Jump to content

"id" and "class" attributes removed when posting


Aetherdan

Recommended Posts

I created my own CKEditor plugin that takes highscore stats from an API and displays it in the post. The problem is with styling, the editor shows the content perfectly fine, but once its posted, IPS strips away the id and class attributes for any user rank that doesn't have html enabled. I find it odd that it has no issue leaving all the other attributes, yet strips those particular ones. It also appears to remove the display class from any hard coded styling via the style attribute.

Is there a setting somewhere or some code I can modify to allow both id and class?

I tried the following to allow the display class, but it didn't resolve the issue:
image.thumb.png.ff5f631e2345a80227d9a9bf8babd564.png

Link to comment
Share on other sites

Indeed, opentype is right. The problem here is that allowing any CSS or id attributes can lead to big problems (we have seen users maliciously use modal CSS classes in posted content and so on, effectively taking over a page). Thus, if you wish to allow custom CSS classes through you must whitelist those classes first.

Link to comment
Share on other sites

Archived

This topic is now archived and is closed to further replies.

  • Recently Browsing   0 members

    • No registered users viewing this page.
×
×
  • Create New...