- This topic has 5 replies, 3 voices, and was last updated 2 years, 8 months ago by
.
-
Posts
-
Hello, I have two sites using the page-head-code area to contain links to .js files or that actually contain JavaScript. These were all working fine until the most recent update. Now code in that field is not displaying/working in the pages. I look at the source code of the site and it’s just not there. I’ve checked to make sure that my Xtreme Plus plugin has an active license. It does.
WP 6.4.2
Weaver Xtreme (weaver-xtreme) – Version 6.4 – using a child theme
Weaver Xtreme Theme Support (weaverx-theme-support) – Version 6.4Can you help?
I believe a security risk was found recently with a custom field and it had to be removed. That was the reason for the recent update.
Not sure if that is the one, @weaver will have to confirm.
Did you need the content to only be in a specific page, or could it go in the global head section located in the advanced Options > Head section
Sorry, but that particular feature is not longer supported due to a security issue discovered by WordFence. They coordinate with WP.org, and give themes a very short window to fix such security issues before essentially banning the theme.
There is no work around I can find other than dropping the support, and the issue had additional problems beyond security. The heart of the problem is that WordPress does not support controlling custom fields by user role. It does turn out that custom fields can be the source of many WP security issues.
It would be possible to add the js code to every page using the global settings.
Wouldn’t it be possible to use JS to make the code place in the global head section page specific?
I was able to find a work around by using a plugin. However, there were other alternatives. You can see them all on this page. However, I don’t see that there’s a way to limit the use of this plugin by role. Hopefully I won’t make all the changes in two sites only to have to find another solution.
- You must be logged in to reply to this topic.