Tell me more ×
WordPress Answers is a question and answer site for WordPress developers and administrators. It's 100% free, no registration required.
up vote 1 down vote favorite

I have a client who is trying to inject some JS directly into a post using the web interface. The script is stripped out on the live site.

I am unable to replicate this behavior on a local installation. The JS is added as expected.

The main difference between my installation and the client's is that my installation is a fresh WP3 installation, whereas the client's is WP3 upgraded from WP2.

Is this a configuration option or a legacy issue? Is there some other reason why this might be happening?

Rich

share|improve this question
On further digging, script is striped out if the code is entered as an author but not as an administrator. Is there anyway to remove this restriction? – kim3er Feb 24 '11 at 11:29
1  
Does the client adds js in wysiwyg mode or html mode? And what about you? I think that in HTML only, js code isn't stripped. – Rilwis Feb 24 '11 at 14:33
@rilwis HTML mode. From my testing, it would appear that JS is striped out for Authors. Though I've found no documentation to confirm this. – kim3er Feb 24 '11 at 21:55

2 Answers

up vote 2 down vote

If I am not mistaken about the issue - that is controlled by unfiltered_html capability. Only available to Editor role and higher by default.

share|improve this answer
+1 Cheers, that's good to know. – kim3er Mar 28 '11 at 8:58
up vote 1 down vote accepted

At least in my installation, Admin and Editors are able to inject script into their posts. Authors are not able to.

Author content is parsed using a plugin called KSES, which strips out disallowed HTML.

The KSES plugin can be overridden or extended. Which I have done by hacking a community plugin called Extend KSES (http://wordpress.org/extend/plugins/extend-kses/).

Not too keen on the idea of allowing script injection, so the client should be made aware of the dangers.

Rich

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.