Take the 2-minute tour ×
WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. It's 100% free, no registration required.

I was thinking of adding the following lines of code to my functions.php file:

/**
 * Change the default list of allowed html tags
 */
add_action('init', 'edittag', 10);

function edittag() {
  define('CUSTOM_TAGS', true);
  global $allowedposttags, $allowedtags;
  $allowedposttags = array(
      'strong' => array(),
      'em' => array(),
      'ol' => array(),
      'li' => array(),
      'u' => array(),
      'ul' => array(),
      'blockquote' => array(),
      'code' => array(),
      'pre' => array(),
      'a' => array(
        'href' => array (),
        'title' => array ()),
      'img' => array(
        'src' => array ()),
  );

  $allowedtags = array(
      'strong' => array(),
      'em' => array(),
      'ol' => array(),
      'li' => array(),
      'u' => array(),
      'ul' => array(),
      'blockquote' => array(),
      'code' => array(),
      'pre' => array(),
      'a' => array(
        'href' => array (),
        'title' => array ()),
      'img' => array(
        'src' => array ()),
  );
}

The user will be able to add stuff using the CLEditor (WYSIWYG editor, so the user can't see the code), and the form belongs to the bbPress plugin:

enter image description here

I was wondering if my site will become vulnerable to spam, hackers, cracker, etc?

If that's the case, what's an easy way of making this stuff more secure? EDIT: If I use Firebug I can see the actual HTML code:

For instance, this is what you see if you inspect a bold text (in Firefox):

<b _moz_dirty="">sd</b>

(Not sure if this is dangerous).

share|improve this question
add comment

1 Answer 1

up vote 1 down vote accepted

Read here about _moz_dirty (Using Google would have given you the same answer - 2nd Result for "_moz_dirty"). Regarding html-stuff: You're offering the ability to add links...

share|improve this answer
    
@kaiser Is the ability of adding links dangerous? Should I disable that ability (How)? –  janoChen Jun 19 '11 at 15:03
    
@janoChen Ad "How": I'm not sure if you're making a joke... ? You posted the code above... –  kaiser Jun 19 '11 at 15:17
    
@kaiser Sorry, I mean, how is the ability of adding link dangerous? –  janoChen Jun 20 '11 at 1:17
    
@janoChen Define "dangerous". Where can you link, what impact on your site can it have? What settings have you made (comment moderation, etc.)? –  kaiser Jun 20 '11 at 1:38
    
@kaiser as I stated above, being hacked or spammed. The only comment moderation are a down vote button (maybe it will hie comments with 3 or more down votes), a flag button and maybe myself. –  janoChen Jun 20 '11 at 7:41
show 1 more comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.