This module allows designated content types to be displayed as raw HTML, bypassing the website's theme. It injects an admin toolbar and contextual links for users with editing permissions, enabling them to interact with the page. Be aware that this module poses a significant security risk, as any user with permission to create or edit this content type can inject malicious code into the site.
Serves nodes of the unrestricted_page content type as the raw contents of their field_markup field, with no theme layer at all.
For users with edit permission, also injects the admin toolbar and the contextual links and tabs so that you can still normally interact with the page.
Security
The field value is emitted unescaped. Anyone who can edit an
unrestricted_page node can inject arbitrary HTML, CSS and JavaScript into the
site's own origin - which means session-stealing XSS and full defacement.
Treat the "create/edit unrestricted_page content" permissions as equivalent to `administer site configuration` and grant them only to trusted roles.
Ask your assistant about Unrestricted Page
Check compatibility with your Drupal and PHP version, maintenance and security coverage, from current release data. How it works
Depends on
Dependencies of the latest stable release
No dependencies recorded for this project.
Required by
Tracked projects that depend on this one
No tracked projects depend on this one yet.