I am using Drupal 7. I have a page that has a PHP body that I know does not have any dangerous tags. According to the README.txt file in Security Review I need to add this to the "security_review_known_risky_fields" system variable ? Can somebody provide an example on how to do this? I am not sure exactly what the entry in the variable table should look like.
How can I prevent a page with PHP content getting flagged in Security Review "Dangerous tags in content" check?
In settings.php add the following:
$conf['security_review_known_risky_fields'] = implode( ',', array( 'xxx', 'yyy', 'zzz' ), );
...where 'xxx', 'yyy', and 'zzz' are the content hash strings shown for each problematic file in the Security Review report.
The README says to create "a SHA-256 hash of the entity_id, entity_type, and field contents". It looks like you have to call
hash('sha256', $entity_id.$entity_type.$field_contents) and save that in the
security_review_known_risky_fields string variable, which can be done in settings.php. If there are multiple fields you want to allow, separate their respective hashes with commas.