HTMLPurifier removes target="_blank"

Question

I'm using HTMLPurifier and even thou I have :

$config->set('HTML.Doctype', 'XHTML 1.0 Transitional');

it removes all 'target' attribues from the links.

Any idea why is it doing it?

Peep

Sure you got the latest purifier? Also, sure your HTML is valid? :) – Barrault

Yes - all valid and version downloaded yesterday. – Peep

Answer 1

The list of allowed frame targets is not enabled by default. You have to enable it manually.

Edmon

That was exactly this - I've used the following: $config->set('Attr.AllowedFrameTargets', array('_blank')); and it works! Thanks a lot! – Peep

Ah thanks, I thought CKEditor was responsible for this. With YML configurations you need to define an array like this (child of html_purifier -> config): Attr.AllowedFrameTargets: [ '_blank', '_top', '_self', '_parent' ] – Misunderstanding

Answer 2

In a Yii2 application, inside of a DetailView, I configured HtmlPurifier as follows:

[
    'label' => 'Document PDF',
    'format'=> 'raw',
    'value' => HtmlPurifier::process(DocumentFunctions::viewDocumentPdfInView($model->document_id), [
    'Attr.AllowedFrameTargets' => ['_blank'],
    ]),
],

Here is a simpler way I found:

[
    'label' => 'Document PDF',
    'format'=> ['html', 'config' => ['Attr.AllowedFrameTargets' => ['_blank']]],
    'value' => DocumentFunctions::viewDocumentPdfInView($model->document_id),
]

Appel