4

I have Drupal 7 with CKEditor 3.6.2.7275 under Wysiwyg module. In configs of Wysiwyg I unchecked all the checkboxes for "Cleanup and output" category. Plus unchecked "Limit allowed HTML tags" for Full HTML text format.

When I try to edit the page, containing javascript inside, the <script type="text/javascript"> is inside the <textarea> for content editing. But it's not shown by CKEditor when I click source button. So it's undoubtedly CKEditor filtering.

What should I do to make CKEditor show javascript?

1
  • one solution is add another textarea field without wysiwyg to your content type for your javascript code Commented Mar 26, 2012 at 12:43

4 Answers 4

4

Drupal, like most Content Management Systems, has security systems in place to filter most javascript during submission so site members can’t do ugly things via scripting. In most cases, that’s a good thing. When you’re scratching your head trying to figure out a way around it, not so much.

You can hard-code a script into the template, if you need it on all the pages and it works. But just adding a a single, inline javascript into a Drupal node is not as easy as it seems.

There may well be a prettier way to do this, but here is a quick way out in case you need it:

First, put the script on your server, someplace it’s easy to find. I usually have a “scripts” folder in my sites/all folder.

Second, when do your post, set your input filter to PHP

Third, do a php include where you’d like to place the script. Something like this:

<?php include('sites/all/scripts/my_javascript.js'); ?>

And there you go. Inline javascript. I guess in the most common scenarios Drupal is used for, having <script> available without filtering would be very foolish security wise. Unfiltered js in a webform makes for a very insecure setup.

4
  • That will get the job done but make sure you understand the security implications of using the custom PHP filter before enabling it. It's actually been removed entirely from drupal 8 core. Have a look at this post. what-are-the-downsides-of-using-custom-php
    – munkiepus
    Commented Aug 21, 2014 at 12:48
  • @munkiepus Although I did not say outright it was very hackish, I did put bold text to say it's not pretty. There are so many ways to add js on a page with drupal either in theme or module layer, you don't really need php in a form to add js. Ever. Commented Aug 21, 2014 at 17:36
  • 1
    I appreciate that, I was just trying to add a bit of useful info that I thought was relevant and helpful, don't want to step on any toes ;)
    – munkiepus
    Commented Aug 22, 2014 at 9:17
  • Lol, no way friend your comment is totally acceptable: my answer is indeed a bad hack. ;) Commented Aug 22, 2014 at 18:55
1

You can try appending:

config.extraAllowedContent = '*(*)';

in the Advanced Content Filter of CKEditor configuration. Be careful of security considerations.

1

On /admin/config/content/ckeditor/edit/Full open fieldset "Advanced content filter" and in textarea "Extra allowed content" add script

0

I had this problem before,but it's becuase of CKeditor Content Filtering feature

Configure input data filtering in CKEditor. See this blog post for more information about ACF.

You can Handle it by two solutions, the first one is preventing CKEditor filter contents, it's an easy solution just Disabled "Advanced Filtering Feature" at admin/config/content/ckeditor/edit/Full but I don't recommend it in all cases.

Better solution is specified your tags at admin/config/content/ckeditor/edit/Full(if you use Full filter, you can change it based your format in used) > Extra allowed content > Extra allowed content enter you desire tags, in your case just enter script in the textarea. save the form and clear the cache.

Exclude script tags from filtering in CKeditor

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.