Is allowing Full HTML input for all user roles safe as long as I enable the HTML filter?
-
2If you add the HTML filter to Full HTML, how is it different from the existing Filtered HTML input?– tim.plunkettAug 3, 2011 at 19:35
-
There's no difference? It just says it removes javascript and harmful stuff. Not sure– Matthew HuiAug 3, 2011 at 19:50
-
2Then why wouldn't you just give them the Filtered HTML input?– tim.plunkettAug 3, 2011 at 19:58
-
1I have some content written by an admin that seems to use the default input filter. I want it to use full html.– Matthew HuiAug 3, 2011 at 20:37
-
HtmlPurifier solved my problem– Matthew HuiAug 3, 2011 at 21:22
Add a comment
|
2 Answers
Only trusted roles and users should have access to Full HTML. You can add some additional allowed tags to the Filtered HTML input format but don't add too many or you risk creating a vulnerability. (admin/settings/filters)
-
-
You can only add some additional allowed tags to filtered html and still keep it safe. Enabling "full html" for anonymous or putting too many (unsafe) tags into filtered html are two of the most common ways I've seen to make a site insecure.– gregglesAug 4, 2011 at 15:20
-
To the question "is it possible to allow inline css" - no, Drupal does not have a good tool for filtering CSS to remove cross site scripting.– gregglesAug 4, 2011 at 15:21
-
It doesn't really matter what the name of the input format is, if "untrusted" users (see a defintion of trusted roles) are allowed to enter unsafe HTML tags then your site is unsafe.
You can make the Filtered HTML input format unsafe by adding the wrong tags to it or make the "Full HTML" input format more safe by changing its configuration.
I suggest installing the Security Review module and configuring it to know which roles of your site you trust. It will then analyze your input formats to see which are safe and which are not. It also has documentation and links to further resources if it determines that some of your input formats are unsafe. One great resource is the handbook page on configuring input formats for safety.
If you want to make a different input format the default for your admins vs. your regular users, try the Better Formats module.