Textpattern CMS support forum
You are not logged in. Register | Login | Help
- Topics: Active | Unanswered
TextileRestricted
Why are we stuck with Textile Restricted for plugins? I know I can use HTML, but it’s a hassle :).
Offline
#2 2008-05-23 08:05:50
- Mary
- Sock Enthusiast
- Registered: 2004-06-27
- Posts: 6,236
Re: TextileRestricted
Complaints of XSS “vulnerability”, IIRC.
Offline
Re: TextileRestricted
Plugin authors can just write a malicious script with raw HTML help though, since JS isn’t disabled. Isn’t it more likely the plugin itself would be dangerous? “Here’s my new plugin, jmd_smile_im_stealing_your_data. Get its sister plugin jmd_db_esplode.” (Or other clever and enticing names.)
Offline
#4 2008-05-25 10:25:54
- Mary
- Sock Enthusiast
- Registered: 2004-06-27
- Posts: 6,236
Re: TextileRestricted
Yep. Didn’t make much sense to me either, especially since we’ve got the preview of both before install.
Offline
Re: TextileRestricted
The difference is, that raw HTML help is previewed as source, while Textile help is previewed as rendered markup. So, rendering Textile help with full Textile could expose your site to a malicious script before you had any chance to check its contents. Sadly, it took some time to figure this out ;-)
Offline
Re: TextileRestricted
Couldn’t you just do this for the preview?
$help_source = $textile->TextileThis($help_raw, false, false, true);
$help_source = highlight_string($help_source, true);Edit: Whoops…forgot to give some context.
Last edited by jm (2008-05-25 18:53:12)
Offline
Re: TextileRestricted
I think that the benefit of a legible help text upon preview outweighs the advantages of full Textile. But that’s certainly a matter of arguments, so what would be the real benefit of full Textile for plugin authors from your POV?
Offline
Re: TextileRestricted
For me, I just need an occasional style attribute. The admin CSS doesn’t play well with headings following tables (too little spacing). Additionally, h2. @code@ needs a smaller font-size.
Edit: When you install a plugin with raw_html (e.g., zem_contact_lang), highlight_string is used. So Textile and HTML plugin help on preview would be equivalent.
Last edited by jm (2008-05-25 19:00:50)
Offline
#9 2008-05-26 13:43:17
- Mary
- Sock Enthusiast
- Registered: 2004-06-27
- Posts: 6,236
Re: TextileRestricted
I think that the benefit of a legible help text upon preview outweighs the advantages of full Textile.
When you install a plugin with raw_html (e.g., zem_contact_lang), highlight_string is used. So Textile and HTML plugin help on preview would be equivalent.
As Jon-Michael says. The entire reason we added preview was for security reasons (to let you checkout what the plugin and help would actually be doing), not to let you read the help text before hand.
I’m not sure that “human-readable” help before install is even a benefit, since you can’t do anything with plugin settings or tags until it is installed anyway. If there’s something you should know before install, the onus has always been on the plugin developer to convey it in a different manner.
Offline
Re: TextileRestricted
Ooh! Commit spree today. Could this be considered again?
Offline
Re: TextileRestricted
Not during this commit spree (which is not over yet).
Offline
Offline