Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Disable shortcode use in job submission #1146

Closed
annezazu opened this issue Aug 17, 2017 · 5 comments · Fixed by #2662
Closed

Disable shortcode use in job submission #1146

annezazu opened this issue Aug 17, 2017 · 5 comments · Fixed by #2662

Comments

@annezazu
Copy link

In 631072-zen, a person asked if there was a way to disable the ability for users on their site to submit shortcodes as part of the application process.

To replicate:

  1. Go to: https://demo.wpjobmanager.com/post-a-job/
  2. Fill the required fields
  3. Paste de following info in the “description” field: https://www.wpjobmanager.com [jobs]
  4. Publish the job offer
  5. Look at the result!

You’ll then see two things:

  1. Wordpress is generating an <iframe> displaying the targeted URL we entered in step 3.
  2. Wordpress is parsing the [jobs] shortcode and displays the generated content.

Example: https://demo.wpjobmanager.com/job/digitalznojko-2-test-shortcode-description/

Can we remove the ability for folks to submit shortcodes OR can we remove the ability for this shortcode to render when/if it is included?

@tripflex
Copy link
Collaborator

tripflex commented Sep 7, 2017

I agree, especially since all other fields specifically do NOT execute shortcodes, the only reason that shortcodes are being executed from the description field is because "technically" it's the post_content and that's due to this filter in default-filters.php:

add_filter( 'the_content', 'do_shortcode', 11 ); // AFTER wpautop()

One thing to mention too, since the demo is using the Jobify theme, which does have code in it to execute shortcode inside the job_description, even if we remove the filter added by core, Jobify will still execute shortcodes so would need to test using a standard theme

@tripflex
Copy link
Collaborator

tripflex commented Sep 7, 2017

I tried testing in 2015 theme by doing something like this in the wpjm_get_the_job_description:

remove_filter( 'the_content', 'do_shortcode', 11 );
$description = apply_filters( 'the_job_description', get_the_content( $post ) );
add_filter( 'the_content', 'do_shortcode', 11 );

Which while it does work, what ends up happening is the main theme content.php template ends up calling the_content again, and thus, executes the shortcode because it's still inside the entire template body ... ugh

SOOO ... with that said, I think the best way to approach this to work correctly with themes and such, would be to strip all shortcode tags when a listing is submitted initially (or edited) ... that way if an admin wants to add shortcodes in the admin area they will still work, but it would prevent frontend users from submitting and saving listings with shortcodes in description.

Thoughts?

@spencerfinnell
Copy link
Contributor

I would vote against stripping the content. We have a lot of people using shortcodes in the listing description area.

I personally would continue to allow them by default -- but if they had to be removed I would go with removing the filter before calling get_the_content() which would allow people to add it back via the_job_description() if needed.

@jom
Copy link
Member

jom commented Mar 27, 2018

@spencerfinnell Do you know which shortcodes folks are using in the job description?

I agree that if we don't process shortcodes (using remove_filter( 'the_content', 'do_shortcode', 11 );) it should be a filterable option (probably defaulted to false to keep current functionality).

@spencerfinnell
Copy link
Contributor

@jom Nothing really specific. Embedding 3rd party frames, sharing, etc. Mostly done by people submitting their own listings. But it's definitely a fairly common practice and we had lots of reports on one version where we disabled them ourselves.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment