WordPress.org

1. johnnypez
   Member
   Posted 3 years ago #

   I'm working on WP-MU 2.6.3
   There are no TinyMCE related plugins installed.
   My customer simply wants to be able to include onclick attributes in links.

   From what I read, TinyMCE 3.x in this version of WP includes a full XHTML ruleset so this should be possible by default but when I save a post, TinyMCE always strips onclick or any other event attribute from the markup.

   I've used firebug to confirm that TinyMCE is configured to allow these attributes. Below is the value of tinyMCE.activeEditor.settings.valid_elements at runtime.

   "@[id|class|style|title|dir<ltr?rtl|lang|xml::lang|onclick|ondblclick|onmousedown|onmouseup|onmouseover|onmousemove|onmouseout|onkeypress|onkeydown|onkeyup],a[rel|rev|charset|hreflang|tabindex|accesskey|type|name|href|target|title|class|onfocus|onblur],strong/b,em/i,strike,u,#p[align],-ol[type|compact],-ul[type|compact],-li,br,img[longdesc|usemap|src|border|alt=|title|hspace|vspace|width|height|align],-sub,-sup,-blockquote[cite],-table[border=0|cellspacing|cellpadding|width|frame|rules|height|align|summary|bgcolor|background|bordercolor],-tr[rowspan|width|height|align|valign|bgcolor|background|bordercolor],tbody,thead,tfoot,#td[colspan|rowspan|width|height|align|valign|bgcolor|background|bordercolor|scope],#th[colspan|rowspan|width|height|align|valign|scope],caption,-div,-span,-code,-pre,address,-h1,-h2,-h3,-h4,-h5,-h6,hr[size|noshade],-font[face|size|color],dd,dl,dt,cite,abbr,acronym,del[datetime|cite],ins[datetime|cite],object[classid|width|height|codebase|*],param[name|value],embed[type|width|height|src|*],script[src|type],map[name],area[shape|coords|href|alt|target],bdo,button,col[align|char|charoff|span|valign|width],colgroup[align|char|charoff|span|valign|width],dfn,fieldset,form[action|accept|accept-charset|enctype|method],input[accept|alt|checked|disabled|maxlength|name|readonly|size|src|type|value|tabindex|accesskey],kbd,label[for],legend,noscript,optgroup[label|disabled],option[disabled|label|selected|value],q[cite],samp,select[disabled|multiple|name|size],small,textarea[cols|rows|disabled|name|readonly],tt,var,big"

   The very first rule in there should allow me to have onclick on any element I want. Can anyone suggest why this is not working as it should?

2. johnnypez
   Member
   Posted 3 years ago #

   Ok I found the problem. I realised that the problem still occurred even with TinyMCE disabled. This led me to a second level of filtering that I was not aware of in wp-includes/kses.php

   Updating the rules in the $allowedposttags array in that file fixed my problem. Unfortunately I can't see any filters to allow me modify the $allowedposttags array from a plugin.

Topic Closed

This topic has been closed to new replies.