Links opening in a new tab to have rel="noopener" attribute about redactor HOT 9 CLOSED

HTML purifier already does that by default for you when saving: http://htmlpurifier.org/live/configdoc/plain.html#HTML.TargetNoopener

Unless you have disabled HTML purifier or explicitly turned that setting off.

from redactor.

Weird, this doesn't seem to be the case for me. I definitely haven't explicitly touched HTML puriffier's config so something else must be going on.

from redactor.

@XhmikosR In your Redactor field settings, is “Purify HTML?” still enabled?

from redactor.

Hmm, it must be a field where that might be off. Going through all my fields right now.

from redactor.

OK, I think that was the reason. Some fields had the option disabled. Sorry for the noise!

from redactor.

No worries, glad to hear it’s working as expected :)

from redactor.

Unfortunately enabling this breaks any IDs and classes we have. :/

@brandonkelly Is it possible to provide a more flexible HTML Purifier config? For example I have also enabled the custom properties Redactor plugin but it's moot since on Save IDs and Classes are being removed :/

I tried setting up my custom config but seems a bit too much for me to handle this only on my own...

{
  "Attr.AllowedFrameTargets": ["_blank"],
  "Attr.EnableID": true,
  "HTML.AllowedAttributes": "img.src,a.href,a.target,a.rel,*.id,*.class",
  "HTML.AllowedComments": ["pagebreak"]
}

What are the default allowed attributes for example? None? If I don't specify img.src I can't even add an image then.

I can make a new issue, I just started playing with this due to rel noopener initially.

from redactor.

@XhmikosR Right now we’re mostly just focused on allowing HTML that can be added via the UI. So if something is getting dropped that you added via the UI, you can post a new issue about that. Otherwise, you can create your own HTML Purifier config.

from redactor.

@brandonkelly: this is done via the UI with https://imperavi.com/redactor/plugins/properties/

Yet, the default config strips IDs and classes.

I did try to use my own config, see above, but then I'd need to whitelist every possible attribute myself. So, I think it would be for the greater good if this was tackled upstream here.

from redactor.