Automattic / Co-Authors-Plus

Multiple bylines and Guest Authors for WordPress
https://wordpress.org/plugins/co-authors-plus/
GNU General Public License v2.0
291 stars 204 forks source link

coauthors_posts_links() echoing escaped HTML #796

Closed unitof closed 3 years ago

unitof commented 3 years ago

When I upgraded Co-Authors-Plus from 3.4.5 to 3.4.6, our bylines started displaying as escaped HTML in the frontend:

anchor written out as escaped HTML in frontend

Our theme simply calls coauthors_posts_links() without arguments, since it echos by default:

<div class="post-preview__author">
  <span class="post-preview__author-prefix">by</span>
  <?php coauthors_posts_links(); ?>
</div>

Downgrading back to 3.4.5 resolved the issue.

Or, I was also able to fix the issue in 3.4.6 coauthors_posts_links return instead of echo (the last argument below), then wrapping it in a printf().

<div class="post-preview__author">
  <span class="post-preview__author-prefix">by</span>
  <?php printf( coauthors_posts_links(null, null, null, null, false) ); ?>
</div>
image

Curious if this is some conflict unique to our site (something automatically escaping echoed HTML?), or a bug others are seeing. I am spinning up a fresh WordPress instance to test it out.

unitof commented 3 years ago

@gcordner found the culprit line, in c66edc0f02278237d91c496bddab2207ab1c2a8f: https://github.com/Automattic/Co-Authors-Plus/commit/c66edc0f02278237d91c496bddab2207ab1c2a8f#diff-55c608ae2de213972c18288ae5590e36855cd86999d8040d26e7e292de7f0f5eR205

Is this new behavior by design? If so, this is a major change and would change the default implementation.

unitof commented 3 years ago

Confirmed this is also happening on a fresh WP install.

image

I only changed the following lines in themes/twentytwenty/inc/template-tags.php:

<li class="post-author meta-wrapper">
        <span class="meta-icon">
                <span class="screen-reader-text"><?php _e( 'Post author', 'twentytwenty' ); ?></span>
                <?php twentytwenty_the_theme_svg( 'user' ); ?>
        </span>
        <span class="meta-text">
                <?php
                if ( function_exists( 'coauthors_posts_links' ) ) {
                        coauthors_posts_links();
                } else {
                        printf(
                                /* translators: %s: Author name. */
                                __( 'By %s', 'twentytwenty' ),
                                '<a href="' . esc_url( get_author_posts_url( get_the_author_meta( 'ID' ) ) ) . '">' . esc_html( get_the_author_meta( 'display_name' ) ) . '</a>'
                        );
                }
                ?>
        </span>
</li>
nielslange commented 3 years ago

Thanks for reporting this problem, @unitof. As you correctly mentioned, I accidentally introduced this problem with https://github.com/Automattic/Co-Authors-Plus/pull/784, but I just created a fix it with https://github.com/Automattic/Co-Authors-Plus/pull/797.