Disabling WYSIWYG tab via the wp_editor_settings filter breaks the editor if it contains a textarea tag

[andruxnet]

I got the request from a client to disable the WYSIWYG tab so that the site admin could only use html for a custom post type, I was able to do this using a few techniques - CSS, user_can_richedit filter, plugins, etc - but this particular case it was needed to be applied to the default WP editor only - the one I print using the_content() - since the site uses other wp_editors for that custom post type.

Anyway I was able to do it using the wp_editor_settings filter, the only problem was that the value in this editor contains a textarea tag, and the editor breaks as soon as it reaches "<textarea>", as can be seen in the screenshot attached.

I was able to make this work anyway, using a second filter, but I think this should be part of the WP core. I would be more than happy to submit the fix myself if this issue is considered for the next patch.

[andruxnet]

before and after saving the html content

[johnbillion]

Thanks for the report andruxnet.

I'm unable to reproduce this just by using the "Disable the visual editor when writing" setting on the user profile screen. Can you share the code you're using to disable the visual editor please?

[andruxnet]

Sure, here it is.

function disable_visual_tab( $settings, $editor_id ) {
	global $post;

	if ( get_post_type( $post ) === 'form' ) {
		if ( $editor_id === 'content' ) {
			$settings['tinymce'] = false;
		}
	}

	return $settings;
}
add_filter( 'wp_editor_settings', 'disable_visual_tab', 10, 2 );

[azaozz]

The problem here is that when TinyMCE is disabled the post content is not escaped before outputting it in the textarea. This is supported in HTML with the exception of the </textarea> tag. Will be fixed with #32425 which normalizes the escaping for both editors.

[andruxnet]

Right, that's what's happening.

In my case I fixed it by using a second filter like below, so the fix I was thinking was to run esc_textarea() through the editor content all the time - not sure if this would affect anything else, though.

function wp_editor_escape_textarea( $content ) {
	global $post;

	if ( get_post_type( $post ) === 'form' ) {
		return esc_textarea( $content );
	}

	return $content;
}
add_filter( 'the_editor_content', 'wp_editor_escape_textarea' );