Come together with the global Drupal community in Rotterdam, 28 Sept – 1 Oct 2026. Sessions, contribution, connection, and Early Bird savings until 8 June.
This would be a great way to not have FlickrSync decide what to omit or allow while giving both Admins and Users flexibility to decide on their own, similar to editing a node.
Comments
Comment #1
elly commentedIt's true, and, HTML in captions gets entified, too, I've noticed... regardless of what you've got as your default input type on the site.
Comment #2
elly commentedit might present some kind of security hole to import unscrubbed html, but i got around the entifying by changing line 671 from
to
Comment #3
gclicon commentedUpdating title to also include issue in #367396: HTML in flickr Description Field Entified since they are related issues.
This is an issue that will take some time to figure out how to best resolve since just about any solution would present some kind of security hole.
Comment #4
gclicon commentedComment #5
gclicon commentedComment #6
xolotl commentedIsn't there an established, secure way to pass such content in Drupal? It's not like this issue is apparent in Drupal core...
If I could point to the method, I would.
Comment #7
elly commentedThe right thing to do is probably pass it through Drupal's html filter, same as you would for node content. Perhaps this function? http://api.drupal.org/api/drupal/modules--filter--filter.module/function...
Comment #8
gclicon commentedActually, the better function would be:
http://api.drupal.org/api/drupal/modules%21filter%21filter.module/functi...
This would be a great way to not have FlickrSync decide what to omit or allow while giving both Admins and Users flexibility to decide on their own, similar to editing a node.
My current focus is on #1869164: Upgrade Flickrsync to support latest version of flickrapi module, but will entertain and review any patches to get this feature added. Otherwise, I'll add this feature once that ticket is closed.
Comment #9
gclicon commented