Skip to the main content

Text that people type, and what the modules do with it

Several Webal modules show text that somebody typed or saved: the text of an accordion item, an article, a Custom HTML module placed in a module position, a footer column, a mega menu column. This page says what the modules do to keep that text safe, and the one thing you may notice.

The short version

  • Text that is typed into a Webal module (an item, a column, a description) is rebuilt from a short list of allowed tags every time the page is built. Only paragraphs, line breaks, bold, italic, lists, links and a language span get through. Nothing else can be added, whatever is stored in the database.
  • Articles and other modules' output (an article shown by the Accordion, a Custom HTML module placed in a Webal module's position) keep all their formatting, pictures and tables. Webal removes only one thing from them: the attributes that make the page run code of its own (see below).
  • Nothing you write changes when you save it. The clean-up happens when the page is built, so a text you saved last year is checked the same way as a text you saved today.

The one thing you may notice: Alpine attributes

Webal Blocks uses a small script library (Alpine.js) for its own behaviour. That library reads special attributes in the page (they start with x-, @ or :, for example x-init, x-bind and x-data). Joomla's own text filter does not remove all of them, so a person with a low-level account (an Author, say) could save an article containing one and the script would run on the page when somebody opened it. Webal Blocks closes that gap in two places:

  1. On the server. Wherever a Webal module prints an article, a Custom HTML module or other stored text, every attribute that starts with x-, @ or : is renamed. For example x-init="..." becomes data-wbl-blocked-x-init="...". The renamed attribute does nothing. The rest of your text is not touched.
  2. In the browser. Before the script library reads an element it removes every x-, @ and : attribute except the two that Webal itself prints (x-data="wblSomething" and x-intersect). This also covers Joomla's own article text and any other module on the page, not only Webal's.

What this means for you:

  • Nothing changes for normal pages. Articles, tables, pictures, videos and links look and work as before.
  • Your own Alpine code will not run on a page that loads Webal Blocks' scripts. If you wrote x-data="{ open: false }" into an article or a module on purpose, it is removed. Webal Blocks does not offer a way to switch this off, because a switch would put the gap back. Use plain HTML (<details> and <summary> do most of what people reach for a script to do) or a script file that is part of your template.
  • If you see data-wbl-blocked-x-... in a page source, somebody saved an Alpine attribute in that text. It is harmless and can be removed from the text.

SVG pictures in your images folder

A picture that is an .svg file is checked before a Webal module draws it as an image, because a hand-made drawing can be built to freeze a visitor's browser tab. If the check fails, the picture is simply not shown. This covers every Webal module that shows a picture, the template logo and menu item pictures in the Webal menus, and the picture on the Webal contact page. Pictures that you upload through the Webal logo field, or save in the Media Manager and that are ordinary drawings, pass without you noticing.

  • Replaced a file by hand? If you replace an SVG straight in the file system (FTP, a file manager) after the page or module was drawn and cached, the cached page still points at that file name, so the new file is drawn without being checked until the cache is refreshed. Clear the cache after replacing files by hand (System, Clear Cache, and the Webal Blocks Clear cache tool).