Original issue fixed: http://repo.or.cz/w/htmlpurifier.git/commit/33afd7d9e050121593d81a8a150bf2b4f5a49f8a

Once the

<!--[if IE]><![endif]-->

is included, each additional time the filter is run it will keep appending that string.

For example, if the filter is run 2x, this is the resulting code:

<object width="640" height="385">
  <param name="movie" value="http://www.youtube.com/v/2mNB_VG_shc&hl=en_US&fs=1&" />
  <param name="allowFullScreen" value="true" />
  <param name="allowscriptaccess" value="always" />
  <!--[if IE]><embed width="640" height="385" src="http://www.youtube.com/v/2mNB_VG_shc&amp;hl=en_US&amp;fs=1&amp;" allowFullScreen="true" allowscriptaccess="always" /><![endif]--><!--[if IE]><embed width="640" height="385" src="http://www.youtube.com/v/2mNB_VG_shc&amp;hl=en_US&amp;fs=1&amp;" allowFullScreen="true" allowscriptaccess="always" /><![endif]-->
</object>

"Latest git version from Tue, 30 Mar 2010 17:33:13 +0000"

refers the the HTML Purifier itself, not the drupal module.

SafeEmbed - "yes" SafeObject - "yes" Trusted - "No" DisableExternalResources - "No"

Drupal Module 6.x-2.1 (http://drupal.org/project/htmlpurifier) Latest git version from Tue, 30 Mar 2010 17:33:13 +0000

Finally - Drupal, CKeditor, IMCE and HTMLPurifier - all playing nice with one another!

Thanks very much for a nice bit o work!

Todd

you must have DisableExternalResources set to "off"!

Todd

If use " the object tag comes through but it is stripped of its parameters. Also embed is removed, but I have seen embed just be commented out for IE too, (not seeing that now)

before

<object height="385" width="480"><param name="movie" value="http://www.youtube.com/v/A_L8sW_ULH8&amp;hl=en_US&amp;fs=1&amp;" /><param name="allowFullScreen" value="true" /><param name="allowscriptaccess" value="always" /><embed allowfullscreen="true" allowscriptaccess="always" height="385" src="http://www.youtube.com/v/A_L8sW_ULH8&amp;hl=en_US&amp;fs=1&amp;" type="application/x-shockwave-flash" width="480"></embed></object>

after

<object height="385" width="480" type="application/x-shockwave-flash"><param name="allowScriptAccess" value="never" /><param name="allowNetworking" value="internal" /><param name="movie" value="" /></object>

Todd

Thanks

Todd

Here is it is

<embed allowfullscreen="true" allowscriptaccess="always" height="400" src="http://blip.tv/play/hb0hgdL%2BFQA%2Em4v" type="application/x-shockwave-flash" width="600"></embed>

Thanks

Todd

I have the latest version from git. I am using the drupal module. I have set SafeEmbed and SafeObject on. I have "Trusted" off. I also have FlashCompat on. I have cleared all caches.

But the embed tag is still getting stripped out.

Is there some other setting I need to deal with?

Thanks

Todd

I've updated my site with the latest "flashvars"-enabled code, but that parameter is still getting stripped out of my embed -- same results as before. (Both with and without %HTML.SafeObject enabled.) Can someone else confirm that a JW embed does work with the parameters described as above?

I don't see those changes in the Git repo yet. Are you going to commit them so I can pull the new version?

Next issue: even with that fixed, my embed is still getting its flashvars stripped out. It's the generic embed code generated by the JW Player. I understand not allowing script access or fullscreen, but it needs its flashvars. Object-based embeds work fine. Any ideas?

Input :

<embed src='http://www.curtisgibby.com/pages/player-viral.swf' height='240' width='320' allowscriptaccess='always' allowfullscreen='true' flashvars='image=http%3A%2F%2Fwww.curtisgibby.com%2Fthumbs%2FEaster2009-NathanSwinging.jpg&file=http%3A%2F%2Fwww.curtisgibby.com%2Fpics%2FEaster2009-NathanSwinging.flv&plugins=viral-1d'/>

Output :

<embed src='http://www.curtisgibby.com/pages/player-viral.swf' height='240' width='320' allowscriptaccess='never' allownetworking='internal' type='application/x-shockwave-flash'>

Config :

$config = HTMLPurifier_Config::createDefault();
$config->set('Output.TidyFormat', true);
$config->set('HTML.Doctype', 'HTML 4.01 Transitional');
$config->set('HTML.SafeObject', true);
$config->set('HTML.SafeEmbed', true);
$config->set('Output.FlashCompat', true);
$purifier = new HTMLPurifier($config);

Thanks for your help!

Warning: Cannot set undefined directive Output.FlashCompat to value on line 10 in file /path/to/myfile.php in /path/to/htmlpurifier/library/HTMLPurifier/Config.php  on line 564

Config code:

$config = HTMLPurifier_Config::createDefault();
$config->set('Output.TidyFormat', true);
$config->set('HTML.Doctype', 'HTML 4.01 Transitional'); // replace with your doctype
$config->set('HTML.SafeObject', true);
$config->set('Output.FlashCompat', true);
$config->set('HTML.SafeEmbed', true);

That gives me an embed, but without the flashvars required to make the video work. I see other people are having success with HTML.SafeEmbed and Output.FlashCompat, but it seems that the version of the code that I have just doesn't recognize that FlashCompat exists. Any ideas?