Security Alert: 26 BuddyDev accounts compromized in brute force attack.

BuddyDev

Search

Gallery Details Page Description Field Doesn't Save Shortcodes

  • Participant
    Level: Initiated
    Posts: 15
    Horton on April 11, 2016 at 6:09 pm #3460

    Hi there-

    I have noticed that when in a Group or User Gallery > Edit Details Screen where you can Upload or Change a Gallery Cover, the Description field does not save WordPress shortcodes entered. I am needing to use a shortcode from a membership plugin to show only part of the description to members. When I save the description field including that shortcode or any other type WordPress shortcode in the description field, the shortcode is removed and the only thing that remains is what was entered within the brackets.

    Example from WP Codex:
    [caption id="attachment_6" align="alignright" width="300"]Kanagawa The Great Wave[/caption]

    On save, the description field shows:
    Kanagawa The Great Wave

    Thanks

  • Participant
    Level: Initiated
    Posts: 15
    Horton on April 11, 2016 at 6:15 pm #3461

    Sorry, I didn’t mean for the images to get inserted here in my example.. and it’s not letting me edit my post right now to remove them.

    The example I used is from this page:
    http://codex.wordpress.org/Caption_Shortcode

    When we save the Description field, the only thing that appears in the description field is the text in between open and closing shortcode brackets. The shortcode itself doesn’t save – it removes the [shortcode info within open and close brackets] and only leaves what is in between the open and closing brackets and so can not do what any given shortcode should.

    PLAIN TEXT EXAMPLE:

    [shortcode info here] here is text inside a shortcode [/shortcode info here]

    becomes

    here is text inside a shortcode

    Thanks!

  • Keymaster
    (BuddyDev Team)
    Posts: 24706
    Brajesh Singh on April 12, 2016 at 2:57 am #3477

    Hi Horton,
    Thank you for posting. It seems on of the things that we are escaping is causing it. We will look into details and will get back to you in next couple of hours.

    Thank you
    Brajesh

  • Participant
    Level: Initiated
    Posts: 15
    Horton on April 12, 2016 at 1:45 pm #3483

    Thanks for looking into it!

  • Keymaster
    (BuddyDev Team)
    Posts: 24706
    Brajesh Singh on April 13, 2016 at 5:25 pm #3489

    Hi Horton,
    I looked into it. The shortcode is saving to the database. The problem is with the output.
    There are two issues here.

    1. In the Edit textarea, shortcodes are getting escaped by a call to esc_textarea( It is not the shortcode but the generated value by the shotcode).

    To change this behavior, we will need to modify the way mpp_get_gallery works and will need to allow it fetching data without calling filters on the_content. Please give me a day and I will update the plugin.

    Thank you
    Brajesh

  • Participant
    Level: Initiated
    Posts: 15
    Horton on April 13, 2016 at 5:39 pm #3491

    Great, appreciate it!

  • Participant
    Level: Initiated
    Posts: 15
    Horton on April 18, 2016 at 7:52 pm #3578

    Hi there, just touching base. Any luck? I know it doesn’t work like a normal text area because after folks save descriptions the field shows <p> and such so I know it may take a bit to get working. Appreciate you looking into it.

    Thanks!

  • Keymaster
    (BuddyDev Team)
    Posts: 24706
    Brajesh Singh on April 18, 2016 at 10:57 pm #3593

    Hi,
    I am sorry, I could not work on it. Please allow me to work on it tomorrow(it’s already 4:25AM here).

    It needs a few major changes. We escaped the data that’s why we are loosing the shortcode in the content(in display). I will have to look at other way to make sure the data is escaped(for security reasons to avoid any XSS attack) but the shortcodes are not lost.

    Thank you
    Brajesh

  • Keymaster
    (BuddyDev Team)
    Posts: 24706
    Brajesh Singh on April 19, 2016 at 11:04 pm #3643

    Hi,
    Just wanted to give you an update. I have been working on it and I am facing a few issues specially related to the use of shortcode. As soon as the theme compat templates are used, our shortcode goes empty. I am looking further and will update you again.

  • Keymaster
    (BuddyDev Team)
    Posts: 24706
    Brajesh Singh on April 20, 2016 at 12:50 pm #3651

    Hi Horton,
    Just wanted to give you another update.

    1.The bug seems to be with BuddyPress. Have been trying to debug it and it seems it lies with the way BuddyPress provides theme compatibility. Try posting the shortcode to activity and see if it works or not?

    2. I am trying to find a reason for this and will update again and open a ticket on BuddyPress track. If you want me to allow html content in the description, please do let me know, I can easily allow that. It is controlled by MediaPress.

    Thank you
    Brajesh

You must be logged in to reply to this topic.

This topic is: not resolved