I'm testing version 6.x-1.14 for use with my Drupal website. I use CKEditor which is switched on by default for the textareas of the send page by e-mail form. I turned it off for the Send to: textarea, but I'd like to leave it enabled for the message textarea. The e-mail I receive displays the HTML codes as text in the message box, even when Inline HTML is selected.
Perhaps forcing text only in the message box was done for SPAM protection. If so, then it should be documented and instruction given on how to disable wysiwyg editors. In my case, I plan to use CAPTCHA for SPAM protection, but I can see the need for some HTML filtering to prevent abuse. Is it possible to use the input filters, e.g. Filtered HTML to allow limited HTML to be included in the message box?
Comments
Comment #1
jcnventuraActually, it's filtering out HTML to prevent some types of security-related abuses, namely XSS attacks, but spam is also a concern..
That was the subject of one of the security releases for this module a few years ago, so I am not inclined to relax the rules there again.
Comment #2
dude4linux commentedFWIW, I found that adding the following two lines to CKEditor's global profile >> visibility settings >> fields to exclude, disabled CKEditor on both the admin and user pages. There must be something similar for the other WYSIWYG editors.
I wonder if there is a way for an app module to tell the WYSIWYG editors to leave certain textareas alone i.e. plaintext only.
Comment #3
jcnventuraI think there is.. Can you try modifying the textarea for api in print_mail/print_mail.inc, line 104 adding the line
I got this suggestion from http://drupal.org/node/460726, but I don't usually wysiwyg so I would appreciate if you could test it.. Don't forget to disable the above settings to re-enable support on those textareas, before adding the line.
Comment #4
dude4linux commentedThat works great, at least for CKEditor. I don't have a setup to test TinyMCE. I had to modify the 'txt_to_addrs' textarea also to get the same result as #2. I added the extra lines as shown below. I didn't try to find all the textareas in the admin pages, but I would recommend disabling wysiwyg there also.
Comment #5
jcnventuraThere's not really a patch here, but I am moving this to the next step, as I know what needs to be done.
Comment #6
jcnventuraFixed in git.