spocke wrote:

paste as plain text in the paste plugin.

But how do you force a plain text paste? If user doesn't use the paste as plain text icon and uses Ctrl-V then it pastes with all the html formating. How do you force a plain text with Ctrl-V? I did not find any options related to this.

First, you need to have the paste plugin enabled.

Then, you need to add an event handler for CTRL+V. This is done in TinyMCE.prototype.handle function. Find the cases for "keyup" and "keydown", and add the following to the end (before the break. In my case it's line numer 1134):

if (e.ctrlKey && e.keyCode == 86 && e.type != "keyup") {
    tinyMCE.execInstanceCommand(e.target.editorId, "mcePasteText", true);
    tinyMCE.cancelEvent(e);
    return false;
}

This did the trick for me.

If you use the contextmenu plugin, you have to configure this as well. I did it by adding the following lines to the ContextMenu.prototype.addItem function (at line 246 for me):

if (command == "Paste") {
    onMouseDown = 'tinyMCE.execCommand(\'mcePasteText\', true);return false;';
}

In your tinyMCE.init section, you should have a line that lists the plugins you want to use. Just add paste to that list.

plugins : "[...],paste"

Hmm, did not work out for me and I made sure I was editing the correct file. Maybe IPN had better luck?

IPN: Good for you!

Muramasa: Are you sure you added the code correctly? Also, if you edited the _src file, like me, remember to set your script to call that file, not the compressed one.

Below is my code in a slightly larger context than I posted above.

case "keyup":
case "keydown":
    [...]

    if (tinyMCE.isMSIE && e.ctrlKey)
        window.setTimeout('tinyMCE.triggerNodeChange(false);', 1);

    // CTRL + V - use plugin "paste" to paste as plain text
    if (e.ctrlKey && e.keyCode == 86 && e.type != "keyup") {
        tinyMCE.execInstanceCommand(e.target.editorId, "mcePasteText", true);
        tinyMCE.cancelEvent(e);
        return false;
    }

break;

I have the same problem. It works great in IE, but in firefox it get pasted into the editor and then the paste as plain text appear .. anyone have any solutions?

Did anyone came up with a solution on how to make this work with Firefox? I have the same problem.

gshellyl wrote:

Dag, we really need this too - trying to prevent XSS problems from people pasting stuff in. 

I'm frankly surprised to not see more on this issue.  Do people basically just accept that using a WYSIWYG editor like TinyMCE will open the door to XSS problems, and just accept it?

While you could attempt to deal with this in with TinyMCE it would still be trivial for someone to muck about with the submitted data outside of the editor.  The net result is that there isn't really much point handling this with TinyMCE since you are going to have to repeat the processing on the back end anyway.

Scott

gshellyl wrote:

By "mucking about", do you mean creating your own copy of the form, with whatever (malicious) data in the field you want and submitting it to the same location, thereby getting your malicious text submitted?

I had been hoping that our JSP session security would prevent that - that a person couldn't simply submit a form without the authentication that comes with the session (and that wouldn't exist for some random form submission).  But perhaps this is a naive/false hope.

Are there additional ways to maliciously muck with submitted data outside the editor?

Various plugins allow users to change things "on the fly".  For FireFox there is FireBug, Greasemonkey, et al, for IE you can probably do something with Fiddler (see the link at the top of this very page).

Scott

This script has worked for me in both Firefox and IE.  It is the same script mentioned above but it only fires when the browser is IE.

function myHandleEvent(e) {
     if (navigator.appName == "Microsoft Internet Explorer"){
                        // CTRL + V - use plugin "paste" to paste as plain text
    if (e.ctrlKey && e.keyCode == 86 && e.type != "keyup") {
       tinyMCE.execInstanceCommand(e.target.editorId, "mcePasteText", true);
       tinyMCE.cancelEvent(e);
        return true;
    }}}

Sorry, was a translation error..... should mean: "it works like a charm" in IE :-)

But i'm hanging on the Firefox problem....

It should insert the "unformated text" by hitting CTRL+V without opening the popup window.
It works in IE ( paste_use_dialog : false, ) , but in Firefox the paste script is fired up, the text is inserted ( with format ), the popup windows open.....weird.

Last edited by Dr.Death (2006-09-20 07:37:41)

I came up with a fix for the Firefox paste problem stated above. Replace the above suggested code with this one:

                if (e.ctrlKey && e.keyCode == 86 && e.type != "keyup") {
                    if (e.preventDefault) {
                       e.preventDefault(); // DOM style
                       setTimeout('tinyMCE.execInstanceCommand(\"'+e.target.editorId+'\", \"mcePasteText\", true)',1);
                    } else {
                       tinyMCE.execInstanceCommand(e.target.editorId, "mcePasteText", true);
                       tinyMCE.cancelEvent(e);
                       return false; // IE style
                    }
                }

Now you don't get FF pasting on Ctrl V.