[wp-trac] [WordPress Trac] #43946: Inconsistent encoding of comment_content

[WordPress Trac]

#43946: Inconsistent encoding of comment_content
---------------------------------------+------------------------------
 Reporter:  leewillis77                |       Owner:  (none)
     Type:  defect (bug)               |      Status:  new
 Priority:  normal                     |   Milestone:  Awaiting Review
Component:  Comments                   |     Version:  4.9.5
 Severity:  normal                     |  Resolution:
 Keywords:  needs-testing needs-patch  |     Focuses:
---------------------------------------+------------------------------
Changes (by westonruter):

 * keywords:  has-patch needs-testing => needs-testing needs-patch


Comment:

 The issue is that when a user is logged-in, namely as an administrator,
 then they can do `unfiltered_html`. This means they can add arbitrary
 HTML. Even a non-administrator, however, is allowed to use a subset of
 HTML which is allow-listed by Kses. Passing all submitted comment text
 through `esc_html()` will break the ability for users to format any of
 their comments with HTML. So unfortunately the proposed patch isn't the
 right solution.

-- 
Ticket URL: <https://core.trac.wordpress.org/ticket/43946#comment:10>
WordPress Trac <https://core.trac.wordpress.org/>
WordPress publishing platform