As far as I can tell, the "HTML Filter" is the only filter to perform XSS checking. We should probably pass this message on to our site administrators within the admin interface. Here's a first attempt.

CommentFileSizeAuthor
#7 filter-desc2.patch896 bytestelcontar
filter-desc.patch840 bytesmatt westgate

Comments

Steven’s picture

Steven commented

A more accurate description is that "it will also remove harmful content such as JavaScript events, JavaScript URLs and CSS styles from those tags that are not removed." Vague constructs like "attempts to sanitize user input" only cause confusion.

dries’s picture

dries commented

Depends on the target audience. My mother doesn't know what Javascript or CSS is, but she can tell that "sanitizing input" is a good thing.

dries’s picture

dries commented

Looking at this closer, it looks like the message would only be shown to administrator (and not on the content submission page)? If that is the case, Steven's message sounds like the best option. If not, I'd go with Matt's.

matt westgate’s picture

matt westgate commented

Dries you're correct. Only a site administrator will see this message while configuring input formats. I like Steven's wording better than mine.

dries’s picture

dries commented

I guess we need a new patch then. :)

dmitrig01’s picture

dmitrig01 commented
Version: x.y.z » 6.x-dev
Status: Needs review » Needs work

love the idea, but it's do for a re-roll

telcontar’s picture

telcontar commented
Status: Needs work » Needs review
StatusFileSize
new filter-desc2.patch896 bytes

Rerolled against HEAD.

dries’s picture

dries commented
Status: Needs review » Fixed

Committed to CVS HEAD. Thanks. :)

Anonymous’s picture

(not verified) commented
Status: Fixed » Closed (fixed)