0

I am attempting to publish HTML generated from an external party within Wordpress, but I am getting very inconsistent results with style attribute on all HTML elements, in that if I programmatically update the post the style attributes get removed, but if I publish the same HTML via the editor it remains untouched. Debugging so far it looks like the kses filter is what is performing the actual stripping

Original HTML:

<div class="container-fluid " style="background-image:url('https://localhost/app/uploads/2018/08/315.png');"></div>

When submitted programmatically it becomes:

<div class="container-fluid "></div>

The code that does the submitting (modified to be clearer example)

$body = <<<EOT
<div class="container-fluid " style="background-image:url('https://localhost/app/uploads/2018/08/315.png');"></div>
EOT;

$new_post = [
    'ID'                => 70,
    'post_title'        => 'Example',
    'post_content'      => $body,
    'post_type'         => 'post',
    'post_status'       => 'draft'
];
$success = wp_update_post($new_post, true);

The goal is to avoid the stripping in a normal environment

Envionment:

  • Wordpress 4.9.6
  • No additional plugins outside of the one this code resides in
  • Default theme
Improve this question

1 Answer 1

Reset to default
2

This is because what you're trying to do trips a security feature, post content is passed through wp_kses_post to strip out dangerous tags

Administrators however, have the unfiltered_html capability, which allows them to put arbitrary dangerous HTML in content and titles. This is why you're able to insert the tags via the editor.

This still doesn't address the root problem though, that you're including style tags in post content, which is bad practice, and can cause other issues.

Instead, use shortcodes to embed arbitrary HTML in content, e.g. implement a fluid container shortcode:

[fluidcontainer background="url"][/fluidcontainer]

Or use a CSS HTML solution that does not require a style tag

As an aside, there is an extremely dangerous solution, that some might suggest, which would be to strip out the security feature. This would be extremely dangerous, and open you up to a large array of attacks. As I have already demonstrated, it is unnecessary. Be very wary of anybody who might suggest it. To do so would be reckless and irresponsible, and on some levels unethical. It could also be used as grounds of technical negligence during compliance, audits, or investigations of data breaches

Improve this answer
6
  • Obviously disabling the entire feature for kses would be very bad, looking at the kses code it allows to some degree additional tags being allowed and has some specific style rules, so is there a secure way for kses to allow addition of a few extra css attributes? Replacing the HTML with shortcodes might not be a realistic possibility (except for the outcome of something that would end up being just as insecure)
    – Mattisdada
    Commented Aug 27, 2018 at 3:51
  • Other WP sites manage just fine without inline style attributes or shortcodes. It would even be more efficient to bundle all your CSS into a style tag then create a post meta value for it, rather than making the browser apply styles on the fly as it's reading the DOM. The current inline style attribute method is the most inefficient on multiple fronts, be it WP, PHP, CSS, or frontend performance in general.
    – Tom J Nowell ♦
    Commented Aug 27, 2018 at 22:21
  • Additionally, Gutenberg blocks manage to implement what you're doing without using inline styles in the post content, perhaps you should be using cover image blocks and other kinds of blocks instead? Also note that rewriting the URLs for CDN plugins etc is not possible the way you've done it. If you can't make the external app generate shortcodes, then transform the html into shortcodes in PHP before passing it to wp_update_post
    – Tom J Nowell ♦
    Commented Aug 27, 2018 at 22:22
  • The example is a snapshot of the resulting HTML for the sake of the example, it works fine with CDNs as WP generates the URL from the attachment. I might try the idea of converting the inline styles into a style tag, I do have a conceptual version of a shortcode that I'm experimenting with as well. But the application that the data is being pulled from allows styling individual elements and that's a feature that needs to be kept (and the styling can be arbitrary). But I don't want to reduce security
    – Mattisdada
    Commented Aug 27, 2018 at 23:57
  • Wait so the 3rd party application is also WordPress? You can just add IDs and classes to the tags in place of the style attributes and reference them in a style tag
    – Tom J Nowell ♦
    Commented Aug 28, 2018 at 0:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.