aria-label being stripped

  • I recently noticed an issue with our site where any editor account on our site is stripping aria-labels that I have previously added using my admin account. Any time an editor updates a page, all pre-existing aria-labels I have added are removed with no notice.

    I have confirmed this only affects our editor roles as I can update a page using my admin account and all changes remain. This has resulted in me having to continuously revert edits made to our site and manually add them using my admin account.

    I have tried adding this function to my theme functions.php, but the labels are still being stripped. 

    // STOP WORDPRESS REMOVING TAGS
function tags_tinymce_fix( $init )
{
  // html elements being stripped
  $init['extended_valid_elements'] = 'div[*], @[aria*]';
  // don't remove line breaks
  $init['remove_linebreaks'] = false;
  // convert newline characters to BR
  $init['convert_newlines_to_brs'] = true;
  // don't remove redundant BR
  $init['remove_redundant_brs'] = false;
  // pass back to wordpress
  return $init;
}
add_filter('tiny_mce_before_init', 'tags_tinymce_fix');

    The page I need help with: [log in to see the link]

Viewing 3 replies - 1 through 3 (of 3 total)
  • Plugin Author Andrew Ozz

    (@azaozz)

    Hmm, it is the “editor” role or the “author” role?

    This is not done in the editor. By default in WordPress admins and editors have the “unfiltered_html” capability. However the content is filtered when saving for authors and contributors. That filtering is removing the aria attributes. this can be fixed by a plugin, there is probably one that fixes it but I’ve never used any.

    Thread Starter tguistwite

    (@tguistwite)

    The previous designer of this site set up custom roles for different divisions, so we are not using out of the box roles. Looking in role manager, here are the differences between an “editor” role and my admin role

    Editor: https://imgur.com/bipLTnN
    Admin: https://imgur.com/wRAl7oj

    I’m trying to accomplish retaining aria-labels without the use of an additional plugin. Hopefully someone else has encountered a similar issue because I see no reason why aria-labels should be stripped.

    Thank you for your assistance so far Andrew. I look forward to your response.

    Best regards,
    Taylor

    Plugin Author Andrew Ozz

    (@azaozz)

    I see no reason why aria-labels should be stripped.

    Me neither but to allow them globally in core when unfiltered_html is not allowed we will have to make sure none of these attributes can be exploited.

    For now the only way to enable them without a plugin would be to allow “unfiltered_html” to editors. That’s the WP default too. Although for your setup it seems better to use a (simpler) plugin to do that. The WordPress component that is filtering the content on saving is called KSES. Perhaps look around for plugins that would let aria attributes through the filters there.

    (I would write one myself if I had the time to research if any aria attributes can be exploited. There are around 50 of them…)

    • This reply was modified 6 years, 2 months ago by Andrew Ozz.
Viewing 3 replies - 1 through 3 (of 3 total)
  • The topic ‘aria-label being stripped’ is closed to new replies.