Changeset 620


Ignore:
Timestamp:
12/22/06 20:18:54 (7 years ago)
Author:
ray
Message:

Improve the handling of JavaScript? inside the editor (see #685)
Before this patch JavaScript? is kept in Mozilla, whereas in IE the contents of script nodes is lost while the tags remain

  • changed HTMLArea.getHTMLWrapper to keep scripts intact or optionally strip the whole tag
  • new config.stripScripts to control this
    • set to true by default to be consistent
  • implemented freezescript solution proposed by mharrisonline to prevent scripts from being executed in the editor
File:
1 edited

Legend:

Unmodified
Added
Removed
  • trunk/htmlarea.js

    r617 r620  
    363363  this.showLoading = false; 
    364364 
     365  // set to false if you want to allow JavaScript in the content, otherwise <script> tags are stripped out 
     366  this.stripScripts = true; 
     367   
    365368  // size of color picker cells 
    366369  this.colorPickerCellSize = '6px'; 
     
    51405143    html = html.replace(/<script[\s]*src[\s]*=[\s]*['"]chrome:\/\/.*?["']>[\s]*<\/script>/ig, ''); 
    51415144  } 
     5145  //prevent execution of JavaScript (Ticket #685) 
     5146  html = html.replace(/(<script[^>]*)(freezescript)/gi,"$1javascript"); 
    51425147 
    51435148  return html; 
     
    51615166 
    51625167  html = this.inwardSpecialReplacements(html); 
     5168 
     5169  html = html.replace(/(<script[^>]*)(javascript)/gi,"$1freezescript"); 
    51635170 
    51645171  // For IE's sake, make any URLs that are semi-absolute (="/....") to be 
     
    56985705HTMLArea._blockTags = " body form textarea fieldset ul ol dl li div " + 
    56995706"p h1 h2 h3 h4 h5 h6 quote pre table thead " + 
    5700 "tbody tfoot tr td th iframe address blockquote"; 
     5707"tbody tfoot tr td th iframe address blockquote "; 
    57015708HTMLArea.isBlockElement = function(el) 
    57025709{ 
     
    58005807      var i; 
    58015808      var root_tag = (root.nodeType == 1) ? root.tagName.toLowerCase() : ''; 
     5809      if ( ( root_tag == "script" || root_tag == "noscript" ) && editor.config.stripScripts ) 
     5810      { 
     5811        break; 
     5812      } 
    58025813      if ( outputRoot ) 
    58035814      { 
     
    58215832        } 
    58225833        break; 
    5823       } else if ( outputRoot ) 
     5834      } 
     5835      else if ( outputRoot ) 
    58245836      { 
    58255837        closed = (!(root.hasChildNodes() || HTMLArea.needsClosingTag(root))); 
     
    59245936      } 
    59255937      var containsBlock = false; 
    5926       for ( i = root.firstChild; i; i = i.nextSibling ) 
    5927       { 
    5928         if ( !containsBlock && i.nodeType == 1 && HTMLArea.isBlockElement(i) ) 
    5929         { 
    5930           containsBlock = true; 
    5931         } 
    5932         html += HTMLArea.getHTMLWrapper(i, true, editor, indent + '  '); 
    5933       } 
    5934       if ( outputRoot && !closed ) 
    5935       { 
    5936         html += (HTMLArea.is_ie && HTMLArea.isBlockElement(root) && containsBlock ? ('\n' + indent) : '') + "</" + root.tagName.toLowerCase() + ">"; 
     5938      if ( root_tag == "script" || root_tag == "noscript" ) 
     5939      { 
     5940        if ( !editor.config.stripScripts ) 
     5941        { 
     5942          var innerText = (HTMLArea.is_ie) ? "\n" + root.innerHTML.replace(/^[\n\r]*/,'').replace(/\s+$/,'') + '\n' + indent : root.firstChild.nodeValue; 
     5943          html += innerText + '</'+root_tag+'>' + ((HTMLArea.is_ie) ? '\n' : ''); 
     5944        } 
     5945      } 
     5946      else 
     5947      { 
     5948        for ( i = root.firstChild; i; i = i.nextSibling ) 
     5949        { 
     5950          if ( !containsBlock && i.nodeType == 1 && HTMLArea.isBlockElement(i) ) 
     5951          { 
     5952            containsBlock = true; 
     5953          } 
     5954          html += HTMLArea.getHTMLWrapper(i, true, editor, indent + '  '); 
     5955        } 
     5956        if ( outputRoot && !closed ) 
     5957        { 
     5958          html += (HTMLArea.is_ie && HTMLArea.isBlockElement(root) && containsBlock ? ('\n' + indent) : '') + "</" + root.tagName.toLowerCase() + ">"; 
     5959        } 
    59375960      } 
    59385961    break; 
Note: See TracChangeset for help on using the changeset viewer.