[4.1] Editor custom field 'Safe HTML' setting not working correctly with iframes
Nobody has claimed this yet.
- Dominant language
- PHP
- Stars
- 5.1k
- Forks
- 3.9k
- Avg merge
- 2d 22h
- Merged PRs (30d)
- 56
Description
Steps to reproduce the issue
- Create an article custom field of type Editor
- Select 'Safe HTML' from the Filter options at the bottom of the General tab and save the new field
- If using TinyMCE, ensure 'iframe' is removed from the list of prohibited elements in the plugin settings
or if using JCE Editor ensure that all iframes are allowed in the profiles editor under Plugin parameters > Media support - Open an article that uses that field and select the field
- Switch to the Code editor and paste in some html, e.g.
<p><iframe src="https://www.google.com/maps/embed?pb=[google-maps-link]" width="600" height="400" style="border: 0;" loading="lazy" allowfullscreen="allowfullscreen" frameborder="0"></iframe></p>
Switch back to the WYSIWYG editor
Save the document
Expected result
The map is saved and visible
Actual result
TinyMCE:
Switching from Code to Editor shows just a blank box, then even before saving the article the code is reduced to
<p><iframe></iframe></p>
JCE Editor:
The map is visible in the Editor pane prior to saving the article, after which the code is stripped out entirely
System information (as much as possible)
J4.1.2
Additional comments
It does the same with the 'RAW html' setting
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reproducing the issue in the Editor custom field with the Safe HTML and RAW html settings, testing both the TinyMCE and JCE Editor paths described. Compare the iframe content before switching editors and after saving; done means the iframe remains intact and the embedded map is visible after saving.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- php
- Domain
- backend, content
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100