Automattic / Automattic/o2

WP MU - P2-breathe with o2 - comment image drag and dropp by non super-admin users not showing

Open
#54 1 comment 0 reactions 0 assignees View on GitHub
Dominant language
JavaScript
Stars
338
Forks
56
Avg merge
24m
Merged PRs (30d)
16

Description

WPMU @ WordPress 4.5.3
P2-breathe P2Version: 1.0-wpcom
o2 v0.2

Due to a different policy on html filtering in posts, in Wordpress Multisite only a super-admin can freely drag and drop images in both posts and comments. In a regular WP instalation this is not an issue, as the rules for the `wp_includes/kses.php` to kick in are less strict.

As a solution, for the WP MU installations some default workaround using similar hooks to remove the `kses_remove_filters();` for some user roles where it's considered safe enough (as e.g. in [Unfiltered MU](https://wordpress.org/plugins/unfiltered-mu/) plugin) should get infolved.

Additional notes:
- the dragged and dropped pictures upload into media library correctly, only the html gets wiped out after hitting "Post/Reply" button

Contributor guide

No contributing guide indexed for this repository

Research direction

Reproduce the comment image drag-and-drop flow for a non-super-admin in WordPress Multisite and inspect the filtering path in wp_includes/kses.php. Read the kses_remove_filters() hooks and compare the role handling described by the Unfiltered MU plugin. Done means safely preserving the uploaded image HTML for permitted roles without weakening filtering for other users.

Written by the indexing model from the issue text.

Assessment

Tech stack
php, wordpress
Domain
backend, content, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.