SMF2 & TinyMCE WYSIWYG?

[rv77]

How much trouble would it be to use tinyMCE as a WYSIWYG editor instead of using bbc?

[Arantor]

Depends. How secure do you want it?

(Hint: a good number of the last few patches in WordPress were to counter vulnerabilities introduced through the filtering applied on their implementation of TinyMCE.)

[rv77]

Depends. How secure do you want it?

(Hint: a good number of the last few patches in WordPress were to counter vulnerabilities introduced through the filtering applied on their implementation of TinyMCE.)

Can't you just disable the "edit HTML" button in tinymce to disable most code insertions?

[Arantor]

No, you can't. Security by design requires you to verify what the user inputs, regardless of anything else, and assume it's unsafe until you know otherwise. Trusting it to be correct just because of a tickbox means nothing, since there would be nothing to stop me using Firebug or Chrome Dev Tools to modify the form and tell it that it's safe when it isn't...