When you use the deprecated CUSTOM_TAGS
constant, you have to define the variables WordPress would normally create in kses.php
at the top. If you do not then you will encounter this issue.
/**
* Specifies the default allowable HTML tags.
*
* Using `CUSTOM_TAGS` is not recommended and should be considered deprecated. The
* {@see 'wp_kses_allowed_html'} filter is more powerful and supplies context.
*
* @see wp_kses_allowed_html()
* @since 1.2.0
*
* @var array[]|false Array of default allowable HTML tags, or false to use the defaults.
*/
if ( ! defined( 'CUSTOM_TAGS' ) ) {
define( 'CUSTOM_TAGS', false );
}
Instead, you should use the wp_kses_allowed_html
filter to modify which tags are allowed, using the context
parameter to control when and where the adjusted tags are usable:
https://developer.wordpress.org/reference/hooks/wp_kses_allowed_html/
Just keep in mind that the list of tags is chosen to avoid allowing dangerous things into posts and comments. E.g. iframes or script tags. Changing these will have significant security consequences.
How is “kses” activated in this case? Is it the content of the blog?
kses
functions are used everywhere in WordPress and play a pivotal role in security. E.g. wp_kses_post
is used to strip out dangerous tags when saving a post, and wp_kses
can strip out tags and attributes that don’t fit a whitelist. wp_kses
and it’s wrapper functions act as both pseudo-escaping and as sanitisation functions.