Hi @angus I have some news from EDD below:
I have identified the problem in the WP Discourse plugin and I’m hoping you can send it along to the developers.
The issue is in this file:
lib/discourse-comment.php
Specifically this filter:
add_filter( ‘wp_kses_allowed_html’, array( $this, ‘extend_allowed_html’ ), 10, 2 );
By default, the array they are filtering contains this:
array (
‘align’ => true,
‘dir’ => true,
‘lang’ => true,
‘xml:lang’ => true,
‘aria-describedby’ => true,
‘aria-details’ => true,
‘aria-label’ => true,
‘aria-labelledby’ => true,
‘aria-hidden’ => true,
‘class’ => true,
‘id’ => true,
‘style’ => true,
‘title’ => true,
‘role’ => true,
‘data-*’ => true,
)
Of particular note is that last one: ‘data-*’
The WP Discourse plugin is filtering this to add their data-youtube-id attribute, but in doing so, they are unintentionally unsetting the data-* attribute. This means all other data attributes no longer work under wp_kses_post(). This is causing a problem with our PayPal code.
To be clear though: WP Discourse isn’t actually disconnecting you from PayPal; it’s just breaking the code that checks to see if you are connected. This is because we use a data attribute in our markup, and the filter in WP Discourse is stripping it out.
My recommendation to the developers would be to extend the $allowedposttags[‘div’] array instead of overwriting it.
Instead of this:
$allowedposttags[‘div’] = array(
‘class’ => true,
‘id’ => true,
‘style’ => true,
‘title’ => true,
‘role’ => true,
‘data-youtube-id’ => array(),
);
They can do this:
$allowedposttags[‘div’][‘data-youtube-id’] = array();
That resolves the issue, and should also ensure their functionality remains the same.