Merge pull request #10977 from blueo/pulls/use-field-editorconfig-whe…

…n-sanitizing Use field editorconfig when sanitising content
silverstripe · Oct 25, 2023 · 87f829a · 87f829a
2 parents 071d8b7 + e5eb98c
commit 87f829a
Show file tree

Hide file tree

Showing 2 changed files with 40 additions and 1 deletion.
diff --git a/src/Forms/HTMLEditor/HTMLEditorField.php b/src/Forms/HTMLEditor/HTMLEditorField.php
@@ -145,7 +145,8 @@ public function saveInto(DataObjectInterface $record)
         // Sanitise if requested
         $htmlValue = HTMLValue::create($this->Value());
         if (HTMLEditorField::config()->sanitise_server_side) {
-            $santiser = HTMLEditorSanitiser::create(HTMLEditorConfig::get_active());
+            $config = $this->getEditorConfig();
+            $santiser = HTMLEditorSanitiser::create($config);
             $santiser->sanitise($htmlValue);
         }
 

diff --git a/tests/php/Forms/HTMLEditor/HTMLEditorFieldTest.php b/tests/php/Forms/HTMLEditor/HTMLEditorFieldTest.php
@@ -11,6 +11,7 @@
 use SilverStripe\Core\Config\Config;
 use SilverStripe\Dev\CSSContentParser;
 use SilverStripe\Dev\FunctionalTest;
+use SilverStripe\Forms\HTMLEditor\HTMLEditorConfig;
 use SilverStripe\Forms\HTMLEditor\HTMLEditorField;
 use SilverStripe\Forms\HTMLEditor\TinyMCEConfig;
 use SilverStripe\Forms\HTMLReadonlyField;
@@ -229,4 +230,41 @@ public function testValueEntities()
             $field->obj('ValueEntities')->forTemplate()
         );
     }
+
+    public function testFieldConfigSanitization()
+    {
+        $obj = TestObject::create();
+        $editor = HTMLEditorField::create('Content');
+        $defaultValidElements = [
+            '@[id|class|style|title|data*]',
+            'a[id|rel|dir|tabindex|accesskey|type|name|href|target|title|class]',
+            '-strong/-b[class]',
+            '-em/-i[class]',
+            '-ol[class]',
+            '#p[id|dir|class|align|style]',
+            '-li[class]',
+            'br',
+            '-span[class|align|style]',
+            '-ul[class]',
+            '-h3[id|dir|class|align|style]',
+            '-h2[id|dir|class|align|style]',
+            'hr[class]',
+        ];
+        $restrictedConfig = HTMLEditorConfig::get('restricted');
+        $restrictedConfig->setOption('valid_elements', implode(',', $defaultValidElements));
+        $editor->setEditorConfig($restrictedConfig);
+
+        $expectedHtmlString = '<p>standard text</p>Header';
+        $htmlValue = '<p>standard text</p><table><th><tr><td>Header</td></tr></th><tbody></tbody></table>';
+        $editor->setValue($htmlValue);
+        $editor->saveInto($obj);
+        $this->assertEquals($expectedHtmlString, $obj->Content, 'Table is not removed');
+
+        $defaultConfig = HTMLEditorConfig::get('default');
+        $editor->setEditorConfig($defaultConfig);
+
+        $editor->setValue($htmlValue);
+        $editor->saveInto($obj);
+        $this->assertEquals($htmlValue, $obj->Content, 'Table is removed');
+    }
 }