RichEditor script tags

Need Help
#1

I want to embed a calendly calendar in a richeditor, but the tags are removed when I save the page.

Is there a way to allow script tags in the richeditor field?

Thanks in advance!

#2

Hi @kevin-invato,

You’re right — the richeditor strips certain tags before saving and sanitizes the content again when loading.

By default, the editor removes <script> tags to prevent potential XSS attacks. While it’s generally not recommended to allow scripts directly, you can enable them by configuring the htmlRemoveTags option.

A safer alternative for something like Google Analytics is to create a custom button that prompts the user for a tracking ID (e.g. UA-000000-01) and stores it separately. You can then inject the script programmatically into the final output — this avoids XSS risks and makes the process simpler for users.

Source: Why is the script tag being removed

For embedding Calendly, probably the cleanest solution is to insert the following HTML in the richeditor:

<div class="calendly-inline-widget" data-url="https://calendly.com/your-user" style="min-width:320px;height:630px;"></div>

Then, in your layout or page file, include the necessary script:

{% put scripts %}
<script type="text/javascript" src="https://assets.calendly.com/assets/external/widget.js"></script>
{% endput %}

If you have the flexibility, using a codeeditor instead of richeditor could be another option to bypass the sanitization restrictions altogether.

2 Likes
#3

Embed as in fully interactive or just a placeholder? If later, maybe you can try snippets: Snippets - October CMS - 3.x

#4

I do sometimes variables like: {{CALENDAR}} in editors, then parse content and load scripts if necessary. Kinda not best option, but allows me to have all sorts of widgets in blogs, content etc.

#5

Yes as fully interactive, unfortunately snippets don’t allow script/code editor fields. I fixed it by splitting the html code and script code. I added a code editor field in the backend where I put the tags in the code editor field and the html code (a div element) in the richeditor field. This works fine for now.

Thanks for the reply!

#6

Thanks! My solution was almost the same, I created a code editor field in the backend where I put the script tag. Also works fine!

Thanks for the reply :slight_smile:

1 Like