README.txt 3.7 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384
  1. ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
  2. ;; WYSIWYG Filter module for Drupal
  3. ;;
  4. ;; Original author: markus_petrux at drupal.org (October 2008)
  5. ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
  6. OVERVIEW
  7. ========
  8. The WYSIWYG Filter module provides an input filter that allows site
  9. administrators configure which HTML elements, attributes and style properties
  10. are allowed. It also may add rel="nofollow" to posted links based on filter
  11. options. It can do so with no additional parsing on user input. That is, it may
  12. apply nofollow rules while parsing HTML elements and attributes.
  13. The filter is based on whitelists that can be defined from the filter settings
  14. panel. Rules for HTML element and attributes are defined using the same syntax
  15. of the TinyMCE valid_elements option.
  16. The following elements cannot be whitelisted due to security reasons, to
  17. prevent users from breaking site layout and/or to avoid posting invalid HTML.
  18. Forbidden elements: applet, area, base, basefont, body, button, embed, form,
  19. frame, frameset, head, html, iframe, input, isindex, label, link, map, meta,
  20. noframes, noscript, object, optgroup, option, param, script, select, style,
  21. textarea, title.
  22. The section used to whitelist style properties is pretty simple. You just check
  23. the properties you need from a list where almost all style properties are
  24. organized into logical groups (Color and Background properties, Font, Text,
  25. Box, Table, List, ...). The WYSIWYG Filter will strip out style properties not
  26. explicitly enabled. On the other hand, for allowed style properties the WYSIWYG
  27. Filter will check their values for strict CSS syntax (based on regular
  28. expressions) and strip out those that do not match. Additional matching rules
  29. are explicitly required for properties that may contain URLs in their values
  30. ("background", "background-image", "list-style" and "list-style-image"). If
  31. rules don't match, these style properties will be ignored from user input.
  32. When the "id" and "class" attributes have been whitelisted, it is also required
  33. to specify explicit rules that will be used to validate user input, and again,
  34. those that don't match will be stripped out.
  35. As a measure to reduce the effectiveness of spam links, it is often recommended
  36. to add rel="nofollow" to posted links leading to external sites. The WYSIWYG
  37. Filter can easily do this for you while HTML is being processed with almost no
  38. additional performance impact. There is a section in the filter settings panel
  39. where a white/back list policy can be defined per domain name (the host part in
  40. the URLs).
  41. INSTALLATION
  42. ============
  43. - Copy all contents of this package to your modules directory preserving
  44. subdirectory structure.
  45. - Goto admin/build/modules to install the module.
  46. - Goto admin/settings/filters and create a new input format as follows:
  47. - Input format name: WYSIWYG Filter (or something similar of your choice).
  48. - Check the filters: WYSIWYG Filter and HTML Corrector. Save.
  49. - Goto Rearrange tab.
  50. - Drag the WYSIWYG Filter on top of the HTML Corrector. Save.
  51. - Goto the Configure tab of your newly created WYSIWYG Filter and setup the
  52. available options to suit your needs.
  53. SECURITY ISSUES
  54. ===============
  55. - To report security issues, do not use the issue tracker of the module.
  56. Instead, please contact the Drupal Security Team or the WYSIWYG Filter
  57. module developer (preferred).
  58. - To contact the WYSIWYG Filter module developer:
  59. http://drupal.org/user/39593
  60. http://drupal.org/user/39593/contact
  61. - To contact the Drupal Security Team:
  62. http://drupal.org/security-team
  63. - For any other kind of issue (support or feature requests, bug reports,
  64. translations, etc.), please, use the issue tracker of the module:
  65. http://drupal.org/project/issues/wysiwyg_filter