Fixed Configuration Disallowing img[src] Attributes

[schwindy]

Overview

I allowed all <img> element attributes in default TinyMCE configuration.

My recent change to improve Word Paste Formatting broke the Insert/Edit Image toolbar button. Attempting to insert an image into WYSIWIG content will fail because the html will be <img/>.

This is caused by not whitelisting the img[src] attribute, which is how the button inserts the image into the content.

For good measure, I added the whitelist as img[*] (all attributes) so that if some plugin were to use the data-src attribute, it would not be stripped out. Alternatively we could also compile a list of attributes we want to allow on <img> tags 🐒

[rreynier]

👍

[elliottregan]

While we're at it, want to enable everything on anchor tags, too? There are a lot of attributes like "target" and "rel" that are useful to add.

[schwindy]

So, I agree 100% on target/rel. The reason I did this is because when I was pasting links from Word, it kept adding this weird name="asdf1234hashxD" which for some reason rendered a weird icon on the left of all links.

Could we maybe compile a list of allowed attributes on <a> tags?

I would think these to start:

1. href
2. rel
3. target

Anything else come to mind @elliottregan ?

[elliottregan]

Ah, good catch.

How about data-*?

[schwindy]

Sounds good 👍

I confirmed locally that this works: a[data-*|href|rel|target] by manually adding all of those attributes and some others like random that I wanted to be deleted in the code view. All of the expected attributes were kept, and random was deleted 🐒