• I have run a WordPress MU site for the last 2 years. During that time I have begun using php widgets in my sidebars extensively throughout the site. With this last upgrade I have run into a snag that I think most people have encountered as well. As a Super Admin I can add php, css, and JS and edit widgets freely, anyone else without those permissions can not, however.

    I have a tight Multi User community and am not worries about someone hosing the site or leaving open a vulnerability due to these widgets. I do need to be able to offer administrators of each individual blog the ability to edit the text in some of these widget, but now when they try to save those edits it strips all of the code out and leaves only valid mark up.

    I have edited the kses.php file, I have added the unfiltered_mu plugin (something I had on the site before). I have tried multiple permission/roles plugins.

    I hacked the code a little to allow for quick embedding in posts but that didn’t affect the widgets. In what file do I look for this.

    I also think that this is something that wordpress should build into it’s UI. The ability to edit role level permissions and allow for unfiltered_text entry (not just HTML) seems like a good idea.

    [moderater note] We don’t do bumps here.

  • The topic ‘WordPress 3.0 Filtering and sanitizing Widget text’ is closed to new replies.