Possible error in $AllowableHTML.....

Regular Joined: Jun 02, 2004 Posts: 88

I may have just found a possible error in the $AllowableHTML code that is placed in the config.php file..... And if I am correct, this may be the problem that others posted are having.

Here is a line from the $AllowableHTML:

"font" => array("face" => 1, "style" => 1, "color" => 1, "size" => array("minval" => 1, "maxval" => 7)),

Please note the array after "size" =>

If I am not mistaken, the only values allowed are either 1 or 2.

I think what the author was thinking was that they could control the font size from this line of code. However, this code is only for allowing attributes or not. It could never control the font size inputs.......

I would think deleting that size array and replacing it with 1 would fix these problems.......

......but I have been wrong many times before.... lol. Wink

Posted: Sun Apr 23, 2006 9:36 am

Your post sure got me looking at the books Spottedhog. I'm no expert with arrays at all. But if you have a system you can experiment with a little, try inserting the following three lines after the $AllowableHTML array has finished being assigned.

Code:

echo $AllowableHTML['font']['face'] . '<br>';


echo $AllowableHTML['font']['size']['minval'] . '<br>';


echo $AllowableHTML['font']['size']['maxval'] . '<br>';

It just looks like an "unbalanced" array, i.e., one with both 1 and 2 elements under "font" but it probably should work. At least the values of face (one level under font) and minval (two levels under) echo out okay.

One of the experts could probably write some kind of foreach loop that would automatically dump out all the elements of the array.

Posted: Sun Apr 23, 2006 5:45 pm

If they changed the check_html function for the WYSIWYG editor, then maybe those arrays will work. As far as I've seen, for standard phpNuke it is either "1" or "2" - with no way to specify which attributes to allow.

Posted: Sun Apr 23, 2006 7:01 pm

The nukeWYSIWYG editor installation instructions does have you replace the check_html() function to use its own. It works alot better than the original check_html() function and has more flexibility for validating the allowed HTML.

We would need Kguske to validate that the KSES routines are handling the validation of the font size attribute correctly.