Gossamer Forum
Home : Products : Gossamer Forum : Discussion :

Get rid of HTML mode?

Quote Reply
Get rid of HTML mode?
We've been considering abandoning the HTML markup mode completely from Gossamer Forum. This won't be in the 1.x version, but most likely a change for version 2.0. However, this is only something we have discussed, and we'd like to throw the idea out there to get some feedback from current and future Gossamer Forum members.

For those not familiar, enabling HTML on a forum has always been advised against by us, as it opens some minor security holes and/or DOS (denial of service) potential. A user could, potentially, make an HTML post that closes all the HTML tags used to display a post, and makes it look like someone else posted below them. Or, a user could include Javascript that would put the browser into an infinite javascript alert() loop, forcing the user to kill their browser session. It isn't feasible to check for all the possibilities of malicious intent. Certainly we could strip out the common misuses, but it's highly doubtful we could block every possible attack, simpy due to the huge number of HTML tags and attributes available, and due to the speed at which new attributes and tags are supported. Who know what IE 6.5 (7.0? XP?) will add to the mix?

I'm interested in any feedback anyone has regarding either scrapping the feature for 2.0, or leaving it. Certainly, with the advanced editor (which I notice vBulletin has now copied, calling it the WYSIWYG editor) whether or not you're using Markup or HTML really doesn't matter from the user's point of view.

Jason Rhinelander
Gossamer Threads
jason@gossamer-threads.com
Subject Author Views Date
Thread Get rid of HTML mode? Jagerman 4006 Aug 16, 2002, 11:15 AM
Thread Re: [Jagerman] Get rid of HTML mode?
Paul 3898 Aug 16, 2002, 11:37 AM
Thread Re: [Paul] Get rid of HTML mode?
Wil 3932 Aug 16, 2002, 11:46 AM
Post Re: [Wil] Get rid of HTML mode?
Paul 3939 Aug 16, 2002, 11:48 AM
Post Re: [Jagerman] Get rid of HTML mode?
Wil 3919 Aug 16, 2002, 11:48 AM
Post Re: [Jagerman] Get rid of HTML mode?
Teambldr 3915 Aug 16, 2002, 11:57 AM
Post Re: [Jagerman] Get rid of HTML mode?
yogi 3948 Aug 16, 2002, 12:16 PM
Post Re: [Jagerman] Get rid of HTML mode?
ArmyAirForces 3934 Aug 16, 2002, 3:14 PM
Thread Re: [Jagerman] Get rid of HTML mode?
hoefti 3882 Aug 16, 2002, 11:52 PM
Thread Re: [hoefti] Get rid of HTML mode?
yogi 3914 Aug 17, 2002, 1:03 AM
Thread Re: [yogi] Get rid of HTML mode?
hoefti 3895 Aug 17, 2002, 5:03 AM
Thread Re: [hoefti] Get rid of HTML mode?
Paul 3866 Aug 17, 2002, 5:43 AM
Thread Re: [Removed] Get rid of HTML mode?
Ian 3891 Aug 17, 2002, 11:09 AM
Thread Re: [Ian] Get rid of HTML mode?
Jagerman 3883 Aug 17, 2002, 12:49 PM
Post Re: [Jagerman] Get rid of HTML mode?
Ian 3853 Aug 17, 2002, 12:52 PM
Thread Re: [hoefti] Get rid of HTML mode?
yogi 3845 Aug 17, 2002, 12:59 PM
Post Re: [yogi] Get rid of HTML mode?
QooQ 3843 Aug 26, 2002, 9:04 AM