8

Among WordPress' capabilities are unfiltered_html and unfiltered_upload, however I have yet to find any documentation about what specifically they allow or prevent in their filtering.

The only mention I've found on WordPress' site about unfiltered_html is:

Allows user to post HTML markup or even JavaScript code in pages, posts, comments and widgets.

I've seen that JavaScript is filtered out for non-admins, but what HTML is being filtered?

And for unfiltered_upload:

This capability is not available to any role by default (including Super Admins). The capability needs to be enabled by defining the following constant:

define( 'ALLOW_UNFILTERED_UPLOADS', true );

With this constant defined, all roles on a single site install can be given the unfiltered_upload capability, but only Super Admins can be given the capability on a Multisite install.

And again, the description doesn't spell out what's permitted and what's filtered out.

Can someone tell me exactly what elements, code, or file types the unfiltered_html and unfiltered_upload capabilities allow or prevent?

Improve this question
1
  • Note that allowing unfiltered HTML to anybody is practically same as granting them full administrative access to all accounts. This is because unfiltered HTML can be used to implement XSS attack which can be used to take over any session.
    – Mikko Rantalainen
    Mar 17, 2021 at 15:51

3 Answers 3

Reset to default
8

It is hard to come up with precise answer since capabilities are often used more broadly than they imply. For example check for manage_options is usually synonym to check for admin user and can come up in contexts that don't actually have much to do with options.

Usually it will be a difference between subject content passing or not passing through wp_kses(). Specific kses settings and what is considered allowed would depend on the context and might wary.

For unfiltered_upload as far as I remember it's more straightforward. Without it only white listed file types are allowed. The list is based on wp_get_mime_types().

Improve this answer
5
  • 1
    In the file wp-includes/kses.php you can find the initial values of $allowedposttags and $allowedtags arrays used by the kses functions.
    – Milo
    Sep 11, 2015 at 20:14
  • Thanks for the explanation. Seems like the MIME types for uploads can be found at core.trac.wordpress.org/browser/tags/4.3/src/wp-includes/…. Any idea where the code that references unfiltered_html might lie?
    – j08691
    Sep 11, 2015 at 20:28
  • unfiltered_html is splattered all over code base. Quick source search nets over dozen different files mentioning it.
    – Rarst
    Sep 11, 2015 at 20:31
  • Can someone work on this. Currently it is an impossible nightmare to upload non whitelisted media. None of the plugins work correctly. Wordpress is a CMS - yeah right. Is a content MISmanagment system.
    – Jim Maguire
    Feb 23, 2017 at 13:24
  • 1
    this question has literally saved our lives, we have been searching for days for solution to the problem which was spread out,, we have custom post type which has to be operated by customers that are generating their posts with active scripts and SVG files and,, the problem was not with saving the posts the problem was that WP has been stripping them off completely ,. this gave us right direction and right cap to use, thanks
    – Kresimir Pendic
    Apr 12, 2018 at 9:02
4

I appreciate this is an old thread, but restricted unfiltered_html was causing us huge problems on our news site.

The in-house writers (a special class of user) are required to place photos and videos in their story. While photos are not a problem, embedding iframe's into the page with the video code embedded saw the embedded code vanish when they saved their stories.

If the video was embedded for them by an editor the writers would still lose the iframe when they saved their stories.

By unblocking unfiltered_html our staff writers can embed the video content and lay up their post properly.

As for unfiltered_uploads, I belie that has been answered.

Hope this helps someone.

Improve this answer
0

unfiltered_html in network

These capabilities block the possibility for all users except super admins to insert JavaScript iframe code etc. in WordPress pages or posts and if one of them(admin, editor ECC) edits a page with an active iframe or JS it is removed.

To give administrators the possibility to add such codes, these abilities must be enabled and to do so you can use this plugin

https://wordpress.org/plugins/unfiltered-mu/

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.