0

I am wondering if there is any available module in 7 that creates some simple blocks?

I need to be able to use script and iframe tags in the blocks but neither input formats nor modifying them through admin panel is required. They just need to be secure and cache-able to scale well.

(I don't want to create blocks from admin panel, as they showed to be vulnerable to code injection which I explained here).

Improve this question
9
  • Blocks created through the admin UI aren't inherently vulnerable to code injection - if you have it configured badly then yes, the wrong people may be able to inject tags you don't want them to. But that's all down to you; the solution is to use core input formats and permissions to manage this, not build another module which does exactly the same thing (IMO).
    – Clive ♦
    Jan 14, 2015 at 14:02
  • @Clive, as I detailed in the link above, I can not use plan text or filtered html on these blocks, as they are to contain ad scripts/iframes. So I just given up using admin panel to create them, and I am not a developer to make my own modules. hence the question.
    – edi
    Jan 14, 2015 at 14:05
  • If your plain text and filtered html formats allow script tags, you have the input formats configured incorrectly. If you want that, then you need to create another format for users who should not have access to that functionality. That's my point - you can manage all of this through the core UI, no extra modules required. Side note: please bear in mind that questions need to be self-contained, you can be fairly certain people aren't going to look at other complicated posts you've linked to for context (I didn't), you need to get that context into this standalone question
    – Clive ♦
    Jan 14, 2015 at 14:06
  • alright, sorry I should not have mnetioned my other problem here. Whatever input format that I define for the block, it should allow script and iframe so become effectively equivalent to 'Full html' that I used on the block and was vulnerable. I guess that's why one needs to use module-based(not admin-created) block, and hence the question here.
    – edi
    Jan 14, 2015 at 14:11
  • 1
    If you can get exactly what you want out of the box with another CMS that's obviously a better shout - it's just such a specific use-case that I'm not sure someone will have tried to solve it before without using Drupal's standard methods (filters + formats), which you don't want to use
    – Clive ♦
    Jan 14, 2015 at 14:44

0

Reset to default

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Browse other questions tagged or ask your own question.