If media module is enabled and any other plugin creates a widget that contains script-tags, these tags are removed on saving node or even switching ckeditor to source view.
editor: ckeditor
file: /sites/all/modules/dev/media/modules/media_wysiwyg/js/media_wysiwyg.filter.js
version: 7.x-2.0-alpha3+96-dev
method: replacePlaceholderWithToken()
issue in line: 76
how to reproduce:
Call function with an input parameter that contains any script tag. E.g.
content = "<div class="TestEmbeddedPlayer" data-videotitle="test 18. Juli"><script src="http://test.com/player/embed.js" type="text/javascript"></script><object class="TestEmbeddedPlayerFlash" data="http://test.com/player/loader.swf" height="321" id="Test_player_d4f05482f82c4a0d9349d40cfe5f2aab" name="Test_player_d4f05482f82c4a0d9349d40cfe5f2aab" type="application/x-shockwave-flash" width="480"><param name="movie" value="http://test.com/player/loader.swf" /><param name="wmode" value="transparent" /><param name="allowScriptAccess" value="always" /><param name="allowFullScreen" value="true" /><param name="flashVars" value="" /></object><script type="text/javascript">
(function ($) {
console.log("test closure");
})(jQuery);
</script><script type="text/javascript">
jQuery(document).ready(function() {
console.log("test onDomReady");
});
</script></div>"
After calling jQuery append() in line 76...
content = $('<div>').append(content);
...all script tags are removed:
console.log(content.html())
will show:
"<div class="TestEmbeddedPlayer" data-videotitle="test 18. Juli"><object class="TestEmbeddedPlayerFlash" data="http://test.com/player/loader.swf" height="321" id="Test_player_d4f05482f82c4a0d9349d40cfe5f2aab" name="Test_player_d4f05482f82c4a0d9349d40cfe5f2aab" type="application/x-shockwave-flash" width="480"><param name="movie" value="http://test.com/player/loader.swf"><param name="wmode" value="transparent"><param name="allowScriptAccess" value="always"><param name="allowFullScreen" value="true"><param name="flashVars" value=""></object></div>"
| Comment | File | Size | Author |
|---|---|---|---|
| #14 | media-2307993-preserve-script-tags-14.patch | 845 bytes | mcrump |
| #8 | media-2307993-preserve-script-tags-8.patch | 2.81 KB | eelkeblok |
| #6 | media-2307993-preserve-script-tags-6.patch | 380 bytes | eelkeblok |
| #5 | media_wysiwyg-2307993.patch | 529 bytes | yoshz |
Comments
Comment #1
libelle2000 commentedAdded a more explicit version number where the issue occures.
Comment #2
Seb_CKSource commentedIf you're using CKEditor 4.1 or above, then the Advanced Content Filter might be removing the script tags. You can read more about ACF here...
Comment #3
libelle2000 commented@Seb_CKSource (#2)
Thanks for you reply.
It is indeed important to have an eye on these filters as well. In my case I do have a valid configuration of allowedContent.
This issue is in fact a matter of using jQuery's append() method. It seems as jQuery.append() does not support appending script tags at all. And using that method was added anytime between 7.x-2.0-alpha3+93-dev and 7.x-2.0-alpha3+96-dev.
In 7.x-2.0-alpha3+93-dev replacePlaceholderWithToken() returns all given script tags as expected by not using jQuery.append()
Comment #4
murzSeems that the problem is in the file
media/modules/media_wysiwyg/js/media_wysiwyg.filter.json lines:content = $('<div>').append(content);and
return content.html();If I comment out first string and replace second with
return content;- script tags are stay here, maybe some Media functional will be broken, but at first look - all works well...
Comment #5
yoshz commentedI got the same problem. Looked for 2 hours why script tags were removed.
Attached the patch with the solution of Murz.
Comment #6
eelkeblokBad news (but also good news). Although the last patch does solve the original issue, it means the actual purpose of this function (replacing placeholder img-tags to make content with inline media images look pretty in the editor) is broken. The good news is I am attaching a patch that also solves this issue and doesn't break the primary function (at least according to my preliminary tests). Review appreciated.
Comment #7
eelkeblokSorry, the patch doesn't seem quite right yet.
Comment #8
eelkeblokOK, here's another stab... I basically replaced the replacement logic (...) with something fairly old. It is regex-based (the problem with the current state of affairs is that .html() executes the JavaScript, apparently, according to jQuery docs). This logic was the result of commit a55a841 (issue #1451316) and was replaced by something entirely different (or might have been collateral damage) in commit 3cb8d2c7 (and that's not mentioning all the other changes that happened since).
This solves this issue for me, while not breaking the actual detachment-logic, but I'm worried about the long history since this logic was ever active. Ideally Dave Reid and/or Paris Liakos have a look at this as they seem to have touched this code more than anyone else.
Comment #9
murzThanks, your patch works well! I test it and find no issues or broken functional (unlike of my version patch :) )
So will be good to see it in HEAD.
Comment #12
aaron commentedCommitted to http://drupalcode.org/project/media.git/commit/ebf1d57.
Comment #14
mcrump commentedHello,
I know this issue is marked as closed but it seems to have regressed with the latest version of the Media module for Drupal 7. I have re-rolled and attached a simpler patch to fix this issue. Hope it helps anyone who is experiencing this issue.
Cheers,
Michael Crump