Django cms remove href attribute from Textplugin

Question

Currently I am working with Django-CMS & trying to add below code in Text Plugin.

<a href="javascript:void(0);" id="map-world">Click me!</a>

But Django-CMS automatically removes the href attribute from text plugin and after save Text plugin has below content.

<a id="map-world">Click me!</a>

As a solution I have already tried below options which I have got from online search.

TEXT_ADDITIONAL_TAGS = ('iframe', 'div', 'a')
TEXT_ADDITIONAL_ATTRIBUTES = ('href', 'onclick')
TEXT_HTML_SANITIZE = False

but still not any solution working.

Please let me know if anyone have solution.

Thanks.

Answer 1

This is by design to prevent Cross Site Scripting attacks (XSS). If you are binding javascript to the element you can just use the # character and return false in the on click function.

Click me!