EE 2.6.1 WYGWAM 2.7.1
I have a Wygwam field. Inline image tags are not being written properly when entered through a Safecracker form. Inline image tags ARE being written properly when entered through the EE CP.
From the control panel, an img tag is written thusly:
<img alt=”” data-cke-saved-src=“something.jpg” src=“something.jpg” style=“width: 110px; height: 150px;”>
And from Safecracker, it looks like this:
<img alt=”” data-cke-saved-src=“something.jpg” src=“something.jpg” 110px;=”” height:=”” 150px;”=”“>
The style attribute is not encoding properly.
Andris over at P&T points us to line 1302 in safecracker_lib.php and suspects “the Security library is somehow deciding that style attribute is an XSS attack and is handling it rather poorly”
Is there something I can be doing to fix this?
I’ll gladly accept a patch if anyone can help. This is kind of a big deal. Thanks.
(I see a few answers that mention editing CKEditor config files. Ugh... really?)