silverstripe-userforms/code/model/editableformfields/EditableLiteralField.php

<?php

/**
 * Editable Literal Field. A literal field is just a blank slate where
 * you can add your own HTML / Images / Flash
 *
 * @package userforms
 */

class EditableLiteralField extends EditableFormField
{

    private static $singular_name = 'HTML Block';

    private static $plural_name = 'HTML Blocks';

    /**
     * Mark as literal only
     *
     * @config
     * @var bool
     */
    private static $literal = true;

    /**
     * Get the name of the editor config to use for HTML sanitisation. Defaults to the active config.
     *
     * @var string
     * @config
     */
    private static $editor_config = null;

    private static $db = array(
        'Content' => 'HTMLText', // From CustomSettings
        'HideFromReports' => 'Boolean(0)', // from CustomSettings
        'HideLabel' => 'Boolean(0)'
    );

    private static $defaults = array(
        'HideFromReports' => false
    );

    /**
     * Returns the {@see HtmlEditorConfig} instance to use for sanitisation
     *
     * @return HtmlEditorConfig
     */
    protected function getEditorConfig()
    {
        $editorConfig = $this->config()->editor_config;
        if ($editorConfig) {
            return HtmlEditorConfig::get($editorConfig);
        }
        return HtmlEditorConfig::get_active();
    }

    /**
     * Safely sanitise html content, if enabled
     *
     * @param string $content Raw html
     * @return string Safely sanitised html
     */
    protected function sanitiseContent($content)
    {
        // Check if sanitisation is enabled
        if (!HtmlEditorField::config()->sanitise_server_side) {
            return $content;
        }

        // Perform sanitisation
        $htmlValue = Injector::inst()->create('HTMLValue', $content);
        $santiser = Injector::inst()->create('HtmlEditorSanitiser', $this->getEditorConfig());
        $santiser->sanitise($htmlValue);
        return $htmlValue->getContent();
    }

    /**
     * Get HTML Content of this literal field
     *
     * @return string
     */
    public function getContent()
    {
        // Apply html editor sanitisation rules
        $content = $this->getField('Content');
        return $this->sanitiseContent($content);
    }

    /**
     * Set the content with the given value
     *
     * @param string $content
     */
    public function setContent($content)
    {
        // Apply html editor sanitisation rules
        $content = $this->sanitiseContent($content);
        $this->setField('Content', $content);
    }

    /**
     * @return FieldList
     */
    public function getCMSFields()
    {
        $fields = parent::getCMSFields();

        $fields->removeByName(array('Default', 'Validation', 'RightTitle'));

        $fields->addFieldsToTab('Root.Main', array(
            HTMLEditorField::create('Content', _t('EditableLiteralField.CONTENT', 'HTML'))
                ->setRows(4)
                ->setColumns(20),
            CheckboxField::create(
                'HideFromReports',
                _t('EditableLiteralField.HIDEFROMREPORT', 'Hide from reports?')
            ),
            CheckboxField::create(
                'HideLabel',
                _t('EditableLiteralField.HIDELABEL', "Hide 'Title' label on frontend?")
            )
        ));

        return $fields;
    }

    public function getFormField()
    {
        // Build label and css classes
        $label = '';
        $classes = $this->ExtraClass;
        if (empty($this->Title) || $this->HideLabel) {
            $classes .= " nolabel";
        } else {
            $label = "<label class='left'>{$this->EscapedTitle}</label>";
        }

        $field = new LiteralField(
            "LiteralField[{$this->ID}]",
            sprintf(
                "<div id='%s' class='field text %s'>
					%s
					<div class='middleColumn literalFieldArea'>%s</div>".
                "</div>",
                Convert::raw2htmlname($this->Name),
                Convert::raw2att($classes),
                $label,
                $this->Content
            )
        );

        // When dealing with literal fields there is no further customisation that can be added at this point
        return $field;
    }

    public function showInReports()
    {
        return ! $this->HideFromReports;
    }
}