Weave Code
Html Widget Laravel Package
friendsofvictoire/html-widget
A small Symfony bundle that adds an HTML widget to the Victoire CMS, letting editors drop raw HTML, embeds, and custom markup into any widget slot without touching templates.
At a glance
Frequently asked questions about Html Widget
- Is friendsofvictoire/html-widget a Laravel package?
- No. friendsofvictoire/html-widget is a Symfony bundle called WidgetHtmlBundle built for Victoire DCMS; it is not a Laravel package and has no Laravel service provider, Blade integration, or Eloquent models. Installing it in Laravel will not provide a working HTML widget.
- Can I install friendsofvictoire/html-widget in a Laravel application?
- Not in any meaningful way. Symfony bundles are bootstrapped through Kernel::registerBundles(), and Victoire widgets depend on Victoire's widget contracts and Twig templates, none of which Laravel package discovery loads. You would need to stand up Symfony alongside Laravel or reimplement the widget, at which point the package adds little.
- How do I install the Victoire HTML widget bundle?
- Run composer require friendsofvictoire/html-widget, then register WidgetHtmlBundle in your Symfony kernel and ensure Victoire DCMS is installed and configured. The bundle depends on Victoire's widget subsystem and Twig rendering pipeline, so it will not function as a standalone Symfony package. Read composer.json first to confirm the Symfony and PHP constraints.
- Which Symfony and PHP versions does this bundle support?
- Expect Symfony 2.8/3.x-era constraints rather than modern Symfony support. There is no adoption signal or evidence that the bundle installs on current PHP 8.x runtimes, and resolution may fail or require --ignore-platform-reqs hacks. Verify the constraint set in composer.json and test in an isolated environment before planning any use.
- How does the HTML widget render raw HTML in Victoire?
- The bundle registers an HTML widget type so editors can place raw markup into Victoire widget slots, and Victoire renders that content through its Twig pipeline. Its core behavior is unescaped editor-supplied HTML, which is a deliberate stored-XSS vector unless you add sanitization. Pair it with an allowlist sanitizer such as HTML Purifier and a restrictive CSP.
- Is the raw HTML widget safe for production?
- Only if you treat it as untrusted input and enforce sanitization, an explicit tag and attribute allowlist, and a Content Security Policy. The package has no visible security policy, disclosure channel, or release cadence, so it should not be your security boundary. Restrict use to trusted editors and review rendered output.
- How can I test the HTML widget bundle before adopting it?
- Install it in an isolated Symfony application running a Victoire version that matches the bundle's composer constraints, register the bundle, and create an HTML widget through the editor. Test dependency resolution, boot behavior on your PHP version, rendering in Victoire slots, and XSS payload handling. Because there are zero stars and zero dependents, you are the first real validation.
- What are alternatives to friendsofvictoire/html-widget for Laravel?
- For Laravel, build a small block system instead: store type and payload in a database table or JSON column, render type html through a Blade partial and a sanitizer such as mews/purifier, add an admin editor with preview, and enforce CSP. That gives you a fully owned implementation with tests in days. A maintained CMS or page-builder package may also fit if you need broader editing features.
- Does the package have active maintenance or security support?
- There is no meaningful maintenance signal: zero stars, zero dependents, no release cadence, and no documented security process. Victoire DCMS and FriendsOfVictoire have shown little activity, so assume upstream may go silent. If you are forced to use it, plan to fork, patch, and own the sanitization story yourself.
- Why should a Laravel team reject this package at triage?
- Because it is a Victoire plugin, not a reusable library, and it does not integrate with Laravel's container, Blade, or package discovery. The provenance, version-lock, and stored-XSS risks are high for a zero-adoption package. Reject it at triage unless Victoire is already in your stack, and implement the small HTML block requirement in-house.
Weaver
How can I help you explore Laravel packages today?