diff options
Diffstat (limited to 'wp-includes/blocks.php')
| -rw-r--r-- | wp-includes/blocks.php | 36 |
1 files changed, 32 insertions, 4 deletions
diff --git a/wp-includes/blocks.php b/wp-includes/blocks.php index 854992d..5b452c6 100644 --- a/wp-includes/blocks.php +++ b/wp-includes/blocks.php @@ -1447,7 +1447,7 @@ function _filter_block_content_callback( $matches ) { * @return array The filtered and sanitized block object result. */ function filter_block_kses( $block, $allowed_html, $allowed_protocols = array() ) { - $block['attrs'] = filter_block_kses_value( $block['attrs'], $allowed_html, $allowed_protocols ); + $block['attrs'] = filter_block_kses_value( $block['attrs'], $allowed_html, $allowed_protocols, $block ); if ( is_array( $block['innerBlocks'] ) ) { foreach ( $block['innerBlocks'] as $i => $inner_block ) { @@ -1463,6 +1463,7 @@ function filter_block_kses( $block, $allowed_html, $allowed_protocols = array() * non-allowable HTML. * * @since 5.3.1 + * @since 6.5.5 Added the `$block_context` parameter. * * @param string[]|string $value The attribute value to filter. * @param array[]|string $allowed_html An array of allowed HTML elements and attributes, @@ -1470,13 +1471,18 @@ function filter_block_kses( $block, $allowed_html, $allowed_protocols = array() * for the list of accepted context names. * @param string[] $allowed_protocols Optional. Array of allowed URL protocols. * Defaults to the result of wp_allowed_protocols(). + * @param array $block_context Optional. The block the attribute belongs to, in parsed block array format. * @return string[]|string The filtered and sanitized result. */ -function filter_block_kses_value( $value, $allowed_html, $allowed_protocols = array() ) { +function filter_block_kses_value( $value, $allowed_html, $allowed_protocols = array(), $block_context = null ) { if ( is_array( $value ) ) { foreach ( $value as $key => $inner_value ) { - $filtered_key = filter_block_kses_value( $key, $allowed_html, $allowed_protocols ); - $filtered_value = filter_block_kses_value( $inner_value, $allowed_html, $allowed_protocols ); + $filtered_key = filter_block_kses_value( $key, $allowed_html, $allowed_protocols, $block_context ); + $filtered_value = filter_block_kses_value( $inner_value, $allowed_html, $allowed_protocols, $block_context ); + + if ( isset( $block_context['blockName'] ) && 'core/template-part' === $block_context['blockName'] ) { + $filtered_value = filter_block_core_template_part_attributes( $filtered_value, $filtered_key, $allowed_html ); + } if ( $filtered_key !== $key ) { unset( $value[ $key ] ); @@ -1492,6 +1498,28 @@ function filter_block_kses_value( $value, $allowed_html, $allowed_protocols = ar } /** + * Sanitizes the value of the Template Part block's `tagName` attribute. + * + * @since 6.5.5 + * + * @param string $attribute_value The attribute value to filter. + * @param string $attribute_name The attribute name. + * @param array[]|string $allowed_html An array of allowed HTML elements and attributes, + * or a context name such as 'post'. See wp_kses_allowed_html() + * for the list of accepted context names. + * @return string The sanitized attribute value. + */ +function filter_block_core_template_part_attributes( $attribute_value, $attribute_name, $allowed_html ) { + if ( empty( $attribute_value ) || 'tagName' !== $attribute_name ) { + return $attribute_value; + } + if ( ! is_array( $allowed_html ) ) { + $allowed_html = wp_kses_allowed_html( $allowed_html ); + } + return isset( $allowed_html[ $attribute_value ] ) ? $attribute_value : ''; +} + +/** * Parses blocks out of a content string, and renders those appropriate for the excerpt. * * As the excerpt should be a small string of text relevant to the full post content, |