Web Wiz - Green Windows Web Hosting

  New Posts New Posts RSS Feed - Allowing (some) HTML in posts
  FAQ FAQ  Forum Search   Events   Register Register  Login Login

Allowing (some) HTML in posts

 Post Reply Post Reply
Author
TonyG View Drop Down
Newbie
Newbie


Joined: 07 August 2009
Location: Extremadura
Status: Offline
Points: 5
Post Options Post Options   Thanks (0) Thanks(0)   Quote TonyG Quote  Post ReplyReply Direct Link To This Post Topic: Allowing (some) HTML in posts
    Posted: 17 August 2009 at 12:33pm
I need to allow some HTML in my forum.
Nothing really dangerous; some tables, fonts, img and little more.

I have enabled blnHTMLView in RTE_setup

This is my test post



It seems OK,

BUT when posted it looks like this



And comming back to edit I find



Bacground color has gone... and a pair of <t> have appeared.

Any ideas about this?
Thanks in advance



Back to Top
WebWiz-Bruce View Drop Down
Admin Group
Admin Group
Avatar
Web Wiz Developer

Joined: 03 September 2001
Location: Bournemouth
Status: Offline
Points: 9844
Post Options Post Options   Thanks (0) Thanks(0)   Quote WebWiz-Bruce Quote  Post ReplyReply Direct Link To This Post Posted: 17 August 2009 at 1:09pm
The forum is built as a way to discuss with other people and not as a design tool.

This means that HTML content that is not going to aid discussions and unsafe HTML is stripped from posts by the security filters.

You can edit the file functions/unsafe_HTML_tags_inc.asp to change what is stripped from posts, however you should be very careful as you would be very surprised what can be used to launch XSS Hacks against forums including quite allot of CCS that you would use for styling.
Back to Top
TonyG View Drop Down
Newbie
Newbie


Joined: 07 August 2009
Location: Extremadura
Status: Offline
Points: 5
Post Options Post Options   Thanks (0) Thanks(0)   Quote TonyG Quote  Post ReplyReply Direct Link To This Post Posted: 17 August 2009 at 2:14pm
I know you're right, and I don't  like the idea very much but many users of the old forum love using tables inside tables with backdrounds over backdrounds (all they saw in MSN groups).
I am plannig to build a new forum and WWF seems a good chioce, but if i cannot give them tables and tables (and very few other things, I promise) I would need another software.

I've changed saryUnSafeHTMLtags(108) = "bgColor" in unsafe_HTML_tags_inc and the background now works.
I hope that won't open a security hole Nuke

I'll take a look at "XSS Hacks"

Thanks for your advice
Back to Top
123Simples View Drop Down
Senior Member
Senior Member
Avatar

Joined: 08 July 2007
Location: United Kingdom
Status: Offline
Points: 1192
Post Options Post Options   Thanks (0) Thanks(0)   Quote 123Simples Quote  Post ReplyReply Direct Link To This Post Posted: 17 August 2009 at 5:54pm
Hi TonyG

Welcome to Web Wiz
As Bruce says forums are by nature a discussion tool and hence what you maybe want - I'm not sure any other forum software worth its salt, will allow you to do this. Yes I expect you can edit out unsafe tags left right and centre, but then you also risk having your forum (perhaps your site, even your server) compromised so I would suggest caution rather than whether or not a table has a pretty colour to it

However, I've seen something similar done on other forums where tables and such are used



Wink Personally I'd settle for security first, tables second
Back to Top
TonyG View Drop Down
Newbie
Newbie


Joined: 07 August 2009
Location: Extremadura
Status: Offline
Points: 5
Post Options Post Options   Thanks (0) Thanks(0)   Quote TonyG Quote  Post ReplyReply Direct Link To This Post Posted: 18 August 2009 at 2:54pm
Unfortunatelly, MrTWS, most of the posts in the forum that is currently running are something like this:



And this is what they want in the new forum.
Security? Who cares!
It's only me who have to deal with that.

Most of this "artistics" is done with table, border and background, cellspacing and cellpadding.
I don't think this these tags to be specially dangerous, but I might be wrong.
I'm planning to enable as few tags as possible in order to keep risk at an acceptable level.

The "old" forum has been running since 2005 with few problems using tables inside tables inside tables with classes that don't exist, div's, p's, font's...
Maybe we have been lucky all this time.

Ah! I almost forget. Another thing they love is playing music. Bgsound is their favourite (I hate it).

It's not my choice, it's only my work.

I understand you both. I hope you understand me.



Back to Top
WebWiz-Bruce View Drop Down
Admin Group
Admin Group
Avatar
Web Wiz Developer

Joined: 03 September 2001
Location: Bournemouth
Status: Offline
Points: 9844
Post Options Post Options   Thanks (0) Thanks(0)   Quote WebWiz-Bruce Quote  Post ReplyReply Direct Link To This Post Posted: 18 August 2009 at 4:22pm
If you are not concerned about security then you can remove as much as you like from the unsafe HTML file which should allow everything you want.

However you should certainly leave in things like Script, JavaScript, VbScript, and IFrame as these are the most common things XXS Hackers will use.
Back to Top
TonyG View Drop Down
Newbie
Newbie


Joined: 07 August 2009
Location: Extremadura
Status: Offline
Points: 5
Post Options Post Options   Thanks (0) Thanks(0)   Quote TonyG Quote  Post ReplyReply Direct Link To This Post Posted: 18 August 2009 at 9:00pm
Thanks to both of you for your advice.
I'll be as careful as possible. I promise Wink
Back to Top
123Simples View Drop Down
Senior Member
Senior Member
Avatar

Joined: 08 July 2007
Location: United Kingdom
Status: Offline
Points: 1192
Post Options Post Options   Thanks (0) Thanks(0)   Quote 123Simples Quote  Post ReplyReply Direct Link To This Post Posted: 19 August 2009 at 6:36pm
Good luck Tony
Back to Top
 Post Reply Post Reply

Forum Jump Forum Permissions View Drop Down

Forum Software by Web Wiz Forums® version 12.08
Copyright ©2001-2026 Web Wiz Ltd.


Become a Fan on Facebook Follow us on X Connect with us on LinkedIn Web Wiz Blogs
About Web Wiz | Contact Web Wiz | Terms & Conditions | Cookies | Privacy Notice

Web Wiz is the trading name of Web Wiz Ltd. Company registration No. 05977755. Registered in England and Wales.
Registered office: Web Wiz Ltd, Unit 18, The Glenmore Centre, Fancy Road, Poole, Dorset, BH12 4FB, UK.

Prices exclude VAT at 20% unless otherwise stated. VAT No. GB988999105 - $, € prices shown as a guideline only.

Copyright ©2001-2026 Web Wiz Ltd. All rights reserved.