• Resolved Klaasman

    (@reinaris)


    I’m running a WordPress multisite with 3 sites in the network.

    The admin (of all the sites, superadmin) can add an ‘onclick’ to an ahref in the visual editor like:
    <a href="#" onclick="testing()">test</a>
    It works fine.

    When I open the page (or try this) with an other user (also with administrator rights for 1 site, so not a superadmin) the visual editor strips the onclick.

    I think this has something to do with the multisite setup because only the superadmin can create the onclick’s. Maybe this is a bug? Or do I miss something?

Viewing 9 replies - 1 through 9 (of 9 total)
  • Moderator Ipstenu (Mika Epstein)

    (@ipstenu)

    🏳️‍🌈 Advisor and Activist

    This is MultiSite, but it’s not a bug. SuperAdmins have unlimited access to add whatever they want to the HTML of a site. Admins cannot. This is a security feature.

    Thread Starter Klaasman

    (@reinaris)

    Thanks for your repley, thats good to know.
    But is there a way to disable this?
    I like to create a user that has access to only 1 website but which has the capability to do whatever they want in the HTML (like adding the onclick’s to ahrefs).

    Moderator Ipstenu (Mika Epstein)

    (@ipstenu)

    🏳️‍🌈 Advisor and Activist

    Yes and no.

    Yes you can, but I really wouldn’t do it unless I trusted my admins with, oh, the life of my pets or my car. Depending on which is more important to you.

    Thread Starter Klaasman

    (@reinaris)

    Well the admin is a client so the only thing he could do is wreck his own website 🙂 And I trust them with all the HTML they like to put it there.

    Disabling this sounds better then installing some TinyMCE advanced plugin or anything like that.

    So you know how to disable this?

    Moderator Ipstenu (Mika Epstein)

    (@ipstenu)

    🏳️‍🌈 Advisor and Activist

    Well the admin is a client so the only thing he could do is wreck his own website 🙂 And I trust them with all the HTML they like to put it there.

    No no. The admin would be able to destroy all websites on your network.

    Actually, every single user on every single site on your network would be able to do that.

    Savvy? Hence my reluctance to suggest the unfiltered HTML plugin at all.

    Thread Starter Klaasman

    (@reinaris)

    mmm.. I like the way WordPress clean’s empty <p> tags and double breaks.. But in this case I need WordPress to stop stripping the onclick’s on ahref. What’s a good way to do this without turning the whole filter off? Suggestions?

    Moderator Ipstenu (Mika Epstein)

    (@ipstenu)

    🏳️‍🌈 Advisor and Activist

    Is the on-click needed for every a-href link or just some? Maybe a shortcode JUST for those links?

    Thread Starter Klaasman

    (@reinaris)

    It’s just for some links. Not all every a-href.

    Shorcode.. mm, so like: [a href=”” onclick=””]Link[/a]
    I never made a custom shortcode before, glad there is a good API. Thanks for your help!

    Thread Starter Klaasman

    (@reinaris)

    For anyone who likes to know, I wrote a shortcode for the A elements:

    // custom shortcode [a href="http://www.google.com" onclick="test()" rel="nofollow" title="Click here" name="link"]Click me[/a]
    function ahref_func($atts, $content=null) {
    
    	extract( shortcode_atts( array(
    		'href' => '',
    		'onclick' => '',
    		'rel' => '',
    		'title' => '',
    		'name' => ''
    	), $atts ));
    
    	//onclick
    	$onclick = "{$onclick}";
    	if($onclick){
    		$onclickcode = " onclick=\"".$onclick."\"";
    	}
    	//rel
    	$rel = "{$rel}";
    	if($rel){
    		$relcode = " rel=\"".$rel."\"";
    	}
    	//title
    	$title = "{$title}";
    	if($title){
    		$titlecode = " title=\"".$title."\"";
    	}
    	//name
    	$name = "{$name}";
    	if($name){
    		$namecode = " name=\"".$name."\"";
    	}
    	return "<a href=\"{$href}\"".$onclickcode.$relcode.$titlecode.$namecode.">" . $content . "</a>";
    }
    add_shortcode('a', 'ahref_func' );

    Best thing: main reason for creating this was for google _gaq.push onclick’s. But… their using brackets in their code (and WordPress doesnt like brackets in shortcodes), so I had to replace the brackets with { in the shortcode and replace them on output…

Viewing 9 replies - 1 through 9 (of 9 total)
  • The topic ‘2 administrator users -> visual editor strips 'onclick' for 1 of the users’ is closed to new replies.