Who is this article for?

All Ideagen Quality Management Users with access to the site.

Ideagen Quality Management site access is needed.

---

We’ve been making security improvements to enable more customers to utilize our hosted platform starting with the 2020.17.0.0 Release. Those improvements required some changes to the allowance of webpage code rendering in user-generated output across the Ideagen Quality Management application. As of 2021.33.0.0, no webpage code rendering is allowed in user-generated output, with a couple exceptions we’ll discuss below.

Based on the value expressed for formatting via styling tags in some product areas, the ability to render tags used for styling deemed safe has been maintained in the following areas: Custom Field Titles, Custom Field Descriptions, Subform Column Headings, Email Action Editor (Design), Email Reminder Editor (Design), Training Descriptions, Test Intros, Test Questions, Test Answers, Workflow HTML Headers and Footers, and HTML Documents (including HTML Headers and Footers). We are continuing to implement security improvements and plan to continue to allow rendering of HTML in Ideagen Quality Management HTML Documents.

This implementation still increases the security of those outputs. The following tags and attributes are allowed in the product areas listed above:

Allowed HTML Tags:

a, abbr, acronym, address, area, article, aside, b, bdi, big, blockquote, br, button, caption, center, cite, code, col, colgroup, data, datalist, dd, del, details, dfn, dir, div, dl, dt, em, fieldset, figcaption, figure, font, footer, form, h1, h2, h3, h4, h5, h6, header, hr, i, iframe, img, input, ins, kbd, keygen, label, legend, li, main, map, mark, menu, menuitem, meter, nav, ol, optgroup, option, output, p, pre, progress, q, rp, rt, ruby, s, samp, section, select, small, span, strike, strong, sub, summary, sup, table, tbody, td, textarea, tfoot, th, thead, time, tr, tt, u, ul, var, wbr

In addition to the tags above, the style tag is allowed in HTML document content only.

Allowed HTML Attributes:

abbr, accept, accept-charset, accesskey, action, align, alt, autocomplete, autosave, axis, bgcolor, border, cellpadding, cellspacing, challenge, char, charoff, charset, checked, cite, clear, color, cols, colspan, compact, contenteditable, coords, datetime, dir, disabled, draggable, dropzone, enctype, for, frame, headers, height, high, href, hreflang, hspace, ismap, keytype, label, lang, list, longdesc, low, max, maxlength, media, method, min, multiple, name, nohref, noshade, novalidate, nowrap, open, optimum, pattern, placeholder, prompt, pubdate, radiogroup, readonly, rel, required, rev, reversed, rows, rowspan, rules, scope, selected, shape, size, span, spellcheck, src, start, step, style, summary, tabindex, target, title, type, usemap, valign, value, vspace, width, wrap

Allowed CSS Properties:

background, background-attachment, background-clip, background-color, background-image, background-origin, background-position, background-repeat, background-repeat-x, background-repeat-y, background-size, border, border-bottom, border-bottom-color, border-bottom-left-radius, border-bottom-right-radius, border-bottom-style, border-bottom-width, border-collapse, border-color, border-image, border-image-outset, border-image-repeat, border-image-slice, border-image-source, border-image-width, border-left, border-left-color, border-left-style, border-left-width, border-radius, border-right, border-right-color, border-right-style, border-right-width, border-spacing, border-style, border-top, border-top-color, border-top-left-radius, border-top-right-radius, border-top-style, border-top-width, border-width, bottom, caption-side, clear, clip, color, content, counter-increment, counter-reset, cursor, direction, display, empty-cells, float, font, font-family, font-feature-settings, font-kerning, font-language-override, font-size, font-size-adjust, font-stretch, font-style, font-synthesis, font-variant, font-variant-alternates, font-variant-caps, font-variant-east-asian, font-variant-ligatures, font-variant-numeric, font-variant-position, font-weight, height, left, letter-spacing, line-height, list-style, list-style-image, list-style-position, list-style-type, margin, margin-bottom, margin-left, margin-right, margin-top, max-height, max-width, min-height, min-width, opacity, orphans, outline, outline-color, outline-offset, outline-style, outline-width, overflow, overflow-wrap, overflow-x, overflow-y, padding, padding-bottom, padding-left, padding-right, padding-top, page-break-after, page-break-before, page-break-inside, quotes, right, table-layout, text-align, text-decoration, text-decoration-color, text-decoration-line, text-decoration-skip, text-decoration-style, text-indent, text-transform, top, unicode-bidi, vertical-align, visibility, white-space, widows, width, word-spacing, z-index

The Custom Field Custom Script feature has been removed as of 2021.18.0.0.

Keep an eye out on Release Notes to stay updated on these future changes to the allowance of webpage code in Ideagen Quality Management as we continue to improve the security measures in the product!

---

Further Reading

This section will provide important links to further troubleshooting and resources. 

1. Aha! Defect - Recent defect found regarding the <div> tag.