On Wed, Jul 4, 2012 at 10:34 AM, Joan Picanyol i Puig < [email protected]> wrote:
> Sounds great, as long as it is not a requirement (either in fossil nor > in the client). I guess the wiki markup issue is a done deal then? > The wysiwyg would be an option, either at the repo or user level (maybe both, we're not yet sure). With the "custom pages" feature we could in fact provide multiple editors with relatively little work, and let the client simply choose his default editor page. > - Adding more metadata to wikis, e.g. a title field. We might embed this > > into the wiki content using a new wiki tag or similar. > > This would be great if it enabled keyword based tagging for later > search. > What do you mean by keyword based tagging? (i'm not a search expert.) Full text search is difficult in fossil because things are stored as deltas. However, i believe someone (don't remember who) was working on this and i _thought_ there was a branch somewhere for this. > > We will have to enable the "style" attribute on tags in the wiki > > content (style is currently filtered out by the wiki out of safety > > concerns), and if anyone can name a concrete security reason why that > > would be a Bad Idea, please speak up! > > This sounds like a wide open door for XSS attacks. > > https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet#RULE_.234_-_CSS_Escape_And_Strictly_Validate_Before_Inserting_Untrusted_Data_into_HTML_Style_Property_Values Is there a specific attack (or attacks) then you can imagine which might be a problem for us? (i'm no security expert, either!) During our meeting we came to the conclusion that allowing style attributes "should" be a benign change, but we're also aware that there are people out there who are more devious than us and how might come up with abuses. How about if we restricted style attributes to class attributes (as opposed to concrete style information)? e.g. this would be legal: <span class="wiki-bold">...</span> but this would not (as it currently is not): <span style="font-weight: bold">...</span> :-? > - Adding a system for integrating "custom pages" to fossil repos, e.g. > > /myCustomPage, which would call content stored in the db. The original > ... > > I smell AOLServer... > i'm not familiar with it. > keep up the good work > :-D Thanks for the feedback! -- ----- stephan beal http://wanderinghorse.net/home/stephan/ http://gplus.to/sgbeal
_______________________________________________ fossil-users mailing list [email protected] http://lists.fossil-scm.org:8080/cgi-bin/mailman/listinfo/fossil-users
