I'm testing version 6.x-1.14 for use with my Drupal website. I use CKEditor which is switched on by default for the textareas of the send page by e-mail form. I turned it off for the Send to: textarea, but I'd like to leave it enabled for the message textarea. The e-mail I receive displays the HTML codes as text in the message box, even when Inline HTML is selected.

Perhaps forcing text only in the message box was done for SPAM protection. If so, then it should be documented and instruction given on how to disable wysiwyg editors. In my case, I plan to use CAPTCHA for SPAM protection, but I can see the need for some HTML filtering to prevent abuse. Is it possible to use the input filters, e.g. Filtered HTML to allow limited HTML to be included in the message box?

Comments

jcnventura’s picture

Status: Active » Postponed (maintainer needs more info)

Actually, it's filtering out HTML to prevent some types of security-related abuses, namely XSS attacks, but spam is also a concern..

That was the subject of one of the security releases for this module a few years ago, so I am not inclined to relax the rules there again.

dude4linux’s picture

FWIW, I found that adding the following two lines to CKEditor's global profile >> visibility settings >> fields to exclude, disabled CKEditor on both the admin and user pages. There must be something similar for the other WYSIWYG editors.

admin/settings/print*.edit-*
printmail/*.edit-*

I wonder if there is a way for an app module to tell the WYSIWYG editors to leave certain textareas alone i.e. plaintext only.

jcnventura’s picture

I think there is.. Can you try modifying the textarea for api in print_mail/print_mail.inc, line 104 adding the line

'#wysiwyg' => false,

I got this suggestion from http://drupal.org/node/460726, but I don't usually wysiwyg so I would appreciate if you could test it.. Don't forget to disable the above settings to re-enable support on those textareas, before adding the line.

dude4linux’s picture

That works great, at least for CKEditor. I don't have a setup to test TinyMCE. I had to modify the 'txt_to_addrs' textarea also to get the same result as #2. I added the extra lines as shown below. I didn't try to find all the textareas in the admin pages, but I would recommend disabling wysiwyg there also.

  $form['txt_to_addrs'] = array(
    '#type' => 'textarea',
    '#title' => t('Send to'),
    '#wysiwyg' => false,
    '#rows' => 3,
    '#resizable' => FALSE,
    '#description' => t('Enter multiple addresses separated by commas and/or different lines.'),
    '#required' => TRUE,
  );
. . .
  $form['txt_message'] = array(
    '#type' => 'textarea',
    '#title' => t('Your message'),
    '#wysiwyg' => false,
    '#rows' => 6,
    '#required' => TRUE,
  );
jcnventura’s picture

Status: Postponed (maintainer needs more info) » Needs review

There's not really a patch here, but I am moving this to the next step, as I know what needs to be done.

jcnventura’s picture

Status: Needs review » Fixed

Fixed in git.

Status: Fixed » Closed (fixed)

Automatically closed -- issue fixed for 2 weeks with no activity.