Misworded Header & No HTML warn on posts

[DJAscendance]

The Message Board notice currently says:

Some HTML coding has been blocked for security reasons. Basic HTML tags (i.e. <p>, <br>, <a href>, and <img src>) are allowed. If a disallowed tag is used, an error message will display.

The Inbox has a shorter version of this notice in some places.

I did a little testing against the current sanitizer, and the wording isn't quite accurate:

• More than those four example tags are allowed, including tables, <font>, <center>, image maps, and <marquee>.
• Disallowed tags and attributes are normally removed silently—the post still goes through and no warning is shown.
• <style>, <link>, <script>, inline CSS, and event attributes are removed.
• Message Board and Inbox posts, replies, and their configuration/introduction sections all appear to use the same HTML rules.

If the notice says it will show an error, it should do that. If it isn't going to, then we should at minimum reword the header so it isn't misleading. I really suggest re-implementing the parser to do its original job and return something like:

Message not sent. The following unsupported HTML tags were found: <tag>, <tag>.

We could also add a small HTML tutorial under the “How Do I?” button on the Control Panel. It could list the basic supported tags and include a couple of simple examples.

This would only document the HTML that is already supported. It is not a request to bring back the old custom-coded RTF/markup editor—that was a completely different feature and a nightmare to maintain.

—BassMekanik

[smile0711]

i.e. typically means for example and not an extensive list of all options. We could add a link to display a whole list of all allowed tags and attributes allowed with them.

The silently ignore was intentional and I forgot to remove the part about the warning. Sanitize adds closing tags like </p> and when it did that, it was kicking the user back with a confusing warning message, and was easier for the code to silently edit the message than hand code an error message. Feel free to change whatever you want on this.

[DJAscendance]

i.e. typically means for example and not an extensive list of all options. We could add a link to display a whole list of all allowed tags and attributes allowed with them.

The silently ignore was intentional and I forgot to remove the part about the warning. Sanitize adds closing tags like </p> and when it did that, it was kicking the user back with a confusing warning message, and was easier for the code to silently edit the message than hand code an error message. Feel free to change whatever you want on this.

I will give it a look during my code traversals. Also noted on the confusion from the hand code sanitize, I think we could maybe put a feature request/revision of the past HTML editor, and just make a fairly simple markdown or rtf style system like GH and lots of other places have these days:

Make it low priority?