Changeset 12807

Timestamp:

11/27/2020 04:03:45 PM (6 years ago)

Author:

johnjamesjacoby

Message:

XProfile: only allow "style" attributes in richtext fields for capable users

This commit prevents non-capable users from adding style attributes to "span" and "p" elements in their profile fields, which could be used in unintended ways relative to when it was introduced in #5625.

Note that this could be considered a backwards compatibility break. If you are a site owner or developer who relied on this functionality, you will want to use the xprofile_allowed_tags filter to re-enable these attributes.

In branches/6.0 for 6.4.0. Fixes #8404.

Props imath, zeldatea.

File:

• branches/6.0/src/bp-xprofile/bp-xprofile-filters.php (modified) (1 diff)

branches/6.0/src/bp-xprofile/bp-xprofile-filters.php

@@ -142 +142 @@
                         'ol'   => array(),
                         'li'   => array(),
-                        'span' => array( 'style' => 1 ),
-                        'p'    => array( 'style' => 1 ),
+                        'span' => array(),
+                        'p'    => array(),
                 );
+
+                // Allow style attributes on certain elements for capable users
+                if ( bp_current_user_can( 'unfiltered_html' ) ) {
+                        $richtext_tags['span'] = array( 'style' => 1 );
+                        $richtext_tags['p']    = array( 'style' => 1 );
+                }
 
                 $xprofile_allowedtags = array_merge( $allowedtags, $richtext_tags );