hey there,

during our project, a client has asked us to place a song's title to the left and its duration to the right.

that would be easily accomplished adding SPANs with classes, but jPlayer strips out every HTML that passes through it.

is there any way to preserve some formatting?

thanks in advance.

regards,
Luciano

CommentFileSizeAuthor
#4 allow_html_tags_in_playlist-1649102-4.patch1.14 KBAnonymous (not verified)
#1 allow_html_tags_in_playlist-1649102-1.patch1.77 KBAnonymous (not verified)

Comments

Anonymous’s picture

Anonymous (not verified) commented
Title: how do I preserve some HTML formatting? » Allow HTML tags in output
Category: Support request » Feature request
Issue summary: View changes
Status: Active » Needs review
StatusFileSize
new allow_html_tags_in_playlist-1649102-1.patch1.77 KB

This patch removes the strip_tags() function and makes the l() function recognise HTML tags in the playlist link.

Working for me, but I'm only using playlists from views, so others should make sure it works in their situations too.

markie’s picture

markie commented
Status: Needs review » Closed (won't fix)

Short story long, that is a security issue that won't be supported. I've had modules shut down due to improper trimming. Sorry, but I can not facilitate your request. You could update the jplayer.js to add or wrap a class in the playlist items.

Anonymous’s picture

Anonymous (not verified) commented
Status: Closed (won't fix) » Needs work

By 'security issue' I assume you're referring to the 'html' option for the l() function which says:

$text is not sanitized if 'html' is TRUE. The calling function must ensure that $text is already safe.

If that's the case, can't we just use one of the sanitization functions (one that keeps HTML tags intact)? I'm not up on sanitization and security, so am not sure which function, but surely one of them will let us safely include HTML tags (e.g. divs, spans) in a link...

Anonymous’s picture

Anonymous (not verified) commented
Status: Needs work » Needs review
StatusFileSize
new allow_html_tags_in_playlist-1649102-4.patch1.14 KB

I needed to update this module, but when I did the patch no longer applied. I therefore figured this'd be a good time to address the concern in #2.

This new patch uses filter_xss() (instead of strip_tags()) and adds 'div' and 'span' to the list of allowed tags.