[wp-trac] [WordPress Trac] #58227: JavaScript can be entered as an image description

[WordPress Trac]

#58227: JavaScript can be entered as an image description
--------------------------+------------------------------
 Reporter:  Presskopp     |       Owner:  (none)
     Type:  defect (bug)  |      Status:  new
 Priority:  normal        |   Milestone:  Awaiting Review
Component:  Media         |     Version:
 Severity:  normal        |  Resolution:
 Keywords:  2nd-opinion   |     Focuses:
--------------------------+------------------------------
Changes (by johnbillion):

 * keywords:  reporter-feedback => 2nd-opinion


Comment:

 This is allowed because Editors and Administrators (on non-Multisite
 installations) have the `unfiltered_html` user capability, which is the
 same reason they can enter JavaScript into post content.

 I agree that it makes little sense to allow JavaScript in this field. It
 would be a breaking change to disallow it, so we'd need to consider if
 there really is a use case to allow JavaScript here.

-- 
Ticket URL: <https://core.trac.wordpress.org/ticket/58227#comment:3>
WordPress Trac <https://core.trac.wordpress.org/>
WordPress publishing platform