Meta Box

Hi,

This is similar to what we've done in the MB REST API plugin. Please take a look at the plugin code to see how it's done.

Yes, that can be done with this filter:

https://docs.metabox.io/actions/#rwmb_field_id_after_save_field

add_action( 'rwmb_YOUR_FIELD_ID_after_save_field', function( $null, $field, $new, $old, $object_id ) {
    $term_ids = $new;
    if ( $field['clone'] ) {
        $term_ids = [];
        foreach ( $new as $clone_value ) {
            $term_ids = array_merge( $term_ids, $clone_value );
        }
    }
    wp_set_post_terms( $object_id, $term_ids, 'YOUR_TAXONOMY' );
}, 10, 5 );

I see. Removing the "content" from the shortcode breaks the date picker. I've just fixed it in this commit. Please try it. The new version is coming soon.

This bug is fixed in version 1.0.3. New version for AIO will come a little later.

Oh, I see the problem. After saving, only the 1st input has the filter working. I'll fix it now.

Hi Mary,

Do you see any error in the browser console?

Hi Rao,

I really appreciate your thoughts on this.

I understand the need for default sanitization. And believe me, this is what I also want to add to the plugin.

You also pointed out a very important point (point 1), which makes me not pushing the santization so hard. Meta Box is now actively used on 400k+ websites. Any change we make will affect these huge amount of websites. I can't notify the developers (there's no way to let them know because WordPress.org doesn't provide any way to contact to them). So, I decide to not implement a forced / opinionated sanitization at the moment. I have to be very careful about this.

Another thing that people should consider is: Meta Box is not an end-user tools. It's a tool for developers which provides API. So there's nothing like Meta Box --> Users, but it's more like Meta Box --> Developers --> Users. Because of this, developers understand which kind of data they want their users to enter. And thus, a sanitization callback fits this situation.

If you're building a new plugin / solution using Meta Box, why don't you implement this with just a few lines of code instead of depending the default sanitization which might not work smoothly in all cases?

There are also a few things regarding sanitization in WordPress, that I think worth mentioning:

• Admins can enter script and style in the post content, regardless the santiziation of wp_kses_post.
• Customizer API requires (not strictly) developers to enter santiziation callback. If no sanitization callback, then what users enter will be used.
• wp_insert_post doesn't do any sanitization for the content when inserting the post programmatically.

Anyway, there is a default sanitization for some fields (email, url, file_input, checkboxes). For other fields, due to the nature of the complexity, I haven't implemented that. If you have any idea on which proper sanitization for each field type, please let me know.

I've added support for sanitize_callback here. Please try it and let me know if you need any improvement.