diff --git a/lib/redmine/wiki_formatting/common_mark/sanitization_filter.rb b/lib/redmine/wiki_formatting/common_mark/sanitization_filter.rb index 7fef35bfa..b1f1cfe01 100644 --- a/lib/redmine/wiki_formatting/common_mark/sanitization_filter.rb +++ b/lib/redmine/wiki_formatting/common_mark/sanitization_filter.rb @@ -27,6 +27,18 @@ module Redmine "a" => %w(href).freeze, }.freeze + ALLOWED_CSS_PROPERTIES = %w[ + color background-color + width + height + padding padding-left padding-right padding-top padding-bottom + margin margin-left margin-right margin-top margin-bottom + border border-left border-right border-top border-bottom border-radius border-style border-collapse border-spacing + font font-style font-variant font-weight font-stretch font-size line-height font-family + text-align + float + ].freeze + def allowlist @allowlist ||= customize_allowlist(super.deep_dup) end @@ -40,6 +52,9 @@ module Redmine allowlist[:attributes][:all].delete("name") allowlist[:attributes]["a"].push("name") + allowlist[:attributes][:all].push("style") + allowlist[:css] = { properties: ALLOWED_CSS_PROPERTIES } + # allow class on code tags (this holds the language info from fenced # code bocks and has the format language-foo) allowlist[:attributes]["code"] = %w(class) diff --git a/public/help/en/wiki_syntax_detailed_common_mark.html b/public/help/en/wiki_syntax_detailed_common_mark.html index 087fa6f05..74c1dd2ef 100644 --- a/public/help/en/wiki_syntax_detailed_common_mark.html +++ b/public/help/en/wiki_syntax_detailed_common_mark.html @@ -356,6 +356,19 @@ It can be expanded by clicking a link.
The style attribute can be used in raw HTML to apply custom formatting. The following CSS properties are allowed:
+
+ color background-color
+ width
+ height
+ padding padding-left padding-right padding-top padding-bottom
+ margin margin-left margin-right margin-top margin-bottom
+ border border-left border-right border-top border-bottom border-radius border-style border-collapse border-spacing
+ font font-style font-variant font-weight font-stretch font-size line-height font-family
+ text-align
+ float
+
+