> Linly, how do they manage security on something like this? If you can > insert any html code on any writeable page you would have severe XSS > problems...
Yes, TiddlyWiki is a local-side wiki, it uses javascript to write data into file only from PC file system like "c:\" or "D:\". If a TiddlyWiki file, yes TiddlyWiki is a single file wiki, has been put onto a web server, it become a read-only file. No one can change it via "http://"; method. The TiddlyWiki user always write their wiki offline and upload it via ftp or other special php uploader. > You can do something similar on BoltWire, just with a twist. First > copy your html code to a page like code.embed.flickr and then in your > wiki, anywhere, put <embed flickr> and it should work. I think this is > more secure because you can control who can edit, and even read all or > specific code.embed pages. Whereas I'm not sure how to make an html > markup like you suggest secure... Yes this is more secure, but difficult as will... :) > There's ways no doubt to do it. Drupal had something similar, but it > involved setting different levels of edit permissions based on user > status. I don't think I want to go down that path, as it would involve > a major reorganization of how the whole system works in BoltWire. It > might be worth thinking about some more, but I have my reservations... No I don't like the "reorganization" idea either. But how about put the <html></html> as a config item, site admin can choose to open or close the function? or limit it can be used in some certain groups? Cheers, linly > On Wed, Jan 28, 2009 at 11:41 PM, Linly <[email protected]> wrote: > > > Hi Dan, > > > While using TiddlyWiki, I've found there is a wiki syntax <html></ > > html> very useful. The syntax allowed user putting html code directly > > into wiki pages and displayed it as is. > > > Sometimes if I want to embed some html code from Flickr or Google Maps > > into wiki page, it would be easy to just copy and paste like this: > > > <html> > > <iframe width="425" height="350" frameborder="0" scrolling="no" > > marginheight="0" marginwidth="0" src="http://maps.google.com/maps? > > f=q&source=s_q&hl=zh- > > TW&geocode=&q=washington&sll=25.091075,121.559834&sspn=0.304706,0.564423&gl=tw&g=Taipei&ie=UTF8&ll=38.900385,-77.019825&spn=0.016367,0.035276&t=k&z=14&brcurrent=3,0x346ef3065c07572f: > > 0xe711f004bf9c5469&output=embed&s=AARTsJrSNCFJskwmMdDKr_R1Rr- > > nQOuxEA"></iframe><br /><small><a href="http://maps.google.com/maps? > > f=q&source=embed&hl=zh- > > TW&geocode=&q=washington&sll=25.091075,121.559834&sspn=0.304706,0.564423&gl=tw&g=Taipei&ie=UTF8&ll=38.900385,-77.019825&spn=0.016367,0.035276&t=k&z=14&brcurrent=3,0x346ef3065c07572f: > > 0xe711f004bf9c5469" style="color:#0000FF;text-align:left">Bigger Map</ > > a></small> > > </html> > > > Cheers, > > linly --~--~---------~--~----~------------~-------~--~----~ You received this message because you are subscribed to the Google Groups "BoltWire" group. To post to this group, send email to [email protected] To unsubscribe from this group, send email to [email protected] For more options, visit this group at http://groups.google.com/group/boltwire?hl=en -~----------~----~----~----~------~----~------~--~---
