Welcome! » Log In » Create A New Profile

PHP Warnings when set HTML.Allowed parameter

Posted by juanramon 
Forum List Message List New Topic
juanramon
PHP Warnings when set HTML.Allowed parameter
February 07, 2012 05:52AM

When I set up the HTML.Allowed configuration I get PHP Warnings. I guess I'm not setting well the allowed parameters... Here is the code I'm using: 

$allowed = 'b,strong,i,em,u,a[href|title],ul,ol,li,p[style],br,span[style],img[width|height|alt|src],';
$allowed .= 'object[align<bottom?left?middle?right?top|archive|border|class|classid|codebase|codetype|data|';
$allowed .= 'declare|dir<ltr?rtl|height|hspace|id|lang|name|onclick|ondblclick|onkeydown|onkeypress|onkeyup|';
$allowed .= 'onmousedown|onmousemove|onmouseout|onmouseover|onmouseup|standby|style|tabindex|title|type|usemap|vspace|width]';
self::$config->set('HTML.Allowed', $allowed);

Warning: Attribute 'align<bottom?left?middle?right?top' in element 'object' not supported (for information on implementing this, see the support forums) in {install}/oc-includes/htmlpurifier/HTMLPurifier/HTMLDefinition.php on line 324

Warning: Attribute 'archive' in element 'object' not supported (for information on implementing this, see the support forums) in {install}/oc-includes/htmlpurifier/HTMLPurifier/HTMLDefinition.php on line 324

You can see the whole PHP Warnings here: http://forums.osclass.org/installation-update-help/warnings-from-2-3-5/msg21081/#msg21081 The original file with the HTMLPurifier implementation is here: https://github.com/osclass/OSClass/blob/hotfixes/oc-includes/osclass/core/Params.php

I'm stuck with this because not everyone see the warning errors... :(

Reply Quote
Ambush Commander
Re: PHP Warnings when set HTML.Allowed parameter
February 07, 2012 10:46AM

The syntax for allowed parameters doesn't support the angled-bracket question mark syntax; that is all handled by HTML Purifier.

For objects, look at %HTML.SafeObject

Reply Quote
Newer Topic Older Topic
Author:
Your Email:

Subject:

HTML input is enabled. Make sure you escape all HTML and angled brackets with &lt; and &gt;.

Auto-paragraphing is enabled. Double newlines will be converted to paragraphs; for single newlines, use the pre tag.

Allowed tags: a, abbr, acronym, b, blockquote, caption, cite, code, dd, del, dfn, div, dl, dt, em, i, ins, kbd, li, ol, p, pre, s, strike, strong, sub, sup, table, tbody, td, tfoot, th, thead, tr, tt, u, ul, var.

For inputting literal code such as HTML and PHP for display, use CDATA tags to auto-escape your angled brackets, and pre to preserve newlines: 

<pre><![CDATA[
Place code here
]]></pre>

Power users, you can hide this notice with: 

.htmlpurifier-help {display:none;}

Message: