-
Notifications
You must be signed in to change notification settings - Fork 822
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Fix wysiwyg sanitisation #11201
Fix wysiwyg sanitisation #11201
Changes from all commits
99e965b
584968e
a4adad6
2bdc24c
72692f9
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
Original file line number | Diff line number | Diff line change | ||||
---|---|---|---|---|---|---|
|
@@ -250,13 +250,11 @@ class TinyMCEConfig extends HTMLEditorConfig implements i18nEntityProvider | |||||
private static $image_size_presets = [ ]; | ||||||
|
||||||
/** | ||||||
* TinyMCE JS settings | ||||||
* Default TinyMCE JS options which apply to all new configurations. | ||||||
* | ||||||
* @link https://www.tiny.cloud/docs/tinymce/6/tinydrive-getting-started/#configure-the-required-tinymce-options | ||||||
* | ||||||
* @var array | ||||||
*/ | ||||||
protected $settings = [ | ||||||
private static array $default_options = [ | ||||||
'fix_list_elements' => true, // https://www.tiny.cloud/docs/tinymce/6/content-filtering/#fix_list_elements | ||||||
'formats' => [ | ||||||
'alignleft' => [ | ||||||
|
@@ -311,8 +309,24 @@ class TinyMCEConfig extends HTMLEditorConfig implements i18nEntityProvider | |||||
'promotion' => false, | ||||||
'upload_folder_id' => null, // Set folder ID for insert media dialog | ||||||
'link_default_target' => '_blank', // https://www.tiny.cloud/docs/tinymce/6/autolink/#example-using-link_default_target | ||||||
// Default set of valid_elements which apply for all new configurations | ||||||
'valid_elements' => "@[id|class|style|title],a[id|rel|rev|dir|tabindex|accesskey|type|name|href|target|title" | ||||||
. "|class],-strong/-b[class],-em/-i[class],-strike[class],-u[class],#p[id|dir|class|align|style],-ol[class]," | ||||||
. "-ul[class],-li[class],br,img[id|dir|longdesc|usemap|class|src|border|alt=|title|hspace|vspace|width|height|align|name|data*]," | ||||||
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more.
Suggested change
Is that a typo with the = for alt? Do we want name, hspace, space for the old extended_valid_elements from admin that's being deleted? There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more.
The
It's only being deleted because I've moved those here. They seem safe, so I'd be inclined to keep them here. If you have a specific reason not to, I can move them back to There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more.
Sorry I'm blind, somehow I managed to not noticed they're copied over. Yes keep them as is in this PR |
||||||
. "-sub[class],-sup[class],-blockquote[dir|class],-cite[dir|class|id|title]," | ||||||
. "-table[cellspacing|cellpadding|width|height|class|align|summary|dir|id|style]," | ||||||
. "-tr[id|dir|class|rowspan|width|height|align|valign|bgcolor|background|bordercolor|style]," | ||||||
. "tbody[id|class|style],thead[id|class|style],tfoot[id|class|style]," | ||||||
. "#td[id|dir|class|colspan|rowspan|width|height|align|valign|scope|style]," | ||||||
. "-th[id|dir|class|colspan|rowspan|width|height|align|valign|scope|style],caption[id|dir|class]," | ||||||
. "-div[id|dir|class|align|style],-span[class|align|style],-pre[class|align],address[class|align]," | ||||||
. "-h1[id|dir|class|align|style],-h2[id|dir|class|align|style],-h3[id|dir|class|align|style]," | ||||||
. "-h4[id|dir|class|align|style],-h5[id|dir|class|align|style],-h6[id|dir|class|align|style],hr[class]," | ||||||
. "dd[id|class|title|dir],dl[id|class|title|dir],dt[id|class|title|dir]," | ||||||
]; | ||||||
|
||||||
protected $settings = []; | ||||||
|
||||||
/** | ||||||
* Holder list of enabled plugins | ||||||
* | ||||||
|
@@ -337,6 +351,11 @@ class TinyMCEConfig extends HTMLEditorConfig implements i18nEntityProvider | |||||
*/ | ||||||
protected $theme = 'silver'; | ||||||
|
||||||
public function __construct() | ||||||
{ | ||||||
$this->settings = static::config()->get('default_options'); | ||||||
} | ||||||
|
||||||
/** | ||||||
* Get the theme | ||||||
* | ||||||
|
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I've gone with
default_options
as the name for this configuration because you usually interact with these by callingsetOption()
orsetOptions()