Problem/Motivation

The link dialog in the text editor exposes the ability to open a link in a new window.
Since #2549077: Allow the "Limit allowed HTML tags" filter to also restrict HTML attributes, and only allow a small whitelist of attributes by default that option does not work anymore as the "target" attribute is not whitelisted.

Proposed resolution

Whitelist the target attribute.

Remaining tasks

Patch, Review, Commit

User interface changes

None.

API changes

None.

Data model changes

None.

CommentFileSizeAuthor
#2 regression_open_in_new_window-2578957-2.patch2.7 KBduaelfr

Comments

DuaelFr created an issue. See original summary.

duaelfr’s picture

duaelfr
he/him
Primary language French
Location Montpellier, France
commented
StatusFileSize
new regression_open_in_new_window-2578957-2.patch2.7 KB

As we now only allow whitelisted tags and attributes, we have to use the plugins' allowedContent to be sure that the functionnalities they expose are not filtered on save.

duaelfr’s picture

duaelfr
he/him
Primary language French
Location Montpellier, France
commented
Status: Active » Needs review
fabianx’s picture

fabianx commented
Assigned: Unassigned » wim leers

Assigning to Wim for review

wim leers’s picture

wim leers
Location Ghent 🇧🇪🇪🇺
commented
Component: editor.module » filter.module
Priority: Normal » Major
Issue tags: +JavaScript

I will definitely review this, but not right now, on the eve of RC1. This is a bugfix, and should therefore be possible to do during the RC phase.

duaelfr’s picture

duaelfr
he/him
Primary language French
Location Montpellier, France
commented
Component: filter.module » editor.module
Priority: Major » Normal
Status: Needs review » Closed (duplicate)

That has been magically fixed by #2579979: Allow contrib to alter EditorImageDialog/EditorImageDialog and have custom attributes be stored
I'm not even sure they know that ;)

Commit hash if you want to try yourself: d8a5cf811e2846a4c2ade067bd3c5daa60f91bc5

wim leers’s picture

wim leers
Location Ghent 🇧🇪🇪🇺
commented
Status: Closed (duplicate) » Active

This actually is not yet fixed; it's only being masked by a bug.

See #2585173: [regression] "Allowed HTML tags" setting corrupted upon accessing Text Format configuration UI, comments 12 through 17.

wim leers’s picture

wim leers
Location Ghent 🇧🇪🇪🇺
commented
Status: Active » Closed (duplicate)
Related issues: +#2590403: Remove "Open in new window" checkbox from EditorLinkDialog — Was: "Consider whitelisting <a>'s target attribute in the Standard install profile"

And now it's fixed because it's gone: #2590403: Remove "Open in new window" checkbox from EditorLinkDialog — Was: "Consider whitelisting <a>'s target attribute in the Standard install profile".