0

We have an installation of WordPress (3.9) where TinyMCE is not removing script tags (in posts etc). This isn't correct, I believe?!

I think a developer that worked on the project possibly changed something when trying to sort something out, but I can't see where at the moment - what are the obvious places to look?

Thanks,

Toby

Update: This seems to happen on a fresh WP3.9 install. In the text tab of the post editor I can enter script tags, which persist unless I switch to the visual editor and save. I don't think that this is correct, I think that WP is supposed to strip script tags out...or did I miss something?

  • 1
    Which user roles experience this issue? – s_ha_dum Apr 22 '14 at 16:26
  • I'm seeing it logged in as an Administrator, haven't checked others. – toby1kenobi Apr 22 '14 at 19:00
  • I don't have the time to chase this down to verify it but the administrator should have "unfiltered html" capability. Try with another role. – s_ha_dum Apr 22 '14 at 19:04
  • editor seems to be able to do it too - I just did a fresh install of WP3.9, created a new post containing an alert between two script tags and the alert works...I also pulled in a js file...this can't be right can it?! – toby1kenobi Apr 22 '14 at 19:35
  • Are there any plugins on the site that may be modifying the editor's behavior? – s_ha_dum Apr 22 '14 at 20:13
1

Ok, it was my oversight - and s_ha_dum was almost spot on - I was kindly directed to this:

http://codex.wordpress.org/Security_FAQ#Why_are_some_users_allowed_to_post_unfiltered_HTML.3F

which explains the situation perfectly.


In case this is of any use to anyone

I have fixed it for the site I'm working on using the wp_insert_post_data filter, like this:

add_filter( 'wp_insert_post_data' , 'filter_post_data' , '99', 2 );

function filter_post_data( $data , $postarr ) {
    $data = wp_kses_post( $data );
    return $data;
}

I am hoping I've got something wrong here, this seems very...wrong?!

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.