Hi folks,
I'm working on a site where I plan on having a lot of users, most of whom will be tech savvy high school students. I want to use a WYSIWYG editor for the site, but unless you use a FULL HTML filter, the text of the WYSIWYG editor will be screwed up. However with so many users, I feel the need to enhance site security.
So I propose a module to allow only text that could have been produced within the confines of a WYSIWYG editor. I also would like greater ability to control which HTML elements are allowed, and what attributes are allowed for those elements.
One of the problems with this solution is that in order for most WYSIWYG editors to work properly, they need to include a span to wrap around various parts of the text with a style attribute. This website:
http://jeremiahgrossman.blogspot.com/2007/07/attribute-based-cross-site-...
suggests that style attributes can be dangerous, and need special treatment. I'm not sure how to implement this treatment for attributes.
The other issue is that I need to create a giant array (see below) of possible xhtml tags and their possible attributes. From this array, I'll build a form where an admin can specify exactly which html tags to allow and which attributes within the tags.