Shortcodes being run in editor when gutenberg is active

[karlazz]

Hello,

We have a shortcode that makes an API call to a remote site. We noticed that it was making calls when we were editing pages on our website, even if the shortcode was not loaded on that page. This does not happen when gutenberg is disabled.

I made up a test shortcode that appends to a file in the uploads directory.
I added it to a test page. It ran when I opened the editor view of the page. It ran when I saved the page. It ran when I viewed the page, which is the only time it should run. I can see when it runs because it writes to my file.

Even more surprising is that the shortcode ran when I edited a different page, a page without the shortcode. We have good reason to believe that the pages API is running the shortcode when it runs to create the parent page drop down selector.

Why do we believe that is the issue? Because in the first incident, the one where we were sending out unexpected API calls to a remote system, the shortcode was just echoing text without doing a proper return. The echoed text interrupted the Parent page drop down selector build and so that drop down did not appear. We saw the shortcode's misplaced response text in our browser console as part of the page API response. Once we properly wrapped the echo statement, that issue went away, but the API calls were still occurring, and so I did the simple test for you.

In summary, the shortcode is run when I edit any page. We believe that the page API call that is used to create the parent page dropdown is running the shortcode.

Is this on purpose behaviour?

Regards,
Karla

[audrasjb]

Hi @karlazz, thanks for the ticket and welcome to WordPress Trac,

Could you please provide some code example to help us to reproduce the behavior you described?

Thanks

[vijayhardaha]

Hey, I have a similar issue, I was working on a custom shortcode for WooCommerce products then I found this issue.

Steps to reproduce the issue.

1. Fresh install the WordPress
2. Create a static homepage
3. Install the WooCommerce plugin & import dummy data (it's not the woocommerce shortcode issue, for issue testing we use WooCommerce)
4. Install Query Monitor for tracking
5. Edit the homepage and on the block, the editor adds a shortcode block and put [products limit=10"]
6. Save/Update the page
7. Reload the page and open the query monitor panel
8. Click the Queries tab, select woocommerce in the component dropdown, and select WP_Term_Query->get_terms() in the Caller dropdown
9. Look for the SELECT DISTINCT t.term_id, tr.object_id query and expend Caller information, you'll find WC_Shortcodes::products() there

Shortcode code is executing on the backend page which should not happen, If you'll install the classic editor plugin then in the classic editor you'll not see shortcode code execution on the backend.

This current behavior slows down the backend page. for example with a website with 10000 products if someone adds a shortcode [products] by mistake without specifying the limit atts, then the backend will execute the query and the page will either break or load after 1-2 minutes.

Another issue that I had with my custom shortcode was, I was not initializing add_shortcode with the init action and was using the set_postdata function, so when I was editing the post, the first rendered product was set on the edit page due to this backend shortcode execution.

However, that was my mistake, so I initiated the add_shortcode with the init action, but I think, shortcode execution in the backend with the block editor is an issue and should be fixed.

Thanks