Skip to content

Preserve HTML in sitedownmessage when WYSIWYG is active#1

Open
Koalink wants to merge 2471 commits into
tom2tom:mainfrom
Koalink:patch-1
Open

Preserve HTML in sitedownmessage when WYSIWYG is active#1
Koalink wants to merge 2471 commits into
tom2tom:mainfrom
Koalink:patch-1

Conversation

@Koalink
Copy link
Copy Markdown

@Koalink Koalink commented Apr 20, 2026

The sitedownmessage field in Site Preferences used strip_tags() on all submitted values, stripping every HTML tag before saving. Since the field is rendered through a WYSIWYG editor, any formatting (paragraphs, line breaks, bold, links, etc.) was silently discarded, giving the impression that modifications were not persisted.

Only apply strip_tags() when the WYSIWYG toggle is disabled; otherwise store the raw HTML as entered. The empty-after-trim guard is preserved so blank submissions still trigger error_sitedownmessage.

tom2tom and others added 29 commits April 18, 2026 17:29
use mutable profile
use user-specific preference methods
rename elements
support jobs clearing
not a cached page
support usage of all profile-properties
use event-handler types
use event-handler types
add checkbox values
show error-dialog
The sitedownmessage field in Site Preferences used strip_tags() on all submitted values, stripping every HTML tag before saving. Since the field is rendered through a WYSIWYG editor, any formatting (paragraphs, line breaks, bold, links, etc.) was silently discarded, giving the impression that modifications were not persisted.

Only apply strip_tags() when the WYSIWYG toggle is disabled; otherwise store the raw HTML as entered. The empty-after-trim guard is preserved so blank submissions still trigger error_sitedownmessage.
@tom2tom
Copy link
Copy Markdown
Owner

tom2tom commented Apr 20, 2026

Thanks, I totally agree with your identification of the problem.
However I think that the solution for that context is to retain any html tags, whether generated by WYSIWYG editor or not.
Instead of stripping tags, IMHO the input should be 'properly' sanitised. (You'll have noticed that in general, CMSMS2 is pathetic at sanitisation.)
See e.g. news_ops::execSpecialize(), UserGuideUtils::cleanContent(). Not cleanValue().
See also
portswigger
owasp
htmLawed

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants