Untrusted users (nearly everyone) should never have access to the Full HTML filter. Depending on what image picker needs you may need to:

- rewrite the module so it doesn't break when the HTML filter is enabled
- rewrite README.txt and tell people to add tags to the allowed tags of the HTML filter
- ?

CommentFileSizeAuthor
#5 imagepicker-readme.patch1.79 KBheine

Comments

hutch’s picture

hutch commented
Priority: Critical » Normal
Status: Active » Closed (fixed)
heine’s picture

heine commented

Is this fixed, won't fix, by design? When going through CVS I see this added:

+Alternately you can add <img>, <div> and <span> to the default filter.

making the relevant text:

Only users who have the right to use Full HTML filter will be able to use
imagepicker. This is done because Imagepicker uses some HTML, which will be
stipped out if user will not use this filter. Users, who has the right to use
Full HTML filter will be able to use Imagepicker instantly after installation.
If you want to enable Imagepicker module for other users, you will have to
reconfigure filters.
[...]
Go to Administer > Site configuration > Input formats. You should see a list of
all available filter in your site. Choose Full HTML and click on the configure
link. In the Roles fieldset select all roles you want to be able to use this
filter and save configuration.
Alternately you can add <img>, <div> and <span> to the default filter.

IMO this isn't nearly strong enough as anyone with access to the Full HTML format can execute cross site scripting attacks (may lead to admin access).

heine’s picture

heine commented
Status: Closed (fixed) » Active

Setting status.

hutch’s picture

hutch commented

Heine, you are telling me what you don't want, not what you do want, please provide a patch ;-)

heine’s picture

heine commented
Status: Active » Needs review
StatusFileSize
new imagepicker-readme.patch1.79 KB
hutch’s picture

hutch commented
Status: Needs review » Fixed

Thanks for this patch, it will be in CVS shortly

Status: Fixed » Closed (fixed)

Automatically closed -- issue fixed for 2 weeks with no activity.