Welcome to Geeklog, Anonymous Saturday, September 07 2024 @ 09:44 pm EDT
Geeklog Forums
Allowable html with GL1.3.7SR3?
Status: offline
rv8
Forum User
Regular Poster
Registered: 10/10/02
Posts: 105
Location:Ottawa, Canada
I upgraded from GL 1.3.7SR2 to 1.3.7SR3 and note that many html tags are not allowed to have any attributes by default. Is this because the other attributes may offer security risks, or is it simply because the developers were trying to get the most needed functionality released as soon as possible?
Is there a risk to allowing the <hr> tag to have attributes of ALIGN, WIDTH and SIZE? Is there a problem with allowing the <BR> tag to have a CLEAR attribute?
How can we know which attributes are acceptable for users and for admin?
Thanks,
Kevin Horton
Is there a risk to allowing the <hr> tag to have attributes of ALIGN, WIDTH and SIZE? Is there a problem with allowing the <BR> tag to have a CLEAR attribute?
How can we know which attributes are acceptable for users and for admin?
Thanks,
Kevin Horton
4
6
Quote
Status: offline
destr0yr
Forum User
Full Member
Registered: 07/06/02
Posts: 324
Also in the GL 1.3.8-1sr1 in the lib-common.php, the COM_allowedHTML is listed as COM_COM_allowedHTML. (Or are the sugar cubes I'm eating finally getting to me?
) I made a comment on the main page about this.
-- destr0yr
"I love deadlines. I like the whooshing sound they make as they fly by." -- Douglas Adams
![Eek!](images/smilies/eek.gif)
-- destr0yr
"I love deadlines. I like the whooshing sound they make as they fly by." -- Douglas Adams
6
5
Quote
Status: offline
Dirk
Site Admin
Admin
Registered: 01/12/02
Posts: 13073
Location:Stuttgart, Germany
Quote by rv8: Is this because the other attributes may offer security risks, or is it simply because the developers were trying to get the most needed functionality released as soon as possible?
The latter.
Attributes like those for alignment or size don't pose any risks. You should avoid the style attribute and probably also the id and class attributes. Attributes typically used for Javascripts etc. (like onmouseover) are also to be avoided.
The current set is a bit conservative - maybe too conservative for some sites. I'd guess that we'll find a better standard set over time.
bye, Dirk
7
7
Quote
All times are EDT. The time is now 09:44 pm.
- Normal Topic
- Sticky Topic
- Locked Topic
- New Post
- Sticky Topic W/ New Post
- Locked Topic W/ New Post
- View Anonymous Posts
- Able to post
- Filtered HTML Allowed
- Censored Content