Re: [sfWiki-devel] wiki.jos.org

[Iain S. <iai...@ya...>]

At 12:56 AM 4/1/2001 -0500, Todd L. Miller wrote:
>         Should be ready to rumble, except for the high-speed edit refusal
>stuff.  I've modified the WikiRenderer to replace <script> tags with
>&lt;script&gt;, so as to prevent 'malicous' (sp?) HTML.  (If there's other
>stuff that should be disallowed, or if only certain tags should be
>allowed, please weight in.)  I haven't re-imported the files from
>metamech, pending a review. :)

Cool.  It looks great.  Let's polish up the look and feel (as per the other 
email I just sent).  I was also wondering if we shouldn't go the other way 
when it comes to allowing HTML.  Unless the HTML is explicitly allowed, its 
filtered out (the brackets turned to &lt; and &gt;).  Then we can create a 
list of allowed html that we're pretty sure is safe and not have to worry 
if we missed adding something crucial.

So, table, font, etc may be allowed.  It's a little more work as we'll have 
to create a list for the parser to parse, but also gives is better 
control/security.  And we can start with a really small list, and slowly 
add tags when people complain (and they can justify why its needed and 
safe).  I prefer this approach because its safer, and will hopefully 
encourage people to use wiki tags instead of html (there should be no 
reason to need bold tag support for example because wiki tags support this).

my 2cents at least

-iain