Contact Us RichText Editor issue about v6

[bhsmither]

The Sanitize class no longer uses a set of exempted POST keys. Thus, the value for every POST key gets sent through the _safety() function.

In _safety(), the value is run through a FILTER_SANITIZE_STRING which strips out HTML tags.

This might not be a quick fix.

[Dirty-Butter]

Is that what that setting about parsing smarty is for?

On January 10, 2015, at 8:21 PM, Brian Smither [email protected] wrote:

The Sanitize class no longer uses a set of exempted POST keys. Thus, the value for every POST key gets sent through the _safety() function.

In _safety(), the value is run through a FILTER_SANITIZE_STRING which strips out HTML tags.

This might not be a quick fix.

—
Reply to this email directly or view it on GitHub.

[bhsmither]

HTML tags use the open-angle and close-angle. Smarty tags use the open-brace and close-brace and will survive sanitation. The Sanitizer applies to all input

I do not yet know what "Parse Smarty Tags" will do. I think it does not allow a POSTed value to escape sanitization.

[Dirty-Butter]

So how can I get v6 to allow simple paragraph, font color editing, etc. in the document boxes? Or is this a bug? It does save a simple text color change to the provided Homepage document, but it would not save a highlight text color, even though the editor has that as a choice.

[bhsmither]

I see the Sanitizer stripping out all HTML tags, so how a simple text color change got saved, I don't know.

Is this a bug? I would say so since you reported here.

[Dirty-Butter]

Documents are working correctly for me now, but not sure why. I have had trouble getting CC cache cleared. There doesn't seem to be a way within v6 to turn off cache, and FF is being stubborn, too.

Contact Us form has no language choices (v5 didn't either), but it will NOT save formatting changes. Reverts to plain text. Very confusing to me.

[abrookbanks]

I can't reproduce this but I think this is due to an earlier cache bug which is now fixed. The admin CP now clears the cache on each page load rather than trying to decide when bits need clearing.