Comments: Improve comment content filtering.

SergeyBiryukov · SergeyBiryukov · commit 1600e3f6daf1 · 2019-03-12T22:39:12.000Z
Merges [44842] to the 4.4 branch. git-svn-id: https://develop.svn.wordpress.org/branches/4.4@44850 602fd350-edb4-49c9-b593-d223f7449a82
diff --git a/src/wp-admin/includes/ajax-actions.php b/src/wp-admin/includes/ajax-actions.php
@@ -1007,6 +1007,8 @@ function wp_ajax_replyto_comment( $action ) {
 			if ( wp_create_nonce( 'unfiltered-html-comment' ) != $_POST['_wp_unfiltered_html_comment'] ) {
 				kses_remove_filters(); // start with a clean slate
 				kses_init_filters(); // set up the filters
+				remove_filter( 'pre_comment_content', 'wp_filter_post_kses' );
+				add_filter( 'pre_comment_content', 'wp_filter_kses' );
 			}
 		}
 	} else {
diff --git a/src/wp-includes/comment.php b/src/wp-includes/comment.php
@@ -2757,6 +2757,8 @@ function wp_handle_comment_submission( $comment_data ) {
 			) {
 				kses_remove_filters(); // start with a clean slate
 				kses_init_filters(); // set up the filters
+				remove_filter( 'pre_comment_content', 'wp_filter_post_kses' );
+				add_filter( 'pre_comment_content', 'wp_filter_kses' );
 			}
 		}
 	} else {

Original file line number	Diff line number	Diff line change
`@@ -1007,6 +1007,8 @@ function wp_ajax_replyto_comment( $action ) {`
`1007`	`1007`	`if ( wp_create_nonce( 'unfiltered-html-comment' ) != $_POST['_wp_unfiltered_html_comment'] ) {`
`1008`	`1008`	`kses_remove_filters(); // start with a clean slate`
`1009`	`1009`	`kses_init_filters(); // set up the filters`
	`1010`	`+ remove_filter( 'pre_comment_content', 'wp_filter_post_kses' );`
	`1011`	`+ add_filter( 'pre_comment_content', 'wp_filter_kses' );`
`1010`	`1012`	`}`
`1011`	`1013`	`}`
`1012`	`1014`	`} else {`
Original file line number	Diff line number	Diff line change
`@@ -2757,6 +2757,8 @@ function wp_handle_comment_submission( $comment_data ) {`
`2757`	`2757`	`) {`
`2758`	`2758`	`kses_remove_filters(); // start with a clean slate`
`2759`	`2759`	`kses_init_filters(); // set up the filters`
	`2760`	`+ remove_filter( 'pre_comment_content', 'wp_filter_post_kses' );`
	`2761`	`+ add_filter( 'pre_comment_content', 'wp_filter_kses' );`
`2760`	`2762`	`}`
`2761`	`2763`	`}`
`2762`	`2764`	`} else {`