Version 3.5.0.10 requires unfiltered_html capability

Hi @hvianna

We had to modify the access levels of Smart Slider 3 because of this problem:

• https://smartslider.helpscoutdocs.com/article/2034-vulnerability-warning-by-ithemes-security-possible-other-security-scanners

and that is why unfiltered_html capability became a requirement to be able to edit sliders:

• https://smartslider.helpscoutdocs.com/article/1983-how-to-give-access-to-smart-slider-for-non-admin-users#unfiltered_html

In your case the problem is that, you users don’t have access this unfiltered_html permission. If your website is on a WordPress multisite, then you should follow this documentation:

• https://smartslider.helpscoutdocs.com/article/1983-how-to-give-access-to-smart-slider-for-non-admin-users#multisite

and that will fix the problem.

@laszloszalvak Thank you for your prompt reply. I would like to ask you guys to please consider, in a future update, simply disabling the fields that allow Javascript and/or enforce data sanitization if the user doesn’t have the unfiltered_html capability. I bet 90%+ of the users don’t need to add JS to their sliders.

I appreciate if you can forward this request to the developers, or point me the appropriate channel where to submit it.

Thanks again!

Hi @hvianna

I am sorry, but the problem is not that simple, as it is not only about JavaScript but HTML and CSS as well.
As we mention in the documentations above, with Smart Slider 3 you can add all of these. If your users could use Smart Slider 3 even if they don’t have the unfiltered_html permission, then it would be basically the same as it was before the security fix we made.

If you don’t want to give user roles an “unfiltered_html” permission, that means you don’t want them to add HTML, CSS and JavaScript codes, and for this reason they shouldn’t be able to use Smart Slider 3 either.

Hello

I am facing the same problem.
I probably misunderstood something since, on this site of this multisite installation, Admin’s do have the “unfiltered_html” capability, and they cannot use Smart Slider.

Can you help me?

Thanks

Hi @silvere

Please check this documentation for details about the unfiltered_html capability error:
https://smartslider.helpscoutdocs.com/article/1983-how-to-give-access-to-smart-slider-for-non-admin-users#unfiltered_html

You could try craing the must-use plugin to assign the unfiltered_html capability:
https://smartslider.helpscoutdocs.com/article/1983-how-to-give-access-to-smart-slider-for-non-admin-users#multisite

Also, make sure you don’t have the define('DISALLOW_UNFILTERED_HTML', true); set in the wp-config.php file, because if you set everything else correctly, this will still prevent accessing the unfiltered_html capability.