In Security.php
“style” is considered an evil attribute (line 581). So, if you want to turn global xss filter on and using WYSIWYG editor, you know what to do.

I mean, inherit and customize.

hyperfire - 22 July 2011 04:14 AM

Is this really a CI 2.02 bug? Just lost a whole hour trying to figure out what’s wrong with the ckeditor aligment.
Disabling global XSS on config worked.
Is there a way to disable global for this specific field? Or any other workaround available?

Btw, Sudhakar@CI, implement ckeditor on CI is a breeze. Have you checked the forum?
http://codeigniter.com/forums/viewthread/127374/
Or even CI wiki?

Can anyone share some toughts on this issue? I need to save html on this project. Disabling styles on POST is the reason why my client clients are goin bananas and disable global XSS is not an option as well.

Thanks.

Just checked another post (http://codeigniter.com/forums/viewthread/191399/#903478) where bubbafoley suggested:

$config['global_xss_filtering'] = TRUE; 

and then

$username = $this->input->post('username'); // filtered
$password = $this->input->post('password', FALSE); // unfiltered 

But this does not work. Anyone?

Yes, that doesn’t work (I think it should be work, otherwise the False parameter is useless). So I simply remove the ‘style’ in system/core/security/_remove_evil_attributes

please help me.

When you set global_xss_filtering on TRUE, it will filter all post variables already at the start of the application. Before you even had the chance to call $this->input->post(). So sending a TRUE or FALSE in this post method has no use as long as you keep the global_xss_filtering on TRUE:

You can always check my solution:
http://codeigniter.com/forums/viewthread/186100/#919438

I’ve obtained identical problem, any fix for this?

I ended up doing this:

* turned global xss filtering off in the config file
* added it back in on every post value in my validation functions

* for the ones that required the style tag, didn’t xss filter those post values only

1. In such case it’s also a bug, because it does sometimes a very ugly job, even breaking the html.
2. Such a new feature SHOULD be mentioned in the change log.

solution to this, let

and inputs that need to be safe place like this: