Problem/Motivation

We want site builders to be able to restrict, per field instance, which HTML tags are acceptable in an embed-code field (e.g. allow iframe but block script), while preserving today's behavior (all tags allowed) when the setting is left blank.

Proposed resolution

This needs a fieldSettingsForm() on the field type, plus validation that runs on entity form submission and reports an error naming the disallowed tag(s).

Data model changes

Add allowed_tags: { type: string, label: 'Allowed HTML tags' } under the field.field_settings.embed_code.mapping key, alongside the existing allowed_formats entry.

Issue fork media_embed_code-3618577

Command icon Show commands

Start within a Git clone of the project using the version control instructions.

Or, if you do not have SSH keys set up on git.drupalcode.org:

About issue forks

Comments

hfernandes created an issue. See original summary.

hfernandes opened merge request !3

hfernandes’s picture

hfernandes commented
Status: Active » Fixed

Now that this issue is closed, review the contribution record.

As a contributor, attribute any organization that helped you, or if you volunteered your own time.

Maintainers, credit people who helped resolve this issue.