Official: Redactor Composer now available in 0.7.1+

[phil]

@phil said:

The new composer looks nice. Very impressive work.

Just one quick question. Are you doing server side HTML sanitization or are you completely relying on Redactor to provide clean HTML? If so, where is the server side code that does the sanitization.

OK, I've answered my own question. No server side sanitization. It's very easy to inject javascript code into a post for XSS.

I would strongly recommend not deploying this to a production site until server side html sanitization is implemented. If any of the devs would like to know how I XSS'd my test site, let me know.

[phil]

@phil said:

@phil said:

The new composer looks nice. Very impressive work.

Just one quick question. Are you doing server side HTML sanitization or are you completely relying on Redactor to provide clean HTML? If so, where is the server side code that does the sanitization.

OK, I've answered my own question. No server side sanitization. It's very easy to inject javascript code into a post for XSS.

I would strongly recommend not deploying this to a production site until server side html sanitization is implemented. If any of the devs would like to know how I XSS'd my test site, let me know.

I've forked and am adding server side validation. Does redactor have a list of all the tags and attributes that pass it's validation? In order for server side validation to not mess things up, it needs to perform the same validation the client performs. It would be even more useful if the guys over at redactor made their client side validation code available in a separate library.

[drew]

@phil they have a list of tags they *don't * take:
http://imperavi.com/redactor/docs/security/

But no explicit list of ones they do. I can see from your pull request you've added a list. Is that one you took from somewhere specific or built yourself?

A huge thank you to you @phil for making a contribution to the Redactor composer plugin. Gold stars and dancing girls for you!*

(* gold stars not made of real gold. Dancing girls may or may not be dancing, may or may not be girls. Offer void in Utah)

[phil]

@drew said:

@phil they have a list of tags they *don't * take:
http://imperavi.com/redactor/docs/security/

But no explicit list of ones they do. I can see from your pull request you've added a list. Is that one you took from somewhere specific or built yourself?

I dug through the Redactor source to find what they were sanitizing against and made the list to match what they were doing.

A huge thank you to you @phil for making a contribution to the Redactor composer plugin. Gold stars and dancing girls for you!*

(* gold stars not made of real gold. Dancing girls may or may not be dancing, may or may not be girls. Offer void in Utah)

[tfraley]

I've run into an issue (I've posted on github with no response) figured I would try here.

When activating redactor it seems I cannot compose a post in Safari, however, it works fine in chrome. Any thoughts on this. Others in github were able to reproduce the issue so its' not a theme issue.

Safari broken · Issue #4 · NodeBB-Community/nodebb-plugin-composer-redactor

Cant write text on safari browser, mac & iOS

GitHub (github.com)

[drew]

@tfraley You're getting replies on github, but I think what you're saying is it's not fixed. If you know js, and you have safari (or anyone reading this) pull requests welcome!

[chrismccoy]

anyone else having an issue when uploading file(s) they dont show up in the compose window, only the preview window

[drew]

@chrismccoy I think you're talking about the default markdown composer, this thread is for the redactor composer, which is a wysiwyg and has no composer/preview split.

[chrismccoy]

i have the default disabled, but markdown enabled, im guessing i have to disable the markdown plugin?

[alberto__segura]

Safari bug fixed on my pull request https://github.com/NodeBB/nodebb-plugin-composer-redactor/pull/12

[drew]

@chrismccoy file upload not yet working in Redactor Composer. We've got a bug report on the Github and hopefully a pull request incoming.

[drew]

@alberto__segura Thank you very much for the pull request. It's been merged and new npm package released.

[tfraley]

Let me start by saying its working well in safari.

Ok I may have missed something here. How come I do not have an upload / Image / video options

like shown in the first image. Am I missing an option or another plugin that is needed?

all I have is

[drew]

There's a enhancement request on the github for this.

[tfraley]

@drew

Thanks, I just found that a little while ago.

But will say that the image at the top of this thread is misleading, it should relate to how the plugin actually looks since you are advertizing the plugin.

Just my 2cents for what it's worth..

[Pilvinen]

For free? That's cool.

I just installed it and seems to be working. A bit strange that there is no separate icon for adding images. I know you can drag and drop, but it might not be so intuitive for everyone.

[drew]

@Pilvinen Something we'll be working on. So far the support from plugin developers has been good (thank you to contributors so much) and I hope a lot more devs help make this a great addition to the NodeBB package.

[julian]

@drew you're getting contributors faster than NodeBB itself is!

[drew]

@julian I'm just glad the demand for this is as real as I expected. I think it'll really help your offering for hosted packages and B2B sales too.

[Pilvinen]

Just an informal heads up:

There is possibly some page load blocking bug related to perhaps deleting posts or adding images in the redactor (I'm not sure).

I just noticed in one of the test threads that I made for the new Redactor composer that it doesn't load the thread unless you do a page refresh (broken html?). But that thread has already been deleted before I realized that I should study it more closely and make a bug report, so ...

But I'll keep an eye out to see if it happens again.