diff -uNr a/mp-wp/manifest b/mp-wp/manifest --- a/mp-wp/manifest acf6b4c38d37946380913eea64e19b5b8d8a497e6721d8969f6dda318111b93d0699141210cc0298be41af8b65b332a2268560b7e726f290fadadcb4dbdafcb9 +++ b/mp-wp/manifest 6d47bbc24996dbf2a24bf6d91abf6ab3de3b2aef33884bf3e583a784bb3bc5d16f6d9c2f1c308c576c319a0a520b62a4432ab13f858c5dae9ac253ba7628b2d3 @@ -3,3 +3,4 @@ 558370 mp-wp_update-image-references-to-svg billymg Update all internal image references to use .svg extensions 568792 mp-wp_html-comments-regrind hanbot Anonymous function in kses.php given variables to allow for html and other desired tags in comments compatible with PHP versions 5 and above. Also, trilema-specific database parameter for spam cleanup converted to (reground: correct) variable table name for compatibility. Spurious trilema-specific commented-out code deleted. 569483 mp-wp_remove-tinymce-and-other-crud billymg Remove tinymce, most of the importers, the self-update feature, and the google gears and press-this plugins +602064 mp-wp_apply-htmlspecialchars-to-post-edit-content billymg Run post content through htmlspecialchars() before loading into the post edit UI diff -uNr a/mp-wp/wp-includes/formatting.php b/mp-wp/wp-includes/formatting.php --- a/mp-wp/wp-includes/formatting.php 96c9b9b0b8da6f255e10fd47fd4053958417127524a5b8be961e126cce7fde0476bd5c2b20c4580517a75b01e9751636c8dc0c6f250ab8f94dbbe8097057cf67 +++ b/mp-wp/wp-includes/formatting.php 8f357ed8c80c0ca11d8f4c97243f23ae535672fd5d9c83e43ddfe14b6d1ba191b920801ed8c9ac0168e61f6e626634d0041985de3afc69ffe6af6ae2fbded7c7 @@ -775,17 +775,16 @@ /** * Acts on text which is about to be edited. * - * Holder for the 'format_to_edit' - * filter. + * Holder for the 'format_to_edit' filter. * * @since 0.71 * * @param string $content The text about to be edited. - * @return string The text after the filter (and possibly htmlspecialchars()) has been run. + * @return string The text after the filter and htmlspecialchars() has been run. */ function format_to_edit($content) { $content = apply_filters('format_to_edit', $content); - return $content; + return htmlspecialchars($content); } /**