Hi,

the htmlpurifier is deleting all forms. how I can change that?

Comments

jepster_’s picture

*bump*

ezyang’s picture

Category: bug » feature
Status: Active » Closed (won't fix)

The backing library HTML Purifier does not support safe forms yet, as such, the Drupal module cannot support them.

jepster_’s picture

so what should I do, to save my forms from removing?

traviscarden’s picture

I needed to do this, too. At present, the HTML Purifier library doesn't support it, but I found a (kind of ugly) workaround: the library actually does have a Forms HTML module, but it declares itself as unsafe, so the elements it defines are stripped. If you just change it to claim to be safe, HTML Purifier will let form elements through. In sites/all/libraries/htmlpurifier/library/HTMLPurifier/HTMLModule/Forms.php, just change the following variable declaration (around line 9) to TRUE:

public $safe = false;

The trouble with this approach is that you're hacking a third party library, so the next time you upgrade it, you'll have to make the change again, or it'll suddenly start stripping form elements again. To make sure I didn't forget, I created a custom module with the following code in the MYMODULE.install to alert me (on the Status report page) if the hack gets reversed.

/**
 * Implements hook_requirements().
 *
 * Tests to make sure HTML Purifier Forms HTML module is patched.
 */
function MYMODULE_requirements($phase) {
  $requirements = array();
  $t = get_t();

  if ($phase == 'runtime') {
    $path = libraries_get_path('htmlpurifier') . '/library/HTMLPurifier/HTMLModule/Forms.php';
    $file = file_get_contents($path);
    if (!strpos(strtolower($file), 'public $safe = true;')) {
      $requirements[MYMODULE_htmlpurifier_forms_module_patched'] = array(
        'title' => $t('HTML Purifier Forms HTML module'),
        'value' => $t('Not patched'),
        'severity' => REQUIREMENT_ERROR,
        'description' => $t('Set !variable to !value in !path to allow HTML form elements through HTML Purifier.', array(
          '!variable' => 'HTMLPurifier_HTMLModule_Forms::$safe',
          '!value' => 'TRUE',
          '!path' => '' . $path . '',
        )),
      );
    }
  }

  return $requirements;
}

It's kinda low tech, but it gets the job done. You could craft a more elegant solution if the library allowed you to include the Forms module via the API, but it doesn't appear it does at present. There's kind of a discussion of this on the library's forms.