The message content does not seem to get passed through any filters.

CommentFileSizeAuthor
#2 ecard-370273-2.patch486 bytestom_buytaert
#1 ecard-370273-1.patch384 bytestom_buytaert

Comments

tom_buytaert’s picture

tom_buytaert commented
StatusFileSize
new ecard-370273-1.patch384 bytes

I attached a patch, in which the message is sent through filter_xss()

tom_buytaert’s picture

tom_buytaert commented
StatusFileSize
new ecard-370273-2.patch486 bytes

Same patch, but this one also allows the use of images.

Or should check_markup() be used instead of filter_xss() ?

kars-t’s picture

kars-t commented
Assigned: Unassigned » kars-t

Hi thanks for the patch. In D5 I used check_markup but with always the default filter applied. For the next D6 patch I will alter the data structure and apply check_markup() sothe user can use any allowed filters to his role. I will do this probably next week.

tom_buytaert’s picture

tom_buytaert commented

Okay, thanks.

Great module, by the way!

kars-t’s picture

kars-t commented
Status: Needs review » Fixed

Latest dev fixes this. Please test it.

Status: Fixed » Closed (fixed)

Automatically closed -- issue fixed for 2 weeks with no activity.