Server name removed from text when submitting JForm TinyMCE editor field

Question

I'm working a custom Joomla module that has a JForm with an editor field. My users use this form to edit and send some email messages to our customers. The field is prefilled by the system with some template content including an URL to another form:

At the same time <A href="https://$servername/en/tour-preferences?tid=$tour_id">please fill in this questionnaire</A>.

$servername is previously set to "myserver.com". When the user submits the form, the system retrieves the text from the editor field using the below code:

$fields = $input->get('main', array(), 'raw'); 

However if I dump all the fields I see that the "https://myserver.com" part of the text is removed from the string, so the link is broken. I checked that the link was properly prefilled into the editor field:

<a href="https://dev.gonativeguide.com/en/tour-preferences?tid=121" data-mce-href="en/tour-preferences?tid=121">please fill in this questionnaire</a>

I have no idea where this data-mce_href tag comes from. Could that cause this issue?

Previously I used the "safehtml" filter in my form definition, now I set that to "raw", but it did not help:

<field
                name="Message"
                type="editor"
                label="Message"
                rows="10"
                cols="40" 
                filter="raw"
                class="gngcontact"
            /> 

Please advise what should I do to really get the raw text from the editor field including the full url in my achor tag.

Important update: I replaced the editor field with simple textarea and the problem does not occur. So it seems to be somehow reated to the editor field type.

Many thanks!

Answer 1

I think you answered your own question, there, so I'll just chime in with some extra detail.

First, I only rarely use any of the js wysiwyg editors for precisely this sort of reason; the take away your control over the data, and substitute the judgement of someone who has no idea what you need it to do.

The data attribute you mention isn't the cause; it seems more like an effect. The idea of embedding external links in form inputs is a favorite technique of attackers, so even if its useful it's often blocked. Especially when the form field is going to be processed by javascript.

On the admin side of the site, go to Extensions->plugins and look for the tinyMCE plugin. On that page you'll see a list of terms that tinyMCE itself will filter out. System->Global Configuration, under the "Text Filters" tab there's a list of what filters are applied to what group of users on the site. Those will be applied to all editor fields even before the editor itself gets to apply its own filter. You might find that's where the server name is getting disappeared.

I think you already found your best solution, though, by making the field a textarea instead of an editor field. That way the only filters that will get applied the to data are the ones you specifically call for.

If that's not good enough for you, try selecting "No Filtering" for the user group you have filling out the field. But if you do that, be aware you're opening a fairly large crack in the security wall on your site. It may be the rest of your site will be able to defend itself against what that lets in. But it may not. Your site, your decision; but if something bad happens, you can't say I didn't warn you.

Answer 2

Thanks for all the useful guidelines above. In the meanwhile I've indeed found the solution. There is a setting for the TinyMCE plugin called "Urls". No further explanation, but default is "relative". I set this to "absolute" and this basically eliminated the problem.