Reduces span classes in comment content to the note mention tokens.
Description
_wp_kses_allow_note_mention_span() lets class through kses on span so the mention chip survives, but class is an open-ended styling and scripting hook, so this companion pass – running right after wp_filter_kses at priority 10 – strips every class token except the two the mention markup uses: wp-note-mention and user-N. span is the only comment tag allowed to carry class at all, so walking span tags covers the entire allowance.
The pass only applies while the restrictive comment allowlist is active: users with unfiltered_html are filtered through wp_filter_post_kses (or not at all), where arbitrary classes are already permitted, and narrowing their markup here would restrict what core allows them to post.
Parameters
$contentstringrequired- Slashed comment content, already filtered by kses.
Source
function _wp_kses_sanitize_note_mention_classes( $content ): string {
if ( ! is_string( $content ) ) {
$content = '';
}
if ( false === has_filter( 'pre_comment_content', 'wp_filter_kses' ) ) {
return $content;
}
$processor = new WP_HTML_Tag_Processor( wp_unslash( $content ) );
while ( $processor->next_tag( 'SPAN' ) ) {
foreach ( $processor->class_list() as $token ) {
if ( 'wp-note-mention' !== $token && ! preg_match( '/^user-[1-9][0-9]*$/', $token ) ) {
// Removing the last class also removes the attribute itself.
$processor->remove_class( $token );
}
}
}
return wp_slash( $processor->get_updated_html() );
}
Changelog
| Version | Description |
|---|---|
| 7.1.0 | Introduced. |
User Contributed Notes
You must log in before being able to contribute a note or feedback.