@Kowlin There is a pull request (not authored by me) which fixes the problem. The Javascript problem is easy to fix. However, that in and of itself does not wholly fix the problem. The second part is that the Persona theme is laid out a bit different in HTML and the poll client javascript expects to insert the poll into a certain HTML element. Altering the poll code to work correctly for Persona means breaking all other themes. I have my own fixes for these issues but haven't pushed anything because of the theme compatibility problem.

How I fixed the JS problem:

index 5eb6a09..7b78147 100644
--- a/public/js/poll/main.js
+++ b/public/js/poll/main.js
@@ -1,7 +1,7 @@
 (function() {
        window.Poll = {
                load: function(data) {
-                       Poll.sockets.emit.load(data.pollid, function(err, poll)
+                       Poll.sockets.emit.load(data, function(err, poll) {
                                if (!err) {
                                        Poll.view.init(poll, function(pollView)
                                                if (parseInt(poll.info.deleted,
diff --git a/templates/poll/notify.tpl b/templates/poll/notify.tpl
index a4c5354..fc693c2 100644
--- a/templates/poll/notify.tpl
+++ b/templates/poll/notify.tpl
@@ -1 +1 @@
-<script>Poll.load({ pollid: {pollid} })</script>
\ No newline at end of file
+<script>Poll.load({pollid})</script>

And how I fixed the Persona theme problem:

diff --git a/public/js/poll/view.js b/public/js/poll/view.js
index 1d586ad..900f3e4 100644
--- a/public/js/poll/view.js
+++ b/public/js/poll/view.js
@@ -63,7 +63,7 @@
                },
                insertPoll: function(poll, callback) {
                        View.parsePoll(poll, function(html) {
-                               $('#post-container .post-row[data-index="0"] .po
+                               $('.posts .clearfix[data-index="0"] .content').p
                                callback();
                        });
                },

@drew said:

@phil they have a list of tags they *don't * take:
http://imperavi.com/redactor/docs/security/

But no explicit list of ones they do. I can see from your pull request you've added a list. Is that one you took from somewhere specific or built yourself?

I dug through the Redactor source to find what they were sanitizing against and made the list to match what they were doing.

A huge thank you to you @phil for making a contribution to the Redactor composer plugin. Gold stars and dancing girls for you!*

(* gold stars not made of real gold. Dancing girls may or may not be dancing, may or may not be girls. Offer void in Utah)

@phil said:

@phil said:

The new composer looks nice. Very impressive work.

Just one quick question. Are you doing server side HTML sanitization or are you completely relying on Redactor to provide clean HTML? If so, where is the server side code that does the sanitization.

OK, I've answered my own question. No server side sanitization. It's very easy to inject javascript code into a post for XSS.

I would strongly recommend not deploying this to a production site until server side html sanitization is implemented. If any of the devs would like to know how I XSS'd my test site, let me know.

I've forked and am adding server side validation. Does redactor have a list of all the tags and attributes that pass it's validation? In order for server side validation to not mess things up, it needs to perform the same validation the client performs. It would be even more useful if the guys over at redactor made their client side validation code available in a separate library.

@phil said:

The new composer looks nice. Very impressive work.

Just one quick question. Are you doing server side HTML sanitization or are you completely relying on Redactor to provide clean HTML? If so, where is the server side code that does the sanitization.

OK, I've answered my own question. No server side sanitization. It's very easy to inject javascript code into a post for XSS.

I would strongly recommend not deploying this to a production site until server side html sanitization is implemented. If any of the devs would like to know how I XSS'd my test site, let me know.

The new composer looks nice. Very impressive work.

Just one quick question. Are you doing server side HTML sanitization or are you completely relying on Redactor to provide clean HTML? If so, where is the server side code that does the sanitization.