I was attempting to do a simple img tag from a field (though it looks like I can do it just as well using image cache formatters) so I'm not sure I actually NEED this, but it seems like replacing the check_plain with filter_xss_admin would be basically harmless and let people put HTML in their formatter.

CommentFileSizeAuthor
#1 1716098-allow-HTML-in-token-replacement.patch433 bytesmerlinofchaos

Comments

merlinofchaos’s picture

merlinofchaos commented
Status: Active » Needs review
StatusFileSize
new 1716098-allow-HTML-in-token-replacement.patch433 bytes

Here's a quick patch.

merlinofchaos’s picture

merlinofchaos commented

Ok, I'm wrong. I do need this, because even after fixing imagecache_token to work with non-node entities, it only provides a URL, not an img tag, so I still need HTML to show the image.

dave reid’s picture

dave reid
he/him
Primary language English
Location Nebraska USA
commented
Status: Needs review » Fixed

Modified the patch in #1 to use field_filter_xss(), allow the link text to also allow HTML, and fixed the $options['sanitize'] parameter for token replacement needed to be flipped since check_plain() is no longer getting called.

http://drupalcode.org/project/token_formatters.git/commit/2171ab8

Status: Fixed » Closed (fixed)

Automatically closed -- issue fixed for 2 weeks with no activity.

hass’s picture

hass commented
Category: feature » bug
Status: Closed (fixed) » Active

I tried using [user:field_address] token that returns me an address field from addressfield / addressfield_tokens modules and I see below code in the node. How can we loosen the rules or can you add <span> to the good tags? May use a filter format that allows more tags?

Example:
<span class="first-name">MyFirstname</span> <span class="last-name">MyLastname</span>MyStreet 63<span class="postal-code">12345</span> <span class="locality">MyCity</span><span class="country">Germany</span>

dave reid’s picture

dave reid
he/him
Primary language English
Location Nebraska USA
commented
Category: bug » feature
Status: Active » Closed (fixed)

According to http://api.drupal.org/api/drupal/modules%21field%21field.module/function... - span tags are allowed. Please file a new issue if needed.

hass’s picture

hass commented

#1778856: HTML span's check_plain'ed and div's filtered with [user:field_address] address field