Comments for Limit HTML Tags: Buncha Custom Jazz

Limit HTML Tags: Buncha Custom Jazz

2008-12-21T07:47:04Z

So I want to allow users in one of my MT forums to embed videos. This means I have to tweak the Limit HTML Tags setting to include my own stuff.

Embedding a video requires object, param, and embed tags. It also requires several custom attributes: width, height, name, value, src, type, allowfullscreen, and allowscriptaccess.

Here’s what I put in the custom setting field:

a href,b,i,br/,p,strong,em,ul,ol,li,blockquote,pre,embed,object,param,* width,* height, * name, * value,* src,* type,* allowfullscreen,* allowscriptaccess

…but it doesn’t work. Can anyone see what I’m doing wrong?

Thanks!

Comment from Rob Kenny on 2008-12-21

2008-12-21T10:18:47Z

What happens?

Aren't width, height, name etc attributes not tags.

Comment from Dan Wolfgang on 2008-12-21

2008-12-21T14:19:35Z

Based on the fact that "a href" is listed, I bet you need to list "object width," "object height, "param name," etc. I don't see anything that indicates you can enter a wildcard like "*."

Comment from Clifton on 2008-12-21

2008-12-21T17:53:06Z

I'm following the syntax rules [described here](http://www.sixapart.com/movabletype/docs/3.3/d_configuration_directives/globalsanitizespec.html). That's where I got the idea for the wild card use with the attributes.

The result of what I've attempted is the video embed code simply doesn't show up (taken straight from [Vimeo](http://vimeo.com)).

Comment from Dan Wolfgang on 2008-12-22

2008-12-22T17:25:05Z

Investigating a little by trying it, I do indeed see that the asterisk isn't being noted as a wildcard.

It doesn't actually work that way (look at the HTML output of a comment), nor does Sanitize.pm appear to deal with tags defined as such (well, the sanitization process deals with them correctly, but it doesn't get that far because parse_spec never adds wildcard attributes to the wildcard key).

Even looking at MT3, I don't think this ever worked. I submitted a bug report for this (http://bugs.movabletype.org/default.asp?86966).

Comment from Clifton on 2008-12-22

2008-12-22T18:41:38Z

Thanks, Dan.

I initially tried just using *only* the tags I needed, and when that didn't work, I figured I needed to add custom attributes.

In the meantime, I'm using:

It sort of makes me nervous to leave things wide open like that, but oh well. :)

Comment from Dan Wolfgang on 2008-12-22

2008-12-22T19:56:03Z

Including "object width," "object height," etc should work. No?

Comment from Clifton on 2008-12-22

2008-12-23T01:29:00Z

I'm using this:

**a href,b,i,br/,p,strong,em,ul,ol,li,blockquote,pre,embed,object,param,object width,object height,param name,param value,embed src,embed type,embed allowfullscreen,embed allowscriptaccess,embed width,embed height**

...and it doesn't work.

Comment from Lisa Fogelman on 2009-01-08

2009-01-08T19:35:59Z

I used this as my allowed HTML and got embeds to work:

a href,b,i,br/,p,strong,em,ul,ol,li,blockquote,pre,object width height,param name value,embed src type allowscriptaccess allowfullscreen

Comment from Clifton on 2009-01-13

2009-01-13T23:15:24Z

I'll give that a try. Thanks, Lisa!