diff --git a/wordpress.org/public_html/wp-content/mu-plugins/pub/wporg-allow-more-html-in-comments.php b/wordpress.org/public_html/wp-content/mu-plugins/pub/wporg-allow-more-html-in-comments.php index b3b4729d5d..280b51bf31 100644 --- a/wordpress.org/public_html/wp-content/mu-plugins/pub/wporg-allow-more-html-in-comments.php +++ b/wordpress.org/public_html/wp-content/mu-plugins/pub/wporg-allow-more-html-in-comments.php @@ -45,7 +45,68 @@ function p2_kses_init() { */ function p2_kses_init_filters() { remove_filter( 'pre_comment_content', 'wp_filter_kses' ); - add_filter( 'pre_comment_content', 'wp_filter_post_kses' ); + add_filter( 'pre_comment_content', __NAMESPACE__ . '\\filter_comment_content' ); +} + +/** + * Applies the post HTML filters to comment content, then drops o2's own classes. + * + * Mirrors wp_filter_post_kses(), which is what this used to hook directly, apart + * from the narrower tag list. + * + * @param string $data Slashed comment content. + * @return string Slashed comment content. + */ +function filter_comment_content( $data ) { + return addslashes( strip_o2_control_classes( wp_kses( stripslashes( $data ), comment_allowed_html() ) ) ); +} + +/** + * Builds the list of HTML allowed in a comment. + * + * The post list, minus the form controls. A comment is prose, so a field the + * reader can type into or a button they can press is out of place in one, and + * o2 reads meaning into both. Same reasoning as the removal below. + * + * @return array[] Allowed HTML tags and attributes. + */ +function comment_allowed_html() { + $tags = \wp_kses_allowed_html( 'post' ); + + unset( $tags['textarea'], $tags['button'] ); + + return $tags; +} + +/** + * Removes o2's control classes from comment HTML. + * + * These classes are how o2 binds its post actions, and the lookup that picks an + * editor to read, across the whole post article rather than to the controls it + * rendered itself. Comments live in that article and their HTML comes from the + * commenter, so it must not be able to present itself as one of those controls. + * + * @param string $html Unslashed comment HTML. + * @return string + */ +function strip_o2_control_classes( $html ) { + $tags = new \WP_HTML_Tag_Processor( $html ); + + while ( $tags->next_tag() ) { + $remove = array(); + + foreach ( $tags->class_list() as $class ) { + if ( str_starts_with( strtolower( $class ), 'o2-' ) ) { + $remove[] = $class; + } + } + + foreach ( $remove as $class ) { + $tags->remove_class( $class ); + } + } + + return $tags->get_updated_html(); } /**