The current PHP code input detection checks the format used for nid == vid. If a future version uses PHP but a previous one did not, this will fail and the PHP code will be wiped when next edited.

I found this out when my current drupal cvs version gave me a new revision of a book page without asking and without keeping the old one. This meant that even without changing the format, the PHP detector failed as there was nowhere in my data base where nid == vid for that node.

CommentFileSizeAuthor
#11 tinymce_5.patch2.38 KBRobRoy

Comments

kiz_0987’s picture

kiz_0987 commented
Priority: Normal » Critical

This is more serious than I thought since this effect will occur for all time as soon as there is one revision in the database. Let's say I have a node with nid 100, vid 100 and I save a new revision. It will be nid 100, vid 101. The next time I save a node it will have nid = 101, vid = 102 (as 101 cannot be reused). So every PHP page that I write from then on will not be detected by TinyMCE and so when I edit them the PHP code is stripped.

m3avrck’s picture

m3avrck commented

I'm not sure I understand the problem. Is this to do with PHP visibility for when TinyMCE is to show, under the settings? Or in the node itself?

If it is the node itself, this would be a bug with Drupal core and not TinyMCE.

kiz_0987’s picture

kiz_0987 commented

It's a problem with TinyMCE, not with Drupal. The TinyMCE bar should not be visible when PHP filter type is used. If the bar is on by default and not turned off before the page is fully displayed then all the PHP code is stripped.

The problem is with the following code (in _tinymce_page_match()):

    preg_match("|^node/(\d+)(/edit)$|", $_GET['q'], $match);
    if (intval($match[1]) > 0) {
      if (db_result(db_query('SELECT format FROM {node_revisions} WHERE nid = %d AND vid = %d AND format = 2', $match[1], $match[1]))) {
        return FALSE;
      }

Say I'm editing node 45, this is doing a SELECT when nid = 45 AND vid=45. But it is likely in fact that nid = 45, vid = 47 (or something) if there have been any revisions (of other pages) beforehand. For example, say I had created revisions of node 44 twice before creating node 45, its nid/vid in the database will be 44/44, 44/45, 44/46. So when I added node 45 originally it's nid/vid will be 45/47 and so the PHP test fails.

m3avrck’s picture

m3avrck commented
Status: Active » Fixed

kiz_0987 , great find! The logic for this was completely wrong. I rewrote all of it and simplified it greatly. Should be working perfectly now, please confirm, thanks!

kiz_0987’s picture

kiz_0987 commented

Works fine. Thanks very much for the quick fix.

jessZ’s picture

jessZ commented

I also find that tinyMCE is eating my php code even when I have php content selected for input format and eating my html even when i have html selected.

It is intermittent in it's error when dealing with a flexinode. It will filter the HTML in the first text area, but not the second. Is this the same bug. Do i just need to downlooad the CVS version of the module?

Can i set up a node type that is not filtered but still allows use of the tinymce toolbar or must it be turned off to turn off filtering?

/**
* Determine if TinyMCE has permission to be used on the current page.
*
* @return
*   TRUE if can render, FALSE if not allowed.
*/
function _tinymce_page_match($edit) {
 //Kill TinyMCE if we're editing a textarea with PHP in it!
 if ($_POST['edit']['format'] == 2) {
   return FALSE;
 }
 else {
   // PHP input formats are #2 in the filters table.
   preg_match("|^node/(\d+)(/edit)$|", $_GET['q'], $match);
   if (intval($match[1]) > 0) {
     if (db_result(db_query('SELECT format FROM {node} WHERE nid = %d AND format = 2', $match[1]))) {
       return FALSE;
     }
   }
 }
m3avrck’s picture

m3avrck commented

@JessZ, you might want to try the CVS version, this fixed a big problem with TinyMCE eating up all PHP code.

You should be able to have a node type with an input format that isn't filtered and TinyMCE should work with that.

jessZ’s picture

jessZ commented

I will dowload and install the cvs version. In the meantime i have gotten clearer on where I am having the most devere problems. The module works fairly well for story, book and page nodes where there is only onetext area where the tinyMCE interface is available. (the onlyobvioud bug being that the first time a php node is created the tynyMCE interface is on. It goes off the second time.)

Howver in nodes where there are multiple text areas, (such as flexinode and dashboard) some text areas are filtered correctly, that is in accord with the input format radio button but others are filtered very aggressively and ALL html is stripped.

Anonymous’s picture

(not verified) commented
Status: Fixed » Closed (fixed)
RobRoy’s picture

RobRoy commented
Version: master » 4.7.x-1.x-dev
Status: Closed (fixed) » Active

I'm still getting this on 4.7.x-1.x-dev. If this really is in HEAD, which I couldn't see that it was, it should really be backported to 4.7 as it's a pretty critical bug.

RobRoy’s picture

RobRoy commented
Status: Active » Needs review
StatusFileSize
new tinymce_5.patch2.38 KB

Found out that it was just happening for blocks. Added a check in there for the blocks admin page.

This also includes a resizable fix because I don't have time right now to split them up.

j4h8’s picture

j4h8 commented

For using the patch with 5.1, it has to read

...
if (arg(0) == 'admin' && arg(1) =='build' && arg(2) == 'block' && arg(3) == 'configure' && arg(4) == 'block' && is_numeric(arg(5))) {
    $box = block_box_get(arg(5));
...

This is because there is a "build" argument in the URL: "admin/build/block/configure/block".
After having added this argument and changed block_box_get(arg(4)) to block_box_get(arg(5)), the patch worked fine.
(Note that I did not test the resizing part of the patch.)

darren oh’s picture

darren oh
Primary language English
Location Lakeland, Florida
commented
Status: Needs review » Closed (fixed)

Please continue the discussion in issue 106153.