Closed (fixed)
Project:
Panopoly
Version:
7.x-1.x-dev
Component:
WYSIWYG
Priority:
Normal
Category:
Support request
Assigned:
Unassigned
Reporter:
Created:
21 Mar 2014 at 14:37 UTC
Updated:
29 Aug 2014 at 19:58 UTC
Jump to comment: Most recent
Comments
Comment #1
lsolesen commentedIt is not best practice to inject javascript or iframe content into a wysiwyg area.
If you really want to inject it, you should allow it from: admin/config/content/formats/panopoly_wysiwyg_text --> Look under WYSIWYG filter. However, I would not advice you to do that, but find an alternative way to get the code in.
Comment #2
dsnopek@lsolesen is right that allowing users to inject Javascript or iframe content is bad idea - it's a security risk. Like he said, you can modify the panopoly_wysiwyg_text input filter OR create your own input filter (maybe just for admins) which doesn't filter out that code.
However, usually injecting Javascript or iframe content is to support embedding some kind of media, like YouTube or Vimeo videos. If you want your users to embed a new kind of media that Panopoly doesn't support (we already support YouTube/Vimeo via media_youtube and media_vimeo), the right way to do it is with an extension to the Media module. That way Media is responsible for actually injecting Javascript and iframe code which it knows is safe.
I hope that helps!
Comment #3
jusyjim commentedThanks for the help and I appreciate the heads up!! This will be for admin/editor only use. I'll test out the filters.
Thanks again!
Comment #5
dobie_gillis commentedI got this to work by using the HTML editor, and disabling the "markItUp" profile for the editor.