Loading...
 
Skip to main content

Features / Usability

Forum List Topic List

 
Thread actions
Print this page
  • Print all pages

    • Development issues

    Posted by netstorm

    Hello there,

    in my last Posting I asked if there is apossibility to show HTML source-code in an article. Well I walked a little bit through the files and changed a little bit in the CODE Plugin, so that it is possible to put HTML-Code in the formular that is manipulated using the 'htmlentities()' from PHP.

    Everything is fine, but when I want to put in something like < script >...< / script >, these Tags are removed completely (even if I write them with whitespaces - its also herein so i have to write &lt; instead of <). So I think there have to be a "Script-Killer" before the thing is given to the Plugin. Could someone help me where to look for that?

    Thanks and bye
    Thorsten

    Reads: 897
    Posted by sylvie greverend

    script is one of the term that is deleted.
    tiki-setup_base.php in the make_clean function
    But be careful, if you change this you can have security problem
    sylvie

    Posted by netstorm

    First of all: Thanks to you. We use tikiwiki in this form just company internal. So that should not be that much a security problem than in wilderness 😀

    But what I do not understand: Why should it be a security problem to push the things through htmlentities instead of deleting it. The script is then no longer recognizable as script, is it?

    Bye Thorsten