Prevent special characters in online content editor

Question

We are on Sitecore 7.5 and recently discovered that when a content editor copies and pastes some content from other documents using Sitecore in-page editor, some special characters make it into the saved content (e.g. &#x3). This leads to weird symbols appearing in some user browsers and is a big deal for some industry regulated websites.

Is there a way to force Sitecore to sanitize user inputed content? It's not reliable to count on content editors to remember to copy&paste content through Notepad all the time.

Thanks.

Answer 1

It possible to extend the Telerik RTE control in Sitecore to automatically strip certain formatting, such as MS Word, or to even strip all formatting.

To extend Sitecore’s configuration of the Telerik controls, create the following class:

using Sitecore.Data.Items;
using Telerik.Web.UI; 

namespace MyProject.CMS.Custom.Controls
{
    public class RteConfiguration : Sitecore.Shell.Controls.RichTextEditor.EditorConfiguration
    {
        public RteConfiguration(Item profile) : base(profile)
        {
        }

        protected override void SetupFilters()
        {
            base.SetupFilters();
            Editor.DisableFilter(EditorFilters.ConvertToXhtml);
            Editor.EnableFilter(EditorFilters.IndentHTMLContent);
            Editor.StripFormattingOptions = EditorStripFormattingOptions.MSWordRemoveAll
                                            | EditorStripFormattingOptions.ConvertWordLists
                                            | EditorStripFormattingOptions.Css
                                            | EditorStripFormattingOptions.Font
                                            | EditorStripFormattingOptions.Span;
        }
    }
}

And then patch the following to override the default configuration:

<settings>
  <setting name="HtmlEditor.DefaultConfigurationType">
    <patch:attribute name="value">MyProject.CMS.Custom.Controls.RteConfiguration, MyProject.CMS.Custom</patch:attribute>
  </setting>
</settings>

NOTE: If your HTML Editor Profile specifies Configuration Type directly then you will need to either remove it so that it uses default specified in config or update the Type setting in the item itself.

You can read more about details in this blog post which I previously wrote: Updating Sitecore Telerik RTE to disable XHTML and strip MS-Word Formatting on Paste

The down side is that your Content Editor must use the Rich Text Editor in order for these configurations to take effect, pasting directly in the Experience Editor may still lead to the previous behaviour. You may wish to investigate using the Sitecore Sweep Module instead which will allow you target all or specific fields via a pipeline on save.

Answer 2

With sitecore 7.5 version in the Rich Text Editor they have introduced some buttons like below which should take care of the above issue.

While copying the text from Word document for example you can select the copied text and then try to select one of these options. It should stripe out bad characters and extra styles added by word.

buttons 4 through 8 are important once.

Buttons from left to right are below:

1) Cut

2) Copy

3) Paste

4) Paste from word

5) Paste from work stripe font

6) Paste plain text

7) Paste as HTML

8) is this screenshot

That should take care of the issue.