KSES: Add command and commandfor to the list of allowed attributes for buttons.

Developed in: WordPress#11483

Props pratiknawkar94, joedolson, westonruter, afercia.

Fixes #64576.


git-svn-id: https://develop.svn.wordpress.org/trunk@62531 602fd350-edb4-49c9-b593-d223f7449a82

Author: afercia

src/wp-includes/kses.php

@@ -109,6 +109,8 @@
 		),
 		'br'         => array(),
 		'button'     => array(
+			'command'             => true,
+			'commandfor'          => true,
 			'disabled'            => true,
 			'name'                => true,
 			'type'                => true,

tests/phpunit/tests/kses.php

@@ -1928,6 +1928,17 @@ public function test_wp_kses_main_tag_standard_attributes() {
 		$this->assertEqualHTML( $html, wp_kses_post( $html ) );
 	}
 
+	/**
+	 * Test that Invoker Commands API attributes are preserved on buttons in post content.
+	 *
+	 * @ticket 64576
+	 */
+	public function test_wp_kses_button_invoker_command_attributes() {
+		$html = '<button type="button" commandfor="my-popover" command="toggle-popover">Toggle</button><div id="my-popover" popover>Content</div>';
+
+		$this->assertEqualHTML( $html, wp_kses_post( $html ) );
+	}
+
 	/**
 	 * Test that object tags are allowed under limited circumstances.
 	 *