Make WordPress Core

Opened 14 years ago

Last modified 5 years ago

#12056 new enhancement

target="_blank" being stripped from Profile Bio and Category Description

Reported by: lovewpmu's profile lovewpmu Owned by:
Milestone: Future Release Priority: normal
Severity: normal Version: 2.9.2
Component: Formatting Keywords: gsoc kses has-patch dev-feedback
Focuses: Cc:


Many apologies if this is a duplicate. I have searched but did not find it yet posted.

I noticed that target="_blank" is being stripped from my "a href" tags my profile "Biographical Info" field even though the "a href" with the URL and closing tag still remain. It happens every time I save my profile.

This was independently verified.

It is a regular wordpress install running 2.9.1 (not wordpressmu, etc.).

My original thread can be found here:

Attachments (1)

12056.diff (324 bytes) - added by nofearinc 10 years ago.
sample target addition to $allowedtags

Download all attachments as: .zip

Change History (22)

#1 @miqrogroove
14 years ago

The target attribute is still valid as of XHTML 1.0 Transitional, but you will probably have to use onclick instead. Probably neither are allowed to non-administrators.

#2 @lovewpmu
14 years ago

there is no reason why someone who is filling out their bio with links to the relevant online info should need to code in javascript. in fact, most people using wordpress -- ie. the common user -- probably cannot. i believe the links on the HTML generated for posts, _blank is used for the "Open in New Window" option.

this should be standardized and completely independent from whether one is or is not an administrator.

#3 @miqrogroove
14 years ago

It does seem to be using the same filters for admins. That's a bit surprising.

#4 @miqrogroove
14 years ago

It's set up as a default filter for pre_user_description so you could override that with a plugin.

You might have a case for enabling unfiltered bios for administrators, but beyond that I think the "it's allowed in posts" argument isn't going to fly. WordPress explicitly filters bios the same way as comments instead of posts.

#5 @nacin
14 years ago

  • Milestone changed from 2.9.2 to Future Release

#6 @bsutcliffe
14 years ago

  • Cc bsutcliffe added
  • Keywords html strip profile bio category description link target added
  • Summary changed from target="_blank" being stripped from Profile Bio to target="_blank" being stripped from Profile Bio and Category Description
  • Version set to 2.9.2

This also occurs in category descriptions. If I add a link to one of my category descriptions and specify target="_blank", the target reference gets stripped out when saving. Unlike bios, this filter definitely should not be applied.

#7 @bsutcliffe
14 years ago

  • Cc bsutcliffe removed
  • Keywords html strip profile bio category description link target removed

#8 @wojtek.szkutnik
14 years ago

  • Keywords gsoc added

#9 @sjefen6
13 years ago

Images, lists and class specifications are also being stripped away from category descriptions. What is the reasoning for being so strict with category descriptions?

10 years ago

sample target addition to $allowedtags

#10 @nofearinc
10 years ago

Adding the target to the anchor array of $allowedtags would solve that globally in kses.php after the default filters are applied in default-filters.php, but I guess there might be a security risk with adding a frame target to external location? I've uploaded a sample proof of concept above.

Not sure if there is a way to globally allow a given value for an attribute in $allowedtags.

#11 @nacin
10 years ago

  • Component changed from General to Formatting
  • Type changed from defect (bug) to enhancement

This is "intentional" but we may be able to fix this now. kses can now make changes based on a particular filter. Otherwise changing $allowedtags would open this up for comments.

#12 @miqrogroove
9 years ago

  • Keywords kses added

#13 @harmr
8 years ago

+1 for enabling href/target by default for $allowedtags

#14 @blogitsolutions
7 years ago

+1 for enabling _blank (ticket is now 8 years old)

Last edited 7 years ago by blogitsolutions (previous) (diff)

#15 @spacedmonkey
7 years ago

  • Keywords has-patch dev-feedback added
  • Milestone changed from Future Release to 5.0

#16 @stefahn
6 years ago

+1 for letting us open links in the author bio in a new tab.

#17 @johnbillion
6 years ago

  • Milestone changed from 5.0 to Future Release

#18 @ctrlaltdelete
6 years ago


Last edited 5 years ago by ctrlaltdelete (previous) (diff)

#19 @arvindwp
5 years ago

Not yet resolved? facing same issue. Author social bio should not cause visitor to mve away from website. Any fix?

#20 @nofearinc
5 years ago

Just tested my 2013 patch above and it still works here. Once applied, you can save target="_blank" to your bio and it no longer gets stripped.

#21 @stefahn
5 years ago

Who will merge this patch into master?

Note: See TracTickets for help on using tickets.