WordPress Stripping out JavaScript

  • Hello, I am trying to set up a website where members can create their own posts and stream files from platforms like Google Photos

    Below is the code that can do this 

    <script src="https://cdn.jsdelivr.net/npm/publicalbum@latest/embed-ui.min.js" async></script>
<div class="pa-gallery-player-widget" style="width:100%; height:480px; display:none;"
  data-link="https://photos.app.goo.gl/p3rstofaE6N1xDBg8"
  data-title="Perth 2017"
  data-description="19 new items added to shared album">
  <object data="https://lh3.googleusercontent.com/sgOBfIJI6hJv0h_tgcrODQjJt6mG_SBiIaggai3aJQsMmjymQIErZKp3iPHsGTeqPDTfEoKTxbqpa8NXwvCV8Ci7YrbWT3sh-9qoiiY8FJdy3HN9FoOHFMElnUEobiZTeQ_EZWtO5tw=w1920-h1080"></object>
  <object data="https://lh3.googleusercontent.com/xh4TR7fxpO47zlc65WF_Rxi9AAkSlt-BowQciKbzjfyx1DOhyn5cWNwYUEoJGN4MGq7aPTJzYtGuJnfWKSKVW6vahCW-3BkmnVOiotQBgo9kh7cGHAIynqXV2DKao8BcTPSe04yL_Oc=w1920-h1080"></object>
  <object data="https://lh3.googleusercontent.com/HDs-v5aFiZtyn-Ig5wviSsjz6mqPJCimREPCkZwwGco4LD_-Ld9uxOc7VnFg6BQysvwF3B-jYBhBbNQiKw8TtmtgpzffUZwwfA4FCoWyNINc-FcJB3vpmmUhdJTBwJ-hhRQqWKf1Wjs=w1920-h1080"></object>
  <object data="https://lh3.googleusercontent.com/xDwaJeoRII5xGs9F3u_JuzSmF5_3R-1p8mgskg3pouGssQe0EUP0sqv3g5ynBX3SVVRO5VzJOW93HZN1H7fpOzR0GXf09WHQsJpCYXABkvwPraYgGUKH86-puEKO5C12GAOOHokXjWw=w1920-h1080"></object>
  <object data="https://lh3.googleusercontent.com/YjfjZscAiaUwxh37xYZEnsE3djdTOarV3WVK8YmJHGZol9EkjJA4GLO6920iZGRFYI68XBu0-eXWdc_YlgZ5grYjVh6qO1rBrFzx_5z-_0v_8T-jqmObVKPA1EYx43JSoUMSNnkSueU=w1920-h1080"></object>
  <object data="https://lh3.googleusercontent.com/WiccQsAFZf_W-65SNy4NDJsbgg8cwxenMsc_J_k5wMGNrETA1MiCXxIZplbH0zqe6xt4P_goJjgJK9rNOS9H82oTPSGTG0GD3LfErrcEdlUKVKCXkBn_kLfL83liYAsS7IiL6ss202Y=w1920-h1080"></object>
  <object data="https://lh3.googleusercontent.com/23_Z1QafZbqiS_MQFCDcNx-neybPUOFxbsxU84UfaCnM_HNzILTzj38nLbwh4DwF-umDdvObhkqkEeSW-ggcBIT-Rvab-oVkCG3Gd9IegEwIw7mTWdslz7UNsEJVfysb_4oA1-6Vsj0=w1920-h1080"></object>
  <object data="https://lh3.googleusercontent.com/BvkLYoV2TRTMa87__6N9cA4g3uBfcAMcdSY9rdcozxZr18vH2FHHtC0Ws5q8lneiNOVX2VZjmC8pqWCDHeRZFh2aKzwRhQ0Awn0HAfnWUn7OnXirB-zUqbuKUP8Nym1ZvFDu0DuH3ps=w1920-h1080"></object>
  <object data="https://lh3.googleusercontent.com/rVb0atmiuWt9KvzuBJTLxQ_ZcBPwUp1HRB8Vl9XbH-C0NKDb4KBkdIohouXd1YoCsELgbMZUMNrXUrAHEPLl1nLlNRlVGWVsfWgVz6AYeeK6Lj-vU5MHNBENPdefN-RI07fdFV663ao=w1920-h1080"></object>
  <object data="https://lh3.googleusercontent.com/LMzRPxMu3DCmz8eRYuHhY5hR6RGFzf1_U0G0feQn17MYxyk50WEOmTdf4gnTtj9X11EuQkKdVSL8XGVR12xqYC9XeRCnnPOCABH9r1YyZPg9SdsI_LmppuNZF6IpClVoLEg3fbc-DnU=w1920-h1080"></object>
  <object data="https://lh3.googleusercontent.com/nbStHLpbcv04CWowhE6KvdgllJwtoWJq2guOb6giTS9ejv2Fgn-XrYILVSyWjv6nWJgKxVHqaBKsasUcHS6n-r3WeGzHIsc-sAR7J2Q3Uu3V1ckjO7SZrZXpp0Xoz1H4lWZHTLax8ck=w1920-h1080"></object>
  <object data="https://lh3.googleusercontent.com/4uH2w3ezmgU_t00_NgbVM9ZAaAWMIFAHAO1caQCLui8xC0-VMLrRqMLI3gUxe-DAKG95cpHYSABPME7F4cThsFMD4BsA5YtNIg5Podc3cvNHZBlIk265V4p9bzp5a69u_XBBN5EQ1G4=w1920-h1080"></object>
  <object data="https://lh3.googleusercontent.com/od9KNKUMEOjtt3Tizw8OQygp4WFB3xxHRecCvsKT6Vw1kHrYSk8WaANKaLXK7pSXSRoMPOu8w0ztL-s30ScxVw1tDlY8ldHCLpI-L3TfPSEms9oXq_M1OveQkSjOg9JeiEPzZkrb53I=w1920-h1080"></object>
  <object data="https://lh3.googleusercontent.com/EC5QJBG-WRO0PMWo4yrK32oAvmY1f6eCOZy73K5crsVhrC9oX0j1vKZC4dc0WDVzuUyrQl8yu7cPcfwN-mbVmD2M2arNuVXlRcg5JoH4Qz7aANMGnNhsmkIhq47gAjI8YUti3pSss7o=w1920-h1080"></object>
  <object data="https://lh3.googleusercontent.com/mZq3odqlQt3ew2IX8Cw6T7072CBSW5VTc2Pg5x04_HPKaSssb7CI5iPiTjCMcimezmas3vAer8ctOK6jOl89L15-3XVO5jQQrzsQOTI1_U1CNkyx9OD65_cpdQ6ZybDuVz79Xd0lq7g=w1920-h1080"></object>
  <object data="https://lh3.googleusercontent.com/KJ49bW8c1ClaB_Z6DRSOSXbnhCau80ZhWZtfFj6CReLgEowAV5F8XVx0BTd-2Kj6JQBc3Rx2-0_52v7PrQI_m3VoT-_Y1erokKDBwh5-f3xWWzltCfoQNDxboR1Bl4d-7A2qkG7fv3c=w1920-h1080"></object>
  <object data="https://lh3.googleusercontent.com/FTaP-jp5gJQko7oAhNVDoeEv0olE8P1rEyIsbsqXnzUO0Kc_P05wzjCmelO6NNOTP0Lnia4972gv3mvJ9mouhjZwoRuEi_yXCfm1wTXFAapvEPcfFA0vif0GR8Chx-iDUO5b0o7e43o=w1920-h1080"></object>
  <object data="https://lh3.googleusercontent.com/JZ6DtrTPXfpwbaqtIdd7J86UcjVQgA1eWTaConqK8bs1TW3RR3mWWJQiwwQBexB6NdrfhTkWIYhPt-dmYvRPnwh7ChWG5jPpNAVzR8_XMcrkSdPE3Q3yGIfy5TJ41n_A7pTs2c9kgZM=w1920-h1080"></object>
  <object data="https://lh3.googleusercontent.com/HJlGYzJRAaOq21RYTiX3D5By7PtFqEXFA2URKnMVpLN6ohn0ueXNZ_fERm2UkDBmT7d3ITzP-oZh5-BwvOk8CODkq7Hvb-HMJS9tvlYoBftuxUzkRakBDmktUTgTIQTy-xyNHd3Tqfw=w1920-h1080"></object>

    Problem I am having is after the post has been uploaded the code is stripped out leaving just the following 

    <div class="pa-gallery-player-widget" style="width:100%;height:480px;display:none" data-link="https://photos.app.goo.gl/p3rstofaE6N1xDBg8" data-title="Perth 2017" data-description="19 new items added to shared album">
  <object></object>
  <object></object>
  <object></object>
  <object></object>
  <object></object>
  <object></object>
  <object></object>
  <object></object>
  <object></object>
  <object></object>
  <object></object>
  <object></object>
  <object></object>
  <object></object>
  <object></object>
  <object></object>
  <object></object>
  <object></object>
  <object></object>
</div>
</div>

    Is there any way I can stop WordPress from doing this?

    thank you

    Adam Petford

Viewing 7 replies - 1 through 7 (of 7 total)

  • The original source code is incomplete and thus syntactically incorrect. This can certainly lead to the behaviour you describe. Please check again that the source code you want to insert is complete.

    Another question would be how you insert this source code. Do you use Gutenberg with the HTML block? Or another PageBuilder like Elementor or Divi? With more information about your project, it would be easier to help you.

    Another gotcha is… what role do the users that you want to “create their own posts and stream files from platforms like Google Photos” have?

    On a normal WordPress site, only Admins and Editors (ie users with the unfiltered_html capability) can post HTML markup and JavaScript code in pages, posts, comments and widgets.

    So if your users are not Admins or Editors, this is likely the reason why the code is being stripped out.

    UPDATE:

    I tested the code in a sandbox site (because I have time on my hands ?? ).

    After my initial post as an Admin, I got the embedded Google Photos slideshow to work. When I reloaded the page in the editor, I saw the message “This block contains unexpected or invalid content” with a button to “Attempt Block Recovery”. The recovery seems to have fixed the syntax error, and I could reload the post in the editor without seeing the error message again. The embedded Google Photos slideshow continued to work at all times.

    I tried again using a user with the Editor role, and the experience was exactly as before.

    Then I tried using a user with the Author role, and as expected, all the JavaScript and data/data-link HTML attributes were stripped off, exactly as the “problem” reported.

    UPDATE 2:

    Please note that this is a critically important feature offered by WordPress to prevent your users from posting malicious code (or even benign but incorrect code) that could break your site.

    If you really really really (enough?) want to disable this vital protection and allow your users to post any random scripts on your site, there are several plugins that can help you do just that. You can use the User Role Editor plugin to enable the unfiltered_html capability for the role that your users belong to: https://www.ads-software.com/plugins/user-role-editor/

    • This reply was modified 2 years, 8 months ago by George Appiah. Reason: Added test results
    • This reply was modified 2 years, 8 months ago by George Appiah. Reason: Added resource to optionally disable code-filtering protection
    Thread Starter adampetford

    (@adampetford)

    Hi George,

    thank you for taking the time respond to my issue – I tried adding in the user-role-editor and enabling the unfiltered.html feature – the same issue happened again – so not sure where to go with this?

    Thread Starter adampetford

    (@adampetford)

    I am using the DIVI Builder and a plugin called user submitted posts url is https://adamp135.sg-host.com/

    Thread Starter adampetford

    (@adampetford)

    this one worked because I added the code directly into the back end

    https://adamp135.sg-host.com/iframe-test-13/

    Thread Starter adampetford

    (@adampetford)

    the editor is RTE/Visual Editor

    Thread Starter adampetford

    (@adampetford)

    I also tried switching the user to admin – got the same issue?

Viewing 7 replies - 1 through 7 (of 7 total)
  • The topic ‘WordPress Stripping out JavaScript’ is closed to new replies.