core/modules/filter/filter.filter_html.admin.js | 20 ++++++++++++-------- 1 file changed, 12 insertions(+), 8 deletions(-) diff --git a/core/modules/filter/filter.filter_html.admin.js b/core/modules/filter/filter.filter_html.admin.js index 4ae7cd7..6b164e1 100644 --- a/core/modules/filter/filter.filter_html.admin.js +++ b/core/modules/filter/filter.filter_html.admin.js @@ -156,7 +156,10 @@ // @todo Neither Drupal.FilterHtmlRule nor // Drupal.EditorFeatureHTMLRule allow for generic attribute // value restrictions, only for the "class" and "style" - // attribute's values to be restricted. + // attribute's values to be restricted. The filter_html filter + // always disallows the "style" attribute, so we only need to + // support "class" attribute value restrictions. Fix once + // https://www.drupal.org/node/2567801 lands. filterRule.restrictedTags.allowed.attributes = featureRule.required.attributes.slice(0); filterRule.restrictedTags.allowed.classes = featureRule.required.classes.slice(0); editorRequiredTags[tag] = filterRule; @@ -204,7 +207,6 @@ if (needsAdditionalClasses) { autoAllowedTags[tag].restrictedTags.allowed.classes = _.union(allowedClasses, requiredClasses); } - // @todo attribute values. } } @@ -244,7 +246,9 @@ var attributeName = attribute.nodeName; // @todo Drupal.FilterHtmlRule does not allow for generic attribute // value restrictions, only for the "class" and "style" attribute's - // values. + // values. The filter_html filter always disallows the "style" + // attribute, so we only need to support "class" attribute value + // restrictions. Fix once https://www.drupal.org/node/2567801 lands. if (attributeName === 'class') { var attributeValue = attribute.textContent; rule.restrictedTags.allowed.classes = attributeValue.split(' '); @@ -278,15 +282,15 @@ if (rule.restrictedTags.allowed.attributes.length) { setting += ' ' + rule.restrictedTags.allowed.attributes.join(' '); } + // @todo Drupal.FilterHtmlRule does not allow for generic attribute + // value restrictions, only for the "class" and "style" attribute's + // values. The filter_html filter always disallows the "style" + // attribute, so we only need to support "class" attribute value + // restrictions. Fix once https://www.drupal.org/node/2567801 lands. if (rule.restrictedTags.allowed.classes.length) { setting += ' class="' + rule.restrictedTags.allowed.classes.join(' ') + '"'; } - // @todo Drupal.FilterHtmlRule does not allow for generic attribute - // value restrictions, only for the "class" and "style" attribute's - // values. Until generic support is here, we don't bother generating - // attribute value whitelists at all, and we pretend every value is - // allowed for any given attribute. setting += '>'; return setting; }, '');