Please add a simple permission and check for users being able to use HTML in the menu items. I use this module to my top level primary links can have html. I don't want the other users to be able to add html in the menu items.

isotope

Only local images are allowed.

Thanks.

Support from Acquia helps fund testing for Drupal Acquia logo

Comments

gmclelland’s picture

Bump, any thoughts on this. Thanks

Alan D.’s picture

Double this. This could be considered a security issue!

mzwyssig’s picture

Subscribing. This would be very useful.

mzwyssig’s picture

Status: Active » Needs review
Issue tags: +permissions
FileSize
756 bytes

Attached is a patch that checks if user has "administer nodes" permissions.

ClaireC’s picture

Status: Needs review » Reviewed & tested by the community

The patch works for me ! Thanks.

gagarine’s picture

Priority: Normal » Major

I think it would be great to commit this...

gagarine’s picture

Assigned: Unassigned » gagarine
gagarine’s picture

Status: Reviewed & tested by the community » Needs work

I'm going to make a permission like "Use html for menu link". If the user don't have the permission but can edit the menu link the menu link should go back to no HTML. The other possibility is than when a menu link use HTML user without the permission can't edit them. Otherwise it's a security problem...

To be clear, the patch #4 doesn't work. An admin can change the link to "HTML" and a user without the permission can still edit the content and add bad stuff...

webadpro’s picture

Great point guys.

Would you guys say to simply not allow to edit the element completely or simply deny access to edit the title, but the user could always change the path, etc.?

gagarine’s picture

I'm for let the user edit what he can and just disable the title field.

gagarine’s picture

Version: 6.x-1.1 » 7.x-1.x-dev
Assigned: gagarine » Unassigned
drupov’s picture

Has this patch been commited?

robinsonsarah01’s picture

Issue summary: View changes
Status: Needs work » Needs review
FileSize
3.27 KB

Attached is a patch that adds a "use html for menu titles" permission to this module. If a user can administer menus but isn't allowed to use HTML in those menus, the checkbox for "Allow HTML" will not appear; if HTML is enabled, the link title will be disabled and the user will not be able to edit it.

gagarine’s picture

This patch look good thanks! Someone was able to test it?

shortspoken’s picture

I just tested the patch and it works as advertised. Thank you @robinsonsarah01! Please commit.

irankhosravi’s picture

FileSize
42.39 KB

hello how to logo in center of menu

irankhosravi’s picture

help

Alan D.’s picture

@mehrwebstay
You are very unlikely to get help by jumping into an unrelated thread, especially a project issue on a completely unrelated topic (aka this is to prevent users from inserting HTML).

Try https://www.drupal.org/forum/22 or http://drupal.stackexchange.com/ and be a bit more verbose about what you have tried and what isn't working. :)

irankhosravi’s picture

Issue summary: View changes
markabur’s picture

Status: Needs review » Reviewed & tested by the community

Looks good, thank you! RTBC

Chris Matthews’s picture

Would it be possible to commit the patch in #13 to 7.x-1.x-dev and tag a 7.x-1.1 release?

Chris Matthews’s picture

Issue tags: -permissions

@maintainers, can the patch in #13 be committed and pushed to a 7.x-1.1 release?