Make WordPress Core

Opened 12 years ago

Closed 10 years ago

#24077 closed defect (bug) (worksforme)

Anchor links unallowed for non-admins

Reported by: artychan's profile artychan Owned by:
Milestone: Priority: normal
Severity: minor Version: 3.5.1
Component: TinyMCE Keywords:
Focuses: Cc:

Description

Due to the HTML filter for roles below the editor (and even editors in the multisite/network version), users cannot add anchor links as per the HTML5 specifications as the name attribute is obsolete: http://www.whatwg.org/specs/web-apps/current-work/multipage/obsolete.html#attr-a-name

While valid in HTML4.01, it was still recommended that the id attribute is used: http://www.w3.org/TR/html401/struct/links.html#h-12.2.3

Change History (5)

#1 @SergeyBiryukov
12 years ago

  • Keywords reporter-feedback added

Could not reproduce on a clean install neither in single site nor in Multisite. Tested in 3.5.1 and 3.6-beta1.

My steps:

  1. Log in with Author role.
  2. Add <a name="test"></a> to post content.
  3. Save the post. The anchor is still there.
  4. View the post on the front-end. The anchor is there.

#2 @artychan
12 years ago

  • Keywords reporter-feedback removed

Sorry, maybe I wasn't clear enough.

The problem is that the id attribute cannot be used to make anchor links.

While using name is possible, the name attribute is obsolete and will come up as invalid code in a code validator when using a HTML5 theme. This is especially a problem for public institutions that are legally under the obligation to follow web accessibility guidelines.

My suggestion is that the id attribute be allowed at least for headers <h2>...<h6> and possibly, the <a> tag.

#3 @SergeyBiryukov
12 years ago

  • Component changed from Validation to TinyMCE

Thanks for the clarification.

As far as I can see, the problem is that <a id="test"></a> gets replaced with &nbsp; when switching from Text to Visual editor tab. This happens for all user roles, including Administrator. I can also reproduce this on TinyMCE demo page: http://www.tinymce.com/tryit/basic.php.

If I save the post without switching to Visual editor, the anchor is preserved, even if I'm logged in as Author.

Do you get the same results?

As for the kses filter, the id attribute is allowed for <a> tag since [6617] (WordPress 2.5) and for <h1>...<h6> tags since [11692] (WordPress 2.8.1).

Since [21790], the standard attributes (class, id, style, and title) are allowed for all tags.

#4 @artychan
12 years ago

Thanks for clarifying. I shouldn't have said it was the newest version doing this since this was an issue I was having a little while back.

Strangely, I actually cannot reproduce the error you're getting, but I'm a super admin on a network version (not sure if that makes a difference) and I have the unfiltered html plugin installed. I also cannot try it with a different role with the setup I have.

I tried it in the wordpress.com version, and couldn't reproduce it there either.

So, unless someone else can reproduce the error, maybe this issue should actually be closed.

Thanks again for the clarification and putting up with my apparent incompetence to test it properly before posting.

#5 @iseulde
10 years ago

  • Milestone Awaiting Review deleted
  • Resolution set to worksforme
  • Status changed from new to closed

Publishing <a id="test"></a> as an author works for me. The only problem is that when I leave this tag on a separate line (no text next to it) and switch to the visual editor, it disappears. Let's address that in #26332.

Note: See TracTickets for help on using tickets.