allowing script tags

blindmime
@blindmime
9 years ago
772 posts
There is a service I would like to embed into select profiles which is something like this:
<script type="text/javascript" src="//blahblah.com/122423-posts.js"></script>
I've set up a custom form field, showing it only to the Master Admin and allowed the script tag to the quota, but it's being blocked, probably for good reason. Is there a way I can do this?

thanks
updated by @blindmime: 10/30/15 10:50:02AM
douglas
@douglas
9 years ago
2,790 posts
I think the next release will allow you to set a quota to allow all HTML tags. That should allow you to use the script tag. And your right... It is being removed for a reason. ;)


--

Douglas Hackney
Jamroom Team - Designer/Developer/Support
FAQ-Docs-Help Videos
michael
@michael
9 years ago
7,715 posts
site.com/core/admin/quota

check "allow ALL HTML tags"
Quote: If this options is checked, then ALL HTML tags will be allowed for profiles in this quota.

WARNING! Enabling this option will allow users to embed HTML tags that could compromise your system security or affect the design and/or layout of your pages.

Enabling this option overrides the "Allowed HTML Tags" option below.
Default: off

Yes there is a discussion about embedding iFrames and scripts being blocked. the end result was "Yes its a security risk, yes its difficult for a purpose, but its being asked for so much, we give up, here you go."

You can search for those threads in this forum if your interested.
blindmime
@blindmime
9 years ago
772 posts
I don't want to allow all HTML tags in this case. The only situation I can think of where that might be needed is for a quota where the Master Admin is the only one with access. The script I want to add is for user profiles, but I don't want to give them the ability to add any script they want which I would be doing if I turned on this All HTML thing. They'd be able to add scripts anywhere I allow HTML.

I guess I'll think of another solution.

Tags