5.9.5 breaks HTML in captions

  • Resolved Alexander S. Kunz

    (@antermoia)


    3 weeks, 4 days ago

    Hello Arno,

    I have HTML links in my captions that go to the attachment page, or link to my photo archive (they are created with a plugin called “Gallery Image Captions” and some code snippets).

    It appears that version 5.9.5 breaks links in the lightbox — they only appear as static text.

    Can this be fixed?

    Thank you,
    Alex.

    The page I need help with: [log in to see the link]

Viewing 3 replies - 1 through 3 (of 3 total)
  • Plugin Author Arno Welzel

    (@awelzel)

    3 weeks, 4 days ago

    Up to version 5.8.7 there is a vulnerability which allowed users to inject malicious JavaScript code into image captions which would get executed as soon as the lightbox is opened. To fix this, version 5.9.0 introduced whitelisting for HTML tags in the caption – so only specific HTML tags are allowed and only in a specific way and not with any kind of attribute.

    I will extend the whitelisting, so the following tags are also allowed in captions, which you use on your site:

    <a href="...">

    <a href="..." target="...">

    <a href="..." style="...">

    <a href="..." target="..." style="...">

    Plugin Author Arno Welzel

    (@awelzel)

    3 weeks, 4 days ago

    Version 5.9.6 should fix your problem.

    Thread Starter Alexander S. Kunz

    (@antermoia)

    3 weeks, 4 days ago

    Hi Arno,

    Wow, lightning-fast response and update!

    Thank you so much for keeping the plugin secure and also making it possible to keep this functionality.

    Alex.

Viewing 3 replies - 1 through 3 (of 3 total)

You must be logged in to reply to this topic.