{"action":"created","issue":{"url":"https://api.github.com/repos/pencilblue/pencilblue/issues/437","labels_url":"https://api.github.com/repos/pencilblue/pencilblue/issues/437/labels{/name}","comments_url":"https://api.github.com/repos/pencilblue/pencilblue/issues/437/comments","events_url":"https://api.github.com/repos/pencilblue/pencilblue/issues/437/events","html_url":"https://github.com/pencilblue/pencilblue/issues/437","id":54645543,"number":437,"title":"WYSIWYG editor in custom objects sanitizes id attribute when in HTML view","user":{"login":"tangledpixel","id":2601128,"avatar_url":"https://avatars.githubusercontent.com/u/2601128?v=3","gravatar_id":"","url":"https://api.github.com/users/tangledpixel","html_url":"https://github.com/tangledpixel","followers_url":"https://api.github.com/users/tangledpixel/followers","following_url":"https://api.github.com/users/tangledpixel/following{/other_user}","gists_url":"https://api.github.com/users/tangledpixel/gists{/gist_id}","starred_url":"https://api.github.com/users/tangledpixel/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/tangledpixel/subscriptions","organizations_url":"https://api.github.com/users/tangledpixel/orgs","repos_url":"https://api.github.com/users/tangledpixel/repos","events_url":"https://api.github.com/users/tangledpixel/events{/privacy}","received_events_url":"https://api.github.com/users/tangledpixel/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/pencilblue/pencilblue/labels/wontfix","name":"wontfix","color":"ffffff"}],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2015-01-17T01:31:34Z","updated_at":"2015-01-18T15:33:08Z","closed_at":"2015-01-18T15:33:08Z","body":"To recreate\r\n1. create a custom object\r\n2. add WYSIWYG field\r\n3. create object\r\n4. go to HTML view\r\n5. type in an HTML tag with an id attribute\r\n6. save\r\n7. reopen custom object for editing, id attribute has been sanitized\r\n\r\n(I'm not sure if other attributes are affected by this, it only seems to occur in the custom objects and not in pages)"},"comment":{"url":"https://api.github.com/repos/pencilblue/pencilblue/issues/comments/70412450","html_url":"https://github.com/pencilblue/pencilblue/issues/437#issuecomment-70412450","issue_url":"https://api.github.com/repos/pencilblue/pencilblue/issues/437","id":70412450,"user":{"login":"blakecallens","id":39135,"avatar_url":"https://avatars.githubusercontent.com/u/39135?v=3","gravatar_id":"","url":"https://api.github.com/users/blakecallens","html_url":"https://github.com/blakecallens","followers_url":"https://api.github.com/users/blakecallens/followers","following_url":"https://api.github.com/users/blakecallens/following{/other_user}","gists_url":"https://api.github.com/users/blakecallens/gists{/gist_id}","starred_url":"https://api.github.com/users/blakecallens/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/blakecallens/subscriptions","organizations_url":"https://api.github.com/users/blakecallens/orgs","repos_url":"https://api.github.com/users/blakecallens/repos","events_url":"https://api.github.com/users/blakecallens/events{/privacy}","received_events_url":"https://api.github.com/users/blakecallens/received_events","type":"User","site_admin":false},"created_at":"2015-01-18T15:33:08Z","updated_at":"2015-01-18T15:33:08Z","body":"You can allow for any type of HTML tags by overriding getSanitizationRules in the new and edit custom objects controllers. Here's why we take them out by default:\r\n\r\nProbably the only reason you would need an *id* attribute is to also add JavaScript inside the WYSIWYG to manipulate the element. Allowing JS in the WYSIWYG would open your site up to XSS attacks.\r\n\r\nWe suggest creating a controller and template to drive pages that need this type of functionality."}}