Shortcodes in Plugin Description aren't handled in the 'View Details' popup

[garrett-eclipse]

Hello,

Just wanted to flag that the shortcodes which are present within Plugin Description work on the Plugin Directory but not in the 'View Details' popup in the Plugin listing on an install, screen;
​http://i.imgur.com/qcuYoLe.png

Cheers

[tellyworth]

What security implications would this have (ie rendering shortcodes within the API)?

Is this a regression from the old API?

[dd32]

I believe the limited whitelisted shortcodes did work in the previous API.
Core has a wp_kses() over the API output which may strip/block/prevent the embeds though.

[dd32]

3 years later, this is a Core bug.

The WordPress.org plugins api does send the embeds, but core wp_kses strips them out.

If you have Jetpack Active, it appears that you see a [vimeo] shortcode instead.

The first plugin I found which uses a Vimeo embed is ​Updraft plus, you'll see the iframe code in the ​https://api.wordpress.org/plugins/info/1.1/?action=plugin_information&request[slug=updraftplus API response] but not within WordPress's plugin info page.

The core wp_kses in question strips the embed down from this

<div class="embed-vimeo" style="text-align: center;">
<iframe src="https://player.vimeo.com/video/154870690" width="640" height="360" frameborder="0" webkitallowfullscreen mozallowfullscreen allowfullscreen></iframe>
</div>

to <div class="embed-vimeo"></div>

[dd32]

Reported upstream as ​#core49731

[dd32]

Vimeo Example: ​https://wordpress.org/plugins/updraftplus/
Youtube Example: ​https://wordpress.org/plugins/wp-smushit/

I can't find anything using VideoPress embeds, so I'm going to remove that support instead.

[dd32]

In 9647:

Plugin Directory: Drop [videopress embed support, no plugins are currently using it.

See #2846