Custom Tag stop while running

Friday 03 December 2010 7:17:26 am

Hi There I created a custom tag to allow users to add extra HTML/Javascript code in XMLBlock.

So I did the following modifications :

content.ini.append.php

[CustomTagSettings]
AvailableCustomTags[]=code
IsInline[code]=false

[code]
CustomAttributes[]=code

ezoe_attributes.ini.append.php

[code]
CustomAttributes[]=code

[CustomAttribute_code_code]
Name=Code
Type=text
Required=true

code.tpl

{wrap_php_func('html_entity_decode', array( $code ))}

With this, <b>UN</b> <i>test</i> <u><i>normal</i></u> run correctly but

<script type="text/javascript"> alert ( "Hello World" ) ;</script>

Stops while running with the following error :

<span class="Apple-style-span" style="font-family: Arial, Helvetica, sans-serif; white-space: normal; font-size: 13px; " mce_fixed="1"><!-- START: including template: design/standard/templates/content/datatype/view/ezxmltags/code.tpl (design:content/datatype/view/ezxmltags/code.tpl) --> 
Mon code : <script typ  
<!-- STOP: including template: design/standard/templates/content/datatype/view/ezxmltags/code.tpl (design:content/datatype/view/ezxmltags/code.tpl) --></span>

I don't understand what happens.

Could someone explain me why it crash while running this very simple text ?

Thanks,

Damien

Monday 06 December 2010 3:19:18 am

Another solution could be to activate raw HTML support via the literal tag.

You can do this in an override of content.ini. Here's what original content.ini says :

[literal]
AvailableClasses[]
# The class 'html' is disabled by default because it gives editors the
# possibility to insert html and javascript code in XML blocks.
# Don't enable the 'html' class unless you really trust all users who has
# privileges to edit objects containing XML blocks.
#AvailableClasses[]=html

This can be a solution, but since there is currently no security policy check on attributes, there might be a XSS security issue here...

Monday 06 December 2010 4:02:28 am

[literal]
AvailableClasses[]
# The class 'html' is disabled by default because it gives editors the
# possibility to insert html and javascript code in XML blocks.
# Don't enable the 'html' class unless you really trust all users who has
# privileges to edit objects containing XML blocks.
#AvailableClasses[]=html

If I were him I would rather not do that :)

http://www.linkedin.com/in/ivolukac
http://www.netgen.hr/eng/blog
http://twitter.com/ilukac

Monday 06 December 2010 5:22:39 am

Why not ? If this fits to the need, then this is the solution ! ;)

The only thing is that the website administrator has to trust his contributors, that's all ! Besides, this is the case for every CMS that propose such a feature...