Disallow HTML in comments

Question

I'd like to disallow all HTML and only allow plain text in comments across the site for all users, authenticated or not, but I still want to use other HTML filters for other content types. How can I achieve that in Drupal 8?

I've created a custom text format called "No HTML" and set it as the default format for comment bodies at admin/structure/comment/manage/comment/fields/comment.comment.comment_body. But instead of disallowing all HTML, it gives the option to change the text format to any other format available to the user.

How can I get comments to only use my "No HTML" text format for all users without disabling the other text formats for other content types?

Answer 1

The Allowed Formats projects allows you to control the available text formats per field, so you can limit it to plain text. Better Formats is a similar module.

You could do the same with a form alter and set #allowed_formats on the form element. Or you could remove the default comment body field and replace it with a plain text field. Although there might be some code relying on the name/existence of the default body field.

Answer 2

Berdir provided the key to figuring this out in his answer, so I marked it as the answer, but I'll post how I finally resolved this issue. Since I only need this for the comment forms, I decided to just write a small module to take care of the problem. Here's how I implemented hook_form_FORM_ID_alter():

function MY_MODULE_form_comment_comment_form_alter(&$form, \Drupal\Core\Form\FormStateInterface $form_state) {
  $form['comment_body']['widget']['0']['#allowed_formats'] = array('plain_text');
}

But I've also confirmed that the Allowed Formats module also does the job quite nicely. It gives me the option to limit the comment body field at admin/structure/comment/manage/comment/fields/comment.comment.comment_body without needing to touch code.

Answer 3

If go to Permissions (admin/people/permissions) you can set which user roles are allowed to use filter types, so you can uncheck basic HTML, Full HTML and Restricted HTML for authenticated users, then they wont have the option to change the text format.

EDIT:

Some other options to disable the filter input form for comments only:

1. Use the Simplify Module

2: Hide the filter form with CSS (Not my advised choice) so it doesn't display.

div.edit-comment-body-0-format {display:none; visibilty:hidden;}

3: Manipulate the the comment form output with PHP using hook_form_FORM_ID_alter() and unset the filter options. This would be my preferred choice. I can't provide a snippet for this just yet, but I will edit and add it as soon as I can.

Answer 4

Another Solution Is To Use --- fields.field_article_type.content|render|striptags