9

The codex says you can't add javascript in the post content

https://codex.wordpress.org/Using_Javascript

But I can. I've turned off all plugins and changed to twentysixteen theme, but to no avail - I can still add javascript, via the post content, and have it run on the frontend. I don't want anyone to be able to add javascript through the post content (apart from oembed etc.) for security reasons.

Has anyone experienced this or have any ideas to help?

Thanks

Improve this question
3
  • I think that if you have the unfiltered_html capability then you can use JS. Test an editor and author level login to reassure yourself that non-admin users can't. – Andy Macaulay-Brook Aug 4 '16 at 18:57
  • Ahhh you're right thanks. Authors and contributors can't do it. Do you have any idea how to filter the script out for admins and editors? I don't know whether to add an edit to this question or ask a new one. – arthurrandom Aug 4 '16 at 19:17
  • I'll add an answer and include that. Bear with me - I'm doing this from my phone. – Andy Macaulay-Brook Aug 4 '16 at 19:18
10

If you have the unfiltered_html capability then you can use JS. Admins and editors have this capability by default.

Personally I use a plugin for fine control of my users' capabilities, but you can make this change easily in code:

  $role = get_role( 'administrator' );
  $role->remove_cap( 'unfiltered_html' );
  $role = get_role( 'editor' );
  $role->remove_cap( 'unfiltered_html' );

The capabilities are stored in the options db table, so technically you don't need to execute this repeatedly. Maybe make yourself a small plugin and put this on the activation hook.

Don't forget that admins could circumvent this by loading their own code and then directly editing the role options. I never let anyone have the admin role unless I'm happy for them to do anything.

Improve this answer
2
  • Perfect man thank you :) Out of interest what plugin do you use for the fine control? – arthurrandom Aug 4 '16 at 19:50
  • No problem! Members by Justin Tadlock. It's in the plugin repository. Does the one job really well including creating custom roles and restricting content. – Andy Macaulay-Brook Aug 4 '16 at 19:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.