search

hyunsupul / aesop-core

Open-sourced suite of components that empower interactive storytelling in WordPress.
http://aesopstoryengine.com
GNU General Public License v2.0
244 stars 56 forks source link

Test Component Options | Escaped Strings #159

Closed bearded-avenger closed 9 years ago

bearded-avenger commented 10 years ago

I just sent through about 25 commits properly escaping every variable in every option in every component. I've done my best to double check that things are still working properly, but hoping for some help here to thoroughly test all options in all components to verify that they still function properly. Post any options that are weird or not working here as one comment.

Note, the content component has undergone some changes as far as the floatermedia is concerned. Previously, anything was allowed here. Including allowing scripts to pass causing a potential XSS vulnerability. This has now been locked down to ONLY allow links, and images. Developers can modify the allowed_html width aesop_content_allowed_html.

Happy testing!

michaelbeil commented 10 years ago

done.

bearded-avenger commented 10 years ago

Thanks michael!

michaelbeil commented 10 years ago

found one:

several quote settings are not available after inserting a quote component. when a user attempts to update, a few options are gone.

screen shot 2014-11-11 at 4 48 46 pm

bearded-avenger commented 10 years ago

hrm, that's weird. not able to replicate this one right off the bat

bearded-avenger commented 10 years ago

This commit is all front end. If that's happening in admin might be something else.

michaelbeil commented 10 years ago

Edge case was with an older version of Novella. No issues elsewhere. All looks great on the front end.