How to stop CKEditor 3.6.3.7474 from stripping <script> tags

Question

With Full HTML enabled and related filters off, CKEditor will strip any <script> tags from content it is editing. The editors who create content for this particular site need to be able to embed things like this in the content they are creating:

    <img src="http://s2.thingpic.com/images/TD/zKWJQJiFBsp3oP1etNC1.png" width="560" class="alwaysThinglink"/>
<script charset="utf-8" src="//www.thinglink.com/jse/embed.js#286861458501795840"></script>

In theory we can make this work by disabling CKEditor and working directly with HTML, but in practice it doesn't work: the editors are not HTML-savvy. They know enough to temporarily drop out of rich-text mode, paste in the above, and then switch back to rich-text mode. But if they go to edit that content again, CKEditor strips the <script> tags when opening the content.

How can I stop that behavior and have CKEditor leave the <script> tags in place? Is there a hidden setting somewhere for that?

BTW, we are using CKEditor in conjunction with Wysiwyg 7.x-2.1 module.

And yes, in general allowing <script> is very bad, but in this case the only people who have access to the Full HTML format are the editors (who are trusted).

Thanks!

Answer 1

You can resolve this by going to the "Advanced Options" section of your CKEditor profile and adding the following string into the text area: config.allowedContent = true;

This resolved the issue for me.

Answer 2

I was running into this too, and it was very frustrating.

For me, the problem was with the Teaser Break plugin that's bundled with the Wysiwyg module. Disabling that button for my Wysiwyg profile solved the problem for me.

You can disable the Teaser Break wysiwyg plugin in Administration › Configuration › Content authoring › Wysiwyg profiles (/admin/config/content/wysiwyg).

I'm very interested to know if this solves your problem also, or if you were running into a different issue. I just filed a new bug for this at http://drupal.org/node/1801166.

Answer 3

I think you are looking for the setting:

• page admin/config/content/ckeditor/edit/advanced (replace advanced with your profile name).
• tab Advanced content filter.
• set to Disabled.

Alternatively you can set it to Enabled and add the script tag in "Extra allowed content", but with scripting allowed, you can as well allow anything.

This setting is from the CKEditor module thus this holds for when you are not using the Wysiwyg module. When using wysiwyg< I guess you have to find out what this setting does, probably setting some options in the CKEditor.

BTW: Why use wysiwyg in between instead of going for the full feature set of CKEditor. I stopped using wysiwyg when CKeditor 4 came out and wysiwyg could not offer support for that for a long time after. As I always and only use CKEditor, what's the point of having wysiwyg in between?

Answer 4

Have you checked the Textformat Settings? So that not "limit HTML Tags" is checked? Anyway i think the Ckeditor Module without WYSIWYG Module is more stable.

Answer 5

Old old question, but another way to handle this is to disable the WYSIWYG by default. If the WYSIWYG doesn't engage (turn on/whatever) in edit mode, then the script tag isn't stripped. In my use case this works out.