Hi Drupal'ers

The footer message as copied hereafter works with the Marvin theme, but with bluemarine and most of the others the following is printed after the three logo's:

var sc_project=1579730; var sc_invisible=1; var sc_partition=14; var sc_security="204be9d6"

Can this be fixed? How? Can I help? If this is not supported how can I make it so and why is it working with Marvin theme? Thanks in advance.

Footer message begins here:

<a href="http://xmsql.sourceforge.net/?q=node/12"><img src="http://xmsql.sourceforge.net/nilostep.png"/></a><br/>
(c) 2006 NiLOSTEP ( nilo de roock, <a href="http://jimcaprioli.blogspot.com">jim caprioli</a>, <a href="http://cecilemorelband.atspace.com/biography/erik/index.html">ali ben s.</a> )
<hr/>
<table><tr><td> <a href="http://sourceforge.net"><img src="http://sflogo.sourceforge.net/sflogo.php?group_id=113874&amp;type=2" width="125" height="37" border="0" alt="SourceForge.net Logo" /></a></td><td><a href="http://drupal.org"><img src="http://cvs.drupal.org/viewcvs/*checkout*/drupal/contributions/docs/marketing/poweredby/drupal.powered.audio.small.png"></a></td><td><a href="http://www.cenqua.com"><img src="http://www.cenqua.com/images/cenquad1.gif" width="89" height="33" border="0" alt="Supported by Cenqua"/></a></td>
<td><!-- Start of StatCounter Code -->
<script type="text/javascript" language="javascript">
var sc_project=1579730; 
var sc_invisible=1; 
var sc_partition=14; 
var sc_security="204be9d6"; 
</script>

<script type="text/javascript" language="javascript" src="http://www.statcounter.com/counter/counter.js"></script><noscript><a href="http://www.statcounter.com/" target="_blank"><img  src="http://c15.statcounter.com/counter.php?sc_project=1579730&amp;java=0&amp;security=204be9d6&amp;invisible=1" alt="counter" border="0"></a> </noscript>
<!-- End of StatCounter Code --></td></tr></table>

End of footer message.

Comments

jimcp’s picture

jimcp commented
Version: 4.7.2 » 4.7.3

Bug appears in 4.7.3 as well.

magico’s picture

magico commented
Title: problem with javascript in footer message » With PHPTemplate the footer does not accepts javascript anymore
Version: 4.7.3 » 5.x-dev

marvin theme uses the following

  if ($footer = variable_get('site_footer', '')) {
    $output .= " <div id=\"footer\">$footer</div>\n";
  }

while the others (through the phptemplate) use

filter_xss_admin(variable_get('site_footer', FALSE)) . "\n" . theme('blocks', 'footer')

So, it's possible that filter_xss_admin() is filtering your javascript. And the possible conclusion is that it will not be possible to add javascript in your footer.

Now the question is: should we allow or not these kind of inputs?

I'm moving this to 5.x-dev to get some attention from senior developers, and have a quick answer.

cburschka’s picture

cburschka
they
commented

As a temporary work-around, I'd suggest using a Full HTML block and place it in the footer region.

But I also agree that this should be changed. In fact, I don't quite understand the "admin-only XSS filter" - what does it actually do? If it's for security, then the site admin can probably find a dozen ways to deactivate or circumvent it (and why not; it's his site). If it makes use of a non-security side effect of the main XSS filter, then this really needs better documentation. Why can't the footer use an Input Format?

cburschka’s picture

cburschka
they
commented

Not fixed.

dpearcefl’s picture

dpearcefl commented
Status: Active » Closed (won't fix)

Considering the time elapsed between now and the last comment plus the fact that D5 is no longer supported, I am closing this ticket.

vinoth.3v’s picture

vinoth.3v commented
Version: 5.x-dev » 6.x-dev
Status: Closed (won't fix) » Active

not working in Drupal 6 too
:(

Status: Active » Closed (outdated)

Automatically closed because Drupal 6 is no longer supported. If the issue verifiably applies to later versions, please reopen with details and update the version.