-
☆ A M B ☆
- 2,475 Posts
I'm looking for a plugin that removes Snippet tags from content (for a specified User Group). This is just to lock down the manager and prevent users from using Snippets. E.g. imagine the horror if the clever user added a getResources tag to read unpublished posts or some other user's content.
Before I write this myself, I thought I'd at least ask the forum dudes. Anyone know of such a plugin that removes (primarily) Snippet tags from a resource's content?
Muchos Gracias.
-
MODX Staff
- 10,725 Posts
I believe modX->stripTags() can do it, though it also strips HTML tags, entities, and anything in <script> tags by default.
-
☆ A M B ☆
- 2,475 Posts
Thanks! From a security standpoint, I think it makes sense to restrict which usergroups/roles can add Snippet-tags (and Javascript) to content. Imagine the fun some clever user could have if they figured out how to use getResources to peep into parts of the site they shouldn't have access to... it might make good sense to incorporate into the access policies, no?
This is already there in NewsPublisher. It adds a custom permission called allow_modx_tags. I agree that it might make sense to have something similar in the Manager, set by default in the Administrator policy.