-
Notifications
You must be signed in to change notification settings - Fork 4.3k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Global Styles: unable to save block some variation styles when KSES is active #66799
Comments
Thanks for writing up this issue @BogdanUngureanu 👍 I had some trouble wrapping my head around it and following the replication steps initially.
The input and output noted in the description don't appear to match in terms of format. Can you confirm exactly where you pulled that data from? When I dumped the theme.json data at the beginning and end of the
This doesn't appear to be related to block style variations, block type styles etc. I believe it's the CSS value being assigned that's the problem. More on that in a second.
For others coming to this issue, as far as I can tell, there's only one problematic style in the above data. It is: That color value fails the You can confirm this if you temporarily force this check to pass. After doing so, you'll see the expected behaviour and the I'm not sure of the security implications of allowing In the short term though there is a I hope that helps some! 🙏 |
Quick follow up: A simplistic search for themes using the cc/ @richtabor |
Hi @aaronrobertshaw! I think there's a bit of confusion here. 😄 There are two issues here:
In hindsight, we can add that KSES workaround in Gutenberg too, until WP Core gets a proper fix. Going back to this issue. The output I've mentioned above was obtained by adding an error_log after this line. So my code was something like
I did some debugging and the KSES filter doesn't block any CSS rule (after applying my KSES workaround), so the problem is from somewhere else; my best guess is that \WP_Theme_JSON_Gutenberg::compute_style_properties skips some properties from the $variation_input. |
Thanks for the extra info @BogdanUngureanu 👍
Agreed. I think we need to update this issue's title, description, etc., to focus solely on the issue that needs addressing here. As you note, the problem with KSES has been or will be dealt with separately. So this issue now only relates to users without unfiltered HTML caps not being able to correctly save variation styles. In other words, the references to KSES are a bit of a red herring that might further confuse others coming to this issue down the road.
That makes sense now. Where you're debugging the output, ignores the block of code after it that processes the element styles. Moving the output logging to after the output is finished being processed paints a clearer picture. Once I add The root cause of the problem is that variations' inner I have a fix that needs some more refining and additional unit tests before I can throw up a PR for it. It's very late here, so I'll probably have to finish it off on Monday morning. |
The KSES filters prevent applying some block variation styles via the Global Styles sidebar in the site editor.
These filters are only registered when a user doesn't have the unfiltered_html capability (which is the case for multisite regular admins).
When these filters are active, some changes to the block variation property are reverted back to their previous value.
Looking at the HTTP request to the global-styles endpoint, the PUT request includes the block variation changes but the response doesn't.
After doing some debugging, I noticed this happens because of this line. After removing the validation, the save worked as expected. This change was introduced in the context of this PR, which seems to fix a similar issue.
Comparing the input and output of that line it seems that it removes properties when it shouldn't:
Given input
Output generated
Step-by-step reproduction instructions
The text was updated successfully, but these errors were encountered: