Uploaded image for project: 'Moodle'
  1. Moodle
  2. MDL-48467

Atto: Clean the html even if submitting the form when atto is in html view mode

    XMLWordPrintable

    Details

    • Testing Instructions:
      Hide
      1. Go into a course and edit a course section heading
      2. Go into HTML mode
      3. Enter:

        <!--
        This is a unclosed comment
        

      4. Save
      5. Confirm on the next page you see the text, and that the whole page is visible
        • Note that you will probably be able to see the content "change", stripping the open comment tag when you hit submit before it is actually submitted.
      Show
      Go into a course and edit a course section heading Go into HTML mode Enter: <!-- This is a unclosed comment Save Confirm on the next page you see the text, and that the whole page is visible Note that you will probably be able to see the content "change", stripping the open comment tag when you hit submit before it is actually submitted.
    • Affected Branches:
      MOODLE_27_STABLE, MOODLE_28_STABLE, MOODLE_29_STABLE, MOODLE_30_STABLE
    • Fixed Branches:
      MOODLE_28_STABLE, MOODLE_29_STABLE
    • Pull Master Branch:
      MDL-48467-master

      Description

      I'll set the scene, on my course page, i'm editing a section description.

      I've noticed that when i switch to the HTML code mode in the Atto HTML editor moodle is allowing me to save the following code

      <body style="background-color: #336699"></body>

      Furthermore moodle is then saving this inline style and putting it on the body tag of the page which results in the whole page turning the above color.

      Then when i go to edit the same section description again the above code is removed by the Atto HTML editor and in order for me to remove the colour i need to add the following code

      <body style=""></body>

      Perhaps Moodle needs to sanitise what is getting pushed back from the text editors or the Atto HTML editor needs to be changed so it doesn't allow certain tags.

        Attachments

          Issue Links

            Activity

              People

              Assignee:
              emerrill Eric Merrill
              Reporter:
              frostfang83 Michael Barber
              Peer reviewer:
              Adrian Greeve
              Integrator:
              Eloy Lafuente (stronk7)
              Tester:
              Mark Nelson
              Participants:
              Component watchers:
              Amy Groshek, David Scotson, Amaia Anabitarte, Carlos Escobedo, Ferran Recio, Sara Arjona (@sarjona), Víctor Déniz Falcón, Andrew Nicols, Jun Pataleta, Michael Hawkins, Shamim Rezaie, Simey Lameze
              Votes:
              0 Vote for this issue
              Watchers:
              9 Start watching this issue

                Dates

                Created:
                Updated:
                Resolved:
                Fix Release Date:
                6/Jul/15