TinyMCE strips HTML not supported by plugins/buttons

Does this also happen when you disable HTML filter for this input format?

Sorry, without further information I'm forced to mark this issue won't fix.

Drupal's default HTML Filter strips out all style attributes for security. You can disable this filter or if you still want security on the HTML output, you will need to enable a more advanced filter. WYSIWYG Filter works great and is easy to set up (let's you specify exactly which css styles to allow and which html attributes to allow for each tag). HTML Purifier is more powerful still, but has a bigger learning curve.

Is there a way to ensure that TinyMCE will not alter my HTML code?

I'm creating a newsletter and the easiest way of giving it a unique style was to use

but TinyMCE strips these.

It also strips
and which means my embedded YouTube video doesn't appear correctly.

Note I've turned off the Input Format HTML filters but can't stop this.

thanks,
Neil

TinyMCE itself strips all HTML that is not supported by the enabled plugins/buttons. Hence, to not have it strip that HTML, you have to enable the corresponding plugins/buttons that allow the user to insert/edit the HTML.

I had every button in TinyMCE enabled and the problem still occurred.

Deleting HTML might make sense in a non-drupal context but it is very bad behaviour in drupal considering the user specifically selected settings should allow all HTML types!!

Herein lies a bigger issue... the wysiwyg module is doomed to be plagued with conflict issues if the permitted editors delete HTML. For example, In a separate test I tried switching between a few editors: TinyMCE, whizzywig, WYMeditor. This resulted in a well and truly trashed page due to all the stripped HTML. As I recall all three were guilty in varying degrees.

BTW FCKEditor did the right thing, i.e. it didn't strip my HMTL. But it has other problems; namely unworkable/unformatted source code (which I need to edit).

Each editor used by wysiwyg needs to have a switch to prevent it messing with the HTML. But this is out of your hands??

Proper title and status.

To answer neilt's last question: If there's no native editor setting (or plugin) to not modify the HTML or allow certain tags, then yes it's out of our hands. We won't modify code in external libraries (and we don't include them in the releases either) as issues like that should be fixed by their respective developers.

If you find a settings in an editor which does what you need, like preserving all tags or format the source, but it's not yet supported by the profile settings GUI in Drupal you can use some code in your template file to inject that setting into the Drupal.settings.wysiwyg object where appropriate for that editor.

Subscribing

It seems that my problem is of a similar nature. I have the input format set to allow certain tags like embed and iframe so that users can embed video and powerpoint presentations from Google Docs. These work fine with the text editor is disabled. However, when TinyMCE is enabled these tags get removed completely when the node is saved. Also, entering the code using the "edit html" button doesn't work either. Is there a good solution for embedding content like I am describing while having the editor enabled?

A workaround might be possible by using the same procedure as in #544032: Add iframes via TinyMCE, specifically allowing certain tags using a "plugin". It probably won't stop the editor from touching the markup at all, but it might be enough to make it keep certain tags.

I've been banging my head on this and finding different results on FireFox, Chrome, and IE when it comes to YouTube videos. In IE, it is definitely stripping out at least the EMBED tag and sometimes more.

I've created a solution which may already be up here somewhere, but I didn't see it, so I'm putting it out there for one of you folks versed in full module development to take up and run with. It applies changes to the TinyMCE extended_valid_elements and media_strict properties through hook_wysiwyg_plugin. What this should do is allow you to paste the YouTube embed code safely into the code window of TinyMCE so that you can have both copy and video.

My environment:
- Drupal 6.19
- WYSIWYG 6.x-2.1
- TinyMCE 3.3.7

Installation:
- Install like a regular module
- Go to the TinyMCE profile, Buttons section, and enable "Fix Video"

To-Do:
- Refine the object, param, and embed attributes in extended_valid_elements to a safe set (I used * for expediency)
- IE7 seems to want to add more information, but that to me is preferable to removing essential information
- Look for conflicts with the Media plugin
- Test broadly

It has not been fully tested and is offered entirely without any guarantees. Try it out and make sure you like what IE does to the embed code before you cheer wildly.

subscribing

I needed to insert a simple facebook like box (http://developers.facebook.com/docs/reference/plugins/like-box) and ran into this problem as well.

My solution was to enable all elements in tinyMCE by adding the following line to sites/all/modules/wysiwyg/editors/tinymce.inc at line 256:

 $settings['extended_valid_elements'] = array_merge($settings['extended_valid_elements'], array('*[*]'));

Disclaimer: I've only been using Drupal for a few days, hence there might be a more elegant way to do this ...

ohhhh, boy. I am afraid brute force and ignorance approach #14 is the only one working right now :|

You can also override that setting by implementing hook_wysiwyg_editor_settings_alter() in a module.
Plugins implemented via hook_wysiwyg_plugin() should be able to define that setting too, but since that setting is currently not merged correctly (issue discussed elsewhere), it's probably easier and more reliable to use the ..._settings_alter hook.
It'll let you set/modify it to anything you'd like without having to modify Wysiwyg itself.

img tag got style attribute stripped but advanced image plugin allows style attribute. i tried override with plugin in my custom module and it did not work too. maybe I just did it wrong? but then I managed to add custom plugin from http://www.maschek.hu/imagemap/download and i have made some ctools plugins so its not that i am completely clueless, it was puzzling and did not work somehow.

Jaabber,

Your code didn't work for me, but this did:

$settings['extended_valid_elements'] = array_merge($settings['extended_valid_elements'], array('form[action|accept|accept-charset|enctype|method|target]'));

Hope this helps someone else.

Mediumgrade, Your code (in #18) worked for me, but it stripped out some of the buttons (teaser break, insert video and others) in the WYSIWYG editor. The solution in #14 also strips out these buttons...

For anyone looking for a solution that doesn't involve editing the source of the Wysiwyg module, adding the following to a custom module worked for me:

I added the code below to MY_MODULE_preprocess_page() function which is an implementation of moduleName_preprocess_hook() - it's quite specific - I needed to target the input filters individually (format1 and format2 are Filtered HTML and Full HTML respectively). This adds the media_strict= false to the Drupal.settings.wysiwyg.configs.tinymce javascript settings objects for these input filters. I imagine one could add any other tinyMCE settings that are not supported by the Wysiwyg module in the same way

      drupal_add_js( array('wysiwyg' => array ( 'configs' => array ( 'tinymce' => array ( 
		'format1' => array ( 'media_strict'=>false ), 
		'format2' => array ( 'media_strict'=>false ) 
	) ) ) ), 'setting'); 

Hope that helps.

After trying many of the solutions on this page, I finally discovered what was going on. I still don't know its happening, but perhaps this "workaround" will work for others:

After disabling the WYSIWYG editor (TinyMCE in my case) and pasting the Youtube embed code in from Youtube (either Iframe or object) I would click the submit button and the video was not there. However, after reloading the page, the video would appear. So somehow something relating to the status message (or something else on the page immediately after submitting) was calling the iframe and embedded object not to appear. But on subsequent page loads, they showed up fine.

This was also true when using input formats that didn't include the WYSIWYG editor, so I'm not sure my issue was related to the WYSIWYG module. But perhaps this will be useful for others who end up reading this thread.

This works well, I wish I had like a 'paste' button

admataz's code in #20 worked for me, but with some important additions and notes:

1. Make sure to call the correct input format. The code below calls the first (format1) and second input format (format2).
2. Make sure to turn on the media plug-in under /admin/settings/wysiwyg in TinyMCE profile for the format you've called. It's a check box under "Buttons and plugins". The variable media_strict modifies that plug-in, not TinyMCE as a whole.
3. There's a problem with using drupal_add_js in the _preprocess_page, as explained by Greg Harvey in The Joys of Preprocessing:
   

   if you add JavaScript using a drupal_add_js() call in yourmodule_preprocess_page() or yourtheme_preprocess_page() then it *will* be added to the $javascript variable, but it will be too late, because it will be added *after* drupal_get_js() has been called to render the mark-up for the JavaScript to be presented on the page.

   To fix this, you need to add "$variables['scripts'] = drupal_get_js();" (see code below)

So here's the whole code for the module I created based on admataz's code, with item #3 included:

<?php 
function wysiwygembedfix_preprocess_page(&$variables, $hook) {
drupal_add_js( array('wysiwyg' => array ( 'configs' => array ( 'tinymce' => array ( 
		'format1' => array ( 'media_strict'=>false ), 
		'format2' => array ( 'media_strict'=>false ) 
	) ) ) ), 'setting'); 
$variables['scripts'] = drupal_get_js();
}
?>

I've attached the whole module, including the .info file for 6.x. If you use it, don't forget to rename format1 and format2 to fit your situation.

To confirm it's working, view the source of one of your pages that uses TinyMCE and search for ""media_strict": false". It should show up in the javascript at the top of the page.

Yikes, replace all the above from #23 with this instead:

sites/all/modules/wysiwygembedfix/wysiwygembedfix.info

name = Wysiwyg Embed Fix
description = Tweaks some TinyMCE media settings via Wysiwyg module
core = 6.x
dependencies[] = wysiwyg

sites/all/modules/wysiwygembedfix/wysiwygembedfix.module

/**
 * Implements hook_wysiwyg_editor_settings_alter().
 * @see wysiwyg.api.php
 */
function wysiwygembedfix_wysiwyg_editor_settings_alter(&$settings, $context) {
  if ($context['profile']->editor == 'tinymce') {
    $settings['media_strict'] = FALSE;
  }
}

That's it, no more need to manually inject JavaScripts. This will apply to all formats where TinyMCE is the editor as the hook runs once per enabled editor profile, but you could limit it to just a few by checking $context['profile']->format

One note though: The $settings object is passed to the client as JSON, via drupal_add_js(). Simple PHP datatypes like Bool, String, Int, etc will be converted to their JavaScript equivalents automatically. It's not possible to pass JavaScript Function/Object references or RegExps this way.

Btw, I'm closing this as won't fix again (see the OP and #3). The issue has become much too fragmented, please start new issues if you're still experiencing problems.