Re: how to add a couple attributes to the default whitelist, e.g. 'onclick'

purushagovinda — Wed, 02 May 2012 12:12:14 -0400

thanks so much for your time!

I'll keep discussion over there on SO then. I was not sure where you prefer to correspond. Are you Edward? Are you the sole man behind support? (You have accomplished an astonishing amount of code in recent years ;-)

Again, just thanks.

Re: how to add a couple attributes to the default whitelist, e.g. 'onclick'

Ambush Commander — Wed, 02 May 2012 11:08:39 -0400

Dupe http://stackoverflow.com/questions/10406841/with-htmlpurifier-how-to-add-a-couple-attributes-to-the-default-whitelist-e-g

how to add a couple attributes to the default whitelist, e.g. 'onclick'

purushagovinda — Wed, 02 May 2012 11:00:52 -0400

Two questions:

I have been reading fiddling with htmlpurifier config settings and reading the docs, and came to the conclusion (erroneously?) that as far as telling htmlpurifier which elements/attributes should be allowed, I have to either leave the default whitelist alone as it is, or I have to specify every single elements/attributes that should be allowed. Is this correct? I would love to be able to just add 2 or 3 attributes to the default whitelist.. so that I do not have to constantly find and add more elements/attributes to, e.g., HTML.AllowedElements and/or HTML.AllowedAttributes.

On the other hand, I would not mind specifying them myself if I could find the default list of allowed elements/attributes, that I could copy and paste, and then add to.

Anyway, specifically now, (for internal trusted users) I need to allow javascript attributes (input from tinymce).

Question #1:

Is there a way to just add an attribute (to what HTMLpurifier allows) without causing the whole default sets of allowed elements/attributes to be effectively wiped out (overwritten by ONLY what is explicitly written in HTML.AllowedElements or HTML.AllowedAttributes)?

For what I need right now (the javascript attributes), I got excited when I saw in this thread:

http://stackoverflow.com/questions/3189396/whitelist-forms-in-html-purifier-configuration

...where Edward Z. Yang says, "... [$config->set('HTML.Trusted', true);] allows JavaScript."

...but even after setting this:

$config->set('HTML.Trusted', true);

, HTMLpurifier 4.4.0 is still stripping e.g. any input onclick="dostuff();" attribute. Why?

Question #2:

Is there a quick way to add just the javascript attributes to the allowed list?

Thanks for your time, sincerely

-Govinda