core/modules/filter/filter.filter_html.admin.js | 20 ++++++++++++--------
1 file changed, 12 insertions(+), 8 deletions(-)
diff --git a/core/modules/filter/filter.filter_html.admin.js b/core/modules/filter/filter.filter_html.admin.js
index 4ae7cd7..6b164e1 100644
--- a/core/modules/filter/filter.filter_html.admin.js
+++ b/core/modules/filter/filter.filter_html.admin.js
@@ -156,7 +156,10 @@
// @todo Neither Drupal.FilterHtmlRule nor
// Drupal.EditorFeatureHTMLRule allow for generic attribute
// value restrictions, only for the "class" and "style"
- // attribute's values to be restricted.
+ // attribute's values to be restricted. The filter_html filter
+ // always disallows the "style" attribute, so we only need to
+ // support "class" attribute value restrictions. Fix once
+ // https://www.drupal.org/node/2567801 lands.
filterRule.restrictedTags.allowed.attributes = featureRule.required.attributes.slice(0);
filterRule.restrictedTags.allowed.classes = featureRule.required.classes.slice(0);
editorRequiredTags[tag] = filterRule;
@@ -204,7 +207,6 @@
if (needsAdditionalClasses) {
autoAllowedTags[tag].restrictedTags.allowed.classes = _.union(allowedClasses, requiredClasses);
}
- // @todo attribute values.
}
}
@@ -244,7 +246,9 @@
var attributeName = attribute.nodeName;
// @todo Drupal.FilterHtmlRule does not allow for generic attribute
// value restrictions, only for the "class" and "style" attribute's
- // values.
+ // values. The filter_html filter always disallows the "style"
+ // attribute, so we only need to support "class" attribute value
+ // restrictions. Fix once https://www.drupal.org/node/2567801 lands.
if (attributeName === 'class') {
var attributeValue = attribute.textContent;
rule.restrictedTags.allowed.classes = attributeValue.split(' ');
@@ -278,15 +282,15 @@
if (rule.restrictedTags.allowed.attributes.length) {
setting += ' ' + rule.restrictedTags.allowed.attributes.join(' ');
}
+ // @todo Drupal.FilterHtmlRule does not allow for generic attribute
+ // value restrictions, only for the "class" and "style" attribute's
+ // values. The filter_html filter always disallows the "style"
+ // attribute, so we only need to support "class" attribute value
+ // restrictions. Fix once https://www.drupal.org/node/2567801 lands.
if (rule.restrictedTags.allowed.classes.length) {
setting += ' class="' + rule.restrictedTags.allowed.classes.join(' ') + '"';
}
- // @todo Drupal.FilterHtmlRule does not allow for generic attribute
- // value restrictions, only for the "class" and "style" attribute's
- // values. Until generic support is here, we don't bother generating
- // attribute value whitelists at all, and we pretend every value is
- // allowed for any given attribute.
setting += '>';
return setting;
}, '');