[SOLVED] - Iframe in vendor description

  • Posts: 8
  • Thank you received: 0
10 years 1 month ago #147349

Hello I am trying to edit the vendor description for display on front-end. The problem is that everytime I try to add an iframe code it removes it after saving. It did that with both JCE Editor and TinyMCE. If I add it to the joomla articel it works without problems.
Any suggestions?
Thanks,

-- Joomla version -- : 3.2.3

Last edit: 10 years 1 month ago by srajca.

Please Log in or Create an account to join the conversation.

  • Posts: 26017
  • Thank you received: 4004
  • MODERATOR
10 years 1 month ago #147355

Hi,

The vendor description data is cleaned by HikaShop using the Joomla Filtering Input system.
I guess that the iframe data is removed by the JFilterInput::clean function.

Can you please edit the file "administrator/components/com_hikamarket/classes/vendor.php" and replace

		$safeHtmlFilter = JFilterInput::getInstance(null, null, 1, 1);
		$vendor->vendor_description = $safeHtmlFilter->clean($vendor->vendor_description, 'string');
		$vendor->vendor_terms = $safeHtmlFilter->clean($vendor->vendor_terms, 'string');
By:
		$app = JFactory::getApplication();
		if(!$app->isAdmin()) {
			$safeHtmlFilter = JFilterInput::getInstance(null, null, 1, 1);
			$vendor->vendor_description = $safeHtmlFilter->clean($vendor->vendor_description, 'string');
			$vendor->vendor_terms = $safeHtmlFilter->clean($vendor->vendor_terms, 'string');
		}
So it will activate the filtering only in the front-end.
If it is right for you, I will see to put an option in HikaMarket to let you allow special HTML content in vendor description and terms.
But for security reasons, it is better to not let your vendor put some special HTML content which can create some security issues (like inserting some javascript).

Regards,

Jerome - Obsidev.com
HikaMarket & HikaSerial developer / HikaShop core dev team.

Also helping the HikaShop support team when having some time or couldn't sleep.
By the way, do not send me private message, use the "contact us" form instead.

Please Log in or Create an account to join the conversation.

  • Posts: 8
  • Thank you received: 0
10 years 1 month ago #147409

Perfect this solved it. How would you add the second option that you mentioned? Can there be a simple allow/disallow button somewhere in the backend configuration. But even if it is allowed I think that the JCE editor supports multiple profiles and one can just make a profile that doesn't allow implementing of code in front-end.
Regards

Please Log in or Create an account to join the conversation.

  • Posts: 26017
  • Thank you received: 4004
  • MODERATOR
10 years 1 month ago #147410

Hi,

The option is currently not there but I will see to add it for the next release.

Regards,

Jerome - Obsidev.com
HikaMarket & HikaSerial developer / HikaShop core dev team.

Also helping the HikaShop support team when having some time or couldn't sleep.
By the way, do not send me private message, use the "contact us" form instead.

Please Log in or Create an account to join the conversation.

  • Posts: 8
  • Thank you received: 0
10 years 1 month ago #147706

Fantastic,
thank you.

Please Log in or Create an account to join the conversation.

Moderators: Obsidev
Time to create page: 0.063 seconds
Powered by Kunena Forum