Redactor stripping script/html tags

Question

I wasn't to allow a user to enter html into the Rich Text field.

The html in question is:

<div class="issuuembed" style="width: 525px; height: 525px;" data-configid="7563847/30149275"></div>
<script src="//e.issuu.com/embed.js" async="true" type="text/javascript"></script>

I can save the entry and on the front end the content displays ok - but when I go back in to edit the entry it is no longer there - the div and script tags have been removed.

I tried adding this

replaceDivs: false,

to the config but it doesn't make any difference

Answer 1

Please do yourself a favor and don't do this in Redactor. Find a solution with Matrix (and/or Super Table) to add things like this in-between your text blocks.

Answer 2

As you probably already know, Redactor removes any inline styling. replaceDivs doesn't appear to be in later versions of Redactor (at the least, it's not documented.)

Redactor will always remove Script tags, per the documentation. (I ran into this issue a few days ago.) Redactor supposedly has an option for this, but it doesn't appear to work in Craft, and has shaky documentation.

Here's the official Redactor documentation for it:

Using this setting with false argument, you can restrict use of script tag in your HTML. Redactor will automatically and always strip this tag form the code.

Here's the actual setting for Redactor:

script: false

I was able to get Redactor to allow script tags by removing that functionality from Redactor's core, but this should be considered a very temporary workaround until we can get someone from P&T to add it, or clarification on the tag's proper use:

1. Go to craft/app/resources/lib/redactor/redactor.js on line 193, and remove the 'script' tag from the array.
2. Comment out line 1980
3. Comment out line 2049
4. Comment out line 8006

Again, this is very temporary until someone from P&T can confirm proper tag functionality. You're modifying core, which is almost never a good thing.

Answer 3

AFAIK this is still an issue with Craft 3. My solution was to create a new text field for the desired section called templateFile. Then I edited my page template so that whenever templateFile is non-empty, it will {% include block.templateFile %} instead of the usual content.

This allows me to bypass Redactor completely while restricting any generated <script> tags to templates, which requires access to the server files as well as the CMS. That keeps non-admin editors from accidentally including damaging code.