› ›
CRITICAL SECURITY VERSION UPDATE:
https://github.com/daylightstudio/FUEL-CMS/releases/tag/1.4.13

Forms - Values being altered

arisaris
edited August 2016 in Bug Reports
Hi,

Whenever i try to save this

< ! -- test -- >

it will be converted into

& lt;!-- test --& gt;

Here's the code as seen on my model

$fields['page_content'] = array(
'label' => 'Page Content',
'comment' => 'Set the content of your page',
'type' => 'textarea',
'class' => 'no_editor');


Is it possible to disable the alteration and retain the values I've originally inputted?

Also tried to save this

< div style="color: red;">test</ div>

and it resulted to

< div >test</ div>

I hope the alterations can be disabled in a simple textarea field.

Comments

  • arisaris
    edited 6:18PM
    Seen it. Added sanitize_input false to my module in my_fuel_modules.php

    $config['modules']['my_module'] = array(
    'preview_path' => '', // put in the preview path on the site e.g products/{slug}
    'model_location' => '', // put in the advanced module name here
    'sanitize_input' => FALSE,
    );

    It works fine now.
  • adminadmin
    edited 6:18PM
    Inline styles will trigger things being altered by the xss_clean function which is being used by default. You may also want to try the following which will give you some sanitization:
    'sanitize_input' => array('template','php'),
Sign In or Register to comment.