=== Safe SVG ===
Contributors: 10up, enshrined
Tags: svg, sanitize, upload, sanitise, security, svg upload, image, vector, file, graphic, media, mime
Requires at least: 4.7
Tested up to: 5.9
Stable tag: 1.9.10
Requires PHP: 7.0
License: GPLv2 or later
License URI: http://www.gnu.org/licenses/gpl-2.0.html
Enable SVG uploads and sanitize them to stop XML/SVG vulnerabilities in your WordPress website
== Description ==
Safe SVG is the best way to Allow SVG Uploads in WordPress!
It gives you the ability to allow SVG uploads whilst making sure that they're sanitized to stop SVG/XML vulnerabilities affecting your site. It also gives you the ability to preview your uploaded SVGs in the media library in all views.
#### Current Features
* **Sanitised SVGs** - Don't open up security holes in your WordPress site by allowing uploads of unsanitised files.
* **View SVGs in the Media Library** - Gone are the days of guessing which SVG is the correct one, we'll enable SVG previews in the WordPress media library.
#### Features on the Roadmap
* **SVGO Optimisation** - You'll have the option to run your SVGs through our SVGO server on upload to save you space.
* **Choose Who Can Upload** - Restrict SVG uploads to certain users on your WordPress site or allow anyone to upload.
Initially a proof of concept for [#24251](https://core.trac.wordpress.org/ticket/24251).
SVG Sanitization is done through the following library: [https://github.com/darylldoyle/svg-sanitizer](https://github.com/darylldoyle/svg-sanitizer).
== Installation ==
Install through the WordPress directory or download, unzip and upload the files to your `/wp-content/plugins/` directory
== Frequently Asked Questions ==
= Can we change the allowed attributes and tags? =
Yes, this can be done using the `svg_allowed_attributes` and `svg_allowed_tags` filters.
They take one argument that must be returned. See below for examples:
add_filter( 'svg_allowed_attributes', function ( $attributes ) {
// Do what you want here...
// This should return an array so add your attributes to
// to the $attributes array before returning it. E.G.
$attributes[] = 'target'; // This would allow the target="" attribute.
return $attributes;
} );
add_filter( 'svg_allowed_tags', function ( $tags ) {
// Do what you want here...
// This should return an array so add your tags to
// to the $tags array before returning it. E.G.
$tags[] = 'use'; // This would allow the <use> element.
return $tags;
} );
== Changelog ==
= 1.9.10 - 2022-02-23 =
**Note that this release bumps the WordPress minimum version from 4.0 to 4.7 and the PHP minimum version from 5.6 to 7.0.**
* **Changed:** Bump WordPress minimum version from 4.0 to 4.7 (props [@cadic](https://github.com/cadic)).
* **Changed:** Bump PHP minimum version from 5.6 to 7.0 (props [@mehidi258](https://github.com/mehidi258), [@iamdharmesh](https://github.com/iamdharmesh), [@amdd-tim](https://github.com/amdd-tim), [@darylldoyle](https://github.com/darylldoyle), [@jeffpaul](https://github.com/jeffpaul)).
* **Changed:** Update `enshrined/svg-sanitize` from 0.13.3 to 0.5.2 (props [@mehidi258](https://github.com/mehidi258), [@iamdharmesh](https://github.com/iamdharmesh), [@amdd-tim](https://github.com/amdd-tim), [@darylldoyle](https://github.com/darylldoyle), [@jeffpaul](https://github.com/jeffpaul), [@cadic](https://github.com/cadic)).
* **Changed:** Bump WordPress version "tested up to" 5.9 (props [@BBerg10up](https://github.com/BBerg10up), [@jeffpaul](https://github.com/jeffpaul), [@cadic](https://github.com/cadic)).
* **Changed:** Updated library location and added a new build step (props [@darylldoyle](https://github.com/darylldoyle), [@dkotter](https://github.com/dkotter)).
* **Changed:** Updated plugin assets and added docs and repo management workflows via GitHub Actions (props [Brooke Campbell](https://www.linkedin.com/in/brookecampbelldesign/), [@jeffpaul](https://github.com/jeffpaul)).
* **Fixed:** Double slash being added in SVG file URL for newer uploads (props [@mehulkaklotar](https://github.com/mehulkaklotar), [@smerriman](https://github.com/smerriman)).
* **Fixed:** Float value casting for SVGs when fetching width and height (props [@mehulkaklotar](https://github.com/mehulkaklotar), [@smerriman](https://github.com/smerriman)).
* **Fixed:** Use calculated size for SVGs instead of using `false` (props [@dkotter](https://github.com/dkotter), [@darylldoyle](https://github.com/darylldoyle), [@fritteli](https://github.com/fritteli)).
* **Fixed:** Add better file type checking when looking for SVG files (props [@davidhamann](https://github.com/davidhamann), [@dkotter](https://github.com/dkotter), [@darylldoyle](https://github.com/darylldoyle)).
= 1.9.9 - 2020-05-07=
* **Fixed:** Issue where 100% width is accidentally converted to 100px width (props [@joehoyle](https://github.com/joehoyle)).
= 1.9.8 - 2020-05-07=
* **Changed:** Underlying library update.
= 1.9.7 - 2019-12-10=
* **Changed:** Underlying library update.
= 1.9.6 - 2019-11-07=
* **Security:** Underlying library update that fixes a security issue.
= 1.9.5 - 2019-11-04=
* **Security:** Underlying library update that fixes some security issues.
= 1.9.4 - 2019-08-21=
* **Fixed:** Bug causing lots of error log output to do with `safe_svg::fix_direct_image_output()`.
= 1.9.3 - 2019-02-19=
* **Fixed:** Bug causing 0 height and width SVGs.
= 1.9.2 - 2019-02-14=
* **Fixed:** Warning about an Illegal string offset.
* **Fixed:** Issue if something other than a WP_Post object is passed in via the `wp_get_attachment_image_attributes` filter.
= 1.9.1 - 2019-01-29=
* **Fixed:** Warning that was being generated by a change made in 1.9.0.
= 1.9.0 - 2019-01-03=
* **Changed:** If an image is the correct ratio, allow skipping of the crop popup when setting header/logo images with SVGs.
= 1.8.1 - 2018-11-22=
* **Changed:** Don't let errors break upload if uploading an empty file
* **Fixed:** Featured image display in Gutenberg. Props [@dmhendricks](https://github.com/dmhendricks) :)
= 1.8.0 - 2018-11-04=
* **Added:** Pull SVG dimensions from the width/height or viewbox attributes of the SVG.
* **Added:** role="img" attribute to SVGs.
= 1.7.1 - 2018-10-01=
* **Changed:** Underlying lib and added new filters for filtering allowed tags and attributes.
= 1.7.0 - 2018-10-01=
* **Added:** Allow devs to filter tags and attrs within WordPress.
= 1.6.1 - 2018-03-17=
* **Changed:** Images will now use the size chosen when inserted into the page rather than default to 2000px everytime.
= 1.6.0 - 2017-12-20=
* **Added:** Fairly big new feature - The library now allows `<use>` elements as long as they don't reference external files!
* **Fixed:** You can now also embed safe image types within the SVG and not have them stripped (PNG, GIF, JPG).
= 1.5.3 - 2017-11-16=
* **Fixed:** 1.5.2 introduced an issue that can freeze the media library. This fixes that issue. Sorry!
= 1.5.2 - 2017-11-15=
* **Changed:** Tested with 4.9.0.
* **Fixed:** Issue with SVGs when regenerating media.
= 1.5.1 - 2017-08-21=
* **Fixed:** PHP strict standards warning.
= 1.5.0 - 2017-06-20=
* **Changed:** Library update.
* **Changed:** role, aria- and data- attributes are now whitelisted to improve accessibility.
= 1.4.5 - 2017-06-18=
* **Changed:** Library update.
* **Fixed:** some issues with defining the size of an SVG.
= 1.4.4 - 2017-06-07=
* **Fixed:** SVGs now display as featured images in the admin area.
= 1.4.3 - 2017-03-06=
* **Added:** WordPress 4.7.3 Compatibility.
* **Changed:** Expanded SVG previews in media library.
= 1.4.2 - 2017-02-26=
* **Added:** Check / fix for when mb_* functions are not available.
= 1.4.1 - 2017-02-23=
* **Changed:** Underlying library to allow attributes/tags in all case variations.
= 1.4.0 - 2017-02-21=
* **Added:** Ability to preview SVG on both grid and list view in the wp-admin media area
* **Changed:** Underlying library version.
= 1.3.4 - 2017-02-20=
* **Fixed:** SVGZ uploads failing and not sanitising correctly.
= 1.3.3 - 2017-02-15=
* **Changed:** Allow SVGZ uploads.
= 1.3.2 - 2017-01-27=
* **Fixed:** Mime type issue in 4.7.1. Mad props to [@LewisCowles1986](https://github.com/LewisCowles1986).
= 1.3.1 - 2016-12-01=
* **Changed:** Underlying library version.
= 1.3.0 - 2016-10-10=
* **Changed:** Minify SVGs after cleaning so they can be loaded correctly through `file_get_contents`.
= 1.2.0 - 2016-02-27=
* **Added:** Support for camel case attributes such as viewBox.
= 1.1.1 - 2016-07-06=
* **Fixed:** Issue with empty svg elements self-closing.
= 1.1.0 - 2015-07-04=
* **Added:** I18n.
* **Added:** da, de ,en, es, fr, nl and ru translations.
* **Fixed:** Issue with filename not being pulled over on failed uploads.
= 1.0.0 - 2015-07-03=
* Initial Release.
== Upgrade Notice ==
= 1.9.10 =
* Important: bumped the WordPress minimum version from 4.0 to 4.7 and the PHP minimum version from 5.6 to 7.0.