9

The codex says you can't add javascript in the post content

https://codex.wordpress.org/Using_Javascript

But I can. I've turned off all plugins and changed to twentysixteen theme, but to no avail - I can still add javascript, via the post content, and have it run on the frontend. I don't want anyone to be able to add javascript through the post content (apart from oembed etc.) for security reasons.

Has anyone experienced this or have any ideas to help?

Thanks

3
  • I think that if you have the unfiltered_html capability then you can use JS. Test an editor and author level login to reassure yourself that non-admin users can't. Aug 4, 2016 at 18:57
  • Ahhh you're right thanks. Authors and contributors can't do it. Do you have any idea how to filter the script out for admins and editors? I don't know whether to add an edit to this question or ask a new one. Aug 4, 2016 at 19:17
  • I'll add an answer and include that. Bear with me - I'm doing this from my phone. Aug 4, 2016 at 19:18

1 Answer 1

10

If you have the unfiltered_html capability then you can use JS. Admins and editors have this capability by default.

Personally I use a plugin for fine control of my users' capabilities, but you can make this change easily in code:

  $role = get_role( 'administrator' );
  $role->remove_cap( 'unfiltered_html' );
  $role = get_role( 'editor' );
  $role->remove_cap( 'unfiltered_html' );

The capabilities are stored in the options db table, so technically you don't need to execute this repeatedly. Maybe make yourself a small plugin and put this on the activation hook.

Don't forget that admins could circumvent this by loading their own code and then directly editing the role options. I never let anyone have the admin role unless I'm happy for them to do anything.

2
  • Perfect man thank you :) Out of interest what plugin do you use for the fine control? Aug 4, 2016 at 19:50
  • No problem! Members by Justin Tadlock. It's in the plugin repository. Does the one job really well including creating custom roles and restricting content. Aug 4, 2016 at 19:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.