I can't write Javascript code in region links

  • Resolved ss5nembokid

    (@ss5nembokid)


    11 years, 3 months ago

    Hi, (I write in English even I’m italian, so everybody can understand)
    I’m trying your plugin and I needed to do Javascript code when you click on a region.
    So if I write “javascript:alert(‘test’);” and I save changes, I can’t read again the code… so give a look to the plugin code and I changed a row in “rvm_regions.php”:

    //$output .= '<td><p><input ' . RVM_REGION_LINK_CLASS . ' type="text" name="' . $region[ 1 ]  . '[]" value="' . esc_url_raw( $regionsparams_array[ 'field_region_link' ] ) . '" ></p></td>' ;
	$output .= '<td>'.$regionsparams_array[ 'field_region_link' ].'<p><input ' . RVM_REGION_LINK_CLASS . ' type="text" name="' . $region[ 1 ]  . '[]" value="' . stripslashes($regionsparams_array[ 'field_region_link' ]) . '" ></p></td>' ;

    Now, after I save my links, I see them again… http://www.google.com or javascript:alert(‘test’); are both correct now…

    I don’t know if this is the best way… but it actually works on my test… anyway, maybe you can add some functions to your plugin, so people can write a normal website URL or javascript code… maybe in href and onClick too…

    Hope this can help everybody…

    https://ww.wp.xz.cn/plugins/responsive-vector-maps/

Viewing 1 replies (of 1 total)
  • Plugin Author Enrico Urbinati

    (@enrico-urbinati)

    11 years, 3 months ago

    Hi SS5NemboKid,

    thanks for sharing this !

    I disallowed javascript on links on purpose, to evoid any kind of XSS ( Cross Site Scripting ) and make the plugin as safer as possible ( instead of esc_url_raw it should be used esc_url – it will updated in next release ).

    What I could do is creating an extra option in settings asking people if they want to allow javascript in their url: I think this is the better way to do it 🙂

    have a nice day and thanks again for your feedback

Viewing 1 replies (of 1 total)

The topic ‘I can't write Javascript code in region links’ is closed to new replies.