Security Alert: 26 BuddyDev accounts compromized in brute force attack.

BuddyDev

Search

Using latest rich txt editor on either bio or multiline textarea doesnt work

  • Participant
    Level: Enlightened
    Posts: 47
    Alex on August 4, 2024 at 2:32 pm #52926

    Hello,
    I have the following problem. I want to add the current TinyMce 7 rich-text editor on either the multiline-Textarea field OR the biography field to let users write something about themselves.
    I dont want to use the old TinyMce version 4.
    If using the buddypress textarea field, I cannot load the TM 7 without disabling wp_editor() on class-bp-xprofile-field-type-textarea.php. And this can’t be done without touching this core file otherwise I would lose richtext functionality and all HTML content will be modified in edit-profile- and profile-page.
    If using the biography field, I can easily use my TM 7 editor cause no old TinyMce 4 is loaded but then having no richtext functionality, which means that again lists f.e. are modified to <br>s. See image.

    https://ibb.co/3Y9TLr7

    I am trying to solve these problems either with the bio or the multiline xfield now for days/weeks with no solution. Your code proposals on another post doesn’t work either. Switching off kses doesn’t solve the problem.
    Please help. I get crazy with this issues now.

  • Keymaster
    (BuddyDev Team)
    Posts: 24697
    Brajesh Singh on August 5, 2024 at 6:31 am #52932

    Hi Alex,
    Thank you for your question.

    As I have mentioned earlier, we are unable to assist you with using Tiny Mce 7. This is related to WordPress core. Unless the update is available in core, it is a lot of work to achieve a proper integration.

    Still, for the sake of discussion, I will try to explain your issues:-
    The problem you are facing has 3 dimensions.

    1. Interface where you want to use Tiny MCE 7
    2. saving to database(Kses are used here and unless you allow some tags explicitly via code, BuddyPress will filter out all of them).

    3. Display:- again kses are used to sanitize the output(and even esc_html after that).

    Your second issue is related to input/output sanitization.

    My suggestion is using Tiny MCE 4 which is included with WordPress. It is safe to use. The bug that you had reported in an earlier thread does not apply to it(since the content is sanitized server side too).

    Regards
    Brajesh

You must be logged in to reply to this topic.

This topic is: not resolved