Skip to content

Conversation

@mlwilkerson
Copy link
Member

This PR is an experiment to explore using dynamic blocks for the Font Awesome Icon block, in order to avoid storing raw HTML in posts.

This support issue shows that users with only the Editor role may not be able to save icon blocks that involve raw HTML. Using dynamic blocks with server-side rendering via render_callback is one way to avoid saving raw HTML into post_content.

The PR demonstrates that this works, as expected. It saves the abstract as generated by @fortawesome/fontawesome-svg-core as a separate attribute, instead of the rendered <svg>. The back end PHP code that implements the render_callback then renders the <svg> from that abstract attribute.

So far, so good.

However, that only work for icon blocks. It won't work for rich text icons.

It won't work for rich text icons because, in their case, the operative block is the paragraph, or button--as examples--into which the rich text icon has been inserted. The render_callback only works to render blocks associated with that render_callback--not bits of content inserted into other blocks.

KSES filtering vs. dynamic block rendering

This experiment is an alternative to modifying the KSES filtering. The KSES filter is what strips out the raw HTML <svg> upon saving, when the user lacks the unfiltered_html capability. In a default installation, both an Admin and Editor have the unfiltered_html capability. But for sites that are more security-hardened, these users may not have the unfiltered_html capability.

So one way to make it work would be the modify the KSES filters to allow for saving our <svg> HTML by any user who can edit content. This would affect all post_content, not just ours.

If the KSES filter were modified, it would mean that the raw <svg> HTML could saved directly into the post_content.

If the KSES filter were not modified, then it would require using dynamic blocks--as in this PR. Instead of saving raw HTML into the post_content, the abstract is stored as part of the HTML comment that serialized all of the block's attributes. Then the render_callback does its rendering based on that abstract.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants