WordPress 4.9 Will Support Shortcodes and Embedded Media in the Text Widget

WordPress 4.8 brought TinyMCE to the core Text widget, along with brand new Image, Video, and Audio media widgets. The upcoming 4.9 release builds on this progress and will introduce some long-awaited improvements to Text widget. Users will finally be able to use shortcodes in the Text widget without the help of additional code from plugins or themes.

This new feature is the answer to an eight-year-old ticket requesting shortcode support inside the Text widget. Weston Ruter broke down the technical details in the dev note for the feature, explaining why it took so long to find a solution:

One reason for the long delay with adding shortcode support in Text widgets was due to many shortcodes looking for a global $post when they run. Since the global $post varies depending on whatever the query is, the shortcodes in a Text widget could render wildly different on different templates of a site. The solution worked out was to temporarily nullify the global $post before doing the shortcodes so that they will consistently have the same global state, with this global $post then restored after the shortcodes are done.

Hundreds of thousands of WordPress installations currently use a plugin to add shortcode support to widgets. Contributors to 4.9 have taken this into account so that updating will not cause unexpected issues.

“If a plugin has added do_shortcode() to widget_text then this filter will be suspended while the widget runs to prevent shortcodes from being applied twice,” Ruter said.

In addition to the new core gallery widget landing in 4.9, this release will also allow users to embed media in the Text widget. A new “Add Media” button is available, making it easy for users to insert images, audio, galleries, and videos, along with text and other content. WordPress 4.9 also adds support for oEmbeds in the Text widget and the Video widget has been updated with expanded support for any oEmbed provider for video.

Little enhancements like these make it easier for users to update their own websites without having to hire a developer or add extra plugins for things that should be simple. The improvements to widgets have also been implemented in such a way that users will be more prepared for how Gutenberg will handle media.

“The media-specific widgets are closely aligned with blocks in Gutenberg; the existence of media inside the Text widget will align with eventual nested blocks in Gutenberg, and would be treated as Classic Text blocks in any future migration from widgets to blocks,” Ruter said.

WordPress 4.9 will improve the experience of switching between themes by including logic that is better at mapping widgets between two themes’ widget areas. This release will also improve the UI for updating and saving widgets in the admin screen. It adds an indicator that shows whether or not widget changes have been saved, as well as a notice if the user attempts to leave the page with unsaved changes.

7 Comments


  1. Oops! Security!

    This article sounds like this will allow visitors to execute shortcodes that were previously restricted to authors (by using known shortcodes in comments, e-mail forms and other places with a user facing text widget).

    Not counting the sites that run the current shortcodes-in-text-widgets plugin (who hopefully know what they are doing), that’s a huge increase in the attack surface on wordpress sites and blogs.

    For example if some extension provides a shortcode for running a traceroute back from the server to the visitors webbrowser, and the wordpress admin has avoided any related exploits by simply telling the handful of trusted authors to never use that shortcode (but still use some other cool feature of the same extension). Then allowing comments to invoke that shortcode could provide an instant way to pawn the blog and even the entire server (because many systems require traceroute to be run as root).

    Feels like a major code review will be needed before upgrading any site to 4.9.

    Report

    Reply

    1. How are you reading that into this post. The article says nothing about user facing forms?

      Report

      Reply

  2. Interesting message they’re sending with this release:

    Gutenberg Team – “Blocks are the future! Stop using shortcodes where possible and start porting your Shortcodes to Blocks today.”

    WP Core Team – “Great new feature – Expanded Shortcode Support in core Widgets!”

    Report

    Reply

  3. Great news. I am a big fan of WordPress.
    I will update all my blogs soon to see how it works

    Report

    Reply

Leave a Reply

Your email address will not be published. Required fields are marked *