[ SOLVED ] Richedit doesn't render <h1> and other tags

[wuzopei]

Dear all,

Whenever I try to use Richedit from the admin panel to modify an item and slam some <h1> or <h2> tags into it (for the sake of readibility), the output on the item page doesn't render them... I've taken a look at the HTML source for it and, whereas it does render <span> styles for font size, it doesn't do it for headings. Not even for <li> or <ul>...

What's the catch? Thanks!

[wuzopei]

Sorry guys, never mind my previous question - looks like I found the answer, I modified /oc-includes/osclass/ItemActions.php and tinkered around the HTML purifier code! Worked!

[shragicz]

Hi,

I have similar problem. I use TinyMCE for edit custom pages (in admin panel). When i use bold text or paragramh, it works perfectly, but if I use <h1> 2 3 ... tags, it is saved without these tags. I was looking for solution on TinyMCE forum and website, but it seems to be configured properly. Does somebody know how to solve this?

thx M.

[shragicz]

SOLVED:
/oc-admin/pages.php

Code: [Select]

Line 60 is: $postParams = Params::getParamsAsArray();
If you add params false,false, you can use H1, H2 .... tags in TinyMCE editor (only Pages in Admin panel are affected)

Code: [Select]

$postParams = Params::getParamsAsArray(false,false);  /* false, false becasue of H1 tags for pages */

[Noosa]

SOLVED:
/oc-admin/pages.php

Code: [Select]

Line 60 is: $postParams = Params::getParamsAsArray();
If you add params false,false, you can use H1, H2 .... tags in TinyMCE editor (only Pages in Admin panel are affected)

Code: [Select]

$postParams = Params::getParamsAsArray(false,false);  /* false, false becasue of H1 tags for pages */

Thank you.
Wanted to add for reference:

oc-admin/pages.php

case 'edit_post':
from: $postParams = Params::getParamsAsArray();
to: $postParams = Params::getParamsAsArray(false, false);

case 'add_post':
from: $postParams = Params::getParamsAsArray();
to: $postParams = Params::getParamsAsArray(false, false);

This now allows all inline styles as well as tags to be inserted into the database whether creating or editing a page.

false, false means you are bypassing:
stripslashes()
htmlspecialchars()
Cross-site scripting check

This shouldn't be an issue for the admin side, but do not use this for the public side description field.