I love this editor, but on my site at least, it strips the PHP code from pages! :-(

Here's what happens:
1) I create a page with both HTML and PHP in it (with rich-text mode off) and set the input format to PHP code.
2) I verify that the page works properly.
3) I edit the page again. Although the PHP code appears in the textarea in the HTML source of the editing page, it does not appear in the editor (with rich-text mode off).
4) I save the page. The PHP part is now gone.
5) I edit the page again. The PHP is gone from the source of the textarea as well as from the visible textarea.

What am I supposed to do -- disable the rich-text editor for all users who are able to use the PHP code filter? Or is there a way to get it working? Thanks in advance.

Comments

gforce301’s picture

gforce301 commented

Basically the answer to your question is yes. TinyMCE is a WYSIWYG editor. It's output attempts to be valid (x)html. It will strip any non-valid tags especially PHP tags as they look very much like (x)html tags. There is no way short of a plugin for that editor to allow PHP code in or through the editor.

On a side note, it would not be considered wise to let very many users (if any) use php code. You must trust those users very VERY much. PHP in the wrongs hands can do things to your server that make even the most hardened admin shudder and if you are on a shared account your users could get you banned in a heartbeat.

gforce301’s picture

gforce301 commented
Status: Active » Closed (fixed)

Setting this to closed as it is not an issue with the TinyMCE Drupal module. This is a behavior of the editor itself which is created and distributed by Moxiecode.

benstallings’s picture

benstallings commented
Priority: Critical » Normal
Status: Closed (fixed) » Active

Thank you for your warning, but the site I'm working on needs a number of customizations that are best accomplished through PHP in the pages, and Drupal's ability to embed PHP in pages is a big part of why we chose it as a CMS, so it is not feasible for us to stop using that capability just so that we can use this module.

We do have our permissions set such that only the admin user has the ability to use PHP. But that raises a question about this module (not about the editor, so I've re-opened the support issue): how does one configure TinyTinyMCE so that the WYSIWYG editor is available to other users but *not* to the admin? It seems to me that enabling it for any user role besides anonymous enables it for the admin. Please advise.

We may have to go back to using FCKeditor, which does not have this problem: if you disable WYSIWYG mode, it lets PHP code through untouched. But I like TinyMCE more and would rather not have to switch back if we don't have to. Thanks!

gforce301’s picture

gforce301 commented

Ok I do not wish to get into an issue active vs. issue closed war. So I will let you close the issue when you deem that it is not an issue of the module.

To resolve the problem of making the editor either a) default to off for the admin or b) not be available at all (whichever one you want), all you need to do is create a separate profile in the settings page of the module for the admin. Now since profiles for this module are directly related to user roles, you will need to create a user role for the admin. This will now allow you to create a profile for that role and since the admin is the only user in that role admin should be the only user who is effected by that profile.

I myself never work as the root user on any of my sites. Instead I define a role, in my case I call it architect, and then create a single user in this role. I give all permissions under access control to this role. I then only log in as this user when I am building/administering the site. In this way I always have the root account available as the super user for a backup in case something happens with permissions and it is the only way I can get into the site. For me this already accomplishes what I have described above but in a different way. I already have a user role and a user in it that I can build a different TinyMCE profile that functions differently than the profile of other users.

Hope this helps.

Steve Lockwood’s picture

Steve Lockwood commented
Status: Active » Closed (duplicate)

Actually, I think there is an issue with this module (tinytinymce) and php input.

In general you should:
- turn off the rich text editor
- enter your php - <?php should be the very first thing in the textarea
- save the node
- the next time you edit the node, the rich text editor should stay switched off

Some users have reported a problem, which I have not yet reproduced, where the editor corrupts the php the next time you edit the node - I think it is to do with interaction with other modules but I have not found which one yet.

I will mark this thread as duplicated and continue the issue on http://drupal.org/node/287223.

If the general advice above does not work for you, it would be helpful if you would post a list of the modules you have enabled.

Steve