Daryll Doyle

@alriksson, that’s amazing. Thanks for letting me know.

Yep, saw that bit the other day, will get a fix up for it when I have some time to play with it, shouldn’t be too complex though ??

Hi @alriksson,

It seems as if your PHP version hasn’t been built with multibyte support. I think I’ve managed to fix this in 1.4.2 but can you give it a try and let me know?

Cheers,
Daryll

No problem at all @alriksson!

Hi Both,

@david1103 good news for you, the issue was that the library wasn’t very case tolerant and therefore was stripping allowed tags due to the mismatch. I’ve updated the underlying library and have release 1.4.1 of this plugin which should fix it for you ??

@mrlagmer unfortunately it’s not such great news for you. The use element can be used in a few ways to attack from an SVG so I’m not comfortable allowing it through the library, even in cases like yours where it’s quite obviously going to cause no harm. The fact that DOMPurify also strips the <use> element from your SVG makes me think that it’s something that won’t be added for a while, if at all. I’m sorry to say but I’m going to have to mark this as a wontfix for now but it’s something that may potentially come in the future once sanitisation improves.

On the other hand, if you don’t mind adjusting your SVG to not use the <use> element, such as the one below, it will sanitise just fine:

<svg width="60" height="49" viewBox="0 0 60 49" version="1.1" xmlns="https://www.w3.org/2000/svg" xmlns:xlink="https://www.w3.org/1999/xlink" xmlns:figma="https://www.figma.com/figma/ns">
<title>Icon copy</title>
<desc>Created using Figma</desc>
<g id="Canvas" transform="translate(-3904 3533)" figma:type="canvas">
<g id="Icon copy" style="mix-blend-mode:normal;" figma:type="frame">
<g id="xE002  copy" style="mix-blend-mode:normal;" figma:type="frame">
<g id="Group" style="mix-blend-mode:normal;" figma:type="frame">
<g id="Vector" style="mix-blend-mode:normal;" figma:type="vector">
<path id="path0_fill" transform="translate(3904.5 -3532.66)" fill="#191B1D" style="mix-blend-mode:normal;" d="M 0.700012 36.9C 0.300012 36.5 0 35.9 0 35.3L 0 2.30001C 0 1.70001 0.200012 1.10001 0.700012 0.700006C 1.10001 0.300006 1.69999 -6.10352e-06 2.29999 -6.10352e-06L 56.3 -6.10352e-06C 56.9 -6.10352e-06 57.5 0.200006 57.9 0.700006C 58.3 1.10001 58.6 1.70001 58.6 2.30001L 58.6 35.3C 58.6 35.9 58.4 36.5 57.9 36.9C 57.5 37.3 56.9 37.6 56.3 37.6L 30 37.6L 30 39.8C 30 40.3 29.8 40.6 29.2 40.6C 28.7 40.6 28.4 40.4 28.4 39.8L 28.4 37.6L 2.20001 37.6C 1.60001 37.6 1.10001 37.4 0.700012 36.9ZM 1.5 35.3C 1.5 35.8 1.69999 36.1 2.29999 36.1L 56.3 36.1C 56.8 36.1 57.1 35.9 57.1 35.3L 57.1 2.30001C 57.1 1.80001 56.9 1.49999 56.3 1.49999L 2.29999 1.49999C 1.79999 1.49999 1.5 1.80001 1.5 2.30001L 1.5 35.3ZM 4.5 32.3L 4.5 5.30001C 4.5 4.80001 4.69999 4.49999 5.29999 4.49999L 53.3 4.49999C 53.8 4.49999 54.1 4.80001 54.1 5.30001L 54.1 32.3C 54.1 32.8 53.9 33.1 53.3 33.1L 5.29999 33.1C 4.69999 33.1 4.5 32.9 4.5 32.3ZM 6 31.6L 52.5 31.6L 52.5 6.1L 6 6.1L 6 31.6ZM 37.5 42.1C 38.3 42.1 39 42.4 39.6 43C 40.2 43.6 40.5 44.3 40.5 45.2L 40.5 47.4C 40.5 47.9 40.3 48.2 39.7 48.2L 18.7 48.2C 18.2 48.2 17.9 47.9 17.9 47.4L 17.9 45.1C 17.9 44.2 18.2 43.5 18.7 42.9C 19.2 42.3 20 42.1 20.9 42.1L 37.5 42.1ZM 38.6 44.1C 38.3 43.8 38 43.6 37.5 43.6L 21 43.6C 20 43.6 19.5 44.1 19.5 45.1L 19.5 46.6L 39 46.6L 39 45.2C 39 44.8 38.9 44.4 38.6 44.1Z"/>
</g>
</g>
</g>
</g>
</g>

</svg>

Cheers,
Daryll

Hi mrlagmer,

Thanks for reporting the issue with your SVG. I’ve taken a look and the reason it’s showing as blank is that the <use> element is being stripped from the sanitised file and therefore it’s not loading your path.

If you can leave this with me for a day or two I’ll look into the issue and see what, if anything, can be done to fix it.

Cheers,
Daryll

• This reply was modified 7 years, 9 months ago by Daryll Doyle.

I’ve just pushed up V1.4.0 which includes previews in the admin media area, enjoy ??

Currently it only hooks in on upload, once the SVGs are on the server, the risk has already started XML bombs etc so hooking in after upload defeats the point a bit.

If you’re happy with the SVGs you have up there and feel they’re safe then I see no reason to re-upload everything.

Haha yep, unsure why my initial tests worked. May have missed something from the release or had another plugin locally that was affecting it.

No worries, let me know how you get on when you’ve tested it.

As for implementing previews in the media library, this isn’t something that’s at the top of my list for now, although I’m not opposed to looking into it when I get a moment.

Hi alriksson,

Thanks for opening a new support topic for this issue.

I’ve double checked locally and there was an issue with uploading SVGZ’s. I’ve just pushed up a fix in 1.3.4 so I’m hoping that this will fix it for you. The directory has updated to you should get the update fairly soon.

See here: https://enshrined.co.uk/svgz-test/ for the fix in place in WordPress.

Also just double check that you have AddEncoding gzip svgz in your .htaccess so that the svgz is served wth the gzip header

Let me know how you get on with 1.3.4

Cheers,
Daryll

Hi alriksson,

I’ve just tested this locally and can confirm that SVGZ files are uploading and displaying correctly. If you’re seeing a broken image I’d imagine that your server isn’t serving the correct headers for the file.

If you’d like to look into this further please open your own support ticket so that I can track it and help.

Cheers,
Daryll

Hi @hendridm,

I’ve just released version 1.3.3 which allows SVGZ uploads also ??

Sorry for the delay!

Cheers,
Daryll

Thanks Guys,

Sorry for the delay, can you give 1.3.2 a try, it’s just been pushed up.

Cheers @lewiscowles for the fix!

Hi All,

Sorry for the delay. I’ve just got back into the country from my holiday, will look at this issue ASAP!

Great to hear! Thanks Chuck

Hi Chuck,

The plugin has been updated now. If you can give 1.3.0 a try and let me know how you get on with that one. If it works I’ll mark this as resolved ??

Cheers,
Daryll