"The text to display for this field. You may include HTML. You may enter data from this view as per the "Replacement patterns" below."

The Replacement Output box says that I can enter HTML into the box, but when I do (I want to use an onClick event for a small snippet of JavaScript), it gets removed when the view is rendered.

I don't care if I have to hack Views, I just want to disable this. I'm the only one who's entering this data, so there really isn't a security risk involved here. I've used this exact same code elsewhere on my site, and it works perfectly, Views is just filtering out the event on the HTML tag.

Can anyone help?

Comments

dawehner’s picture

dawehner
Primary language German
commented
Component: field data » Miscellaneous
Status: Active » Fixed

This output is runned through filter_xss_admin. And inline js some kind of xss.

I suggest to use good jquery code in an example js file, to achive what you want.

SpikeX’s picture

SpikeX commented
Status: Fixed » Active

I just need to insert an onClick event that opens a popup box. I do this elsewhere on the site with no problems.

And you're going to need to be more specific... I've never used jQuery before, and I have no idea how you would use jQuery in place of an onClick event on an HTML tag.

(issue is not fixed until I find a solution, since this is a support request)

dawehner’s picture

dawehner
Primary language German
commented

See http://drupal.org/node/171213 as a general introduction to jquery.
See http://api.jquery.com/click/ for the documentation of jquery.

Once you get additcted to jquery normal js will feel like Stone Age :)

A issue is fixed until you can solve your problem for yourself. I think its sure, that you have to
code this stuff for yourself. So its fixed.

Status: Active » Closed (fixed)

Automatically closed -- issue fixed for 2 weeks with no activity.

scotthorn’s picture

scotthorn commented
Version: 6.x-2.6 » 7.x-3.x-dev
Status: Closed (fixed) » Active

I would also like to disable the html filter in the node rewrite area. I've got mp3's uploaded, and I want to put them in tags, but the filter removes all of them automatically. I guess I could do something hacky with jQuery... but that seems like the wrong way to go about it.

merlinofchaos’s picture

merlinofchaos commented
Status: Active » Closed (won't fix)

For security reasons this is won't fix. You can use views_php_field which can give you unfiltered text (but we don't really recommend it) or you can put that HTML in the field template.

ptoly’s picture

ptoly commented

Views php filter also gets filtered (unless you actually echo the snippet via php). Sigh.

onClick events are a staple part of Google Analytics tracking, and a host of other useful functions.

Putting a short snippet of code into jQuery files, for a site with thousands of links is quite impractical.

While I acknowledge that there is a security risk with allowing onClick events in, barring even educated developers from being able to do this rankles me.

Vote + for an override.