Prevent disabling htmlawed

[mrclay]

Even with warnings, Elgg site admins simply do not consider how dangerous disabling htmlawed is, and I've seen other plugins and their docs mention "Oh, just turn htmlawed off then do this... and remember to turn it back on again!"

There should be one way to replace/disable its functionality: adding a plugin with a handler that bypasses it.

I see a couple BC options:

1. Make a manifest option that prevents it from being disabled.
2. Moved the plugin into libs while leaving its plugin hooks unchanged.

[brettp]

If we make it un-disable-able, the naughty plugins devs will update their docs to say "Delete mod/htmlawed." If we pull it into core they'll update their docs to say "Edit engine/lib/htmlawed.php and delete lines 10-700."

I don't think there's a good solution here. We can't FORCE admins to make the right choices any more than we can force 3rd party plugin devs to stop writing bad plugins. Ultimately it's up to the admin to know how to administer the site.

[mrclay]

Ugh. Agreed.

[ewinslow]

Btw, get_input has a third parameter that allows you to bypass the filter, so I think this is actually a worksforme issue.