Timeline for Allowing HTML in block title - where is $block->subject created?
Current License: CC BY-SA 3.0
5 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Jan 14, 2013 at 20:27 | comment | added | alexvance | Right, that's what I meant - the users are trusted by me, not necessarily Drupal. :) | |
| Jan 14, 2013 at 20:05 | comment | added | tenken | Drupal doesnt care about "trusted users". It assumes everyone is potentially malicious -- because your site could be hacked and an un-trusted user could submit a blog post, or create a block for instance. Dont get me wrong -- I've done something similiar for a project as well. As a CMS drupal sanitizes all "titles" that come from user input. | |
| Jan 14, 2013 at 19:40 | comment | added | alexvance |
Thanks, yes. This is for a site with only trusted users. Is there a better filter for html that still lets <br> tags through?
|
|
| Jan 14, 2013 at 19:25 | comment | added | tenken | careful. Core does this to disallow HTML in block titles -- this is to avoid an authorized user from creating content that contains HTML to cross-link titles to malicious domains. | |
| Jan 14, 2013 at 18:03 | history | answered | alexvance | CC BY-SA 3.0 |