Changeset 12806 for trunk/src/bp-xprofile/bp-xprofile-filters.php

Timestamp:

11/27/2020 03:56:32 PM (5 years ago)

Author:

johnjamesjacoby

Message:

XProfile: only allow "style" attributes in richtext fields for capable users

This commit prevents non-capable users from adding style attributes to "span" and "p" elements in their profile fields, which could be used in unintended ways relative to when it was introduced in #5625.

Note that this could be considered a backwards compatibility break. If you are a site owner or developer who relied on this functionality, you will want to use the xprofile_allowed_tags filter to re-enable these attributes.

In trunk for 7.0. See #8404.

File:

• trunk/src/bp-xprofile/bp-xprofile-filters.php (modified) (1 diff)

trunk/src/bp-xprofile/bp-xprofile-filters.php

@@ -142 +142 @@
             'ol'   => array(),
             'li'   => array(),
-            'span' => array( 'style' => 1 ),
-            'p'    => array( 'style' => 1 ),
+            'span' => array(),
+            'p'    => array(),
         );
+
+        // Allow style attributes on certain elements for capable users
+        if ( bp_current_user_can( 'unfiltered_html' ) ) {
+            $richtext_tags['span'] = array( 'style' => 1 );
+            $richtext_tags['p']    = array( 'style' => 1 );
+        }
 
         $xprofile_allowedtags = array_merge( $allowedtags, $richtext_tags );