search

surveyjs / surveyjs-wordpress

Example of integration SurveyJS: Survey Library and Survey Creator into WordPress
https://wordpress.org/plugins/surveyjs/
38 stars 18 forks source link

HTML questions are ending up as plain text #7

Open flowt-au opened 5 years ago

flowt-au commented 5 years ago

If I have this in my survey JSON:

{
    "type": "html",
    "name": "question1",
    "html": "<h4>Welcome!</h4>"
}

the resulting html in the survey is:

<div data-bind="html: question.locHtml.koRenderedHtml">Welcome!</div>

i.e. no html tags. I am assuming WP is doing that? Not sure what to do.

Any ideas? Thanks, Murray

tsv2013 commented 5 years ago

The survey JSON is sanitized on save into WP database (https://github.com/surveyjs/surveyjs-wordpress/blob/master/ajax_handlers/save_survey.php#L14) in order to cut off potentially malicious content

This was the requirement from WP guys before they approved this plugin

It looks like this sanitization kills the html question content.

We'll check whether we can use less strict sanitization function.

In any case you can use any other sanitization function in your local WP instance - just patch this line of code

flowt-au commented 5 years ago

Ok. Thanks. What if the plugin was set up with a Markdown hook? That way the save sanitisation wouldn't change the content and the simple things like bold and links could be formatted on viewing?

Just a thought for later. Thanks, Murray

tsv2013 commented 5 years ago

@flowt-au Thank you for sharing your thoughts and feedback. It is very helpful. SurveyJS library does have markdown hook. We'll consider to use it in the plugin.

flowt-au commented 5 years ago

Happy to help. It is a great product!

slatecake commented 5 years ago

I'm looking to see if there is an update on this, or a potential workaround that would allow the html content to be maintained? I am dealing with this issue right now.

tsv2013 commented 5 years ago

@slatecake This behavior is so due to sanitization of the all texts passed to wordpress server. This was requirement during SurveyJS wordpress plugin approvement. You can change this behavior on your custom wordpress installation. But be aware of security vulnerabilities.