Uh oh!
There was an error while loading.Please reload this page.
- Notifications
You must be signed in to change notification settings - Fork9.6k
[HtmlSanitizer] Add blockBodyElements that will block all known elements by default.#49920
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to ourterms of service andprivacy statement. We’ll occasionally send you account related emails.
Already on GitHub?Sign in to your account
base:7.4
Are you sure you want to change the base?
Uh oh!
There was an error while loading.Please reload this page.
Conversation
| @@ -2931,6 +2931,10 @@ private function registerHtmlSanitizerConfiguration(array $config, ContainerBuil | |||
| $def->addMethodCall('allowStaticElements', [], true); | |||
| } | |||
| if ($sanitizerConfig['block_body_elements']) { | |||
| $def->addMethodCall('blockBodyElements', [], true); | |||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others.Learn more.
shouldn't this be donebefore the calls to allow safe or static elements, in case both are enabled ?
@Neirda24 Any feedback? |
hey. Sorry forgot about this one. I'll get back on it as soon as I'm done with the feature flag one. |
…t action (Seldaek)This PR was merged into the 7.2 branch.Discussion----------[HtmlSanitizer] Add support for configuring the default action| Q | A| ------------- | ---| Branch? | 7.2| Bug fix? | no| New feature? | yes| Deprecations? | no| Issues |Fix#48358| License | MITThe default action can be set to block or allow unconfigured elements instead of dropping themKinda replaces#49920 but it would need some work on the configuration handling side to allow configuring default actions. I am just using this as a library so I am not so keen on doing that part sorry but maybe `@Neirda24` might want to take care of it if this PR gets accepted.Commits-------4fd1c4c [HtmlSanitizer] Add support for configuring the default action to block or allow unconfigured elements instead of dropping them
Add a way to block all body elements. Currently without any setup, the
purgemode is the default.Without the framework :
With the framework :