html text stripping when saving

Resolved atiqorakzai
(@atiqorakzai)

2 months, 3 weeks ago
Hi, I am using latest Version 1.5.1 and yootheme when I try to save this html
```
<div id="MyIframeContainer"> <iframe id="iframeApp" frameborder="1" class="iframe"> </iframe> </div>
```
and click on save changes, It saves this
```
<div id="MyIframeContainer"> <iframe> </iframe> </div>
```
It just started happening now and was working fine before.

Viewing 10 replies - 1 through 10 (of 10 total)

Plugin Author Aleksandar Urošević
(@urkekg)

2 months, 3 weeks ago

Hello @atiqorakzai,

Thank you for choosing Head & Footer Code for your project!

A new version 1.5.2 is released with allowed W3C standard HTML5 iframe attributes (includes id and class).

Please note, frameborder is deprecated in HTML5 and should not be used. Instead, control iframe borders with CSS — ref https://developer.mozilla.org/en-US/docs/Web/HTML/Reference/Elements/iframe#deprecated_attributes

Kind regards,
Aleksandar

Thread Starter atiqorakzai
(@atiqorakzai)

2 months, 3 weeks ago

Thanks for fixing this in next release but at the same time its extremely frustating that your plugin is stripping the id attribute which is extremely critical and broke our several websites. Please be careful about this in future. Also the style=”display:none” is still being stripped off.

Plugin Author Aleksandar Urošević
(@urkekg)

2 months, 3 weeks ago

Thanks for the feedback. I do my best to balance security vulnerabilities with various user requirements. Whenever a user reports an issue with specific attributes being stripped, I prioritize adding them to the allow list.

Could you let me know which HTML tags are having their style attributes stripped? If you have other examples, I’m more than happy to add support for those as well.

Thread Starter atiqorakzai
(@atiqorakzai)

2 months, 3 weeks ago

Its the <img> tag.

Plugin Author Aleksandar Urošević
(@urkekg)

2 months, 3 weeks ago

Can you please provide a bit more info about your website environment?

The style attribute for the IMG tag is not stripped out, please see video below

https://drive.google.com/file/d/1qBSQRHQSXJGuNFamdv1Vxg_tLEuwsLU6/view?usp=drive_link
Thread Starter atiqorakzai
(@atiqorakzai)

2 months, 3 weeks ago
```
<img src="https://test.com/v1/star.gif?pid=ngdfgfdgDSfdg455hlejJ45gi5&amp;src=mh&amp;evt=hi" style="display:none;" alt="" width="0" height="0">
```
When I try to save this, its stripping the style attribute.
Plugin Author Aleksandar Urošević
(@urkekg)

2 months, 3 weeks ago

Thank you for your patience.

I’m testing on WordPress 7.0-beta2, where the CSS property ‘display’ is in safecss_filter_attr filter and does not get stripped out. Previous WP versions (including 6.9.1) does not treat ‘display’ as safe, and strip it out.

Before I release WP backward compatibility, please let me know if you have noticed any other issues?

Thread Starter atiqorakzai
(@atiqorakzai)

2 months, 3 weeks ago

I have wordpress 6.9.1 version.

Plugin Author Aleksandar Urošević
(@urkekg)

2 months, 2 weeks ago

Please update to version 1.5.3

Thread Starter atiqorakzai
(@atiqorakzai)

2 months, 2 weeks ago

Thank you. It is working now.

Viewing 10 replies - 1 through 10 (of 10 total)

You must be logged in to reply to this topic.