Customizing SMF > SMF Coding Discussion

Allow HTML "class" attribute

(1/3) > >>

Ivan F.:
Hello people  :)

I need to allow the HTML "class" attribute for all users in my forum, in order to call an external 100% sure script.

I've already allowed basic HTML in settings.
So, users can now post links with HTML, such as:


--- Code: ---<a href="http://mylink.com">Link</a>
--- End code ---

But if they try to use the "class" attribute inside:


--- Code: ---<a href="http://mylink.com" class="myclass">Link</a>
--- End code ---

They obtain this:

--- Code: ---<a href="http://mylink.com" class="myclass">Link[/url]
--- End code ---

Two questions:
1. How do I add the "class" attribute to the allowed tags list?
(after that, I guess that my forum will close the </a> tag)
2. Allowing this attribute poses a concrete security risk?

Thanks a lot!

Arantor:
1.not without fairly significant changes to the way all of the preparsing is done to make this work 100% correctly.

2. Needs to be implemented carefully as if not implemented correctly, this could easily become a nasty issue.

Why do your users need to add classes exactly?

Ivan F.:

--- Quote from: Arantor on July 12, 2018, 11:18:29 AM ---Why do your users need to add classes exactly?

--- End quote ---

Because the correct "class" can call the Embedly script, allowing rich previews and audio/video embedding.

Arantor:
What does that offer that the existing embed mods do not?

Ivan F.:

--- Quote from: Arantor on July 12, 2018, 12:05:24 PM ---What does that offer that the existing embed mods do not?
--- End quote ---

A single solution to embed links, audio and video with rich previews.

Are there mods that can generate rich previews from links?
Didn't find any, but I'd sure prefer to install a mod than allowing new HTML tags.

Navigation

[0] Message Index

[#] Next page

Go to full version