X-Git-Url: http://git.tremily.us/?a=blobdiff_plain;f=doc%2Fplugins%2Fhtmlscrubber.mdwn;h=98933d99e6626e816c46effd71df23599cda2168;hb=070b90727139c1415300040ea359aeac7fade9d5;hp=c59b46e14e12624463881101fff3190de36061c1;hpb=c2d2ff0199f16e028431cd83961b1bff5e2caa99;p=ikiwiki.git diff --git a/doc/plugins/htmlscrubber.mdwn b/doc/plugins/htmlscrubber.mdwn index c59b46e14..98933d99e 100644 --- a/doc/plugins/htmlscrubber.mdwn +++ b/doc/plugins/htmlscrubber.mdwn @@ -6,7 +6,8 @@ to avoid XSS attacks and the like. It excludes all html tags and attributes except for those that are whitelisted using the same lists as used by Mark Pilgrim's Universal Feed -Parser, documented at . +Parser, documented at +. Notably it strips `style` and `link` tags, and the `style` attribute. All attributes that can be used to specify an url are checked to make sure @@ -32,10 +33,11 @@ other HTML-related functionality, such as whether [[meta]] allows potentially unsafe HTML tags. The `htmlscrubber_skip` configuration setting can be used to skip scrubbing -of some pages. Set it to a [[ikiwiki/PageSpec]], such as "!*/Discussion", -and pages matching that can have all the evil CSS, JavsScript, and unsafe -html elements you like. One safe way to use this is to use [[lockedit]] to -lock those pages, so only admins can edit them. +of some pages. Set it to a [[ikiwiki/PageSpec]], such as +`posts/* and !comment(*) and !*/Discussion`, and pages matching that can have +all the evil CSS, JavsScript, and unsafe html elements you like. One safe +way to use this is to use [[lockedit]] to lock those pages, so only admins +can edit them. ----