The MU forums have moved to WordPress.org

CSS Support in WordPress MU 1.5 (11 posts)

  1. donncha
    Key Master
    Posted 16 years ago #

    In http://trac.mu.wordpress.org/changeset/1235 I checked in changes to kses to allow the style attribute to be used in html tags.

    The style attribute value is filtered using a perhaps overly generous list of styles which in turn can be filtered using the 'safe_style_css' WP filter.

    I would really appreciate some feedback on this change, especially from a security perspective. The function safe_css_filter() does all the hard work, so please take it apart :)

  2. amanzi
    Member
    Posted 16 years ago #

    In my opinion, this change is unnecessary and should be left to the WPMU owners to implement through a plugin (like the one I created to allow video embedding.)

    But I don't see any obvious security issues here unless someone can do something funky using the float, height and width attributes to make an element appear like something it's not supposed to be. Perhaps you could leave out anything to do with positioning?

  3. donncha
    Key Master
    Posted 16 years ago #

    The new uploader uses styles for many things and unfortunately the old behaviour of MU would really screw that up.

    I will chop that list way down though, and you're right. The site owner can use a plugin to add new styles via the filter I added.

    See this bug report for more: http://trac.mu.wordpress.org/ticket/581

  4. andrea_r
    Moderator
    Posted 16 years ago #

    I would think the float would be one of the few things left, as many users might make use of it for image positioning.
    Just sticking in two canadian cents, whatever they're worth these days. :D

  5. cafespain
    Member
    Posted 16 years ago #

    It's looking good, but I agree for the default to be only the styles that the editor uses and leave it up to plugin developers or site owners to add any extra styles that their plugins/users would require.

    My plugin adds a lot more than is really necessary, and I'll probably remove a lot of the un-needed stuff as my users generally only want to "float" things left or right,size images or make the text a different colour. All of which should be safe enough to let out in the wild.

    Allowing absolute positioning of elements and changing the z-index are probably not recommended though.

    Rgds
    Barry

  6. moorezilla
    Member
    Posted 16 years ago #

    Canadian cents are worth more than ever these days... at least against the U.S. dollar! Guess it could be a travel year for Andrea!

  7. andrea_r
    Moderator
    Posted 16 years ago #

    Hey, I can *see* Maine from where I am. :D

  8. dbcohen
    Member
    Posted 16 years ago #

    Can someone clarify this - we no longer will be able to manipulate the list of allowed tags, just the style tag? Having a hard time understanding the code changes.

    If we can't manipulate all the tags allowed I have to agree with Amanzi.

  9. donncha
    Key Master
    Posted 16 years ago #

    dbcohen - you can manipulate the style attributes using a filter, as well as changing any of the allowed tags using another filter.

  10. dbcohen
    Member
    Posted 16 years ago #

    so edit_allowedtags and edit_allowedposttags are out, what is in their place?

  11. cafespain
    Member
    Posted 16 years ago #

    dbcohen: edit_allowedtags and edit_allowedposttags are still there and are used to filter the allowed tags and their attributes.
    This functionality is in addition, so you can also filter the allowed styles for tags.

About this Topic

  • Started 16 years ago by donncha
  • Latest reply from cafespain