TinyMCE text input sanitazation

[Gilbertdelyon]

This is not an issue. Only a question.

• HTML Custom Pages are using TinyMCE as text input editor.
• Template Custom Pages are also using TinyMCE as Richtext elements text input editor.

As far as I see tinyMCE is configured in the same way in both cases.

• HTML Custom Pages are not allowed in spaces, apparently for secutity reasons.
• Template Custom pages with RichText elements are allowed in spaces (and there are a lot of such pages in our site)

And now the questions:

• Is HTML text input less sanitized than RichText element text input? (This would explain why one is allowed in spaces and not the other.)
• Can I allow Template pages with RichText elements in spaces without any risk?

[luke-]

This is not an issue. Only a question.

• HTML Custom Pages are using TinyMCE as text input editor.
• Template Custom Pages are also using TinyMCE as Richtext elements text input editor.

As far as I see tinyMCE is configured in the same way in both cases.

• HTML Custom Pages are not allowed in spaces, apparently for secutity reasons.
• Template Custom pages with RichText elements are allowed in spaces (and there are a lot of such pages in our site)

And now the questions:

• Is HTML text input less sanitized than RichText element text input? (This would explain why one is allowed in spaces and not the other.)

What do you mean with "HTML text input"? If you mean the HTML page type, yes, it's completely unpurified HTML.

• Can I allow Template pages with RichText elements in spaces without any risk?

No, RichText (HTML) elements are very powerful. It may run through a HTML Purifier, but there is a risk here. To protect against XSS, I would use HumHub RichText.

[Gilbertdelyon]

@luke-
Thank you for these clarifications.

What do you mean with "HTML text input"? If you mean the HTML page type.....

Yes this is what I mean.

No, RichText (HTML) elements are very powerful. It may run through a HTML Purifier, but there is a risk here

May I suggest some improvement for Richtext elements:

• Either add a warning for newbees administrators like me that find convenient to add some Richtext elements in Template pages and allow them in spaces.
• Or, purify Richtext in Elements more strictly than in HTML pages.
  Richtext allows more flexibility than the basic HumHub Richtext, but I guess 99,99% of the users will not need some <script> tags or other risky things in elements.

Only my 2 cents!

[luke-]

Good point. Feel free to create an issue about it.