We're seeing the following message pop-up randomly on different pages when trying to use the BUEditor preview function:

“The preview is disabled due to previously inserted HTML code in the content. This aims to protect you from any potentially harmful code inserted by other editors or users. If you own the content, just preview an empty text to re-enable the preview.”

There is no harmful code in these pages and it seems to show up randomly on different pages. The only common factor that we can see is they have more code than the basic buttons (though no problems or conflicts with the input filter).

Any ideas what triggers this error? The BUEditor preview is much faster and more use-able than the built-in Drupal preview, so we'd like to get this working if possible.

Comments

tinsmon’s picture

tinsmon commented

Also, what does "preview an empty text" mean? Cut everything out of the code, paste it into a temp. file then preview the blank page?

mshaver’s picture

mshaver commented

I'm experiencing this as well. Is there something about the filters that needs to be setup to deal with the new safeToPreview function?

ufku’s picture

ufku commented

BUEditor previews the content in Full HTML. It does not apply any filters because it's not possible to implement javascript equivalents of all input filters. Full HTML previewing can be dangerous for collaboratively edited contents. Users must be careful enough to notice a previously entered suspicious code before previewing.
Since BUE does not know if the current user owns the content or not, it blocks the preview.

There are workarounds:
1- If you make the content html free and preview, then the preview will function normally. You may consider cutting the whole text and previewing the empty content, then pasting back. This can be annoying.
2- If the content (e.g. comments) is not edited by multiple users then you may use
E.safeToPreview = true; eDefPreview();
3- You may consider using eDefAjaxPreview() with the Ajax markup enabled. It provides real preview considering the input filters.

php:
if (module_invoke('ajax_markup', 'on')) {
  return 'js: eDefAjaxPreview();';
}
dave reid’s picture

dave reid
he/him
Primary language English
Location Nebraska USA
commented

I would also like to direct people to #586098: Add a core Drupal.checkMarkup() function like check_markup() so we can have a core-provided check_markup() JavaScript function to provide modules for secure text sanitation. Also, I'd recommend removing the live preview feature from BUeditor and directing users to the Live module for live comment and node previews. Possibly we can get the Live module to add it's own preview button when BUEditor is enabled.

tinsmon’s picture

tinsmon commented
Status: Active » Closed (fixed)

ufku,

Thanks for this:
2- If the content (e.g. comments) is not edited by multiple users then you may use
E.safeToPreview = true; eDefPreview();

That seems to have solved our problem. I'm going to close this.

g10tto’s picture

g10tto commented

2- If the content (e.g. comments) is not edited by multiple users then you may use
E.safeToPreview = true; eDefPreview();

This fixed it for me as well.

Thanks!

beasley’s picture

beasley commented

E.safeToPreview = true; eDefPreview();

Can anyone suggest where this line is supposed to go? I presume it's in /library/default_buttons_function.js, around line 110. I've tried a few places but had no joy. In the end I just took a shotgun approach and deleted:

 E.safeToPreview = E.safeToPreview || E.textArea.value.indexOf('<') == -1;
  if (!E.safeToPreview) {
    html = '<div class="warning">' + Drupal.t('The preview is disabled due to previously inserted HTML code in the content. This aims to protect you from any potentially harmful code inserted by other editors or users. If you own the content, just preview an empty text to re-enable the preview.') + '</div>';
  }

That got it going, but I know it's not the best way! As you can see, I'm not a programmer.

ufku’s picture

ufku commented

beasley, that should be the content of the preview button. you don't have to edit any file.

beasley’s picture

beasley commented

Ah, I see. I thought it must be simple. I've re-instated the original code and added the line to the content field now. Works fine after I remembered to put the js: prefix in front of it. Thanks for that!