id,summary,reporter,owner,description,type,status,priority,milestone,component,version,severity,resolution,keywords,cc 685,Patch to make javascript safe (not execute) in Xinha,mharrisonline,gogo,"In htmlarea.js, just below the line that says: {{{ // external stylesheets to load (REFERENCE THESE ABSOLUTELY) this.pageStyleSheets = [""this.css""]; }}} add: {{{ // external js file to link content to (REFERENCE THIS ABSOLUTELY) // example: utilityjs = ""flashobject.js""; utilityjs = """"; }}} Replace: {{{ // Set up event listeners for saving the iframe content to the textarea if (textarea.form) { // onsubmit get the HTMLArea content and update original textarea. HTMLArea.prependDom0Event ( this._textArea.form, 'submit', function() {editor._textArea.value = editor.outwardHtml(editor.getHTML()); return true;} ); }}} with: {{{ // Set up event listeners for saving the iframe content to the textarea if (textarea.form) { // onsubmit get the HTMLArea content and update original textarea. HTMLArea.prependDom0Event ( this._textArea.form, 'submit', function() {editor._textArea.value = editor.outwardHtml(editor.getHTML()).replace(/freezescript/ig, ""javascript""); return true;} ); }}} Replace: {{{ html += ""\n""; html += ""\n""; html += editor.inwardHtml(editor._textArea.value); html += ""\n""; html += """"; } else { var html = editor.inwardHtml(editor._textArea.value); if (html.match(HTMLArea.RE_doctype)) { editor.setDoctype(RegExp.$1); html = html.replace(HTMLArea.RE_doctype, """"); } } doc.write(html); doc.close(); }}} with: {{{ html += ""\n""; html += ""\n""; html += editor.inwardHtml(editor._textArea.value); html += ""\n""; html += """"; } else { var html = editor.inwardHtml(editor._textArea.value); if(utilityjs){ html = ""\n"" + html; } html = html.replace(/