Upstream
/
WordPress
mirror of https://github.com/WordPress/WordPress.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

Widgets: Validate HTML before saving block widgets. 

Props talldanwp, noisysocks, kevin940726, peterwilsoncc.
Merges [51414] and [51423] to the 5.8 branch.
Built from https://develop.svn.wordpress.org/branches/5.8@51424


git-svn-id: http://core.svn.wordpress.org/branches/5.8@51035 1a063a9b-81f0-0310-95a4-ce76da25c4cd
This commit is contained in:
desrosj 2021-07-13 18:04:58 +00:00
parent 5658a2d03c
commit eba698dba1
3 changed files with 17 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
wp-includes/class-wp-customize-widgets.php
View File

@ -1419,6 +1419,15 @@ final class WP_Customize_Widgets {
if ( isset( $value['raw_instance'] ) && $id_base && wp_use_widgets_block_editor() ) {
$widget_object = $wp_widget_factory->get_widget_object( $id_base );
if ( ! empty( $widget_object->widget_options['show_instance_in_rest'] ) ) {
if ( 'block' === $id_base && ! current_user_can( 'unfiltered_html' ) ) {
/*
* The content of the 'block' widget is not filtered on the
* fly while editing. Filter the content here to prevent
* vulnerabilities.
*/
$value['raw_instance']['content'] = wp_kses_post( $value['raw_instance']['content'] );
}
return $value['raw_instance'];
}
}

2
wp-includes/version.php
View File

@ -13,7 +13,7 @@
*
* @global string $wp_version
*/
$wp_version = '5.8-RC2-51422';
$wp_version = '5.8-RC2-51424';
/**
* Holds the WordPress DB revision, increments when changes are made to the WordPress DB schema.

9
wp-includes/widgets/class-wp-widget-block.php
View File

@ -178,8 +178,13 @@ class WP_Widget_Block extends WP_Widget {
* @return array Settings to save or bool false to cancel saving.
*/
public function update( $new_instance, $old_instance ) {
$instance = array_merge( $this->default_instance, $old_instance );
$instance['content'] = $new_instance['content'];
$instance = array_merge( $this->default_instance, $old_instance );
if ( current_user_can( 'unfiltered_html' ) ) {
$instance['content'] = $new_instance['content'];
} else {
$instance['content'] = wp_kses_post( $new_instance['content'] );
}
return $instance;
}