#1321 Border table issue by using HTML editor in the notification template

[FCELLI]

By using the HTML editor, I'm not able to apply border on the table in the body of the notification template.

To reproduce :

• Click on Notifications from the menu Admin Tools
• Create a new Trigger of type 'when log is updated' related to the class UserRequest
• Create a new action related to the Trigger that you have just created.
• Fill the properties of this action and insert a table with a border in the Body.
• Create the action.
• The table is inserted without the selected border.

[Vincent @ Combodo]

This behavior is expected as you can see here: https://wiki.openitop.org/doku.php?id=2_3_0:admin:rich_text_limitations&s[]=tags#styles_white-list
The table tag ONLY supports attributes "style", "width", not "border"

[Romain Quetiez]

Unfortunately, the HTML editor embedded into iTop (aka CKEditor) produces a markup that is further excluded by the HTML sanitizer.

The bug can be produced with either the notification templates or notes (document).

A dirty workaround is to disable HTML sanitization, which opens the door to XSS injection. To do so, edit the configuration and add the entry:

'html_sanitizer' => 'HTMLNullSanitizer',

Fix implemented in trunk as [r4376] and retrofitted into branch/2.3 as [r4377].

The white list has been enlarged... requires an update of the documentation!