Folks,<div><br></div><div>Why this post to this list? I have plenty of issues and help requests out in various places... I thought this list would be the best place to share my overall process and problems and hopefully hear yours.</div>
<div><br></div><div>I use the <a href="http://drupal.org/project/wysiwyg">Wysiwyg Api module</a> because it is the most "Drupally" and seems to make the most sense in the long run. It already has wide acceptance being installed on 130K sites.</div>
<div><br></div><div>My clients require a full featured WYSIWYG like CKeditor or TinyMCE.</div><div><br></div><div>The easiest set up is simply to assign a wysiwyg profile and use Drupal's "Full HTML" "Input format" (D6)/"Text format" (D7).</div>
<div><br></div><div>That approach is <b>unacceptable</b> for the following reasons:</div><div><br></div><div><ol><li>It's not secure</li><li>Content creators/editors can easily destroy the site design</li></ol><div>Using Drupal core's "HTML Filter" is equally unacceptable because it <b>doesn't allow html attributes to be added</b>, which is necessary for the chosen wysiwyg to deliver functionality.</div>
</div><div><br></div><div>The solution is to use one of the following three modules:</div><div><ol><li><a href="http://drupal.org/project/wysiwyg_filter">wysiwyg_filter</a> (D7 version currently at <a href="http://drupal.org/sandbox/axel.rutz/1105784">http://drupal.org/sandbox/axel.rutz/1105784</a> until module takeover process is completed)</li>
<li><a href="http://drupal.org/project/htmlpurifier">htmlpurifier</a></li><li><a href="http://drupal.org/project/htmLawed">htmLawed</a></li></ol><div>I'm using wysiwyg_filter. It's D6 version is stable and good. However the maintainer disappeared. @axel.rutz has done great work on D7; he <a href="http://drupal.org/node/1105850">has filed an issue to take over the project</a>. I'm assuming that will be successful.</div>
</div><div><br></div><div><b>Teaser break plug-in broken in wysiwyg module</b>.</div><div><br></div><div><a href="http://drupal.org/node/510552">This issue has been open since, July, 2009</a>, kind of scary. I somewhat overstated the issue in my bolding above, which is why, possibly, this issue hasn't been solved yet, in addition to the significant technical challenges. What happens with the teaser break plug-in turned on is that self-closing tags like <br> and <img> are closed like ">" and not the XHTML way, "/>". For folks not using wysiwyg_filter, htmlpurifier or htmLawed, the upshot is code that doesn't validate for XHTML, not a huge deal (depending on your personality <img src="cid:330@goomoji.gmail" style="margin-top: 0px; margin-right: 0.2ex; margin-bottom: 0px; margin-left: 0.2ex; vertical-align: middle; " goomoji="330">). However, for anyone using one of those html filter modules, any improperly closed self-closing tag gets stripped away, making a fix absolutely imperative. There is a working patch at: <a href="http://drupal.org/node/510552#comment-3879096">http://drupal.org/node/510552#comment-3879096</a>. Note that patch only solves the problem for the latest version of CKeditor and not TinyMCE. The maintainers of wysiwyg have not committed the patch because they are trying to address the problem in a better way. But in the meantime, new Drupal users who may have a hard time finding that patch are going to be quite frustrated.</div>
<div><br></div><div>To sum up so far:</div><div><br></div><div><ol><li>If you care about security and/or site design, an html filter is key. It can't be the one that comes with Drupal.</li><li>I have found the patch to fix the teaser break problem in wysiwyg and I've switched from TinyMCE to CKeditor because the patch works with the latter only.</li>
</ol><div><b>However: getting the Wysiwyg to actually be: "what you see is what you get" (or anything close to it), I have found impossible.</b></div></div><div><b><br></b></div><div>Because Drupal's "input filters" are actually "output" filters the end user will see in the editor formatting that will be stripped by the html filter when the page is rendered. This is a huge usability issue. Careful selection of "buttons and plug-ins" in the editor configuration as well as current "Paste to Word" plug-ins for CKEditor and TinyMCE go a bit of the way in addressing these issues. But there are still many ways in which code that will be filtered can get into your editing box and display formatting to the user that will be filtered when the page is displayed.</div>
<div><br></div><div><i><font class="Apple-style-span" color="#3333ff">I've looked for a CKEditor plug-in that would essentially do what wysiwyg_filter does on the output for the editor on the input. I have not found one. Have you?</font></i></div>
<div><br></div><div><i>My guess is that most of the 130K users of the wysiwyg module get frustrated and simply take their chances with "Full HTML" and try to solve both security and site design problems via educating the client (re site design) and good site monitoring and backup (to, sort of, address security issues).</i></div>
<div><br></div><div>Am I missing something?</div><div><br></div><div>I really want to hear from you on what you do.</div><div><br></div><div>Thanks,</div><div><br></div><div>Shai</div><div><br></div><div><br></div><div><br>
</div>