Script tags in custom field not working after update

Hi Scott,

In recent version we have escaped custom field values to prevent XSS (Cross-site scripting) attacks on website.

Cross-site scripting (XSS) is a type of computer security vulnerability typically found in web applications. XSS enables attackers to inject client-side scripts into web pages viewed by other users. A cross-site scripting vulnerability may be used by attackers to bypass access controls such as the same-origin policy.

See https://developer.wordpress.org/plugins/security/securing-input/ & https://developer.wordpress.org/plugins/security/securing-output/

Let us know how you are using scripts to display third-party plugins in custom fields. If possible i will provide you help/snippet to use filter instead of script tags. Allow to use script tags in input is not safe for website in terms of security.

Best Regards,
Kiran

Hi Scott,

Please use following PHP code snippet, it will skip field value sensitization.

/**
 * Skip sanitize field values.
 *
 * Skipping sanitize values may result in cross-site scripting (XSS) attack.
 */
function gd_snippet_skip_sanitize_field( $value, $gd_post, $custom_field, $post_id, $post, $update ) {
	$value = $gd_post[ $custom_field->htmlvar_name ];

	if ( isset( $custom_field->data_type ) && ( $custom_field->data_type == 'DECIMAL' || $custom_field->data_type == 'INT' ) && $value === '' ) {
		$value = null;
	}
	return $value;
}
add_filter( 'geodir_custom_field_value_email', 'gd_snippet_skip_sanitize_field', 11, 6 );
add_filter( 'geodir_custom_field_value_html', 'gd_snippet_skip_sanitize_field', 11, 6 );
add_filter( 'geodir_custom_field_value_phone', 'gd_snippet_skip_sanitize_field', 11, 6 );
add_filter( 'geodir_custom_field_value_text', 'gd_snippet_skip_sanitize_field', 11, 6 );
add_filter( 'geodir_custom_field_value_textarea', 'gd_snippet_skip_sanitize_field', 11, 6 );
add_filter( 'geodir_custom_field_value_url', 'gd_snippet_skip_sanitize_field', 11, 6 );

Let us know how it goes.

Regards,
Kiran

Hi Scott,

Please try listing re-save again with script tags. The listing which saved after current release may have stripped tags, so those listings needs to re-save again with script tags.

Let us know.

Kiran

Hi Scott,

Try following PHP snippet to prevent strip tags for specific fields.

/**
 * Skip sanitize specific field values.
 *
 * Skipping sanitize values may result in cross-site scripting (XSS) attack.
 */
function gd_snippet_custom_skip_sanitize_field( $value, $gd_post, $custom_field, $post_id, $post, $update ) {
	// Fields to skip strip tags.
	$skip_strip_tags = array();
	$skip_strip_tags[] = 'custom_field';
	$skip_strip_tags[] = 'custom_text';
	$skip_strip_tags[] = 'my_field';

	if ( in_array( $custom_field->htmlvar_name, $skip_strip_tags ) ) {
		$value = $gd_post[ $custom_field->htmlvar_name ];

		if ( isset( $custom_field->data_type ) && ( $custom_field->data_type == 'DECIMAL' || $custom_field->data_type == 'INT' ) && $value === '' ) {
			$value = null;
		}
	}
	return $value;
}
add_filter( 'geodir_custom_field_value_email', 'gd_snippet_custom_skip_sanitize_field', 11, 6 );
add_filter( 'geodir_custom_field_value_html', 'gd_snippet_custom_skip_sanitize_field', 11, 6 );
add_filter( 'geodir_custom_field_value_phone', 'gd_snippet_custom_skip_sanitize_field', 11, 6 );
add_filter( 'geodir_custom_field_value_text', 'gd_snippet_custom_skip_sanitize_field', 11, 6 );
add_filter( 'geodir_custom_field_value_textarea', 'gd_snippet_custom_skip_sanitize_field', 11, 6 );
add_filter( 'geodir_custom_field_value_url', 'gd_snippet_custom_skip_sanitize_field', 11, 6 );

Kiran

$skip_strip_tags[] = 'my_field';

replace my_field with your field’s key