plone / Products.CMFPlone

The core of the Plone content management system
https://plone.org
GNU General Public License v2.0
252 stars 189 forks source link

TinyMCE strikethrough format is stripped on save #3069

Open ewohnlich opened 4 years ago

ewohnlich commented 4 years ago

BUG/PROBLEM REPORT (OR OTHER COMMON ISSUE)

TinyMCE editor strikethrough is removed on save, or on transform.

What I did:

Highlight text in the wysiwyg TinyMCE editor, select Format -> Strikethrough. Save.

What I expect to happen:

The text should have strikethrough decoration.

What actually happened:

Using the strikethrough format in the editor wraps the text in a span with some classes. These classes are no longer present on the viewpage - all that's happened is I have wrapped some text in a element.

What version of Plone/ Addons I am using:

5.2.1. I tested this on https://demo.plone.org

ewohnlich commented 4 years ago

It looks like the same situation is with indent/outdent as discussed here: https://community.plone.org/t/tinymce-indent-outdent-dont-work-in-plone-5-2/12234/3. Both of these TinyMCE functions work by applying a style attribute, as opposed to using a class or tag. The CMFPlone tinymce pattern is responsible for configuring TinyMCE initialization with valid tags and attributes and does by combining lxml.html.defs.safe_attrs with any custom_attributes listed in @@filter-controlpanel.

That lxml frozenset does not include style as a safe attrs, but if TinyMCE is going to use for these formatting options, and we're going to include them by default (we should) I think it should be a allowed by default.

Not sure which is the best way to do this:

  1. Update the pattern to consider safe attributes to be lxml.html.defs.safe_attrs + ['style'] + custom_attributes. This would not allow a site admin to prohibit it though.
  2. Add style to custom_attributes as part of an upgrade step. Should be able to do this without purging settings.
zopyx commented 4 years ago

The same is true for the left|right|center|justify formatting options