

BP Nouveau is using the WP Editor to improve the user experience of the Messages component when people are writing a new message or replying to a thread. So far allowed HTML tags for the messages content *when BP Nouveau is the active template pack* were the same than WordPress Posts. When BP Nouveau is not the active template pack, the allowed tags are those of the WordPress global .

This commit is introducing a new function that is used to filter the allowed HTML tags for activity content and message content. It extends the with new tags (img, span, ul, ol & li) and leaves specific functions to the 2 components to include filters so that it is possible to restrict/extend allowed HTML tags for both content types or one of them. It also restricts the WP Editor available buttons when used into the BP Nouveau Messages UI so that they are consistent with the allowed HTML tags.

Props DJPaul

Fixes #7795

Location:
trunk/src
Files:
9 edited

Legend:

Unmodified
Added
Removed

  • trunk/src/bp-activity/bp-activity-filters.php

    r11763 r12067  
    203203 */
    204204function bp_activity_filter_kses( $content ) {
    205     global $allowedtags;
    206 
    207     $activity_allowedtags = $allowedtags;
    208     $activity_allowedtags['a']['aria-label']      = array();
    209     $activity_allowedtags['a']['class']           = array();
    210     $activity_allowedtags['a']['data-bp-tooltip'] = array();
    211     $activity_allowedtags['a']['id']              = array();
    212     $activity_allowedtags['a']['rel']             = array();
    213     $activity_allowedtags['a']['title']           = array();
    214 
    215     $activity_allowedtags['b']    = array();
    216     $activity_allowedtags['code'] = array();
    217     $activity_allowedtags['i']    = array();
    218 
    219     $activity_allowedtags['img']           = array();
    220     $activity_allowedtags['img']['src']    = array();
    221     $activity_allowedtags['img']['alt']    = array();
    222     $activity_allowedtags['img']['width']  = array();
    223     $activity_allowedtags['img']['height'] = array();
    224     $activity_allowedtags['img']['class']  = array();
    225     $activity_allowedtags['img']['id']     = array();
    226 
    227     $activity_allowedtags['span']                   = array();
    228     $activity_allowedtags['span']['class']          = array();
    229     $activity_allowedtags['span']['data-livestamp'] = array();
    230 
    231     $activity_allowedtags['ul'] = array();
    232     $activity_allowedtags['ol'] = array();
    233     $activity_allowedtags['li'] = array();
    234 
    235205    /**
    236206     * Filters the allowed HTML tags for BuddyPress Activity content.
    … …  
    240210     * @param array $value Array of allowed HTML tags and attributes.
    241211     */
    242     $activity_allowedtags = apply_filters( 'bp_activity_allowed_tags', $activity_allowedtags );
     212    $activity_allowedtags = apply_filters( 'bp_activity_allowed_tags', bp_get_allowedtags() );
    243213    return wp_kses( $content, $activity_allowedtags );
    244214}

  • trunk/src/bp-core/bp-core-functions.php

    r11891 r12067  
    38043804    return (array) apply_filters( 'bp_email_get_unsubscribe_type_schema', $emails );
    38053805}
     3806
     3807/**
     3808 * Get BuddyPress content allowed tags.
     3809 *
     3810 * @since  3.0.0
     3811 *
     3812 * @global array $allowedtags KSES allowed HTML elements.
     3813 * @return array              BuddyPress content allowed tags.
     3814 */
     3815function bp_get_allowedtags() {
     3816    global $allowedtags;
     3817
     3818    return array_merge_recursive( $allowedtags, array(
     3819        'a' => array(
     3820            'aria-label'      => array(),
     3821            'class'           => array(),
     3822            'data-bp-tooltip' => array(),
     3823            'id'              => array(),
     3824            'rel'             => array(),
     3825        ),
     3826        'img' => array(
     3827            'src'    => array(),
     3828            'alt'    => array(),
     3829            'width'  => array(),
     3830            'height' => array(),
     3831            'class'  => array(),
     3832            'id'     => array(),
     3833        ),
     3834        'span'=> array(
     3835            'class'          => array(),
     3836            'data-livestamp' => array(),
     3837        ),
     3838        'ul' => array(),
     3839        'ol' => array(),
     3840        'li' => array(),
     3841    ) );
     3842}

  • trunk/src/bp-messages/bp-messages-filters.php

    r11447 r12067  
    1919add_filter( 'bp_get_messages_subject_value',        'wp_filter_kses', 1 );
    2020add_filter( 'bp_get_messages_content_value',        'wp_filter_kses', 1 );
    21 add_filter( 'bp_get_the_thread_message_content',    'wp_filter_kses', 1 );
     21add_filter( 'messages_message_subject_before_save', 'wp_filter_kses', 1 );
     22add_filter( 'messages_notice_subject_before_save',  'wp_filter_kses', 1 );
     23add_filter( 'bp_get_the_thread_subject',            'wp_filter_kses', 1 );
    2224
    23 add_filter( 'messages_message_content_before_save', 'wp_filter_kses', 1 );
    24 add_filter( 'messages_message_subject_before_save', 'wp_filter_kses', 1 );
    25 add_filter( 'messages_notice_message_before_save',  'wp_filter_kses', 1 );
    26 add_filter( 'messages_notice_subject_before_save',  'wp_filter_kses', 1 );
    27 
    28 add_filter( 'bp_get_the_thread_message_content',    'wp_filter_kses', 1 );
    29 add_filter( 'bp_get_the_thread_subject',            'wp_filter_kses', 1 );
     25add_filter( 'bp_get_the_thread_message_content',    'bp_messages_filter_kses', 1 );
     26add_filter( 'messages_message_content_before_save', 'bp_messages_filter_kses', 1 );
     27add_filter( 'messages_notice_message_before_save',  'bp_messages_filter_kses', 1 );
     28add_filter( 'bp_get_message_thread_content',        'bp_messages_filter_kses', 1 );
    3029
    3130add_filter( 'messages_message_content_before_save', 'force_balance_tags' );
    … …  
    4645add_filter( 'bp_get_message_thread_excerpt',     'wptexturize' );
    4746add_filter( 'bp_get_the_thread_message_content', 'wptexturize' );
     47add_filter( 'bp_get_message_thread_content',     'wptexturize' );
    4848
    4949add_filter( 'bp_get_message_notice_subject',     'convert_smilies', 2 );
    … …  
    5252add_filter( 'bp_get_message_thread_excerpt',     'convert_smilies', 2 );
    5353add_filter( 'bp_get_the_thread_message_content', 'convert_smilies', 2 );
     54add_filter( 'bp_get_message_thread_content',     'convert_smilies', 2 );
    5455
    5556add_filter( 'bp_get_message_notice_subject',     'convert_chars' );
    … …  
    5859add_filter( 'bp_get_message_thread_excerpt',     'convert_chars' );
    5960add_filter( 'bp_get_the_thread_message_content', 'convert_chars' );
     61add_filter( 'bp_get_message_thread_content',     'convert_chars' );
    6062
    6163add_filter( 'bp_get_message_notice_text',        'make_clickable', 9 );
    6264add_filter( 'bp_get_the_thread_message_content', 'make_clickable', 9 );
     65add_filter( 'bp_get_message_thread_content',     'make_clickable', 9 );
    6366
    6467add_filter( 'bp_get_message_notice_text',        'wpautop' );
    6568add_filter( 'bp_get_the_thread_message_content', 'wpautop' );
     69add_filter( 'bp_get_message_thread_content',     'wpautop' );
    6670
    67 add_filter( 'bp_get_message_notice_subject',          'stripslashes_deep' );
    68 add_filter( 'bp_get_message_notice_text',             'stripslashes_deep' );
    69 add_filter( 'bp_get_message_thread_subject',          'stripslashes_deep' );
    70 add_filter( 'bp_get_message_thread_excerpt',          'stripslashes_deep' );
    71 add_filter( 'bp_get_message_get_recipient_usernames', 'stripslashes_deep' );
    72 add_filter( 'bp_get_messages_subject_value',          'stripslashes_deep' );
    73 add_filter( 'bp_get_messages_content_value',          'stripslashes_deep' );
    74 add_filter( 'bp_get_the_thread_message_content',      'stripslashes_deep' );
    75 add_filter( 'bp_get_the_thread_subject',              'stripslashes_deep' );
     71add_filter( 'bp_get_message_notice_subject',          'stripslashes_deep'    );
     72add_filter( 'bp_get_message_notice_text',             'stripslashes_deep'    );
     73add_filter( 'bp_get_message_thread_subject',          'stripslashes_deep'    );
     74add_filter( 'bp_get_message_thread_excerpt',          'stripslashes_deep'    );
     75add_filter( 'bp_get_message_get_recipient_usernames', 'stripslashes_deep'    );
     76add_filter( 'bp_get_messages_subject_value',          'stripslashes_deep'    );
     77add_filter( 'bp_get_messages_content_value',          'stripslashes_deep'    );
     78add_filter( 'bp_get_the_thread_message_content',      'stripslashes_deep'    );
     79add_filter( 'bp_get_the_thread_subject',              'stripslashes_deep'    );
     80add_filter( 'bp_get_message_thread_content',          'stripslashes_deep', 1 );
    7681
    7782/**
    … …  
    99104}
    100105add_filter( 'bp_after_has_message_threads_parse_args', 'bp_messages_enforce_current_user', 5 );
     106
     107/**
     108 * Custom kses filtering for message content.
     109 *
     110 * @since 3.0.0
     111 *
     112 * @param string $content The message content.
     113 * @return string         The filtered message content.
     114 */
     115function bp_messages_filter_kses( $content ) {
     116    $messages_allowedtags      = bp_get_allowedtags();
     117    $messages_allowedtags['p'] = array();
     118
     119    /**
     120     * Filters the allowed HTML tags for BuddyPress Messages content.
     121     *
     122     * @since 3.0.0
     123     *
     124     * @param array $value Array of allowed HTML tags and attributes.
     125     */
     126    $messages_allowedtags = apply_filters( 'bp_messages_allowed_tags', $messages_allowedtags );
     127    return wp_kses( $content, $messages_allowedtags );
     128}

  • trunk/src/bp-templates/bp-nouveau/buddypress/common/js-templates/messages/index.php

    r12058 r12067  
    4242<script type="text/html" id="tmpl-bp-messages-editor">
    4343    <?php
    44     // Temporarily filter the editor
    45     add_filter( 'mce_buttons', 'bp_nouveau_mce_buttons', 10, 1 );
     44    // Add a temporary filter on editor buttons
     45    add_filter( 'mce_buttons', 'bp_nouveau_messages_mce_buttons', 10, 1 );
    4646
    4747    wp_editor(
    … …  
    5959        )
    6060    );
    61     // Temporarily filter the editor
    62     remove_filter( 'mce_buttons', 'bp_nouveau_mce_buttons', 10, 1 );
     61    // Remove the temporary filter on editor buttons
     62    remove_filter( 'mce_buttons', 'bp_nouveau_messages_mce_buttons', 10, 1 );
    6363    ?>
    6464</script>

  • trunk/src/bp-templates/bp-nouveau/css/buddypress-rtl.css

    r12066 r12067  
    30703070
    30713071.bp-messages-content #thread-preview .preview-message {
    3072     clear: both;
     3072    overflow: hidden;
    30733073}
    30743074
    … …  
    31393139
    31403140.bp-messages-content #bp-message-thread-list .message-content {
    3141     clear: both;
     3141    overflow: hidden;
    31423142    margin: 1em auto 0;
    31433143    width: 90%;

  • trunk/src/bp-templates/bp-nouveau/css/buddypress.css

    r12066 r12067  
    30703070
    30713071.bp-messages-content #thread-preview .preview-message {
    3072     clear: both;
     3072    overflow: hidden;
    30733073}
    30743074
    … …  
    31393139
    31403140.bp-messages-content #bp-message-thread-list .message-content {
    3141     clear: both;
     3141    overflow: hidden;
    31423142    margin: 1em auto 0;
    31433143    width: 90%;

  • trunk/src/bp-templates/bp-nouveau/includes/messages/functions.php

    r12058 r12067  
    300300
    301301/**
    302  * @since 3.0.0
    303  */
    304 function bp_nouveau_mce_buttons( $buttons = array() ) {
     302 * Disable the WP Editor buttons not allowed in messages content.
     303 *
     304 * @since 3.0.0
     305 *
     306 * @param array $buttons The WP Editor buttons list.
     307 * @param array          The filtered WP Editor buttons list.
     308 */
     309function bp_nouveau_messages_mce_buttons( $buttons = array() ) {
    305310    $remove_buttons = array(
    306311        'wp_more',
    … …  
    308313        'wp_adv',
    309314        'fullscreen',
     315        'alignleft',
     316        'alignright',
     317        'aligncenter',
     318        'formatselect',
    310319    );
    311320

  • trunk/src/bp-templates/bp-nouveau/includes/messages/loader.php

    r11899 r12067  
    103103        // Messages
    104104        add_filter( 'bp_messages_admin_nav', 'bp_nouveau_messages_adjust_admin_nav', 10, 1 );
    105 
    106         remove_filter( 'messages_notice_message_before_save', 'wp_filter_kses', 1 );
    107         remove_filter( 'messages_message_content_before_save', 'wp_filter_kses', 1 );
    108         remove_filter( 'bp_get_the_thread_message_content', 'wp_filter_kses', 1 );
    109 
    110         add_filter( 'messages_notice_message_before_save', 'wp_filter_post_kses', 1 );
    111         add_filter( 'messages_message_content_before_save', 'wp_filter_post_kses', 1 );
    112         add_filter( 'bp_get_the_thread_message_content', 'wp_filter_post_kses', 1 );
    113         add_filter( 'bp_get_message_thread_content', 'wp_filter_post_kses', 1 );
    114         add_filter( 'bp_get_message_thread_content', 'wptexturize' );
    115         add_filter( 'bp_get_message_thread_content', 'stripslashes_deep', 1 );
    116         add_filter( 'bp_get_message_thread_content', 'convert_smilies', 2 );
    117         add_filter( 'bp_get_message_thread_content', 'convert_chars' );
    118         add_filter( 'bp_get_message_thread_content', 'make_clickable', 9 );
    119         add_filter( 'bp_get_message_thread_content', 'wpautop' );
    120105    }
    121106}

  • trunk/src/bp-templates/bp-nouveau/sass/_nouveau_messages.scss

    r12041 r12067  
    193193
    194194        .preview-message {
    195             clear: both;
     195            overflow: hidden;
    196196        }
    197197
    … …  
    264264
    265265        .message-content {
    266             clear: both;
     266            overflow: hidden;
    267267            margin: 1em auto 0;
    268268            width: 90%;
Note: See TracChangeset for help on using the changeset viewer.