CUNY Academic Commons

Similar to #6878

I can look at this in more detail in the upcoming days, but here's some initial notes, so you can pursue some research if you want.

The underlying issue is that both our "Custom CSS" module and the Jetpack Custom CSS feature use the CSSTidy library to validate CSS entered by the user. (The validation is largely for security reasons.) The CSS properties you're using don't appear to be supported by the original CSSTidy (used by our sitewide plugin, not updated in 5+ years), or by the version of CSSTidy that the Jetpack team appears to have forked. It does look like Jetpack occasionally adds support to CSSTidy for new properties. Look through https://github.com/Automattic/jetpack/issues?q=label%3A%22Custom+CSS%22 for some inspiration.

The technique used in https://github.com/Automattic/jetpack/pull/8141 can probably be reproduced outside of Jetpack, but this needs investigation.

We are talking about moving to a different CSS tool in the future. I'm going to cross-reference #7811 and copy Dan here just in case there's some useful lesson to be learned here.

If I instead had a child theme with a css file, would the same sanitization happen to the CSS files I add to the theme?

No. This is only an issue when entering CSS through these admin interfaces.

1. Yes - our new plugin doesn't validate CSS as such at all - it just does some character escaping to avoid security issues. So it'll never strip out newer properties, but it also won't help users identify typos or other errors. Do think that still works.

2. Will work on this soon!

Do think that still works.

Right, but the CodeMirror interface ought to at least warn about syntax errors. I think this is probably better than strict sanitization for the purposes of this ticket.

I think it'll be easy to use the same method as in that PR (just manually adding to $GLOBALS['csstudy']). I think we can just hook into init with a high priority and it should be okay. It doesn't look like they reset that array when they create it.

Also - the CodeMirror interface doesn't exactly warn about syntax errors, but it is obvious that something's wrong because the syntax highlighting doesn't look right.