When using HTML Filter on flash embedding markup, HTML Filter replaces:

<object classid="clsid:d27cdb6e-ae6d-11cf-96b8-444553540000" height="200" width="200">[...]</object>

by:

<object classid="d27cdb6e-ae6d-11cf-96b8-444553540000" height="200" width="200">[...]</object>

The clsid: prefix is removed, thus preventing flash content to show up in Internet Explorer.

CommentFileSizeAuthor
#4 drupal.filter-clsid.4.patch1.88 KBsun

Comments

greenreaper’s picture

greenreaper
Primary language English
Location Welling, Bexley, London
commented

Same here, but I'm also seeing this in Drupal 6.19. Subscribing.

taslett’s picture

taslett commented

In D7 the function drupal_strip_dangerous_protocols http://api.drupal.org/api/function/drupal_strip_dangerous_protocols/7
contains a list of allowed protocols.
There is a variable filter_allowed_protocols which it attempts to read from although I can't see where it is actually set.
I'm not sure if the clsid is considered dangerous, if it should be added to the list or added via a config settings page somewhere if needed.

anrikun’s picture

anrikun commented

FYI, the CKEditor SWF module provides a workaround to this issue.

sun’s picture

sun
Primary language German
Location Karlsruhe
commented
Status: Active » Needs review
StatusFileSize
new drupal.filter-clsid.4.patch1.88 KB

No harm in adding that, I think.

sun’s picture

sun
Primary language German
Location Karlsruhe
commented

#4: drupal.filter-clsid.4.patch queued for re-testing.

Status: Needs review » Needs work

The last submitted patch, drupal.filter-clsid.4.patch, failed testing.

sun’s picture

sun
Primary language German
Location Karlsruhe
commented
Status: Needs work » Needs review

#4: drupal.filter-clsid.4.patch queued for re-testing.

Status: Needs review » Needs work

The last submitted patch, drupal.filter-clsid.4.patch, failed testing.

sun’s picture

sun
Primary language German
Location Karlsruhe
commented
Status: Needs work » Needs review

#4: drupal.filter-clsid.4.patch queued for re-testing.

Status: Needs review » Closed (outdated)

Automatically closed because Drupal 7 security and bugfix support has ended as of 5 January 2025. If the issue verifiably applies to later versions, please reopen with details and update the version.