Allow span, and only allow style attrib

2017-02-27 11:32:57 +00:00 · 2017-02-27 11:32:57 +00:00 · 5fc828f24c
parent 886b0a3f13
commit 5fc828f24c
1 changed files with 2 additions and 1 deletions
--- a/src/HtmlUtils.js
+++ b/src/HtmlUtils.js
@ -92,11 +92,12 @@ var sanitizeHtmlParams = {
        // deliberately no h1/h2 to stop people shouting.
        'h3', 'h4', 'h5', 'h6', 'blockquote', 'p', 'a', 'ul', 'ol',
        'nl', 'li', 'b', 'i', 'u', 'strong', 'em', 'strike', 'code', 'hr', 'br', 'div',
-        'table', 'thead', 'caption', 'tbody', 'tr', 'th', 'td', 'pre'
+        'table', 'thead', 'caption', 'tbody', 'tr', 'th', 'td', 'pre', 'span',
    ],
    allowedAttributes: {
        // custom ones first:
        font: ['color', 'style'], // custom to matrix
+        span: ['style'],
        a: ['href', 'name', 'target', 'rel'], // remote target: custom to matrix
        // We don't currently allow img itself by default, but this
        // would make sense if we did