[wp-trac] [WordPress Trac] #37208: Comment blacklist can be bypassed with HTML

[WordPress Trac]

#37208: Comment blacklist can be bypassed with HTML
---------------------------------------------+--------------------------
 Reporter:  cfinke                           |       Owner:  rachelbaker
     Type:  defect (bug)                     |      Status:  closed
 Priority:  normal                           |   Milestone:  4.6
Component:  Comments                         |     Version:  1.5
 Severity:  normal                           |  Resolution:  fixed
 Keywords:  has-unit-tests has-patch commit  |     Focuses:
---------------------------------------------+--------------------------
Changes (by ocean90):

 * status:  reopened => closed
 * resolution:   => fixed


Comment:

 In [changeset:"38092"]:
 {{{
 #!CommitTicketReference repository="" revision="38092"
 Comments: Use `wp_strip_all_tags()` to strip HTML tags.

 `wp_kses()` should only be used if you have a whitelist.

 Props rachelbaker.
 Fixes #37208.
 }}}

--
Ticket URL: <https://core.trac.wordpress.org/ticket/37208#comment:13>
WordPress Trac <https://core.trac.wordpress.org/>
WordPress publishing platform