Nofollow filter can be overridden by users

Yes, seems they're already discussed that here http://groups.google.com/group/Google_Webmaster_Help-Indexing/browse_thr... and still got no good solution.

You've raised an interesting question, but seems that it concerns a known problem with the tag attribute filtering at user input. They're still looking for a reliable solution, and seems there are a number of ways:

- to restrict some tags like A at all;
- to make all users insert the BBCode instead of HTML ( http://drupal.org/project/bbcode );
- to write some filtering of your own ( http://drupal.org/project/filter_macros , http://drupal.org/project/ext_link_page , http://drupal.org/project/dme etc. );
- or probably try one of the http://drupal.org/project/htmlpurifier , http://drupal.org/project/htmLawed or http://drupal.org/project/safehtml ones. IMHO , the http://drupal.org/project/htmlpurifier looks like a good solution at the moment, but I can be wrong, of course.

It will be good if you try some of the ways and tell us your opinion, that will help many of us to fight with spammers.

If you use the htmLawed module you can use a $spec rule (see the project page) to deny any rel="follow" in user input:

a = rel(noneof=follow);

With htmLawed in use, you don't need the Nofollow filter (or even Drupal's HTML filter).

subscribe

See patch created here http://drupal.org/node/362972, comment #50

Now if we could apply this to D6...

Marking as duplicate of #362972: Filters should remove "rel" attributes instead of just adding rel="nofollow"