wp_filter_post_kses creates invalid JSON on save_post_array

[dennisnissle]

Hi,

I was facing a really nasty bug. My actions were added correctly but did all receive a "failed fetch action" error. This was due to my arguments not being able to run through json_decode and therefor not being attached to my hook (resulting in a PHP too few arguments error). This is an example of my arguments:

$args = array(
	'date_expires' => '<' . $today->getTimestamp(),
	'status'       => 'active',
	'limit'        => 1,
	'orderby'      => 'date_expires',
	'paginate'     => true,
);

This is the JSON being created within the post_content DB field (sanitized by WP)

{"args":{"date_expires":"<1559174400","status":"active","limit":50,"orderby":"date_expires","offset":0}}

As you can see, starting from the timestamp all the quotes are transformed into their HTML equivalent - this is due to wp_filter_post_kses sanitizing the post_content data.

WP prevents this from happening with their own JSON data (e.g. WP_Embed) by checking and removing the kses filters before inserting/updating the post. I've fixed the error by doing the same in ActionScheduler_wpPostStore method save_post_array:

$has_kses = false !== has_filter( 'content_save_pre', 'wp_filter_post_kses' );

if ( $has_kses ) {
	// Prevent KSES from corrupting JSON in post_content.
	kses_remove_filters();
}

$post_id = wp_insert_post($post_array);

if ( $has_kses ) {
	kses_init_filters();
}

I can provide you with a pull request too..

Cheers

[rrennick]

I can provide you with a pull request too..

Please do. Can you include a reference to where WP does it for WP_Embed?

[thenbrent]

this is due to wp_filter_post_kses sanitizing the post_content data

This should also be fixed with custom tables, as we won't be using post_content anymore.

[dennisnissle]

Added the pull request. See https://core.trac.wordpress.org/browser/trunk/src/wp-includes/class-wp-embed.php#L282 for further information on how this is handled within WP_Embed.

Cheers