[wp-trac] [WordPress Trac] #43187: Add pre-save filter to make target="_blank" always secure
WordPress Trac
noreply at wordpress.org
Fri Mar 2 14:15:10 UTC 2018
#43187: Add pre-save filter to make target="_blank" always secure
-------------------------+-----------------------
Reporter: notnownikki | Owner:
Type: enhancement | Status: reopened
Priority: normal | Milestone: 5.0
Component: General | Version:
Severity: normal | Resolution:
Keywords: has-patch | Focuses:
-------------------------+-----------------------
Comment (by azaozz):
Replying to [comment:32 notnownikki]:
> New diff added, the filter is applied in all these cases...
Many of these are filtered through either `'sanitize_text_field'`,
`'sanitize_email'` or `'wp_strip_all_tags'` that remove all HTML tags.
Seems we only need to check for link targets on `'pre_term_description',
'pre_link_description', 'pre_link_notes', 'pre_user_description'`.
Updated patch coming up.
--
Ticket URL: <https://core.trac.wordpress.org/ticket/43187#comment:34>
WordPress Trac <https://core.trac.wordpress.org/>
WordPress publishing platform
More information about the wp-trac
mailing list