• Hi,

    I have a client that wants to have some of their widget titles be links. Following the directions on this article, I made the following changes:

    In the functions.php file of my theme, I added the following:

    if (include('custom_widgets.php')){
         add_action("widgets_init", "load_custom_widgets");
    }
    function load_custom_widgets() {
        unregister_widget("WP_Widget_Text");
        register_widget("WP_Widget_Text_Custom");
    }

    I created the custom_widgets.php file, and made some changes.

    In the function update() in the WP_Widget_Text class I changed:

    $instance['title'] = strip_tags($new_instance['title']);
    		if ( current_user_can('unfiltered_html') )
    			$instance['text'] =  $new_instance['text'];
    		else
    			$instance['text'] = stripslashes( wp_filter_post_kses( addslashes( $new_instance['text'] ) ) );

    to

    if ( current_user_can('unfiltered_html') )
    		{
    			$instance['text'] =  $new_instance['text'];
    			$instance['title'] = html_entity_decode($new_instance['title']);
    		}
    		else
    		{
    			$instance['title'] = strip_tags($new_instance['title']);
    			$instance['text'] = stripslashes( wp_filter_post_kses( addslashes( $new_instance['text'] ) ) ); // wp_filter_post_kses() expects slashed
    		}

    I also removed the strip_tags call in the form() function just below.

    The sidebar is now outputting raw html, i.e. the code itself rather rendering as a link. How do I get around this? Suggestion of using html_entitiy_decode() in the comments didn’t work, although i may be applying it incorrectly.

    Thanks.

Viewing 3 replies - 1 through 3 (of 3 total)
  • No! Never, ever, edit WordPress core scripts. And do not encourage others to do so. Editing core scripts can bring down your entire site and/or open security holes for hackers to use.

    Thread Starter andrew.bartel

    (@andrewbartel)

    I’m not editing a core file. You’ll notice I created my own file. A client requested a feature that does not exist in a plugin that I could find and the WordPress team seems to have no interest in adding, for whatever reason. I’m not opening it up to hackers, you’ll notice I put it in the same security logic statement stock WordPress uses to disallow malicious code from the body of the widget.

    A simple google search reveals tons of topics on this site for the very same feature. You all allow it in the textarea but not the title, why?

    You have to change the widget function in custom_widgets.php also.

    Before:
    echo $before_title . $title . $after_title;

    After:
    echo $before_title . html_entity_decode($title) . $after_title;

    Cheers

Viewing 3 replies - 1 through 3 (of 3 total)
  • The topic ‘Allowing HTML in Widget Titles’ is closed to new replies.