<html>
<body>
Hi kupuers,<br><br>
I was wondering about how secure the HTML Filter in Kupu is so I did the
following little experiment:
<ul>
<li>By default, the <font> element isn't allowed in both the Kupu
HTML Filter and safe_html in Zope
<li>Added "font" to the list of valid_tags in safe_html in Zope
so that the <font> element can be rendered
<li>Edited a page in Plone and add the code <font
color="blue">test</font> in the HTML source mode
<li>Switched back to normal WYSIWYG mode and save
<li>As expected, the <font> tags were removed, leaving the text
"test" there
<li>Tried adding the code <font
color="blue">test</font> again but this time...
<li>Didn't switch back to the WYSIWYG mode. Instead, click the
"Save" button directly in the HTML source mode
<li>And the <font> element got saved this time!
</ul>Is it how the Kupu HTML Filter is supposed to work? If that is so,
is there a way to configure it so that it removes the banned elements in
both the WYSIWYG mode and the HTML source mode? I'm using Plone 2.5.5 and
Kupu 1.4.10. Thanks a lot!<br><br>
<x-sigsep><p></x-sigsep>
Regards,<br><br>
Alex</body>
</html>