WP Manifestindependent plugin directory
manifest / media / add-svg-support-for-media-uploader-inventivo

Add SVG Support for Media Uploader | inventivo

Ermöglicht berechtigten Benutzern den Upload serverseitig bereinigter SVG-Dateien.

by Nils Harder · github.com/inventivo/add-svg-support-for-media-uploader-inventivo · website

★ 0stars

Install

Download source zip No release zip yet

This is the repository archive. It installs, but the folder name will carry the branch suffix and updates will not flow.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/inventivo/add-svg-support-for-media-uploader-inventivo/archive/refs/heads/master.zip
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.
Readme github.com/inventivo/add-svg-support-for-media-uploader-inventivo ↗

WordPress plugin for controlled SVG uploads. Version 2.0.0 allows SVG files only for users with the unfiltered_html capability and sanitizes regular media-library, REST API and sideload uploads before storage.

SVG uploads through wp_upload_bits() are rejected before that function writes the file to its public destination. This intentionally includes the XML-RPC methods wp.uploadFile and mw_newMediaObject as well as SVG files handled by the WXR importer.

The attachment backstop remains active for unexpected paths that register an SVG attachment. Invalid SVG files and uploads without an available sanitizer are rejected. If a stored file cannot be cleaned, its attachment record and file are removed.

Requirements

  • PHP 7.4 or newer
  • WordPress 5.1 or newer, tested through WordPress 7.1
  • Composer
  • PHP extensions dom and libxml

Installation

Install the package and its dependencies through the Composer setup of the WordPress project. For a standalone checkout, run:

composer install --no-dev

Then activate the plugin in WordPress.

Security behavior

  • SVG is added to WordPress' allowed MIME types only for users with unfiltered_html.
  • SVG is removed from the allowed MIME types while wp_upload_bits() is running. XML-RPC and WXR imports therefore reject SVG files.
  • enshrined/svg-sanitize cleans normal uploads before storage and checks every newly registered SVG attachment again when needed.
  • Safe internal CSS remains intact, including Illustrator `