[wp-trac] [WordPress Trac] #37208: Comment blacklist can be bypassed with HTML
WordPress Trac
noreply at wordpress.org
Thu Jul 14 07:27:34 UTC 2016
#37208: Comment blacklist can be bypassed with HTML
---------------------------------------------+--------------------------
Reporter: cfinke | Owner: rachelbaker
Type: defect (bug) | Status: closed
Priority: normal | Milestone: 4.6
Component: Comments | Version: 1.5
Severity: normal | Resolution: fixed
Keywords: has-patch has-unit-tests commit | Focuses:
---------------------------------------------+--------------------------
Comment (by dd32):
@rachelbaker @cfinke Should this just use `wp_strip_all_tags()` instead of
`wp_kses()`? KSes is designed to limit to a whitelist, if you want no
tags, might as well just strip them entirely.
--
Ticket URL: <https://core.trac.wordpress.org/ticket/37208#comment:8>
WordPress Trac <https://core.trac.wordpress.org/>
WordPress publishing platform
More information about the wp-trac
mailing list