From http://drupal.org/node/447778

I'm setting up a customized view and want to use style="" for one part (see code below):
<div style="background: url(/[field_featured_image_fid]) no-repeat top left #9ac03c;" id="featured-background"><div id="featured_left_panel"><div id="related terms">[tid]</div><div id="featured_left">[field_featured_left_value]</div><div id="view-study">view case study</div></div><div id="featured_right_panel"><div id="title">[title]</div><div id="featured_right">[field_featured_right_value]</div></div></div>

I could use views template for this and have it work; however, "rewrite the output of this field" does 99% of what I need. Everything is displayed properly with the above code except the first tag which become

Comments

dawehner’s picture

dawehner
Primary language German
commented
Status: Active » Closed (won't fix)

the Problem that we have to filter bad / js code.

This could be provide by using js in style tag, so its filtered by filter_xss_admin.

So you cannot do it, it think you would have to define a custom field or create another handler which does not filter_xss but this is incredible BAD!

I set this to won't fix because this this would be quite a create security problem when not filtering out style.

ron williams’s picture

ron williams commented
Status: Closed (won't fix) » Active

I am still not convinced that the security issue is grounds to remove a useful element. For example, in my case, [field_featured_image_fid] is a field, generated by filefield (image), in this case there would not be any code inserted manually by the end user, only an uploaded image, generating a url, which then gets displayed by views. The style="" function is disabled in the footer for drupal, and in views, but fully allowed in the code for pages and blocks. Is there a reason for the inconsistency?

BTW, I'm not trying to be rude, just attempting to fully understand the logic behind the removal.

merlinofchaos’s picture

merlinofchaos commented
Status: Active » Closed (won't fix)

The security measures are provided by Drupal core itself. Were I to try to allow this tag, I'd have to provide alternate, weaker security measures. Chances are the security team would consider it a security hole and file a report. And I do understand what you are saying, but security measures are something we aren't flexible on, especially when there are alternatives.

Unfortunately, if you want to use the 'style' tag you're going to have to use a template. Your alternatives are to add classes and put the appropriate 'styling' code into your CSS.

exobuzz’s picture

exobuzz commented

Could there perhaps be a compromise where you could allow the admin to choose to "not secure html". for example in my case, only the admin (me) can create views and as such is trusted. Having the style element is very useful for example when wanting to put an image from cck on a background for example, and would save time creating a custom template.

dawehner’s picture

dawehner
Primary language German
commented

you can use css classes.
Inline css also makes other themes unhappy, because they cannot change it.

exobuzz’s picture

exobuzz commented

I want some data from the view used as a background for a div so it is dynamic, so I don't know how it could be done from a class. In my case I've managed to work around it by theming the view, but it took a lot longer to work out

<div class="homepage_section" style="background-image: url(<?php print $fields['field_sectionimage_fid']->content ?>)">
  <h2><?php print $fields['title']->content; ?></h2>
</div>