內容簡介
SaniGlyph SVG 允許選定的 WordPress 角色上傳 SVG 檔案，同時保持持續的檔案清理功能。此外掛專注於安全性與檔案完整性，確保上傳的 SVG 檔案不會被隱性修改。
【主要功能】
• 永久啟用 SVG 檔案清理功能
• 僅支援純 .svg 檔案上傳
• 角色基礎的上傳權限設定
• 媒體庫中顯示 SVG 尺寸與預覽
• 支援 [saniglyph_svg] 短碼進行內嵌渲染
• 動態內嵌 SVG 區塊供區塊編輯器使用
外掛標籤
開發者團隊
原文外掛簡介
SaniGlyph SVG enables SVG uploads for selected WordPress roles while keeping sanitization permanently enabled.
SVG files are XML-based and can contain active or externally referenced content. SaniGlyph SVG uses a fail-closed, allowlist-based validation pipeline before an uploaded SVG is stored. Unsafe or unsupported SVGs are rejected rather than silently rewritten. Valid SVGs keep their original fills, strokes, CSS, gradients, XML formatting, and exporter-specific presentation markup.
Features
Always-on SVG sanitization. It cannot be disabled from the settings screen.
Plain .svg uploads only. Compressed .svgz uploads are intentionally not enabled.
Conservative optimization that preserves geometry, text spacing, and title/description accessibility content.
Role-based upload permissions in addition to WordPress’ normal upload_files capability; administrators are the secure default for new installs.
SVG dimensions and previews in the Media Library.
Optional inline rendering through the [saniglyph_svg] shortcode.
Dynamic Inline SVG block for the block editor.
No external services, telemetry, tracking, or remote code.
Inline shortcode
Enable inline rendering under Settings > SaniGlyph SVG, then use:
[saniglyph_svg id="123"]
Optional attributes:
[saniglyph_svg id="123" class="site-logo" width="160" height="48"]
Inline output is validated again at render time and escaped with a dedicated SVG KSES allowlist immediately before WordPress renders it. Scoped CSS rules preserve approved fills, strokes, gradients, filters, and local fragment references without changing KSES behavior elsewhere on the site.
What makes SaniGlyph different?
SaniGlyph focuses on a narrow security-and-fidelity workflow rather than merely adding the SVG MIME type. It rejects the complete upload when unsupported active content is found instead of silently removing pieces from the artwork. Accepted files pass validation before storage, again after optional optimization, and again before inline output. Inline shortcode and block callbacks then apply WordPress KSES output escaping with SVG-specific rules scoped to that single render operation.
