Forum OpenACS Development: my workspace enhanced

Collapse
Posted by Ben Koot on
Hi folks, I realize under dotLRN the workspace already changed, but since the current acs4.6 still displays the confusing version, I have been working on a simple enhancement. Here's a sample in Dutch. All this can be build if the existing bio section would have the same functionality as the /page module I used to create this version. If you try to add html to the bios it tell's you security reasons prohibit the use of html tags. I understand there are reasons for that, but beeing a newbie don't see the risks, it would help to have an explanation.

1. Why can I not add html tags to a personal profile.
2. Is it possible to embed the /page module into a profile without causing security problems.
3. Incase I wan't to ignore a possible security issue, how can I change the bio source so it will allow me to add the html code?

Personaly I feel it's a matter of choice for the site administrator if adding html might cause privacy problems. The same isseu occurs in other modules aswell. Maybe it makes sense to offer an option. The default workspace at this moment doesn't realy add much value to the user experience. The average "üser" expects to be able to do something on his personal workspace.

You may notice in my example I offer a customizable top portion, and the default workspace section, although with some additonal features, refering to settings sometimes require inteference of a site administrator.

An additional benefit of this approach is that it allows a user to crate a customized page using both acs 3.25 and acs 4.6 functionality, without digging into the source. Thanks
Ben

Collapse
Posted by Ben Koot on
Sorry, I was referring to this example
Collapse
Posted by Ben Koot on
Just noticed I asked the question before .  Take a look  at the anitspam section of the ACS Kernel parameters. Add
the tags and/or attributes you'd like to use on your site and you'll be good to go. No coding required!

Thanks Bart

Collapse
Posted by Jade Rubick on
The problem I see with allowing HTML is that you're opening up your server to being hacked. A person who can embed HTML in their messages can take over your server, or do things with the privileges of other users.

You can get around this, but it is tricky. The ideal solution, I think, is using something like:

http://www.aaronsw.com/2002/atx/intro

or a Wiki-style markup instead of HTML

Collapse
Posted by Ben Koot on
Jade, interesting thought. The Wiki route I mean. It seems Wiki is becoming more and more of interest. https://openacs.org/forums/message-view?message_id=90469
Collapse
Posted by Ben Koot on