-
Steve … wondering if you found a way to include the iframe tag.
I’d like to embed googledocs in some of my pages but when I do this in the current html editor the tag gets stripped. This seems to indicate that it would require a little more than simply including the right button in the editor. I’m also wondering if you know how to allow fine grained access to different TinyMCE toolbars. That would be one way to protect against iframe insertions.
-
Just a follow up. I was able to allow in the editor by adding it to the extended_valid_elements line in longtext.php. Now an iframe I insert in the html view will show up in the editor. However, upon saving the page the iframe is clipped, apparently by something in the elgg system.
A discussion from the google groups suggested that in elgg 0.9 the lib/constants.php file would also need to be updated for or tag inclusion. But I can’t find this file or its successor in elgg 1.5. Any ideas?
-
Hi Matt–
Sorry I couldn’t get to you sooner. I was going to suggest working in longtext.php in the extended valid elements, but you figured it out yourself.
As far as the rest goes, it seems to me that there is something in elgg itself that impacts such, but I can’t recall where I ran into it.
Can you think of some text strings that you could grep?
-
Well, that part is kind of guesswork on this end. I don’t really know what I’m looking for and only found the longtext.php solution via your posts here and comments on the google group.
I’ve done a little digging through comments in the original lontext.php file and other files in the original /input folder but nothing jumped out at me and that is in the /views area rather than the core. My guess is that Elgg filters at the core level to get rid of insertion threats across the site.
If you get any brainwaves or can refer me to some one or somewhere, let me know.
-
I’m getting warmer Steve! The code we’re looking for is the kses script which filters html text. The call for the code is found in engine/lib/input.php and the script itself is in vendors/kses/. Apparently this whole issue has already been under discussion. The most recent version of input.php (http://reference.elgg.org/input_8php-source.html) seems to have rewritten the original call with a much more configurable approach. I’ll do a bit of tinkering to see if I can break anything. If you have any suggestions, let me know.
-
Looks like in the trunk, kses has been removed entirely from the vendors and input.php and is now a module with allowable attributes listed in start.php




9 comments
Comments feed for this article
Trackback link: http://openedweb.com/blog/2008/08/31/basic-hacking-tinymce-in-elgg/trackback/