CUNY Academic Commons

Hi Laurie - Thank you very much for researching this issue.

We cannot allow the unfiltered-mu plugin, for security reasons.

I've had a look at the Kadence author's custom plugin. I have to say that it's pretty bonkers. First, it adds svg attributes to the allowlist for permitted HTML (this part is not so weird). Then, it uses a hash-based trick to work around WordPress's security filter at the time that content is saved. It's clever, but it defeats the purpose of having these security issues in place. It would be easy for me to write some malicious code that would take advantage of this workaround. So I'm very wary of installing it.

It's certainly none of my business how the Kadence author writes plugins, but it seems to me that this problem could be mitigated by inserting the SVG into the post content via filter/shortcode/JS/render-callback rather than inserting it into the post content. Many WP blocks use custom render callbacks for this very purpose.

I may be able to write a small plugin that uses a content filter to detect the class names (like kt-info-svg-icon-fe_calendar) and then inserts the SVG. I'll take a bit of time in the upcoming weeks to see how labor-intensive it'll be. In the meantime, my only idea for a workaround is to avoid using the icons.

Thanks for this insight Boone, super helpful.

Yes, I was worried about the developer plugin too. I understand your concerns with the plugin and it sounds like it can't be used on the Commons.

I wonder if a plugin like Atomic blocks has icons and if switching to this plugin might solve this issue. I think I am meeting with her tomorrow and if she decides to use another plugin, i will report back here so you don't spend too much time looking into another workaround for Kadence.

I have added Scott on this ticket as a watcher in case he knows a bit more about the icon and page building options available through atomic blocks.

I'm going to close this as resolved, based on Scott's workaround. Thanks!