0

I have buddypress installation. When posting an acitivity, I'm including some data (html) as meta. Let me show some code:

this is an action triggered when acitivty is posted.

function add_activitylink_to_activity( $content, $user_id, $activity_id ) { ?>
<script type="text/javascript" >
    var activity_id = '<?php echo $activity_id; ?>';
    if ( !jQuery('#add_activity_link_area').hasClass('empty') ) {
        var add_link = jQuery("#add_activity_link_area").html();
        jQuery.ajax({
            type : 'POST',
            url : ajaxurl,
            data : {
                action : 'addActivityMeta',
                activity_id: activity_id,
                add_link: add_link
            },
            dataType: "html",
            success : function(data) {
                jQuery("#activity-" + activity_id).find(".activity-inner").after(jQuery("<div class='meta-activitylink'></div>").html(add_link));
            },
            error: function(MLHttpRequest, textStatus, errorThrown){
                alert(textStatus);
            }
        })
    }
</script>
<?php }
add_action( 'bp_activity_posted_update', 'add_activitylink_to_activity', 10, 3 );

and here is a ajax handler:

function addActivityMeta() {
    bp_activity_update_meta( $_POST['activity_id'], 'activitylink', $_POST['add_link'] );
    die('success');
}

everything works fine as long as I'm logged in as administrator, but with normal users, the meta does not get posted

as I understand it, it's because "unfiltered html", but I don't understand much of it and this maybe sound stupid: can I filter it somehow? :D

there are table and image links and such.

or is there any workaround? for example I'm thinking about inserting this meta with mysql query? Is this bad solution?

2

Do you really want your members to be able to insert unfiltered html in the database? By default, it's not allowed as a security measure to protect your installation.

You could allow it by adjusting kses filters. Or by-pass the filters via a custom sql query.

|improve this answer|||||
  • I don't want to allow unfiltered html globally, just for this one, and I'll try to build some security for this one, like construct the whole html inside my ajax query, just gettings text and src of image from html... I think – CBeTJlu4ok Aug 16 '13 at 19:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.