Issue Details (XML | Word | Printable)

Key: MDL-15963
Type: Bug Bug
Status: Open Open
Priority: Major Major
Assignee: Eloy Lafuente (stronk7)
Reporter: Bill Mounce
Votes: 0
Watchers: 2
Operations

Add/Edit UI Mockup to this issue
If you were logged in you would be able to see more operations.
Moodle

<span> info being stripped from textarea

Created: 07/Aug/08 10:22 AM   Updated: 04/Dec/08 02:03 AM
Return to search
Component/s: Database activity module
Affects Version/s: 1.9.2
Fix Version/s: None

Database: MySQL
Participants: Bill Mounce, Eloy Lafuente (stronk7), Eric Merrill, Mauno Korpelainen and Petr Skoda
Security Level: None
Affected Branches: MOODLE_19_STABLE


 Description  « Hide
Peter (?),

This may be related to my previously reported bug. If I select some text and change the font (e.g., <span style="font-family: tahoma,arial,helvetica,sans-serif;">a[ggeloV</span>), when I save the record the font has not changed. When I go back to the html, all that is there is <span>a[ggeloV</span>.

I learned the problem when importing data. Even something as simple as <span style=&quot;font-weight: bold;&quot;>Angeles</span> is being removed.

I am in a real predicament here. The Fall semester is right around the corner and I have tons of data to import into Moodle. The bug is evidently a subroutine that tries to clean up my data. In the short term, can you please email me where this happens in Moodle so I can comment it out for now. If not I am in real trouble; I keep all my data external so I can make global style changes and reimport, so I have a lot of importing to do. Thanks.

Bill

 All   Comments   Change History   Version Control      Sort Order: Ascending order - Click to sort in descending order
Mauno Korpelainen added a comment - 07/Aug/08 04:10 PM
Bill,

I tested adding first
<font face="impact">test1<span style="font-family: tahoma,arial,helvetica,sans-serif">test some text</span> test2</font>

and then

<span style="font-family: impact">test1<span style="font-family: tahoma,arial,helvetica,sans-serif">test some text</span> test2</span>

to htmlarea (the latest weekly 1.9.2+ with IE7 and FF3 ) and could not reproduce this. Both seem to work ok...font is changed inside span tags.

Maybe some filter is causing your problem?


Mauno Korpelainen added a comment - 07/Aug/08 05:05 PM
Sorry - I did not notice that this happened in Database activity. Database does seem to strip tags...

Bill Mounce added a comment - 08/Aug/08 12:47 AM
Is this something that can be fixed soon, or do I need to maker other plans? I need the information up pretty quickly because classes are starting.

Thanks.

Bill


Mauno Korpelainen added a comment - 08/Aug/08 05:42 AM
Bill,

i have nothing to do with Database activity (wrote previous comment only for editor) but after a quick check it looks like file mod/data/field/textarea/field.class.php and function update_content

else { $content->content = clean_param($value, PARAM_CLEAN); }

cleans span tags. Another thing is that even if you delete those tags (then it will stay as you wrote it , uncleaned in database and in editor when you edit content) moodle filters the visible content when you view database in view.php - this may be some security issue (I really don't know the reason)

I hope Eloy, Peter, Martin or some other core developer can give you better explanation.


Eloy Lafuente (stronk7) added a comment - 08/Aug/08 06:32 AM
Well, there are two problems here (after talking with Petr about this):

1) The most obvious is that the clean is cleaning too much (it's cleaning the font-family selector and it shouldn't). it's easy to fix. Will be in CVS in some minutes (I'll post here once committed).

2) The second problem is WHEN that cleaning is happening. I really thing that we don't have to clean before insert or update DB, mainly because we always clean on display (format_text(), format_string()). So I'd suggest database module to don't perform that clean when inserting/updating those "textarea" fields.

In fact, doing that causes wrongly-cleaned contents to be sent to DB, so they cannot be recovered. In the other side, cleaning on display... guaranties that contents in DB are the ones entered by user, i.e. the cleaning doesn't destroy anything.

Adding to Robert and Martin here... ciao


Eloy Lafuente (stronk7) committed 1 file to 'Moodle CVS' on branch 'MOODLE_19_STABLE' - 08/Aug/08 06:36 AM
Allow font-family "protocol" to avoid kses cleaning it. MDL-15963
MODIFY lib/weblib.php   Rev. 1.970.2.106    (+3 -3 lines)
Eloy Lafuente (stronk7) committed 1 file to 'Moodle CVS' - 08/Aug/08 06:38 AM
Allow font-family "protocol" to avoid kses cleaning it. MDL-15963 ; merged from 19_STABLE
MODIFY lib/weblib.php   Rev. 1.1124    (+3 -3 lines)
Eloy Lafuente (stronk7) committed 1 file to 'Moodle CVS' on branch 'MOODLE_18_STABLE' - 08/Aug/08 06:42 AM
Adding 'text-decoration' and 'font-family' to allowed protocols. Backported from HEAD. MDL-15963
MODIFY lib/weblib.php   Rev. 1.812.2.107    (+4 -4 lines)
Eloy Lafuente (stronk7) added a comment - 08/Aug/08 06:45 AM
1) has been fixed in CVS (for 18_STABLE, 19_STABLE and HEAD). Will be available in next weekly build (or by direct CVS access). That will allow you to save new contents having that css selector.

2) waiting for answer about to avoid that cleaning before insert/update in database module.

Ciao


Bill Mounce added a comment - 08/Aug/08 02:28 PM
Is this related to my earlier report (http://tracker.moodle.org/browse/MDL-15925) that disallows the administrator to use EMBED and OBJECT tags? It would be great, while you are cleaning up the CLEAN routine, to make it so that admin can use these.

Eloy Lafuente (stronk7) added a comment - 08/Aug/08 05:27 PM
Ah, Bill, this isn't related to MDL-15925 AFAIK.

Reading it I don't think that "allowing to bypass the setting to admins" is completely correct. Because then, other users can arrive. Perhpas a new capability (edit:useembedandobject or so) could be added to the system to allow selectively permissions about who can use those tags? (just thinking as I type, not really sure if that's possible). I'd suggest you to comment there, to leave both bugs separated.

Ciao


Petr Skoda added a comment - 13/Aug/08 05:23 AM
this embedding should be imo solved the same way as trusttext in forum and glossary, but first step would be to rewrite it there

Bill Mounce added a comment - 14/Aug/08 02:19 PM
I just downloaded the new 1.9.2 weekly stable (August 13) and updated my site. The problem with <span="textGreek"> (or any other span) is still there. Moodle leaves the </span> but still strips out the leading <span>. Is it possible for you to tell me where I can manually enter the fix? I have lots of data to input and can't until this is fixed. Thanks.

Bill Mounce added a comment - 15/Aug/08 08:13 AM
Weird. It is the next day, and the <span> tags are being left alone. I did uncheck Enable Trusted Content, so maybe that is the difference, and with it checked the <span> is still being removed. Don't know.

ericmerrill committed 1 file to 'Moodle CVS' on branch 'MOODLE_17_STABLE' - 04/Dec/08 01:54 AM
weblib: MDL-16293: background-color attribute stripped from html. Adding 'background-color' attribute to $ALLOWED_PROTOCOLS array so kses doesn't drop it.

Including:
weblib: MDL-15963: Backporting the addition of font-family and text-decoration while i'm here for consistency.
MODIFY lib/weblib.php   Rev. 1.674.2.37    (+4 -4 lines)
ericmerrill committed 1 file to 'Moodle CVS' on branch 'MOODLE_16_STABLE' - 04/Dec/08 01:55 AM
weblib: MDL-16293: background-color attribute stripped from html. Adding 'background-color' attribute to $ALLOWED_PROTOCOLS array so kses doesn't drop it.

Including:
weblib: MDL-15963: Backporting the addition of font-family and text-decoration while i'm here for consistency.
MODIFY lib/weblib.php   Rev. 1.581.4.14    (+4 -4 lines)
Eric Merrill added a comment - 04/Dec/08 02:03 AM
Backported the addition of 'text-decoration' and 'font-family' to MOODLE_17_STABLE and MOODLE_16_STABLE while working on MDL-16293

-eric