REST APIeasy-svg-pro/v1/settings

easy-svg-pro/v1/settings

Reads or stores the Configurator options that widen the sanitizer's allow-list.

REST endpoint · Easy SVG Pro · Status: Internal · Defined in includes/core/rest.php

Internal: not part of the promised public surface. It may change without notice.

Usage

GET|POST /wp-json/easy-svg-pro/v1/settings

Example

curl -u admin:app-password -H 'Content-Type: application/json' -d '{"tags_enabled":true,"extra_tags":["filter"]}' https://example.com/wp-json/easy-svg-pro/v1/settings

Description

POST merges the body onto the stored option, so a key you leave out keeps its value. extra_tags and extra_attrs take a list or a comma or space separated string. Dangerous names such as script, style, foreignObject, event handlers and href animation are dropped at store time whatever arrives, and listed under rejected. The extras only apply while tags_enabled is true. The old size pair is not part of this answer. Permission: Requires manage_options and an active licence. No single feature flag is needed.

Permission: Requires manage_options and an active licence. No single feature flag is needed.

Parameters

body
tags_enabledboolean

POST only. Whether the extra tags and attributes widen the allow-list.

body
extra_tagsarray|string

POST only. Extra SVG elements to allow.

body
extra_attrsarray|string

POST only. Extra SVG attributes to allow.

Return value

returnWP_REST_Response|WP_Error

tags_enabled, extra_tags and extra_attrs. POST adds rejected with the refused dangerous names per list.

Response

tags_enabled, extra_tags and extra_attrs. POST adds rejected with the refused dangerous names per list.

{
  "tags_enabled": true,
  "extra_tags": [
    "filter"
  ],
  "extra_attrs": [
    "filterUnits"
  ],
  "rejected": {
    "extra_tags": [
      "script"
    ],
    "extra_attrs": []
  }
}
Every name you allow is markup the sanitizer would otherwise have removed. Widen only for sets that need it.
Was this page helpful?