[oik] plugins.com

WordPress plugins and themes

escaped shortcodes being unexpectedly expanded during ‘get_the_excerpt’

This post describes a minor problem with escaped shortcodes (shortcodes that are wrapped in two square brackets, e.g. [[shortcode]]) being expanded when they shouldn’t be. The shortcode is not expected to be processed. Instead, the double brackets surrounding shortcode are expected to be reduced to a single square bracket. e.g. [[shortcode]] in the source gets displayed as [shortcode].

Note: The reason we can happily mix double square brackets and single square brackets in this post is because there is no shortcode called shortcode.

Investigation

The problem was most recently noticed in the following scenario

  • using shortcode bw_jq with the value of the inline= parameter set to n or not being set
  • the wordpress-seo plugin (version 1.4.19) is configured to Add Open Graph meta data.

The problem did not happen with:

  • inline=y.
  • Add Open Graph meta checkbox unchecked.
  • wordpress-seo v1.4.10

Note: The fact that the problem was detected after migration to 3.8 was a red-herring. The problem is not limited to WordPress 3.8. It has been demonstrated to occur in WordPress 3.7.1.

Explanation

The oik base plugin attaches shortcode expansion logic to a number of filters:

You appear to be a bot. Output may be restricted


function oik_plugin_file_loaded() {
// . . .
add_filter('widget_text', 'do_shortcode')  <;
add_filter('the_title', 'do_shortcode' )  <;
add_filter('wp_footer', 'do_shortcode' )  <;
add_filter('get_the_excerpt', 'do_shortcode' )  <;
add_filter('the_excerpt', 'do_shortcode' )  <;
// . . .
}
 

In certain situations it is possible for

filter to be invoked while processing

when the double bracket [[shortcode]] has already been reduced to a single bracket [shortcode]. Shortcode expansion therefore occurs.

In the case of the [bw_jq] shortcode this can produce the unexpected side effect of adding some external jQuery that gets run when the page is displayed.

With wordpress-seo we see the following trace output, produced by

You appear to be a bot. Output may be restricted


function bwsc_jquery( $atts=null, $content=null, $tag=null ) {
bw_trace2();
bw_backtrace();
// . . .
}
 

Current filter array

 
C:\apache\htdocs\wordpress\wp-content\plugins\oik\shortcodes\oik-jquery.php(255:0) 2013-12-13T17:53:31+00:00 506 cf=the_content 9 9393 20807104/20936168 bwsc_jquery(4) current_filter Array
(
    [0] => wp_head
    [1] => wpseo_head
    [2] => wpseo_opengraph
    [3] => get_the_excerpt
    [4] => the_content
)

Note: This is the first time that “get_the_excerpt” and “the_content” are called. Given that the shortcode was enclosed in double square brackets we don’t expect this invocation to occur. Also note that in this instance, the [[shortcode]] is all that we find in “the_content”.

0. bw_lazy_backtrace C:\apache\htdocs\wordpress\wp-content\plugins\oik\bwtrace.inc:55 0
1. bw_backtrace C:\apache\htdocs\wordpress\wp-content\plugins\oik\shortcodes\oik-jquery.php:256 0
2. bwsc_jquery(Array,,bw_jq) C:\apache\htdocs\wordpress\wp-content\plugins\oik\shortcodes\oik-jquery.php:0 3
3. call_user_func(bwsc_jquery,Array,,bw_jq) C:\apache\htdocs\wordpress\wp-content\plugins\oik\oik-add-shortcodes.php:148 4
4. bw_shortcode_event(Array,,bw_jq) C:\apache\htdocs\wordpress\wp-content\plugins\oik\oik-add-shortcodes.php:0 3
5. call_user_func(bw_shortcode_event,Array,,bw_jq) C:\apache\htdocs\wordpress\wp-includes\shortcodes.php:273 4
6. do_shortcode_tag(Array) C:\apache\htdocs\wordpress\wp-includes\shortcodes.php:0 1
7. preg_replace_callback(/\[(\[?)( bw_jq|other|shortcodes )(?![\w-])([^\]\/]*(?:\/(?!\])[^\]\/]*)*?)(?:(\/)\]|\](?:([^\[]*+(?:\[(?!\/\2\])[^\[]*+)*+)\[\/\2\])?)(\]?)/s,do_shortcode_tag,[ bw_jq src="https://www.intouchcrm.co.uk/app/settings/signupforms/v/Default.aspx?s=28baa8bf-b3e7-4204-940f-1837ded70117" nline=y ]
) C:\apache\htdocs\wordpress\wp-includes\shortcodes.php:188 3
8. do_shortcode([ bw_jq src="https://www.intouchcrm.co.uk/app/settings/signupforms/v/Default.aspx?s=28baa8bf-b3e7-4204-940f-1837ded70117" nline=y ]

) C:\apache\htdocs\wordpress\wp-includes\shortcodes.php:0 1
9. call_user_func_array(do_shortcode,Array) C:\apache\htdocs\wordpress\wp-includes\plugin.php:199 2
10. apply_filters(the_content,[ bw_jq src="https://www.intouchcrm.co.uk/app/settings/signupforms/v/Default.aspx?s=28baa8bf-b3e7-4204-940f-1837ded70117" nline=y ]

) C:\apache\htdocs\wordpress\wp-includes\formatting.php:2198 2
11. wp_trim_excerpt() C:\apache\htdocs\wordpress\wp-includes\formatting.php:0 1
12. call_user_func_array(wp_trim_excerpt,Array) C:\apache\htdocs\wordpress\wp-includes\plugin.php:199 2
13. apply_filters(get_the_excerpt,) C:\apache\htdocs\wordpress\wp-includes\post-template.php:275 2
14. get_the_excerpt C:\apache\htdocs\wordpress\wp-content\plugins\wordpress-seo\frontend\class-opengraph.php:370 0
15. description() C:\apache\htdocs\wordpress\wp-content\plugins\wordpress-seo\frontend\class-opengraph.php:0 1
16. call_user_func_array(Array,Array) C:\apache\htdocs\wordpress\wp-includes\plugin.php:429 2
17. do_action(wpseo_opengraph) C:\apache\htdocs\wordpress\wp-content\plugins\wordpress-seo\frontend\class-opengraph.php:65 1
18. opengraph() C:\apache\htdocs\wordpress\wp-content\plugins\wordpress-seo\frontend\class-opengraph.php:0 1
19. call_user_func_array(Array,Array) C:\apache\htdocs\wordpress\wp-includes\plugin.php:429 2
20. do_action(wpseo_head) C:\apache\htdocs\wordpress\wp-content\plugins\wordpress-seo\frontend\class-frontend.php:523 1
21. head() C:\apache\htdocs\wordpress\wp-content\plugins\wordpress-seo\frontend\class-frontend.php:0 1
22. call_user_func_array(Array,Array) C:\apache\htdocs\wordpress\wp-includes\plugin.php:429 2
23. do_action(wp_head) C:\apache\htdocs\wordpress\wp-includes\general-template.php:1626 1
24. wp_head C:\apache\htdocs\wordpress\wp-content\themes\oik2012\header.php:31 0
25. require_once(C:\apache\htdocs\wordpress\wp-content\themes\oik2012\header.php) C:\apache\htdocs\wordpress\wp-includes\template.php:441 1
26. load_template(C:\apache\htdocs\wordpress/wp-content/themes/oik2012/header.php,1) C:\apache\htdocs\wordpress\wp-includes\template.php:417 2
27. locate_template(Array,1) C:\apache\htdocs\wordpress\wp-includes\general-template.php:35 2
28. get_header C:\apache\htdocs\wordpress\wp-content\themes\twentytwelve\single.php:10 0
29. include(C:\apache\htdocs\wordpress\wp-content\themes\twentytwelve\single.php) C:\apache\htdocs\wordpress\wp-includes\template-loader.php:74 1
30. require_once(C:\apache\htdocs\wordpress\wp-includes\template-loader.php) C:\apache\htdocs\wordpress\wp-blog-header.php:16 1
31. require(C:\apache\htdocs\wordpress\wp-blog-header.php) C:\apache\htdocs\wordpress\index.php:17 1

Historical explanation

This problem has been reported before, and a rational explanation given, 6 years ago. http://wordpress.org/support/topic/call-to-get_the_excerpt-on-an-excerpt-less-post-invokes-the_content?replies=2

BUT, it didn’t take into account the fact that [[shortcode]] expansion to [shortcode] could have been performed during get_the_excerpt(), BEFORE wp_trim_excerpt(). Which suggests to me that the core logic is wrong in replacing the double [[‘s with a single [. it should use &#91;

An alternative solution, in which the filter function invoked for ‘the_content’ detects the fact that it’s being called from ‘get_the_excerpt’ is not appropriate in this case either.

Workaround

Assuming that the code is not going to be fixed in the very near future, there are a number of workarounds:

  • Create a hand crafted excerpt that doesn’t include [[shortcode]]. This could simply contain

    &nbsp;
     
  • Code a more tag before the first [[shortcode]]
  • Don’t enable Open Graph Meta data
  • Don’t use ANY instances of [[shortcode]]… use [bw_code shortcode] instead.

Fix

See WordPress Trac 26649

See also my original defect report from nearly two years ago ( WordPress 3.3.1 ) WordPress TRAC: #19927 Improve support escaping a shortcode tag

The patch that I submitted for #26649 includes the fix for #19927.