Gossamer Forum
Home : Products : Gossamer Forum : Discussion :

Get rid of HTML mode?

Quote Reply
Get rid of HTML mode?
We've been considering abandoning the HTML markup mode completely from Gossamer Forum. This won't be in the 1.x version, but most likely a change for version 2.0. However, this is only something we have discussed, and we'd like to throw the idea out there to get some feedback from current and future Gossamer Forum members.

For those not familiar, enabling HTML on a forum has always been advised against by us, as it opens some minor security holes and/or DOS (denial of service) potential. A user could, potentially, make an HTML post that closes all the HTML tags used to display a post, and makes it look like someone else posted below them. Or, a user could include Javascript that would put the browser into an infinite javascript alert() loop, forcing the user to kill their browser session. It isn't feasible to check for all the possibilities of malicious intent. Certainly we could strip out the common misuses, but it's highly doubtful we could block every possible attack, simpy due to the huge number of HTML tags and attributes available, and due to the speed at which new attributes and tags are supported. Who know what IE 6.5 (7.0? XP?) will add to the mix?

I'm interested in any feedback anyone has regarding either scrapping the feature for 2.0, or leaving it. Certainly, with the advanced editor (which I notice vBulletin has now copied, calling it the WYSIWYG editor) whether or not you're using Markup or HTML really doesn't matter from the user's point of view.

Jason Rhinelander
Gossamer Threads
jason@gossamer-threads.com
Subject Author Views Date
Thread Get rid of HTML mode? Jagerman 4088 Aug 16, 2002, 11:15 AM
Thread Re: [Jagerman] Get rid of HTML mode?
Paul 3978 Aug 16, 2002, 11:37 AM
Thread Re: [Paul] Get rid of HTML mode?
Wil 4012 Aug 16, 2002, 11:46 AM
Post Re: [Wil] Get rid of HTML mode?
Paul 4021 Aug 16, 2002, 11:48 AM
Post Re: [Jagerman] Get rid of HTML mode?
Wil 3998 Aug 16, 2002, 11:48 AM
Post Re: [Jagerman] Get rid of HTML mode?
Teambldr 3994 Aug 16, 2002, 11:57 AM
Post Re: [Jagerman] Get rid of HTML mode?
yogi 4027 Aug 16, 2002, 12:16 PM
Post Re: [Jagerman] Get rid of HTML mode?
ArmyAirForces 4013 Aug 16, 2002, 3:14 PM
Thread Re: [Jagerman] Get rid of HTML mode?
hoefti 3962 Aug 16, 2002, 11:52 PM
Thread Re: [hoefti] Get rid of HTML mode?
yogi 3993 Aug 17, 2002, 1:03 AM
Thread Re: [yogi] Get rid of HTML mode?
hoefti 3975 Aug 17, 2002, 5:03 AM
Thread Re: [hoefti] Get rid of HTML mode?
Paul 3946 Aug 17, 2002, 5:43 AM
Thread Re: [Removed] Get rid of HTML mode?
Ian 3970 Aug 17, 2002, 11:09 AM
Thread Re: [Ian] Get rid of HTML mode?
Jagerman 3964 Aug 17, 2002, 12:49 PM
Post Re: [Jagerman] Get rid of HTML mode?
Ian 3932 Aug 17, 2002, 12:52 PM
Thread Re: [hoefti] Get rid of HTML mode?
yogi 3924 Aug 17, 2002, 12:59 PM
Post Re: [yogi] Get rid of HTML mode?
QooQ 3922 Aug 26, 2002, 9:04 AM