TinyMCE-EXP popup function doesn't work after security patch

Ant · 14.06.2005, 12:10

After patched with Security Patches Out for 4.5.x, TinyMCE-EXP 1.0 (mambo 4.5.2) thumbnail to popup feature doesn't work anymore. When I insert an image as thumbnail in th html source there is the correct code:

Code:

<a href="javascript:void window.open('http://***/mambots/editors/tinymce_exp/jscripts/tiny_mce/popupImage.php?img=images/stories/piazza3.jpg&imgwidth=400&imgheight=280&alt=piazza3.jpg','Image','menubar=no,toolbar=no,scrollbars=yes,resizable=yes, left='+(screen.availWidth/2-(400/2))+',top='+(screen.availHeight/2-(280/2))+',width='+(400+10)+',height='+(280+75)+'');"><img width="150" vspace="5" hspace="5" height="105" border="0" align="" alt="piazza3.jpg" src="http://***/images/stories/.thumbnails/.thumb_piazza3.jpg" /></a><br />

But after saved, the code is:

Code:

<a><img width="150" vspace="5" hspace="5" height="105" border="0" align="align" src="http://***/images/stories/.thumbnails/.thumb_piazza3.jpg" alt="piazza3.jpg" /></a><br />

Any idea about?
Thanks
A.

indy68 · 14.06.2005, 13:41

The problem is not TinyMCE-E but seems to point at a php-input-filter-class installed with the latest patch (4.5.2.2).

For security issues , this filter wil delete all 'dangerous' code when the content is saved. The reason for this filter is to prevent mallicious users to insert code into the content.

The href="javascript:..." code is considered 'dangerous' and therefor delete.
I've experienced the same problem (without an editor) and decided that the only short-term solution is (allthough I'll miss out on the rest of the security patch) to go back to 4.5.2.1 as this filter would make my website useless.

This problem has been posted as a bug on mamboforge.net although it's not really a bug as it's more a loss in functionality.

Maybe the developers could consider the ability to turn off this filter (at least for the backend) through a parameter in the configuration file.

Ant · 15.06.2005, 23:29

With new update 4.5.2.3 pop-up works fine again.