Uploaded image for project: 'Moodle'
  1. Moodle
  2. MDL-48467

Atto: Clean the html even if submitting the form when atto is in html view mode

XMLWordPrintable

    • MOODLE_27_STABLE, MOODLE_28_STABLE, MOODLE_29_STABLE, MOODLE_30_STABLE
    • MOODLE_28_STABLE, MOODLE_29_STABLE
    • MDL-48467-master
    • Hide
      1. Go into a course and edit a course section heading
      2. Go into HTML mode
      3. Enter: 

        <!--
        		 
        This is a unclosed comment

      4. Save
      5. Confirm on the next page you see the text, and that the whole page is visible
        • Note that you will probably be able to see the content "change", stripping the open comment tag when you hit submit before it is actually submitted.
      Show
      Go into a course and edit a course section heading Go into HTML mode Enter: <!-- This is a unclosed comment Save Confirm on the next page you see the text, and that the whole page is visible Note that you will probably be able to see the content "change", stripping the open comment tag when you hit submit before it is actually submitted.

      I'll set the scene, on my course page, i'm editing a section description.

      I've noticed that when i switch to the HTML code mode in the Atto HTML editor moodle is allowing me to save the following code 

      <body style="background-color: #336699"></body>

      Furthermore moodle is then saving this inline style and putting it on the body tag of the page which results in the whole page turning the above color.

      Then when i go to edit the same section description again the above code is removed by the Atto HTML editor and in order for me to remove the colour i need to add the following code

      <body style=""></body>

      Perhaps Moodle needs to sanitise what is getting pushed back from the text editors or the Atto HTML editor needs to be changed so it doesn't allow certain tags.

            emerrill Eric Merrill
            frostfang83 Michael Barber
            Adrian Greeve Adrian Greeve
            Eloy Lafuente (stronk7) Eloy Lafuente (stronk7)
            Mark Nelson Mark Nelson
            Votes:
            0 Vote for this issue
            Watchers:
            10 Start watching this issue

              Created:
              Updated:
              Resolved:

                Error rendering 'clockify-timesheets-time-tracking-reports:timer-sidebar'. Please contact your Jira administrators.