Kirki: WordPress blocks svg uploads: workaround?

[runnickrun]

Issue description:

I'd like to create an image option, where user can upload svg logo.
WordPress, though, doesn't allow svg uploading because of security concerns.
There is a plugin with sanitizing library, but it's an overkill in my opinion for just one field. Also, options are shown only for admin, who can be trusted I suppose.

Is there a workaround for this issue? (I understand it is rather WP Uploader issue, rather than Kirki one).

Version used:

2.3.8

Using theme_mods or options?

theme_mods

Code to reproduce the issue (config + field(s))

There is no specific code.

Thanks so much for the awesome framework!

[aristath]

Check out https://css-tricks.com/snippets/wordpress/allow-svg-through-wordpress-media-uploader/

[MapSteps]

I've added the code snippets from css-tricks and uploading svg files works great.

Nothing happens if i try to select the svg image though. It still shows the previous selected image (or no image if none was selected before).

Btw, do you want me to create a new ticket in such a case or is it fine to comment on closed tickets? 😄 Thanks!

[aristath]

Yeah, previewing the SVGs is not as easy as being able to select them.

[aristath]

Btw, do you want me to create a new ticket in such a case or is it fine to comment on closed tickets? 😄 Thanks!

In general if it's a different ticket it should be new. In this case I think it's ok.
I reopened this issue to examine if we can work out the previewing issue etc for 3.1

[runnickrun]

Also, do I understand correct css-tricks code allows SVG uploads for all roles?

[MapSteps]

@runnickrun,

it allows svg upload in general. so yes, for all user roles.

[runnickrun]

@MapSteps Should it be taken into account? Because if you develop for yourself that's fine, but for a client, security issues arise.

Again, there are some plugins for support and so on, but how convenient to include those for just one field?

[MapSteps]

Personally, I wouldn't allow svg uploads by default. One of my clients tried to use the css-tricks code and opened a ticket. you can see his results on the screenshot above.

[runnickrun]

@MapSteps for now you can use regular WP_Customize_Image_Control: it seems to render svg fine

$wp_customize->add_control( new WP_Customize_Image_Control( $wp_customize, 'm1_logo', array(
        'label'    => __( 'Upload Logo (replaces text)', 'm1' ),
        'section'  => 'title_tagline',
        'settings' => 'm1_logo',
    ) ) );

[MapSteps]

Just wanted to catch up with you. I still get issues, not only previewing the SVG, it also doesn't save and publish for me.

Maybe we can reopen this :)

[faebe]

Plugin workaround: Using the 'Safe SVG' plugin let's you upload, preview and select an SVG in the page builder framework (and anywhere else). And gives you at least some level of security...