By kavithra on

Is it a security risk to keep the full html filter format as default?

My WSYIWYG editor (tinymce or fckeditor) does not work with filtered html?

⋅ Categories: Drupal 5.x

Comments

tdimg’s picture

tdimg commented

Well, with full html code it could be possible to include some evil stuff in your site, iframe should be possible, maybe even including external javascript and other stuff.

There's a module called filter default, that lets you define the default filter depending on user role.

kavithra’s picture

kavithra commented

Kavita

Thank you for a quick response, That module is for drupal 4.7, I have 5.1, But I got the idea... the particular user roles should not be given access to the filter type.