I am trying to prevent from Cross Site Scripting vulnerabilities. For that I have to make sure that it is not possible to insert JavaScript code directly via the editing functionality on Text editor. I want to be able to add only HTML and CSS content on text editor. have you an idea how to disable javascript code insertion in the wordpress text editor? Thanks.
Add a comment
|
2 Answers
WordPress already disallows the use of JavaScript in the editor for users without the unfiltered_html capability. By default, only the Administrator and Editor roles have this capability. If necessary, you could remove this capability from Editor users as well. (It doesn't make sense to remove it from Administrators, because they will still have the ability to install plugins, and thus execute whatever kind of code they want to.)
This code should do that for you:
function wpse_285333_remove_unfiltered_html_cap() {
$wp_roles = wp_roles();
$wp_roles->remove_cap( 'editor', 'unfiltered_html' );
}
// This function actually only needs to run once, so you can comment this out
// after loading the site once.
add_action( 'init', 'wpse_285333_remove_unfiltered_html_cap', 5 );
There are also plugins available to help with managing roles and capabilities.
-
What is the code i need to add to functions.php to disallows the use of javascript for all users except Afministrator? Thanks– SamuelCommented Nov 8, 2017 at 21:49
-
-
Thanks JD. it's an other way by just hide text-editor and by default have visual editor with this code : function my_editor_settings($settings) { $settings['quicktags'] = false; return $settings; } add_filter('wp_editor_settings', 'my_editor_settings');– SamuelCommented Nov 12, 2017 at 12:48
-
@sampaii I don't think that will prevent a clever user from being able to still use script tags if they want to. They would be able to modify the request sent from their browser to your server, and insert the script tags that way. The only way to be sure that they can't use JS is if the scripts are stripped out server-side.– J.D.Commented Nov 12, 2017 at 19:30
Hook into wp_insert_post_data to either filter out <script> content or simply give out error on saving.
https://codex.wordpress.org/Plugin_API/Filter_Reference/wp_insert_post_data
