Jump to content

"id" and "class" attributes removed when posting


Aetherdan
 Share

Go to solution Solved by opentype,

Recommended Posts

I created my own CKEditor plugin that takes highscore stats from an API and displays it in the post. The problem is with styling, the editor shows the content perfectly fine, but once its posted, IPS strips away the id and class attributes for any user rank that doesn't have html enabled. I find it odd that it has no issue leaving all the other attributes, yet strips those particular ones. It also appears to remove the display class from any hard coded styling via the style attribute.

Is there a setting somewhere or some code I can modify to allow both id and class?

I tried the following to allow the display class, but it didn't resolve the issue:
image.thumb.png.ff5f631e2345a80227d9a9bf8babd564.png

Edited by Aetherdan
Link to comment
Share on other sites

Indeed, opentype is right. The problem here is that allowing any CSS or id attributes can lead to big problems (we have seen users maliciously use modal CSS classes in posted content and so on, effectively taking over a page). Thus, if you wish to allow custom CSS classes through you must whitelist those classes first.

Link to comment
Share on other sites

 Share

  • Recently Browsing   0 members

    • No registered users viewing this page.
×
×
  • Create New...