Latest version 6.5.2

Resolved dfuytn
(@dfuytn)

2 months, 3 weeks ago

With the latest version, 6.5.2, that was supposed to “Fix: Sanitize custom field value before being inserted into post.” but it broke my custom field shortcode. The shortcode gets a Text Area custom field from ACF. The Text Area has HTML in it that display a video. It has been working perfectly for several years but after the 6.5.2 update, the shortcode only shows a blank section on the website. The pages are behind a paywall so let me know if you need temp access.

Viewing 15 replies - 1 through 15 (of 15 total)

Thread Starter dfuytn
(@dfuytn)

2 months, 3 weeks ago

I’ve restored version 6.5.0 and things are back working again. So something is not working in 6.5.2.

Plugin Author vaakash
(@vaakash)

2 months, 3 weeks ago

Hi @dfuytn,

Yes you are right and that is expected in the latest version. I have added certain security checks to strip off malicious scripts. Do you insert JS as custom field value? I’ll revisit and see how this can be handled for these usecases.

Thanks,

Aakash
Thread Starter dfuytn
(@dfuytn)

2 months, 3 weeks ago
No. Just an iframe in a div.

Here’s what it looks like.
```
<div style="position: relative; padding-top: 56.25%;"><iframe src="https://link-to-the-video?autoplay=false" loading="lazy" style="border: none; position: absolute; top: 0; height: 100%; width: 100%;" allow="accelerometer; gyroscope; autoplay; encrypted-media; picture-in-picture;" allowfullscreen="true"></iframe></div>
```
Plugin Author vaakash
(@vaakash)

2 months, 3 weeks ago

Got it. Let me see if I can allow basic HTML. Please expect a fix by next weekend.

Thread Starter dfuytn
(@dfuytn)

2 months, 1 week ago

Any progress?

Plugin Author vaakash
(@vaakash)

2 months, 1 week ago

Hi @dfuytn,

I understand you concern. The fix is quite complex 😅. I’m looking at the best way to handle this. Please expect a fix by this Saturday or Sunday.

Thread Starter dfuytn
(@dfuytn)

2 months, 1 week ago

Us non-developers think you should be able to fix it easily and fast.

Plugin Author vaakash
(@vaakash)

2 months, 1 week ago

Hi @dfuytn,

Can you please send me a DM on my contact form below? There are no other requests for the same fix. While I work on this I can arrange a temp workaround for you to proceed. Please send me a ping and I’ll get back to you.

https://www.aakashweb.com/contact/

Thanks,

Aakash

Martyn Chamberlin
(@martyn-chamberlin)

2 months ago

Hello,

We similarly got a break with this 6.5.2 release. We have <input /> in a shortcode, and we use this plugin to summon those contents in a Page, and this update is stripping the input from the output. Would love to be able to get this fixed. For now we’re just having to roll back to a previous version of the plugin. Thanks!

Martyn Chamberlin
(@martyn-chamberlin)

2 months ago

the fix is quite complex

Might it be possible to add a setting to the plugin called something like Sanitize custom field value before being inserted into post, and have it default to true, and then we could just disable that setting if we need the original functionality?

Thread Starter dfuytn
(@dfuytn)

3 weeks, 5 days ago

Any progress on a fix?

Plugin Author vaakash
(@vaakash)

3 weeks, 5 days ago

Hi @dfuytn,

My apologies for the delay. I’m considering @martyn-chamberlin option to add a setting to disable this check. Please give me 1 week time. I will release a new version with this option on or before 9th May. Hope you understand.

Thanks,

Aakash

Plugin Author vaakash
(@vaakash)

2 weeks, 3 days ago

Hi @dfuytn, @martyn-chamberlin,

I have added an option in v6.5.3 under Shortcoder –> Settings to disable sanitization as required. Can you please upgrade to this version and enable this option?

Thanks,

Aakash

Thread Starter dfuytn
(@dfuytn)

2 weeks, 3 days ago

Works for me with Sanitation>Off

Plugin Author vaakash
(@vaakash)

2 weeks ago

Hi @dfuytn,

Thanks for confirming! Marking this as resolved.

Thanks,

Aakash

Viewing 15 replies - 1 through 15 (of 15 total)

You must be logged in to reply to this topic.