3

I can't figure out how I can limit my text format or HTML codes for the comment sections on a node. If I edit the input formats with user roles, it edits the entire thing, including the node body and other fields.

For example, I want to have filtered text on the body field of a node, but only plain text (or other custom text format) in the comments section.

The problem I'm running into is that I have added <embed>, <param>, <iframe>, <object> into the allowed HTML tags field in my filtered text format settings, but this also allows users to post Youtube videos into the comments section, and I don't want that.

How can I do this?

Improve this question
1
  • 3
    Just a note, make sure you trust the users who are posting <embed> tags. <embed> is a cross-site scripting vector and someone could use these tags to completely take over your site: heine.familiedeelstra.com/exploit-embed-tag
    – Dylan Tack
    Commented Aug 25, 2011 at 4:40

1 Answer 1

Reset to default
3

You need to create two "Filtered Text" formats, one that is used by people with the access to post nodes and one for comments.

If you can't separate the two forms by access control (e.g. users are allowed to post nodes and comments, but shouldn't be allowed to post videos in comments), you could use hook_form_alter() in a custom module to limit the allowed filters for the comment form.

Improve this answer
4
  • Thank you for the reply. Yes, I have already created a custom 'comment' text format that limits those HTML tags. HOWEVER- users can both post Nodes AND Comments. Also- I can't seem to figure out how to hide the text format selector box from the users. I want to be able to designate a specific format for each section (node, comment), and lock it down so that they cannot change it. Is that possible to do? Can you tell me more about this hook_form_filter thing? Thanks for the help!
    – user800507
    Commented Jun 23, 2011 at 17:54
  • 3
    Changing the filter is a bit tricky, because that is generating after hook_form_alter() is invoked, see stackoverflow.com/questions/4894448/… for how to hide it completely, limiting the available filters should work similarly. For general information about hook_form_*alter*(), see lullabot.com/articles/modifying-forms-drupal-5-and-6
    – Berdir
    Commented Jun 23, 2011 at 17:56
  • @berdir: True, a simple solution if you don't want the hazzle would be to set the format to a specific value instead, which could work for comment fields.
    – googletorp
    Commented Jun 23, 2011 at 18:02
  • Can you explain what it means to set the value to a specific value?
    – user800507
    Commented Jun 23, 2011 at 19:48

Not the answer you're looking for? Browse other questions tagged or ask your own question.