Uploaded image for project: 'Moodle'
  1. Moodle
  2. MDL-78485

TinyMCE does not allow insertion of script tags

XMLWordPrintable

    • MOODLE_401_STABLE, MOODLE_402_STABLE
    • MOODLE_401_STABLE, MOODLE_402_STABLE
    • MDL-78485-401
    • MDL-78485-402
    • MDL-78485-master
    • Hide

      Covered with a new behat test

      Prerequisite

      1. Make sure you're preferred editor is set to tinyMCE editor

      Manual testing

      1. Login as admin
      2. Go to profile then edit profile
      3. Go to a section where you have an editor of tinyMCE
      4. Click on "Tools > Source code"
      5. Set the field value to "<script>alert('script in tiny');</script>"
      6. Click "Save"
      7. Click on "Tools > Source code" again
      8. Verify that the script tag is still there and being removed from the editor.

      Behat testing

      Please run the behat test from this patch and feel free to change the value in the .feature file to verify the validation

      Show
      Covered with a new behat test Prerequisite Make sure you're preferred editor is set to tinyMCE editor Manual testing Login as admin Go to profile then edit profile Go to a section where you have an editor of tinyMCE Click on "Tools > Source code" Set the field value to "<script>alert('script in tiny');</script>" Click "Save" Click on "Tools > Source code" again Verify that the script tag is still there and being removed from the editor. Behat testing Please run the behat test from this patch and feel free to change the value in the .feature file to verify the validation
    • 2
    • Team Hedgehog 2023 Sprint 2.2, Team Hedgehog 2023 Sprint 2.3

      Need to add support for use of script tags using the extended_valid_elements tag.

      Need to add the following to the tinymce config in editor.js:

      extended_valid_elements: 'script[*]',

      Also needs a behat test.

      Essentially Tiny filters out invalid elements and it is quite strict about this.

      There's also a related issue in TinyMCE itself.

      https://www.tiny.cloud/docs/tinymce/6/content-filtering/#extended_valid_elements

        1. MDL-78485.png
          MDL-78485.png
          240 kB

            stevani.andolo@moodle.com Stevani Andolo
            dobedobedoh Andrew Lyons
            Meirza Meirza
            Ilya Tregubov Ilya Tregubov
            Ron Carl Alfon Yu Ron Carl Alfon Yu
            Votes:
            8 Vote for this issue
            Watchers:
            8 Start watching this issue

              Created:
              Updated:
              Resolved:

                Estimated:
                Original Estimate - 0 minutes
                0m
                Remaining:
                Remaining Estimate - 0 minutes
                0m
                Logged:
                Time Spent - 1 day, 2 hours, 2 minutes
                1d 2h 2m

                  Error rendering 'clockify-timesheets-time-tracking-reports:timer-sidebar'. Please contact your Jira administrators.