HTML in Category Descriptions

[ericr1]

When I enter a category description, it is being rendered showing the html code. This is something new. Is there a fix for this?

Thanks,

Eric

[User]

@ericr1

Can you please provide a link, and more details of what the result looks like?

Regards!

 

[ericr1]

Yes thank you.

Take a look here. https://mindmuser.com/category/ideas/

I entered the description without any formatting, yet it shows in italics with codes inserted. I’ve recreated the section as a separate page as a workaround but I prefer to use categories.

Hope you can help.

Thanks,

Eric

[Weaver]

So, in my opinion, this is a WP problem. For some reason, WP is taking the Category description, and adding a <p> </p> to the vanilla string you put there.

Because any user who can edit Categories (I don’t know if a Contributor or Editor can do that), but that becomes a security hole as malicious code could be entered into the description. Technically, WP adding the <p>…</p> breaks their own security rules.

The italic is a theme style setting.

I will fix the theme, but I ‘m not sure how good of an idea it is. On one hand, the previous method allowed HTML in the description – so one could add tags like <strong> to style the description, but it also possible to add malicious code that way, too, unless WP is doing the sanitizing   of the description.

The theme is currently nearing a new releasable version, but it may be a week or so before that is ready.

[ericr1]

Ok thanks. WP has never allowed HTML in category descriptions.  Now, for some reason, the issue I’ve raised here has appeared and I have to now remove all category descriptions as they are useless.

Thanks again.

[Weaver]

It turns out, that in fact, WP does allow html in Category Descriptions! I added a <strong>part of description</strong> to a description, and it does in fact show up!

I never knew that. What WP does do with the description is automatically wrap what you wrote with <p>your description</p>.

My previous validation used esc_html which changes HTML to be visible instead of just shown. The new version will allow only legal HTML for posts.

I will also check for the author description which may have the same issue.

If you like, I can provide you with a Beta version of Weaver Xtreme 6.2.0.2 which will have some incomplete implementation of new features, but which seem to work just fine. I’m a few hours away from a “stable” version of that.

[ericr1]

Yes, allowing html in category descriptions is something new. For years I had to use a plugin for this. I don’t know which WP update added this function but I will need to reorganize my sites.

No need to send me a Beta version of the Weaver update. I’m happy to wait for the regular update.

Thanks so much for your quick responses and helpful information.

[jsternfe]

I came here to report the same problem.  I use HTML in my category descriptions and author bio (description), and just noticed that the category description is now showing the HTML code as plain text.  The author bio still seems to work though.

In order to get the HTML to work in the past, I had to use the following PHP code snippet:

// Allow html in author bio
remove_filter(‘pre_user_description’, ‘wp_filter_kses’);
add_filter(‘pre_user_description’, ‘wp_filter_post_kses’);

// Allow html in category and taxonomy descriptions
remove_filter(‘pre_term_description’, ‘wp_filter_kses’);
remove_filter(‘pre_link_description’, ‘wp_filter_kses’);
remove_filter(‘pre_link_notes’, ‘wp_filter_kses’);
remove_filter(‘term_description’, ‘wp_kses_data’);

Are you guys saying that HTML is now natively supported, and once the new version of the theme is installed, I will no longer need the PHP?

-Jon

 

[Weaver]

Embedded HTML  will be allowed when Weaver Xtreme 6.2.1 is released. I believe the descriptions for user bio, categories, and others now all allow any legal Post HTML. Weaver has been restricting it to no HTML, but will be updated.

Weaver 6.1 only recently added the escaping of embedded HTML in descriptions, which is not correct given that WP apparently now allows HTML.

I do know specifically that Author Descriptions do allow HTML because even Contributor members could add XSS scripts to their description, and Weaver was not filtering that. V 6.1 is filtering, but it is too zealous and 6.2 will allow post safe HTML. (Thus V5.0.7 has been tagged as unsafe because of the possibility that Contributors could add bad scripts.) That, by the way, is the first and only known such issue with Weaver Xtreme. (Since your post had some PHP, the deal is that Weaver now uses wp_kses_post() to filter descriptions instead of the much more strict esc_html().

I’m getting close with the final release, but will post a BETA version 6.2.0.90 within a few days that will include some new Plus 6.2 features.

One is total integration and self-hosting of both standard Weaver Xtreme and Plus Google Fonts.

The other is a very nice new Grid sub-menu for Primary and Secondary menus. That will work in the Beta versions, even without Plus (just temporarily for the beta release.)

EDIT: I don’t know if you still need the filters or not. I haven’t added them, and am getting HTML markup for various descriptions to display as expected  such as wrapping with <em> or <strong>.

[jsternfe]

Excellent, thank you very much Weaver!  I just recently installed OMFG, now I won’t need it either!

 

[Author]

Posts