Switching the format of the node editing - run filter by AJAX, saving node rewrites the raw value in the database - it is contrary to the default behavior of Drupal!

  1. Value In the field "Body" is always stored as raw value and should not pass xss filtering - this is the default behavior of Drupal.
  2. Filters used when viewing a page should be based on the format("Filters content in preparation for display"- Filter module description), not when editing.
  3. WYSIWIG provides XSS filtering
CommentFileSizeAuthor
#1 disable-xss-ajax-filter-2000712-1.patch3.51 KBAndrei.Sapeshko

Comments

Andrei.Sapeshko’s picture

Andrei.Sapeshko commented
StatusFileSize
new disable-xss-ajax-filter-2000712-1.patch3.51 KB

Рossible solution.

Andrei.Sapeshko’s picture

Andrei.Sapeshko commented
Issue summary: View changes

Some additions

drifter’s picture

drifter commented

I think the point they made is that the content is loaded as HTML rather than plain text in CKEditor, and so the XSS attacks could fire while editing content. Nevertheless, this should at least be a clearly labeled option that I can disable, as currently it is erasing important parts of the content's HTML!

jcisio’s picture

jcisio commented
Status: Active » Closed (won't fix)

There won't be that option. From the CKEditor CTO: http://stackoverflow.com/a/12099443/417401.
So the AJAX XSS filter was added to protect from server side. If it has bug, then let's fix it instead of removing the filter.

jcisio’s picture

jcisio commented
Issue summary: View changes

Some additions