You are not logged in.
Not giving us much to go on. What errors/exceptions were shown in the javascript console (presuming you were using a browser with a javascript console).
Try playing with these settings
// specify a base href for relative links
this.baseHref = null;
// we can strip the base href out of relative links to leave them relative, reason for this
// especially if you don't specify a baseHref is that mozilla at least (& IE ?) will prefix
// the baseHref to any relative links to make them absolute, which isn't what you want most the time.
this.stripBaseHref = true;
// and we can strip the url of the editor page from named links (eg <a href="#top">...</a>)
// reason for this is that mozilla at least (and IE ?) prefixes location.href to any
// that don't have a url prefixing them
this.stripSelfNamedAnchors = true;(eg xinha_config.stripBaseHref = false; )
If you want the Xinha area to display (in HTML mode)
<hello & world>
then your textarea would look like
<textarea><hello & world></textarea>
This is the correct format as per HTML specifications - <textarea> has no valid tags that may appear in it and the content is defined as #PCDATA
You probably need to let it load a bit longer. There is a finicky timing issue or something with Moz that rear's it's ugly head sometimes, especially if the content has images in it.
No effort has gone into making the output conformant to any standard - it's basically all up to the web browser as to what html it creates. It should be well formed (well, IE might drop quotes from attributes sometimes I think), but as for compliant... who knows.
Sounds like you are not entizing the data you put between the <textarea> tags. As per the HTML standards, <textarea> content is #PCDATA. That means you must not put "raw html" in it, you must run it through an entizer, such as in php, htmlspecialchars()
<textarea><?php echo htmlspecialchars($myhtmltoedit) ?></textarea>Hi folks,
I have recognized, that xinha doesn't change special chars like the german umlauts into their HTML-Equivalent.
xinha_config.sevenBitClean = true;
will approximatly do what you require, presuming you are using utf-8 encoding for Xinha (infact even if you're not it will probably do what you need).
There is also a problem with writing code into the Editor, if you want to show something like this
"This is an Anker-tag: <a href="sdfsdf">erfgergt.</a>"
it is impossible
I have not seen this behaviour, can anybody confirm?
6. in this script (backend.php) you catch your params again:
$val1 = $_REQUEST['val1'];They are used in the included file "config.inc.php".
7. Finally you take them and print them into your dir-Variables:
$IMConfig['images_dir'] = $val1;
$IMConfig['images_url'] = "http://mydomain.org".$val1;
That's a security problem right there. Now anybody can set the image directory for your copy of ImageManager to any directory they want on the server, just by calling
backend.php?val1=/some/directory/people/should/not/see
wether ImageManager can do anything useful with that I don't know, but it gives a crack for hackers to work on.
Welcome aboard
Xinha's nightly is reasonably stable, it's generally what I use on my production systems, just be careful and test before pushing it out or anything ![]()
Subversion is the best way to keep up to date, saves bandwidth ![]()
For security if you want to supply an image directory to the image manager, then it must be done in this way (snipped from the comments in image-manager.js
// It's useful to pass the configuration to the backend through javascript
// (this saves editing the backend config itself), but the problem is
// how do you make it so that the enduser can not sneakily send thier own
// config to the server (including directory locations etc!).
//
// Well, we specify 3 config variables (if the first is given all 3 are required)
// first in backend_config we provide the backend configuration (in the format
// required by the backend, in the case of PHP this is a serialized structure). We do not
// need to provide a complete configuration here, it will be merged with defaults.
//
// Then in backend_config_secret_key_location we store the name of a key in a
// session structure which stores a secret key (anything random), for example
// when making the Xinha editor in PHP we might do
// <?php $_SESSION['Xinha:ImageManager'] = uniqid('secret_'); ?>
// xinha_config.ImageManager.backend_config_secret_key_location = 'Xinha:ImageManager';
//
// Then finally in backend_config_hash we store an SHA1 hash of the config combined
// with the secret.
//
// A full example in PHP might look like
//
// <?php
// $myConfig = array('base_dir' = '/home/your/directory', 'base_url' => '/directory')
// $myConfig = serialize($myConfig);
// if(!isset($_SESSION['Xinha:ImageManager'])) $_SESSION['Xinha:ImageManager'] = uniqid('secret_');
// $secret = $_SESSION['Xinha:ImageManager'];
// ?>
// xinha_config.ImageManager.backend_config = '<?php echo jsaddslashes($myConfig)?>';
// xinha_config.ImageManager.backend_config_hash = '<?php echo sha1($myConfig . $secret)?>';
// xinha_config.ImageManager.backend_config_secret_key_location = 'Xinha:ImageManager';
//
// (for jsspecialchars() see http://nz.php.net/manual/en/function.addcslashes.php)
//Now, this isn't going to be much help to you if you're using CF (I spent several years working in CF - all I can say is that I'm glad I don't have to any more), unless you have PHP on the same machine. As to putting php in js, well sure, what I'd do is name your file my_config.php instead of my_config.js, then you can put in <?php .... ?> areas as much as you like.
You move the cursor using the selection and range objects. You'll ave to dig through htmlarea.js to see how to use them, unfortunatly IE and Mozilla do it differently, and it's not documented well by either of the browsers.
It's not possible to actually simulate a "CTRL-C", but you can call the copy command for the editor - see how the copy button in the toolbar works.
I don't actually remember. Can you check for me.
You may implement any plugin you so desire ![]()
Redownload, you must have an imcomplete package for some reason.
But what scope is the eval called in? eg.. if you do
function mycallback()
{
eval(HTMLArea._request[i].responseText);
}
then any functions defined in responseText which were intended to be global, are now only defined within mycallback. N'est pas?
Sorry, I don't know about leaking script elements because I don't use them anymore. I have modified the loading of scripts so that all scripts are loaded with XMLHttp requests. I think this is also necessary for Safari support.
Regards,
Stanislas Rolland
I looked at doing that, but I couldn't figure a way to eval the loaded javascript in the global scope. Did you come up with a different solution?
Your problem is a server configuration error, when the browser tries to load the plugin javascript files it gets a 404 back from your server. Here is a trace of the request & response headers for a load of the url you gave above. Note all the 404's. I'd check permissions ![]()
http://www.hilliardpres.org/admin3.php
GET /admin3.php HTTP/1.1
Host: www.hilliardpres.org
User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.7.8) Gecko/20050511 Firefox/1.0.4
Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 300
Connection: keep-alive
Referer: http://xinha.gogo.co.nz/punbb/viewtopic.php?pid=2137
Cache-Control: max-age=0
HTTP/1.x 200 OK
Transfer-Encoding: chunked
Date: Sat, 06 Aug 2005 05:10:56 GMT
Content-Type: text/html
Server: Apache/1.3.33 (Unix) mod_auth_passthrough/1.8 mod_bwlimited/1.4 PHP/4.3.9 mod_log_bytes/1.2 FrontPage/5.0.2.2635 mod_ssl/2.8.22 OpenSSL/0.9.7a
X-Powered-By: PHP/4.3.9
Via: 1.1 nc1 (NetCache NetApp/5.6.2)
----------------------------------------------------------
http://www.hilliardpres.org/xinha/full_example.css
GET /xinha/full_example.css HTTP/1.1
Host: www.hilliardpres.org
User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.7.8) Gecko/20050511 Firefox/1.0.4
Accept: text/css,*/*;q=0.1
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 300
Connection: keep-alive
Referer: http://www.hilliardpres.org/admin3.php
HTTP/1.x 404 Not Found
Transfer-Encoding: chunked
Date: Sat, 06 Aug 2005 05:10:56 GMT
Content-Type: text/html
Server: Apache/1.3.33 (Unix) mod_auth_passthrough/1.8 mod_bwlimited/1.4 PHP/4.3.9 mod_log_bytes/1.2 FrontPage/5.0.2.2635 mod_ssl/2.8.22 OpenSSL/0.9.7a
Via: 1.1 nc1 (NetCache NetApp/5.6.2)
----------------------------------------------------------
http://www.hilliardpres.org/xinha/htmlarea.js
GET /xinha/htmlarea.js HTTP/1.1
Host: www.hilliardpres.org
User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.7.8) Gecko/20050511 Firefox/1.0.4
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 300
Connection: keep-alive
Referer: http://www.hilliardpres.org/admin3.php
If-Modified-Since: Fri, 05 Aug 2005 13:44:23 GMT
If-None-Match: "c28244-28c09-42f36d37"
Cache-Control: max-age=0
HTTP/1.x 304 Not Modified
Etag: "c28244-28c09-42f36d37"
Date: Sat, 06 Aug 2005 05:10:57 GMT
----------------------------------------------------------
http://www.hilliardpres.org/xinha/htmlarea.css
GET /xinha/htmlarea.css HTTP/1.1
Host: www.hilliardpres.org
User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.7.8) Gecko/20050511 Firefox/1.0.4
Accept: text/css,*/*;q=0.1
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 300
Connection: keep-alive
Referer: http://www.hilliardpres.org/admin3.php
If-Modified-Since: Fri, 05 Aug 2005 13:44:23 GMT
If-None-Match: "c28243-14bd-42f36d37"
Cache-Control: max-age=0
HTTP/1.x 304 Not Modified
Etag: "c28243-14bd-42f36d37"
Date: Sat, 06 Aug 2005 05:11:00 GMT
----------------------------------------------------------
http://www.hilliardpres.org/xinha/plugins/TableOperations/table-operations.js
GET /xinha/plugins/TableOperations/table-operations.js HTTP/1.1
Host: www.hilliardpres.org
User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.7.8) Gecko/20050511 Firefox/1.0.4
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 300
Connection: keep-alive
Referer: http://www.hilliardpres.org/admin3.php
HTTP/1.x 404 Not Found
Transfer-Encoding: chunked
Date: Sat, 06 Aug 2005 05:11:01 GMT
Content-Type: text/html
Server: Apache/1.3.33 (Unix) mod_auth_passthrough/1.8 mod_bwlimited/1.4 PHP/4.3.9 mod_log_bytes/1.2 FrontPage/5.0.2.2635 mod_ssl/2.8.22 OpenSSL/0.9.7a
Via: 1.1 nc1 (NetCache NetApp/5.6.2)
----------------------------------------------------------
http://www.hilliardpres.org/xinha/plugins/SuperClean/super-clean.js
GET /xinha/plugins/SuperClean/super-clean.js HTTP/1.1
Host: www.hilliardpres.org
User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.7.8) Gecko/20050511 Firefox/1.0.4
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 300
Connection: keep-alive
Referer: http://www.hilliardpres.org/admin3.php
HTTP/1.x 404 Not Found
Transfer-Encoding: chunked
Date: Sat, 06 Aug 2005 05:11:02 GMT
Content-Type: text/html
Server: Apache/1.3.33 (Unix) mod_auth_passthrough/1.8 mod_bwlimited/1.4 PHP/4.3.9 mod_log_bytes/1.2 FrontPage/5.0.2.2635 mod_ssl/2.8.22 OpenSSL/0.9.7a
Via: 1.1 nc1 (NetCache NetApp/5.6.2)
----------------------------------------------------------
http://www.hilliardpres.org/xinha/plugins/Stylist/stylist.js
GET /xinha/plugins/Stylist/stylist.js HTTP/1.1
Host: www.hilliardpres.org
User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.7.8) Gecko/20050511 Firefox/1.0.4
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 300
Connection: keep-alive
Referer: http://www.hilliardpres.org/admin3.php
HTTP/1.x 404 Not Found
Transfer-Encoding: chunked
Date: Sat, 06 Aug 2005 05:11:02 GMT
Content-Type: text/html
Server: Apache/1.3.33 (Unix) mod_auth_passthrough/1.8 mod_bwlimited/1.4 PHP/4.3.9 mod_log_bytes/1.2 FrontPage/5.0.2.2635 mod_ssl/2.8.22 OpenSSL/0.9.7a
Via: 1.1 nc1 (NetCache NetApp/5.6.2)
----------------------------------------------------------
http://www.hilliardpres.org/xinha/plugins/SpellChecker/spell-checker.js
GET /xinha/plugins/SpellChecker/spell-checker.js HTTP/1.1
Host: www.hilliardpres.org
User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.7.8) Gecko/20050511 Firefox/1.0.4
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 300
Connection: keep-alive
Referer: http://www.hilliardpres.org/admin3.php
HTTP/1.x 404 Not Found
Transfer-Encoding: chunked
Date: Sat, 06 Aug 2005 05:11:02 GMT
Content-Type: text/html
Server: Apache/1.3.33 (Unix) mod_auth_passthrough/1.8 mod_bwlimited/1.4 PHP/4.3.9 mod_log_bytes/1.2 FrontPage/5.0.2.2635 mod_ssl/2.8.22 OpenSSL/0.9.7a
Via: 1.1 nc1 (NetCache NetApp/5.6.2)
----------------------------------------------------------
http://www.hilliardpres.org/favicon.ico
GET /favicon.ico HTTP/1.1
Host: www.hilliardpres.org
User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.7.8) Gecko/20050511 Firefox/1.0.4
Accept: image/png,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 300
Connection: keep-alive
HTTP/1.x 404 Not Found
Transfer-Encoding: chunked
Date: Sat, 06 Aug 2005 05:11:02 GMT
Content-Type: text/html
Server: Apache/1.3.33 (Unix) mod_auth_passthrough/1.8 mod_bwlimited/1.4 PHP/4.3.9 mod_log_bytes/1.2 FrontPage/5.0.2.2635 mod_ssl/2.8.22 OpenSSL/0.9.7a
Via: 1.1 nc1 (NetCache NetApp/5.6.2)
----------------------------------------------------------Thanks Stanislas, somebody posted about your work a while back. The work I've done on this is mostly in the same areas, mostly in the toolbar as you point out. There's one leak I can't seem to figure out though - <script> elements are leaking, even though I completly nullify everything on them.. any ideas?
Hmm, try using an absolute url for _editor_url, or maybe try without the trailing / (can't remember if it's required or not off the top of my head).
Are you loading the spell checker plugin?
problem is now making it work with IE5 for OS X
AFAIK, IE5 on Mac does not support contentEditable, so it's just not going to work, at all, ever.
As far as JS in the editor goes, what is required to support it is for "shielded" code, a-la Dreamweaver. It's slated for after V1.0, unless somebody comes up with it as a plugin before then, in which case we can just include it straight off (no new features in the core before 1.0, but new plugins are always welcome).
You have written:
xinha_editors = xinha_editors ? xinha_editors :
[
'cert5',
'frontline'
];But I don't see a textarea named cert5 in your form, only frontline.
We do not currently support javascript (or any other language) in the HTML being edited.
Xinha is (for now) an HTML editor, not a programming environment ![]()
<script type="text/javascript" src="../htmlarea.js"></script>should probably be
<script type="text/javascript" src="../xinha/htmlarea.js"></script>
(presuming your _editor_url is correct)
Not that I remember.
You're better to use strip_tags() (in PHP, whatever equivalent in other languages) when you get the HTML back and limit the buttons/features so people can't easily insert those undesired tags.