Unable to add a link in secondary title

Hi @swissprice,

I appreciate your feedback.

I’ll dive into it tomorrow since it’s late over here, but my initial instinct tells me it’s likely related to the XSS protection I had to implement.

You might recall that WP.org temporarily shut down my plugin a few months back due to a rare vulnerability in the secondary title feature. This prompted me to restrict certain HTML tags, so I had to disable many of them in certain situations, probably including yours.

In the meantime, could you walk me through exactly what you were trying to accomplish and where, so I can replicate the issue and get to the bottom of this?

Hi @thaikolja,

Thanks a lot for your swift reply!

I tried to add an <a href=””></a> tag in the secondary title. Basically, it’s a blog for a reading club and the reviews of the books are posted in posts. I would like to add a secondary title in order to add the name of the author (of the book) with a link that leads to a dedicated page about the author.

The text in the secondary title looked like this: <a href=”myblog.com/authorname”>Author Name</a>

Best regards, Samuel

Hi again,

I’d love to be able to reply even faster, but for some reason that I’m unaware of, the mods decided that my comments must first be approved before they can be published ˉ_(ツ)_/ˉ

This issues like this one, I always need a way to reproduce the issue. Can you walk me through where and what you’re doing and maybe a screenshot of your Secondary Title settings page? That’d help me a lot.

Thanks so far!

Edit: This comment didn’t need approval. I don’t know why and when my comments are being held back and when not. I’m just mentioning it for transparency.

• This reply was modified 9 months ago by thaikolja. Reason: Edit approval statement

In case you mean the input field for the secondary title when you create or edit posts, then I understand the issue.

If that’s the case, there’s currently no way around because I had to implement a strong XSS protection that strips out all HTML from the input field.

However, I’ve adjusted that part and made it to allow <a> tags while still protecting against any other XSS possibility (<script>, most importantly).

Please get in touch with me via kolja {{dot}} nolte {{at}} gmail {{dot}} com so I can send you the updated version that allows <a> tags. If this works for you, I’ll have it tested with a few other users, and if there are no bugs and the security evaluation turns out fine, I’ll update the plugin as soon as I can.

• This reply was modified 9 months ago by thaikolja.

Hi,

Thank you very much for looking into this.

You are right, I mean exactly this. It’s for a project that it currently paused until September. So if that’s ok with you, I will email you in September (unless if the update becomes officially available by then).

Many thanks and best regards, Samuel

Thanks, but I hope I’ll have it tested thoroughly and updated the plugin by then. But thanks for the offer. If you like my plugin and my service, feel free to write a review ??