Enhanced Text is saved as a format in the widget.
However, the HTML format is not saved.
How do I set up the HTML format so it will be saved?
This widget used on these forums permits all 4 formats to be saved, and our widget won't save the HTML format. Is there a parameter I should change?
We are looking for someone we can pay to get this to work, this is why we are looking at solutions.
Does anyone know if this is a quick fix?
Is the code already there to save in HTML?
Thanks in advance.
We can save HTML fragments with the format "Enhanced Text" from the pull down box at the bottom of the HTML area box.
As a site admin, where do I add the tags to the list of permitted tags?
Is that within the acs-templating package?
Here is the list from the 5.2 branch for review:
A ADDRESS B BLOCKQUOTE BR CODE DIV DD DL DT EM FONT HR I LI OL P PRE SPAN STRIKE STRONG SUB SUP TABLE TBODY TD TR TT U UL EMAIL FIRST_NAMES LAST_NAME GROUP_NAME H1 H2 H3 H4 H5 H6
align alt border cellpadding cellspacing color face height href hspace id name size src style target title valign vspace width
Here is an updated list from one of the more conservative OpenACS servers I run:
a abbr acronym address b big blockquote br caption cite code col colgroup del dfn div dd dl dt em font h1 h2 h3 h4 h5 h6 hr i li ins ol p pre q s samp span strike strong sub sup table tbody td tfoot th thead tr tt u ul var EMAIL FIRST_NAME LAST_NAME GROUP_NAME
abbr align alt axis bgcolor border cellpadding cellspacing char charoff charset cite class classid clear color colspan datetime dir face frame headers height href hreflang hspace id longdesc name rel rev rowspan rules scope size src style target title type valign vspace width
Anyone see any problems with these two lists? Any additions? We should update these before the next release imho.
i have not looked at the attributes in detail.
we should allow tags from html 4.01 excluding these
- programmatical elements (forms, form elements, applet, object, map, script/noscript),
- head elements (link, title, meta, ...),
- A and
- but as well the STYLE attribute.
The XSS page lists e.g.
<DIV STYLE="width: expression(alert('XSS'));">
which are dangerous for some browsers.
So, the STYLE attribute is dangerous and should be handled with care (e.g. not in the default configuration).
here is a slightly completed and sorted list of HTML 4.01 elements:
abbr acronym address b big blockquote br caption cite code col
colgroup dd del dfn div dl dt em fieldset font h1 h2 h3 h4 h5 h6 hr i
ins kbd legend li ol p pre q s samp small span strike strong sub sup
table tbody td tfoot th thead tr tt u ul var
i am not sure if we should allow the ms office tags in the web pages, since these will cause errors on HTML conformance tests.
In general, we should distinguish between public content (so special rights are required to provide HTML content) like in a public forum, where a conservative policy is required, and somewhat trusted and known content developers, where a more liberal policy can be used.
For the general user i would ask myself, why do we want to allow e.g. CLASS, STYLE or ID, what do we gain by doing so. The general policy should stay conservative.
For a site administrator editing the home page, we most likely need to allow any HTML, but for a regular user posting a forum message, we would need to be more conservative.
One thing I tried was to just skip HTML security for site-wide admins, which solves the problem for the simplest sites.
I found them now.
Is it possible to specify different allowed tags for different packages?
For example, we want the default tags for Forum posts.