0

I am building a website on django-cms. In some pages I want to add javascript to django-cms pages(not templates).

How can I escape the script tag in django-cms wysiwyg editor, whenever I tried to add alert in page, it get executed as soon as write the word "alert".

Any pointers or suggestions would be great

Thanks

Pradnya Mhatre
  • 208
  • 2
  • 8

1 Answers1

0

script tags (and any other insecure tag) is not allowed in the django-cms default text editor. See http://wiki.whatwg.org/wiki/Sanitization_rules for a list of sanitization rules that get applied.

You cannot override or disable these rules.

If you need users to add script tags, write a custom CMS Plugin (see http://docs.django-cms.org/en/2.4.0/extending_cms/custom_plugins.html) that allows your users to do this. I recommend you don't actually let them write the script tag, but rather provide them with a form that will sanitize/validate the input and generate the script tag.

ojii
  • 4,729
  • 2
  • 23
  • 34
  • Sorry for replying so late. Actually I am migrating website from Plone to Django-cms. I want same functionality as Tinymce kupu wysiwyg plone provides. I tried django's by default text editor and django-text-ckeditor. – Pradnya Mhatre Jun 02 '13 at 13:43