{% trans_default_domain 'security' %}
<h3>
    <span class="fas fa-list"></span>
    {% trans %}Allowed HTML settings{% endtrans %}
    {{ pageSetVar('title', 'Allowed HTML settings'|trans) }}
</h3>

<p class="alert alert-info">{% trans %}Filtering of allowed HTML occurs when a template string or variable is modified with the 'safeHtml' filter, or when a module asks for similar processing from within its functions.{% endtrans %}</p>

<form action="{{ path('zikulasecuritycentermodule_config_allowedhtml') }}" method="post" enctype="application/x-www-form-urlencoded" role="form">
    <fieldset>
        <legend>{% trans %}HTML entities{% endtrans %}</legend>

        <div class="form-group row">
            <div class="col-sm-12">
                <label>{% trans %}Translate embedded HTML entities into real characters{% endtrans %}</label>
                <div class="custom-control custom-radio custom-control-inline">
                    <input id="securitycenter_htmlentities_yes" type="radio" name="htmlentities" value="1"{% if htmlEntities == 1 %} checked="checked"{% endif %}class="custom-control-input" />
                    <label class="custom-control-label" for="securitycenter_htmlentities_yes">{% trans %}Yes{% endtrans %}</label>
                </div>
                <div class="custom-control custom-radio custom-control-inline">
                    <input id="securitycenter_htmlentities_n0" type="radio" name="htmlentities" value="0"{% if htmlEntities != 1 %} checked="checked"{% endif %}class="custom-control-input" />
                    <label class="custom-control-label" for="securitycenter_htmlentities_n0">{% trans %}No{% endtrans %}</label>
                </div>
            </div>
        </div>
    </fieldset>

    <fieldset>
        <legend>{% trans %}HTML tags{% endtrans %}</legend>

        <div class="alert alert-warning">
            {% set tags = '&lt;img&gt;, &lt;span&gt;, &lt;marquee&gt;, &lt;script&gt;, &lt;embed&gt;, &lt;object&gt; or &lt;iframe&gt;' %}
            <p>{% trans with {'%taglist%':tags|raw} %}Warning! Enabling the %taglist% tags increases the opportunity for attacks against your users that might reveal their personal information. Therefore, you are recommended to keep these tags set to 'Not allowed' unless you are sure that you really understand the consequences of enabling them.{% endtrans %}</p>
            {% if htmlPurifier %}
                {% set html_pur_link = '<a href="' ~configUrl~ '">' ~ 'HTML Purifier output filter'|trans ~ '</a>' %}
                <p>{% trans with {'%html_pur_link%': html_pur_link, '%examples%': '&lt;object&gt; and &lt;embed&gt;'|raw} %}'Warning! Using the %html_pur_link% will override settings for some HTML tags (such as %examples%).{% endtrans %}</p>
            {% endif %}
        </div>

        <table class="table table-bordered table-striped">
            <colgroup>
                <col id="cTag" />
                <col id="cNotAllowed" />
                <col id="cAllowed" />
                <col id="cAllowedWithAttributes" />
                <col id="cUsageInfo" />
            </colgroup>
            <thead>
                <tr>
                    <th id="hTag" scope="col" class="text-left">{% trans %}Tag{% endtrans %}</th>
                    <th id="hNotAllowed" scope="col" class="text-left">
                        <label for="toggle_notallowed" title="{% trans %}Check all{% endtrans %}">{% trans %}Not allowed{% endtrans %}</label>
                        <input name="radiotoggle" id="toggle_notallowed" type="radio" value="0" />
                    </th>
                    <th id="hAllowed" scope="col" class="text-left">
                        <label for="toggle_allowed" title="{% trans %}Check all{% endtrans %}">{% trans %}Allowed{% endtrans %}</label>
                        <input name="radiotoggle" id="toggle_allowed" type="radio" value="1" />
                    </th>
                    <th id="hAllowedWithAttributes" scope="col" class="text-left">
                        <label for="toggle_allowedwith" title="{% trans %}Check all{% endtrans %}">{% trans %}Allowed with attributes{% endtrans %}</label>
                        <input name="radiotoggle" id="toggle_allowedwith" type="radio" value="2" />
                    </th>
                    <th id="hUsageInfo" scope="col" class="text-left">{% trans with {'%link%':'<a href="https://www.w3schools.com">W3Schools</a>'|raw} %}Tag usage (from %link%){% endtrans %}</th>
                </tr>
            </thead>
            <tbody>
            {% for htmlTag, usageTag in htmlTags %}
                <tr>
                    <th id="hTag{{ htmlTag }}" scope="row">&lt;{{ htmlTag }}&gt;</th>
                    <td headers="hTag{{ htmlTag }} hNotAllowed">
                        <input class="notallowed_radio" type="radio" value="0" name="htmlallow{{ htmlTag }}tag"{% if currentHtmlTags[htmlTag] is not defined or currentHtmlTags[htmlTag] == 0 %} checked="checked"{% endif %} />
                    </td>
                    <td headers="hTag{{ htmlTag }} hAllowed">
                        <input class="allowed_radio" type="radio" value="1" name="htmlallow{{ htmlTag }}tag"{% if currentHtmlTags[htmlTag] is defined and currentHtmlTags[htmlTag] == 1 %} checked="checked"{% endif %} />
                    </td>
                    <td headers="hTag{{ htmlTag }} hAllowedWithAttributes">
                        <input class="allowedwith_radio" type="radio" value="2" name="htmlallow{{ htmlTag }}tag"{% if currentHtmlTags[htmlTag] is defined and currentHtmlTags[htmlTag] == 2 %} checked="checked"{% endif %} />
                    </td>
                    <td headers="hTag{{ htmlTag }} hUsageInfo">
                        {% if usageTag is not empty %}<a href="{{ usageTag }}">{% trans %}About{% endtrans %} "&lt;{{ htmlTag|raw }}&gt;"</a>{% endif %}
                    </td>
                </tr>
            {% endfor %}
            </tbody>
        </table>
    </fieldset>
    <div class="form-group row">
        <div class="col-md-9 offset-md-3">
            <button class="btn btn-success" title="{% trans %}Save{% endtrans %}"><i class="fas fa-check"></i> {% trans %}Save{% endtrans %}</button>
            <a class="btn btn-secondary" href="{{ path('zikulasecuritycentermodule_config_config') }}" title="{% trans %}Cancel{% endtrans %}"><i clas="fas fa-times"></i> {% trans %}Cancel{% endtrans %}</a>
        </div>
    </div>
</form>
{{ pageAddAsset('javascript', zasset('@ZikulaSecurityCenterModule:js/ZikulaSecurityCenterModule.Admin.AllowedHtml.js')) }}