wpseek.com
A WordPress-centric search engine for devs and theme authors



_wp_kses_sanitize_note_mention_classes › WordPress Function

Since7.1.0
Deprecatedn/a
› _wp_kses_sanitize_note_mention_classes ( $content )
Access:
  • private
Parameters:
  • (string) $content Slashed comment content, already filtered by kses.
    Required: Yes
Returns:
  • (string) Slashed comment content with span classes reduced.
Defined at:
Codex:

Reduces `span` classes in comment content to the note mention tokens.

_wp_kses_allow_note_mention_span() lets class through kses on span so the mention chip survives, but class is an open-ended styling and scripting hook, so this companion pass - running right after wp_filter_kses at priority 10 - strips every class token except the two the mention markup uses: wp-note-mention and user-N. span is the only comment tag allowed to carry class at all, so walking span tags covers the entire allowance. The pass only applies while the restrictive comment allowlist is active: users with unfiltered_html are filtered through wp_filter_post_kses (or not at all), where arbitrary classes are already permitted, and narrowing their markup here would restrict what core allows them to post.


Related Functions: _wp_kses_allow_note_mention_span, sanitize_html_class, wp_kses_normalize_entities, sanitize_comment_cookies, wp_render_elements_class_name

Source 

function _wp_kses_sanitize_note_mention_classes( $content ): string {
	if ( ! is_string( $content ) ) {
		$content = '';
	}
	if ( false === has_filter( 'pre_comment_content', 'wp_filter_kses' ) ) {
		return $content;
	}

	$processor = new WP_HTML_Tag_Processor( wp_unslash( $content ) );

	while ( $processor->next_tag( 'SPAN' ) ) {
		foreach ( $processor->class_list() as $token ) {
			if ( 'wp-note-mention' !== $token && ! preg_match( '/^user-[1-9][0-9]*$/', $token ) ) {
				// Removing the last class also removes the attribute itself.
				$processor->remove_class( $token );
			}
		}
	}

	return wp_slash( $processor->get_updated_html() );
}