The 2026 Drupal Business Survey is open. Your response will help shape the future of the Drupal business ecosystem.I have text fields on my CCK node types and they are incompatible with BUEditor. When BUEditor is installed, you get the buttons on every text field, whether it is set to plain text or not. Worse, having BUEditor installed causes it to ignore the input filters. Plain text CCK fields suddenly allow HTML and the ones with the input format enabled don't run the filters.
This is serious because it means that the user can put in any HTML even when their input format is filtered or the field is supposed to be text only.
Michelle
Comments
Comment #1
ufku commentedbueditor has nothing to do with filtering.
to see, disable bueditor and enter html manually to those fields.
Comment #2
michelleYes, that's the whole point. The filtering works fine until BUEditor is installed. When it is installed, it causes the filtering not to work anymore. Which means that if you install BUEditor and you use CCK fields that users can put any HTML into them, possibly even scripts, though I haven't checked that. This is a security issue and makes BUEditor unusable for people who also use CCK.
It's a pity because this is the best editor I've found but I'll need to uninstall it if this can't be fixed. My site has node adding open to the public so this module is far too dangerous.
Michelle
Comment #3
michelleOh, wow, I'm so embarrassed. :( I thought the only difference between the dev site and the live site was bueditor but it turns out there was a theme difference as well that I had forgotten about. After spending the morning tracing through code trying to figure out why having bueditor enabled bypassed the filters it turns out that the problem was that my theme needs to run check_markup as well.
I'm so sorry for sounding a false alarm. I really thought I had confirmed it was bueditor and was concerned that anyone using this with cck was putting their sites in danger.
Michelle
Comment #4
ufku commented