Shortcode Bug

[YanMetelitsa]

Greetings!

I noticed, that on some sites the [acf] shortcode does not work, while on some sites it works (with the same versions of WordPress and SCF).

When trying to output shortcode [acf field=”..."], an empty string is displayed. Everywhere – in page/post content, plugins etc..

I checked if the shortcode is registered using $GLOBALS[ 'shortcode_tags' ] – shortcode [acf] is registered.

At the same time, if you recreate the shortcode, it starts working correctly:

add_shortcode( 'acf', function ( $atts ) {
	$value = apply_filters(
		'acf/format_value', 
		get_field( $atts[ 'field' ], $atts[ 'post_id' ] )
	);

	return $value;
});

[pkevan]

Hi @YanMetelitsa, thanks for the report - is there any further details you can share with the sites you were testing this on? and any differences between the ones which work and don't i.e. themes/plugins?

[YanMetelitsa]

Hi, @pkevan! The sites are practically the same. I dug a bit deeper into the issue and found out:

• Starting from ACF 6.3, shortcode is disabled by default in new installations for security reasons.
• On the site where the shortcode works, ACF was installed first, then SCF was added (system status shows it as enabled).
• On the site where the shortcode doesn't work, SCF was installed right away (system status shows it as disabled).
• I added the shortcode activation hook to the second site:

add_action( 'acf/init', function () {
    acf_update_setting( 'enable_shortcode', true );
});

• Now the system status shows the shortcode as enabled.
• The shortcode still doesn't work.

That's all the information I've managed to find out so far.

[pkevan]

Thanks - I can see it here in the code: https://github.com/WordPress/secure-custom-fields/blob/trunk/secure-custom-fields.php#L172-L175 but don't fully understand if or why or when it should be possible to do this - i'll investigate further.

[YanMetelitsa]

Okay, I'll also try to find time to look for the cause of this error in the code. Especially since I've already been contacted several times with this problem, that is, it's quite widespread and, in theory, occurs on any new SCF installation.

[pkevan]

I have a feeling it's probably related to a misplaced text translation string: https://github.com/WordPress/secure-custom-fields/blob/trunk/includes/api/api-template.php#L1043 - looking at https://developer.wordpress.org/reference/functions/shortcode_atts/ it seems like that parameter should be acf in order for the shortcode attributes to be read.

[YanMetelitsa]

I dug a little deeper into the problem and found out:

• The acf_shortcode() function returns in section 1083-1089
• Since the condition associated with $field[ 'allow_in_bindings' ] is met
• In my case return on line 1087, since this is not a preview page
• If you activate the Allow Access to Value in Editor UI parameter in the Presentation tab for the required field, the shortcode starts working and displays the value

I think a good idea might be to replace the empty return on line 1087 with an instruction message:

/* translators: %s: Field label */
return apply_filters( 'acf/shortcode/field_not_allowed_message', '[' . sprintf( esc_html__( 'You need to enable "Allow Access to Value in Editor UI" in the "%s" field parameters to display it in the ACF Shortcode.', 'secure-custom-fields' ), $field[ 'label' ] ) . ']' );