From 7a4a4e9b6ad79eb80c8f2e8d68250174ea060226 Mon Sep 17 00:00:00 2001
From: Daniela Soares Feitosa <danielafeitosa@colivre.coop.br>
Date: Sat, 31 Oct 2009 18:41:45 -0300
Subject: [PATCH] Allowing users to post videos from other sites

---
 app/views/shared/tiny_mce.rhtml                                      |  3 ++-
 config/environment.rb                                                |  4 ++--
 public/stylesheets/tinymce.css                                       | 10 ++++++++++
 test/unit/tiny_mce_article_test.rb                                   | 20 ++++++++++++++++++++
 vendor/plugins/white_list_sanitizer_unescape_before_reescape/init.rb | 19 +++++++++++++++----
 5 files changed, 49 insertions(+), 7 deletions(-)

diff --git a/app/views/shared/tiny_mce.rhtml b/app/views/shared/tiny_mce.rhtml
index 593a481..a60f7cc 100644
--- a/app/views/shared/tiny_mce.rhtml
+++ b/app/views/shared/tiny_mce.rhtml
@@ -1,6 +1,6 @@
 <%= javascript_include_tag 'tinymce/jscripts/tiny_mce/tiny_mce.js' %>
 <script type="text/javascript">
-  var myplugins = "searchreplace,print,media,table";
+  var myplugins = "searchreplace,print,table";
   if (tinymce.isIE) {
     // the paste plugin is only useful in Internet Explorer
     myplugins = "paste," + myplugins;
@@ -22,6 +22,7 @@ tinyMCE.init({
         paste_insert_word_content_callback : "convertWord",
         paste_use_dialog: false,
         apply_source_formatting : true,
+        extended_valid_elements : "applet[style|archive|codebase|code|height|width],comment,iframe[src|style|allowtransparency|frameborder]",
         content_css: '/stylesheets/tinymce.css',
         language: <%= tinymce_language.inspect %>,
         entity_encoding: 'raw'
diff --git a/config/environment.rb b/config/environment.rb
index b577066..ad53b41 100644
--- a/config/environment.rb
+++ b/config/environment.rb
@@ -83,10 +83,10 @@ Rails::Initializer.run do |config|
   }
 
   # Adds custom attributes to the Set of allowed html attributes for the #sanitize helper
-  config.action_view.sanitized_allowed_attributes = 'align', 'border', 'alt', 'vspace', 'hspace', 'width', 'heigth', 'value', 'type', 'data', 'style', 'target'
+  config.action_view.sanitized_allowed_attributes = 'align', 'border', 'alt', 'vspace', 'hspace', 'width', 'heigth', 'value', 'type', 'data', 'style', 'target', 'codebase', 'archive', 'classid', 'code', 'flashvars'
   
    # Adds custom tags to the Set of allowed html tags for the #sanitize helper
-  config.action_view.sanitized_allowed_tags = 'object', 'embed', 'param', 'table', 'tr', 'th', 'td'
+  config.action_view.sanitized_allowed_tags = 'object', 'embed', 'param', 'table', 'tr', 'th', 'td', 'applet', 'comment', 'iframe'
 
   # See Rails::Configuration for more options
 
diff --git a/public/stylesheets/tinymce.css b/public/stylesheets/tinymce.css
index e11f6dc..5ef156a 100644
--- a/public/stylesheets/tinymce.css
+++ b/public/stylesheets/tinymce.css
@@ -4,3 +4,13 @@ body.mceContentBody td {
   font-size: 12px;
 }
 
+object, embed {
+  border:1px dotted #cc0000;
+  background-position:center;
+  background-repeat:no-repeat;
+  background-color:#ffffcc;
+  display: block;
+  width: 150px;
+  height: 150px;
+  background-image: url(../designs/icons/tango/Tango/22x22/actions/media-playback-start.png);
+}
diff --git a/test/unit/tiny_mce_article_test.rb b/test/unit/tiny_mce_article_test.rb
index 65396b6..ec97428 100644
--- a/test/unit/tiny_mce_article_test.rb
+++ b/test/unit/tiny_mce_article_test.rb
@@ -49,4 +49,24 @@ class TinyMceArticleTest < Test::Unit::TestCase
     assert(article.body.is_utf8?, "%s expected to be valid UTF-8 content" % article.body.inspect)
   end
 
+  should 'fix tinymce mess with itheora comments for IE from tiny mce article body' do
+    article = TinyMceArticle.create!(:profile => profile, :name => 'article', :abstract => 'abstract', :body => "the <!--–-[if IE]--> just for ie... <!--[endif]-->")
+    assert_equal "the <!–-[if IE]> just for ie... <![endif]-–>", article.body
+  end
+
+  should 'not mess with <iframe and </iframe if it is from itheora' do
+    article = TinyMceArticle.create!(:profile => profile, :name => 'article', :abstract => 'abstract', :body => "<iframe src='http://itheora.org'></iframe>")
+    assert_equal "<iframe src=\"http://itheora.org\"></iframe>", article.body
+  end
+
+  should 'remove iframe if it is not from itheora' do
+    article = TinyMceArticle.create!(:profile => profile, :name => 'article', :abstract => 'abstract', :body => "<iframe src='anything'></iframe>")
+    assert_equal "", article.body
+  end
+
+  #TinymMCE convert config={"key":(.*)} in config={&quotkey&quot:(.*)}
+  should 'not replace &quot with &amp;quot; when adding an Archive.org video' do
+    article = TinyMceArticle.create!(:profile => profile, :name => 'article', :abstract => 'abstract', :body => "<embed flashvars='config={&quot;key&quot;:&quot;\#$b6eb72a0f2f1e29f3d4&quot;}'> </embed>")
+    assert_equal "<embed flashvars=\"config={&quot;key&quot;:&quot;\#$b6eb72a0f2f1e29f3d4&quot;}\"> </embed>", article.body
+  end
 end
diff --git a/vendor/plugins/white_list_sanitizer_unescape_before_reescape/init.rb b/vendor/plugins/white_list_sanitizer_unescape_before_reescape/init.rb
index 923fb10..e43d19e 100644
--- a/vendor/plugins/white_list_sanitizer_unescape_before_reescape/init.rb
+++ b/vendor/plugins/white_list_sanitizer_unescape_before_reescape/init.rb
@@ -5,11 +5,22 @@
 
 HTML::WhiteListSanitizer.module_eval do
   
-  def sanitize_with_filter_comments(*args, &block)
-    text = sanitize_without_filter_comments(*args, &block)
-    text.gsub(/&lt;!--/, '<!--') if text
+  def sanitize_with_filter_fixes(*args, &block)
+    text = sanitize_without_filter_fixes(*args, &block)
+    if text
+      final_text = text.gsub(/&lt;!/, '<!')
+      final_text = final_text.gsub(/<!--.*\[if IE\]-->(.*)<!--\[endif\]-->/, '<!–-[if IE]>\1<![endif]-–>') #FIX for itheora comments
+
+      if final_text =~ /iframe/
+        unless final_text =~ /<iframe(.*)src=(.*)itheora.org(.*)<\/iframe>/
+          final_text = final_text.gsub(/<iframe(.*)<\/iframe>/, '')
+        end
+      end
+      final_text = final_text.gsub(/&amp;quot;/, '&quot;') #FIX problems with archive.org
+      final_text
+    end
   end
-  alias_method_chain :sanitize, :filter_comments
+  alias_method_chain :sanitize, :filter_fixes
 
   # unescape before reescape to avoid:
   # & -> &amp; -> &amp;amp; -> &amp;amp;amp; -> &amp;amp;amp;amp; -> etc
--
libgit2 0.21.2