<div dir="ltr">Where was this discussion weeks ago,when we posted it to Make/Themes?<div><br></div><div>This change will not "break" users' sites, and there's nothing that says that developers of current Themes can't propose a migration path to reach compliance. That's the way we've handled such things in the past, and I see no reason that we can't do the same thing here.</div>
</div><div class="gmail_extra"><br><br><div class="gmail_quote">On Thu, Mar 6, 2014 at 1:42 PM, Otto <span dir="ltr"><<a href="mailto:otto@ottodestruct.com" target="_blank">otto@ottodestruct.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">If the guideline is actually going to cause a situation where unwitting users will have their sites broken by our actions, then we cannot implement the guideline in this manner.<div>
<br></div><div>We don't break sites. Not if we can find a better way.</div>
<div><br></div><div>So, slow down a bit here. We can say existing themes should not implement such things, and require stringent security checks if they do. We can say existing themes cannot implement such things as new features. We can say that brand new themes must not implement such things. We can recommend methods of migration.</div>
<div><br></div><div>But what we cannot do is say that theme authors must change things in a way that will break user's sites. That's a non-starter, and it's simply not going to be a realistic guideline to set or enforce.</div>
<div><br></div><div>Over the long term, as things migrate towards what you want, then you make the rules more stringent to round up the stragglers. Phased deployment, in other words. You can't go from 0 to 60 in one swift burst without getting whiplash. :)</div>
<span class="HOEnZb"><font color="#888888">
</font></span><div class="gmail_extra"><span class="HOEnZb"><font color="#888888"><br clear="all"><div>-Otto</div></font></span><div><div class="h5">
<br><br><div class="gmail_quote">On Thu, Mar 6, 2014 at 12:29 PM, Chip Bennett <span dir="ltr"><<a href="mailto:chip@chipbennett.net" target="_blank">chip@chipbennett.net</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div dir="ltr">If Bruce wants to discuss a *migration plan*, that's perfectly acceptable. He and other developers have used them before.<div><br></div><div>But the potential "site breakage" is already inherent in the Themes impacted by the change, if they've been facilitating users to put Theme-unrelated (i.e. arbitrary) scripts in the site header and footer via Theme options. So, a blanket exception? No, I don't think that's the right approach.</div>
</div><div><div><div class="gmail_extra"><br><br><div class="gmail_quote">On Thu, Mar 6, 2014 at 1:26 PM, Chip Bennett <span dir="ltr"><<a href="mailto:chip@chipbennett.net" target="_blank">chip@chipbennett.net</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">Site analytics have been Plugin Territory for some time now.<div><br></div><div>And a migration path isn't what the premise here; a grandfather exception is what was requested.</div>
</div><div><div><div class="gmail_extra">
<br><br><div class="gmail_quote">On Thu, Mar 6, 2014 at 1:02 PM, Otto <span dir="ltr"><<a href="mailto:otto@ottodestruct.com" target="_blank">otto@ottodestruct.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div dir="ltr">I'm kinda with Bruce on this one, this seems a bit strict to push entirely in one change.<div><br></div><div>I would say that a theme is allowed to do this sort of thing *if* it has proper safety checks surrounding it. User must have unfiltered_html, and if not, then the data has to be run through kses (much like core does in posts/comments and such). </div>
<div><br></div><div>I would also say that it is recommended for themes to not have that sort of functionality at all, in favor of plugins that do this sort of thing, so that a user using those fields for, say, Google Analytics doesn't lose them when changing themes. Which is, of course, the point. Themes should not have things that leads to a de-facto lock in when used for obvious purposes. Theme authors that already have them should transition users to using plugins and other non-theme dependent items for same.</div>
<div><br></div><div>In the end, we need to focus on what's best for the users, and while it's definitely better for them to not have these in themes, it's not acceptable for us to enforce a system that will break sites because we think it's somehow good for users as a whole. Even if we're right, we have to be backward compatible here, and migrate to such rules over time, not all at once.</div>
<span><font color="#888888">
<div><br></div></font></span></div><div class="gmail_extra"><span><font color="#888888"><br clear="all"><div>-Otto</div></font></span><div><div>
<br><br><div class="gmail_quote">On Thu, Mar 6, 2014 at 11:48 AM, Bruce Wampler <span dir="ltr"><<a href="mailto:weavertheme@gmail.com" target="_blank">weavertheme@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div dir="ltr"><div>I know how to do it for future users, but I don't know any way to get people to read a notice to install the plugin BEFORE updating the theme. And unless the plugin is there first to capture those settings, the Settings API will will wipe out previous settings the instant they try to change any other options. Users: screwed. Sure it is their own fault for not reading the instructions, but that is just how people are.<br>
<br></div>And, and as I've said before, only a tiny tiny tiny fraction of WP users can or even want to know squat about doing anything involving PHP. I seriously don't understand why you keep saying that we should expect/hope/want an average WP theme user to want to do anything involving PHP. That is just not a reasonable expectation.<div>
<div><br>
<div class="gmail_extra"><br><br><div class="gmail_quote">On Thu, Mar 6, 2014 at 10:29 AM, Chip Bennett <span dir="ltr"><<a href="mailto:chip@chipbennett.net" target="_blank">chip@chipbennett.net</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><p dir="ltr">"Screwing" you users is only dependent on you not properly transitioning theme settings to your plugin.</p>
<div><div>
<div class="gmail_quote">On Mar 6, 2014 12:27 PM, "Bruce Wampler" <<a href="mailto:weavertheme@gmail.com" target="_blank">weavertheme@gmail.com</a>> wrote:<br type="attribution"><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div dir="ltr"><div><div>So, in other words, I'm forced to screw thousands of my theme users. So be it.<br><br></div>Right now, users with raw html capability can insert whatever they want, including JavaScript, into <head>, the header, and the footer.<br>
<br></div>They've been able to do this since I introduced by theme in 2010, and there are thousands and thousands of users who've been using that capability with no know issues for all that time.<br></div><div class="gmail_extra">
<br><br><div class="gmail_quote">On Thu, Mar 6, 2014 at 10:22 AM, Chip Bennett <span dir="ltr"><<a href="mailto:chip@chipbennett.net" target="_blank">chip@chipbennett.net</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<p dir="ltr">Any arbitrary script/stylesheet that hooks into wp_head or wp_footer (or that can/should do so) is exactly the focus of the guideline change. Allowing a grandfather exception would defeat the purpose.</p>
<p dir="ltr"> If you're talking about markup at template locations, that's possibly worth discussing.</p><div><div>
<div class="gmail_quote">On Mar 6, 2014 12:16 PM, "Bruce Wampler" <<a href="mailto:weavertheme@gmail.com" target="_blank">weavertheme@gmail.com</a>> wrote:<br type="attribution"><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div dir="ltr"><div>I'm trying to avoid specifics on this general group, but, to generalize...<br><br></div><div>Using the WP Settings API runs all settings through validation checks which often filter the content, possibly deleting part of a particular setting through the filter (think JavaScript). So, my existing validation/filters allow one kind of content to be accepted (for those with raw html capability only). The new guidelines prohibit that kind of content in some places, so to comply with the new guidelines, I would have to simply change the validation filter to remove that content. But that same filter will then also remove that content from any users who had previously had the now prohibited content. So their sites will now be broken just by updating to the new version and opening the admin page - the previously valid settings will be filtered out. <br>
<br></div><div>A plugin (which has been suggested as a way around this requirement) is not a solution in this case because they would have to install the plugin before updating to a new 3.9 compliant version of the theme, and then simply deactivating the plugin would revert to removing the settings which is not very user friendly behavior. So the only solution I can see to not screw my exiting users is to ask to get this one thing grandfathered for my existing themes.<br>
</div><div><br><br></div><div><div><div class="gmail_extra"><br><br><div class="gmail_quote">On Thu, Mar 6, 2014 at 9:51 AM, Derek Herman <span dir="ltr"><<a href="mailto:derek@valendesigns.com" target="_blank">derek@valendesigns.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div style="word-wrap:break-word">Hey Bruce,<div><br></div><div>I just read the WordPress 3.9 proposal and didn't see anything about settings being erased - could you please elaborate on what would cause that?<br>
<div>
<span style="text-indent:0px;letter-spacing:normal;font-variant:normal;text-align:-webkit-auto;font-style:normal;font-weight:normal;line-height:normal;border-collapse:separate;text-transform:none;white-space:normal;font-family:Helvetica;word-spacing:0px"><div>
<span style="font-size:12px"><br>Cheers,</span><br><span style="font-size:12px">Derek Herman</span><br><font style="font-size:medium" color="#144fae"><span style="font-size:12px"><a href="http://valendesigns.com" target="_blank">http://valendesigns.com</a></span></font></div>
</span></div><div><br><br></div><br></div></div><br>_______________________________________________<br>
theme-reviewers mailing list<br>
<a href="mailto:theme-reviewers@lists.wordpress.org" target="_blank">theme-reviewers@lists.wordpress.org</a><br>
<a href="http://lists.wordpress.org/mailman/listinfo/theme-reviewers" target="_blank">http://lists.wordpress.org/mailman/listinfo/theme-reviewers</a><br>
<br></blockquote></div><br></div></div></div></div>
<br>_______________________________________________<br>
theme-reviewers mailing list<br>
<a href="mailto:theme-reviewers@lists.wordpress.org" target="_blank">theme-reviewers@lists.wordpress.org</a><br>
<a href="http://lists.wordpress.org/mailman/listinfo/theme-reviewers" target="_blank">http://lists.wordpress.org/mailman/listinfo/theme-reviewers</a><br>
<br></blockquote></div>
</div></div><br>_______________________________________________<br>
theme-reviewers mailing list<br>
<a href="mailto:theme-reviewers@lists.wordpress.org" target="_blank">theme-reviewers@lists.wordpress.org</a><br>
<a href="http://lists.wordpress.org/mailman/listinfo/theme-reviewers" target="_blank">http://lists.wordpress.org/mailman/listinfo/theme-reviewers</a><br>
<br></blockquote></div><br></div>
<br>_______________________________________________<br>
theme-reviewers mailing list<br>
<a href="mailto:theme-reviewers@lists.wordpress.org" target="_blank">theme-reviewers@lists.wordpress.org</a><br>
<a href="http://lists.wordpress.org/mailman/listinfo/theme-reviewers" target="_blank">http://lists.wordpress.org/mailman/listinfo/theme-reviewers</a><br>
<br></blockquote></div>
</div></div><br>_______________________________________________<br>
theme-reviewers mailing list<br>
<a href="mailto:theme-reviewers@lists.wordpress.org" target="_blank">theme-reviewers@lists.wordpress.org</a><br>
<a href="http://lists.wordpress.org/mailman/listinfo/theme-reviewers" target="_blank">http://lists.wordpress.org/mailman/listinfo/theme-reviewers</a><br>
<br></blockquote></div><br></div></div></div></div>
<br>_______________________________________________<br>
theme-reviewers mailing list<br>
<a href="mailto:theme-reviewers@lists.wordpress.org" target="_blank">theme-reviewers@lists.wordpress.org</a><br>
<a href="http://lists.wordpress.org/mailman/listinfo/theme-reviewers" target="_blank">http://lists.wordpress.org/mailman/listinfo/theme-reviewers</a><br>
<br></blockquote></div><br></div></div></div>
<br>_______________________________________________<br>
theme-reviewers mailing list<br>
<a href="mailto:theme-reviewers@lists.wordpress.org" target="_blank">theme-reviewers@lists.wordpress.org</a><br>
<a href="http://lists.wordpress.org/mailman/listinfo/theme-reviewers" target="_blank">http://lists.wordpress.org/mailman/listinfo/theme-reviewers</a><br>
<br></blockquote></div><br></div>
</div></div></blockquote></div><br></div>
</div></div><br>_______________________________________________<br>
theme-reviewers mailing list<br>
<a href="mailto:theme-reviewers@lists.wordpress.org" target="_blank">theme-reviewers@lists.wordpress.org</a><br>
<a href="http://lists.wordpress.org/mailman/listinfo/theme-reviewers" target="_blank">http://lists.wordpress.org/mailman/listinfo/theme-reviewers</a><br>
<br></blockquote></div><br></div></div></div></div>
<br>_______________________________________________<br>
theme-reviewers mailing list<br>
<a href="mailto:theme-reviewers@lists.wordpress.org">theme-reviewers@lists.wordpress.org</a><br>
<a href="http://lists.wordpress.org/mailman/listinfo/theme-reviewers" target="_blank">http://lists.wordpress.org/mailman/listinfo/theme-reviewers</a><br>
<br></blockquote></div><br></div>