HTML Filter breaks the classid attribute of the object tag [#812590]

When using HTML Filter on flash embedding markup, HTML Filter replaces:

<object classid="clsid:d27cdb6e-ae6d-11cf-96b8-444553540000" height="200" width="200">[...]</object>

by:

<object classid="d27cdb6e-ae6d-11cf-96b8-444553540000" height="200" width="200">[...]</object>

The clsid: prefix is removed, thus preventing flash content to show up in Internet Explorer.

Comment	File	Size	Author
#4	drupal.filter-clsid.4.patch	1.88 KB	sun
#4

Support from Acquia helps fund testing for Drupal Acquia logo

Comments

Comment #1

GreenReaper

English

Welling, Bexley, London

CreditAttribution: GreenReaper commented 26 October 2010 at 07:00

Same here, but I'm also seeing this in Drupal 6.19. Subscribing.

Comment #2

taslett CreditAttribution: taslett commented 28 October 2010 at 03:13

In D7 the function drupal_strip_dangerous_protocols http://api.drupal.org/api/function/drupal_strip_dangerous_protocols/7
contains a list of allowed protocols.
There is a variable filter_allowed_protocols which it attempts to read from although I can't see where it is actually set.
I'm not sure if the clsid is considered dangerous, if it should be added to the list or added via a config settings page somewhere if needed.