diff --git a/src/Forms/HTMLEditor/HTMLEditorField.php b/src/Forms/HTMLEditor/HTMLEditorField.php index db8d08a05..3edd623f7 100644 --- a/src/Forms/HTMLEditor/HTMLEditorField.php +++ b/src/Forms/HTMLEditor/HTMLEditorField.php @@ -138,7 +138,8 @@ class HTMLEditorField extends TextareaField // Sanitise if requested $htmlValue = HTMLValue::create($this->Value()); if (HTMLEditorField::config()->sanitise_server_side) { - $santiser = HTMLEditorSanitiser::create(HTMLEditorConfig::get_active()); + $config = $this->getEditorConfig(); + $santiser = HTMLEditorSanitiser::create($config); $santiser->sanitise($htmlValue); } diff --git a/tests/php/Forms/HTMLEditor/HTMLEditorFieldTest.php b/tests/php/Forms/HTMLEditor/HTMLEditorFieldTest.php index 2abe550aa..b046a1fd2 100644 --- a/tests/php/Forms/HTMLEditor/HTMLEditorFieldTest.php +++ b/tests/php/Forms/HTMLEditor/HTMLEditorFieldTest.php @@ -12,6 +12,7 @@ use SilverStripe\Control\Director; use SilverStripe\Core\Config\Config; use SilverStripe\Dev\CSSContentParser; use SilverStripe\Dev\FunctionalTest; +use SilverStripe\Forms\HTMLEditor\HTMLEditorConfig; use SilverStripe\Forms\HTMLEditor\HTMLEditorField; use SilverStripe\Forms\HTMLEditor\TinyMCEConfig; use SilverStripe\Forms\HTMLReadonlyField; @@ -278,4 +279,41 @@ EOS $this->assertEquals("auto", $data_config->height, 'Config height is not set'); $this->assertEquals("60px", $data_config->row_height, 'Config row_height is not set'); } + + public function testFieldConfigSanitization() + { + $obj = TestObject::create(); + $editor = HTMLEditorField::create('Content'); + $defaultValidElements = [ + '@[id|class|style|title|data*]', + 'a[id|rel|dir|tabindex|accesskey|type|name|href|target|title|class]', + '-strong/-b[class]', + '-em/-i[class]', + '-ol[class]', + '#p[id|dir|class|align|style]', + '-li[class]', + 'br', + '-span[class|align|style]', + '-ul[class]', + '-h3[id|dir|class|align|style]', + '-h2[id|dir|class|align|style]', + 'hr[class]', + ]; + $restrictedConfig = HTMLEditorConfig::get('restricted'); + $restrictedConfig->setOption('valid_elements', implode(',', $defaultValidElements)); + $editor->setEditorConfig($restrictedConfig); + + $expectedHtmlString = '

standard text

Header'; + $htmlValue = '

standard text

Header
'; + $editor->setValue($htmlValue); + $editor->saveInto($obj); + $this->assertEquals($expectedHtmlString, $obj->Content, 'Table is not removed'); + + $defaultConfig = HTMLEditorConfig::get('default'); + $editor->setEditorConfig($defaultConfig); + + $editor->setValue($htmlValue); + $editor->saveInto($obj); + $this->assertEquals($htmlValue, $obj->Content, 'Table is removed'); + } }