diff options
Diffstat (limited to 'wp-comments-post.php')
| -rw-r--r-- | wp-comments-post.php | 12 |
1 files changed, 9 insertions, 3 deletions
diff --git a/wp-comments-post.php b/wp-comments-post.php index 26b476b..5988fd5 100644 --- a/wp-comments-post.php +++ b/wp-comments-post.php @@ -25,14 +25,20 @@ $comment_content = trim($_POST['comment']); // If the user is logged in $user = wp_get_current_user(); -if ( $user->ID ) : +if ( $user->ID ) { $comment_author = $wpdb->escape($user->display_name); $comment_author_email = $wpdb->escape($user->user_email); $comment_author_url = $wpdb->escape($user->user_url); -else : + if ( current_user_can('unfiltered_html') ) { + if ( wp_create_nonce('unfiltered-html-comment_' . $comment_post_ID) != $_POST['_wp_unfiltered_html_comment'] ) { + kses_remove_filters(); // start with a clean slate + kses_init_filters(); // set up the filters + } + } +} else { if ( get_option('comment_registration') ) wp_die( __('Sorry, you must be logged in to post a comment.') ); -endif; +} $comment_type = ''; |