@ tibor.pacalat : same than some other feature request.
Have a prospect, if quote is OK : I take it.

The alternative is to create a plugin, but

1. I think it can be interesting for all
2. Less difficult to integrate in core (less code)
3. Integrate in core allow update GUI settings

From Carsten:
I don't think it should be implemented that way, but instead a user permission should be created for this.

From global settings to User Permission ?
Leaving global settings for the default value ?

BUT we still have the same issue for superadmin !

Better name for option : filterxsshtml_forcedall maybe ?
Still compatible needed if we allow Permission, but then permission are not needed (must be hidden/disable for UX)

@c_schmitz

I don't think it should be implemented that way, but instead a user permission should be created for this.

This is another issue.

Here the desired behavior is Nobody can add script tag even superadmin.

Since superadmin have all permission : adding a new permission didn'(t fix the issue.

Proposition :

1. filterxsshtml_forcedall by config.php only : if it's true : superamin have their content filters for XSS like simple user. The settings can not be disabled in settings and a differe,t text is shown
2. disablescriptwithxss have same usage than today and can be enabled/disabled by superamdin but
3. enablescriptwithxss_superadmin can be added but obnly via config.php

OK,
I have the solution to do by plugin only if you don't want it