Closed (fixed)
Project:
Drupal core
Component:
base system
Priority:
Normal
Category:
Feature request
Assigned:
Unassigned
Reporter:
Created:
31 May 2003 at 08:45 UTC
Updated:
24 Aug 2004 at 21:20 UTC
Filter system should be rewrited, last changes to CVS version made filter system totaly unusable. My propositions:
1. Backout last filter changes (so filters are called only on submission)
2. Content should be filtered only when !user_access("administer nodes")
First point is clear, and something about second point.
Lets have following situation, HTML filters enabled, allowed tags h1 h2 pre and now some administrator would like to add node with form element. To do that he must turn off filters (and then some user could post his "malicious" tags) for some time, second option is to add form tags to allowed tags (also bad idea). With filters used when !user_access("administer nodes") administrator could post anything and input from normal user would be filtered without any problems. I can provide patch to this.
Comments
Comment #1
Steven commentedI have carried this over onto the mailinglists because the issue is a lot more complex than just deciding to filter before or after submission.
A major rehaul of the filter system is required.
Read the mail here
Comment #2
bkessels commented>2. Content should be filtered only when !user_access("administer
>nodes")
This seems not a good option to me. Some filters (more to come i hope :) ) provide extra functionality.
When !user_access("administer nodes") is used, Glossary, urlfilter and much more will not work for administrators.
That would mean an admin has to have two accounts: one to administer and one to post. Seems very unhandy to me!
An option would be to provide access based filtering. So for each filter needs to be set to wich user roles it applies. This is, IMHO, way too much work.
Ber
Check www.mediarevolution.org voor mijn nieuwste site.
We zijn nog hard aan knutselen, maar opmerkingen en tips
zijn van harte welkom.
Comment #3
GmbH commentedYes, I forgot about other filters like Glossary (mayby because I don't use them). So mayby small modification:
common.inc:
function filter($text, $when) {
...
module_invoke($name, "filter", $text, $when);
...
}
in module:
function filter($text, $when="onsubmit") {
switch ($when) {
case "onsubmit":
...
case "onview":
...
}
}
Then add some priviledges checking to "onsubmit"
ink" alt="Eye-w
ink" />
Glossary and URLFilter should be then in "onview" category.
Comment #4
al commentedComment #5
moshe weitzman commentedComment #6
jonbob commentedRewritten in HEAD.
Comment #7
(not verified) commented