Daryll Doyle

Hi @brad2dabone,

I would say that it sounds like your browser has cached the old SVGs based upon their name. Does it do the same if you clear your browser cache or open the media library in an incognito window?

Cheers,
Daryll

A fix has just been approved with the WordPress team, please upgrade your installations to version 1.9.6 ??

Cheers,
Daryll

Hi All,

The WordPress review has now gone through successfully and the plugin is available for download. Please make sure you all upgrade to the latest version 1.9.6 in order to be fully secure again!

Thanks for your patience while we got this sorted ??

Cheers,
Daryll

Hi All,

Just as an update, a fix for the issue has been found and committed to the WordPress repository.

We now have to wait for the WordPress plugin team to review the fix and then it should be available for you to all update to.

Thanks for your patience.

Cheers,
Daryll

Hi @skvandeusen,

That’s correct, there has been a bypass found for the underlying sanitiser. The WordPress team have disabled downloads until a fix has been confirmed.

I’m currently working on a fix and am hoping to have something ready by the end of the week, although we will have to wait for the WordPress team to review the fix before its re-enabled.

In my opinion, there’s no real reason to worry. It’s still more secure than any other SVG option out there (which offer no sanitisation) and a fix will be out shortly for the bypass found.

Sorry for the inconvenience and I hope we can get it sorted soon.

Cheers,
Daryll

Hey @nonverbla,

Thanks for reporting this issue. I see what you mean ??

Whilst adding __DIR__ fixes your use case, it does also break any time it’s used with symlinks. I will look into it and see what I can work out!

Thanks again for the help.

Cheers,
Daryll

Thanks @georgerujoiu,

I’ve not personally used wp-stateless but I have used other offloading plugins and it seems to work fine with those.

I’ll look into this though, and see if I can find a solution going forward.

Thanks for the heads up!

Cheers,
Daryll

Thanks @thomask,

I’ll look into this for the next release!

Cheers,
Daryll

Hi @cmplesolutions,

I’m guessing that this is an issue with how you’re exporting the files. Photoshop is a raster-based editing program and generally, when I’ve seen it export SVGs, it simply wraps another image type (png, jpg, etc.) in an SVG wrapper, rather than truly exporting an SVG.

I would suggest trying it with an SVG exported from a vector-based editor, such as Sketch or Illustrator and seeing if you still get the same issue.

Cheers,
Daryll

Thanks @jklatt86,

I’ll take a look into this for the next release!

Cheers,
Daryll

Hi @generalpeter,

I’m sorry to hear you’re having issues. If the plugin is installed and activated, then there should be nothing more you need to do.

If you’ve double-checked that it is and you’re still getting the issue, can you let me know a list of plugins and their versions, that you have installed on the site? I’m guessing there will be a conflict with one of them that’s overriding the Safe SVG upload handler.

Cheers,
Daryll

Hi @svzgsgps,

Glad you got it sorted, thanks for letting me know ??

Cheers,
Daryll

Hi @thepunisherbabi,

Thanks for pointing that out, you are indeed correct!

The plugin started off with 4.0 compatibility and I must have missed the update when adding in that function. I’ll get it updated on the next release.

Cheers,
Daryll

Hi @delaitec,

I’m not too sure if these plugins are to blame for the issue, as I’m not familiar with them, unfortunately. They could potentially have caused it if they tried to regenerate the image, but I can’t be 100% sure.

The modification wouldn’t have been CSS related, but it’s odd that it disappeared and came back after making an edit. Maybe there’s another plugin on your site that’s messing with images?

Unfortunately, saving the metadata for restore isn’t an option for this plugin. It would add far too much weight to the database in duplicated metadata and therefore would slow everyone’s sites down.

As we’re not seeing this on a huge amount of sites, I have a feeling it’s something within your WordPress stack that’s causing the issue. Can you try uploading a fresh SVG as before, but disable all plugins other than Safe SVG before you do so. Keep them disabled and refresh the page a few times. If you don’t see the issue, then the error is being caused by another plugin.

In that case, enable them one by one and refresh the page with the errors until you see it again, at that point, you should be able to narrow down the plugin in question.

Cheers,
Daryll

Closing due to lack of response