|
Forum with WYSIWYG Editor safely
from PEAK XOOPS
(2007/9/27 18:13)
|
I've just released d3forum-0.77. You can use fckxoops with this version. Perhaps, you've already known forum modules can use WYSIWYG Editors. But d3forum is far differnt from them because of the security. If you turn "Enable HTML" on, your post will be filtered HTMLPurifier automatically. Then, all of JavaScripts will be removed from the post. I've opened "HTML allowd FORUM" for my experments. http://xoops.peak.ne.jp/md/d3forum/index.php?forum_id=12 Only with the forum, you can use fckxoops and allow HTML. Of couse, you can control such detailed settings by forum's option. default_options:smiley,xcode,number_entity,htmlallow_html:1body_editor:common_fckeditor Note: The forum's "default_options" contain "html" instead of "br".
|
|
Extending features of pico by smarty plugins(1)
from PEAK XOOPS
(2007/9/23 15:41)
|
Now, I show a practical examples how to use pico's formmail system. Case 1: "Implant forms after product presentation pages" You can easily achive it using pico's smarty plugisn "pico" and "formmail". Make a content like this. (Turn "Smarty" filter on) (products introducing section)<{capture}><{pico id="(content ID describing the form)"}><{/capture}><{formmail4fleamarket mail_body_pre="A query from visitor exists\nContact him/her soon as possible\n\n" from_name="Product manager" cc_field_name="youremail" cc_mail_subject="A confirmation for your query" cc_mail_body_pre="Thank you for querying us.\nThis is the content you have queried\n"}> Also, you have to make a content like this. <form>name: <input type="text" name="name" class="required" /><br />email: <input type="text" n ...
|
|
HTMLPurifier
from PEAK XOOPS
(2007/9/18 4:00)
|
WYSIWYG Editors require "allow HTML" for the system. But it must invite "Script Insertion" attacks easily. kentauls told me HTMLPurifier. http://htmlpurifier.org/ It looks great especially smoketest for XSS. You should know HTMLPurifier can work with PHP5 only though the documentation tells us that it can work with PHP>=4.3.2. Anyway, I've included this library into Protector. You can try "postcommon_post_htmlpurify4guest.php" as protector's filter plugin. But, it is just a sample. I'll modify my modules can use HTMLPurifier as necessary by config. HTMLPurifier allows us "WYSIWYG forum" etc.
|
|
Formmail validated by HTML (5)
from PEAK XOOPS
(2007/9/15 6:01)
|
In pico-1.52, the spec of formmail system has been fixed. Then, I'll write example codes. Look again the skelton. <{capture}><form>(describe form parts)</form><{/capture}><{formmail}> Now, try a checkbox. <{capture}><form><input type="checkbox" name="Favorite_Fruits" value="Orange" />Orange<input type="checkbox" name="Favorite_Fruits" value="Apple" />Apple<input type="checkbox" name="Favorite_Fruits" value="Pear" />Pear<input type="submit" value="Confirm" /></form><{/capture}><{formmail}> This is the simplest pattern. You should check "Favorite_Fruits" instead of "Favorite_Fruits[]". (Of course, you can also use "Favorite_Fruits[]" there) With this system, you need not add [] after "name" attribute. You can write better form HTML ...
|
|
Formmail validated by HTML (4)
from PEAK XOOPS
(2007/9/8 18:16)
|
In pico-1.51, the rule for "Form validated by HTML" has been changed radically. read (1)~(3) again, please. These are the new rule of the system for HTML designers. Name of the field It is name attribute. Only [0-9a-zA-Z_-] can be used. You can also use linear array by just adding [] after the name. eg) name="favorite_fruits[]" Title of the field The 1st option is <label> corresponding the <input>. 2nd option is title attribute in the tag. Last option is name attribute in the tag. (same as Name) essential Specify it by class attribute. eg1) <input ... class="required" /> eg2) <input ... class="required int" /> // "int" AND "required" Type Specify it by class attribute. Only a type can be valid. - int -- filtered by intval() - double -- filtered by doubleval() - singlebytes -- filtered by mb_convert_kana( ... , 'as' ) - email -- checked by RFC2822. an error will be raise ...
|
|
Formmail validated by HTML (3)
from PEAK XOOPS
(2007/9/6 6:31)
|
Here is a document how to validate POST data via pure HTML. (A) How to get POST's indexes should be received? Just get "name" attributes in the HTML. # Though it is difficult to treat array like hobbies[], I skip it now. (B) How to get field's title? This system gets field's title from <label> corresponding the <input> from HTML. (C) How to judge whether the field is essential or not? This system judges them by their filed's name. If a field contains '_required' in its name, the field will be regarded as essential. refer the sample HTML in (1). The field of 'name_required' is essential. (D) How to do "TYPE-SAFE" or "TYPE-AUTO-CONVERSION"? This "type" contains not only int,double,string etc, but also "telephone number","email address" etc. This system judges them their filed's name like (C). eg) if a field contains 'email' in its name, the ...
|
|
Formmail validated by HTML (2)
from PEAK XOOPS
(2007/9/5 5:45)
|
The sample code shown in yesterday can be simplified like this. <{capture}><form>(form controllers)</form><{/capture}><{formmail}> You have to check the skelton. "The plugin <{formmail}> parses the form HTML captured by <{capture}> block. Also <{formmail}> receive POST and store SESSION. Then <{formmail}> outputs rewritten form HTML" eg) <form> will be added proper attributes of "action" and "method". Of course you can specify action and method by yourself. <form action="/modules/pico/form.html" method="POST"> You can write "form controllers" as you like. But you should follow the rule of XHTML. - write tags with small letter - write `selected="selected"` fully instead of `selected` - close the tags like <input .... /> - write <label> corresponding each inputs. <{formmail}> judges <label> as the title of the in ...
|
|
Formmail validated by HTML (1)
from PEAK XOOPS
(2007/9/4 6:00)
|
I implemented "Formmail validated by HTML" for pico 1.50 You may ask "What is new?" OK. This system uses Template data written by HTML designer as "Validator". You need not XML definition etc. And I don't value the module like liaise or class of XoopsForm, because such HTML generating system kills the liberty for HTML design. I believe this system makes both designers and programmers happy. Anyway try to make a contents like this. Filters: Turn 'Smarty(XoopsTpl)' on. All of the rest should be turned off. <{capture}><form><label for="name_required">Name</label><input type="text" name="name_required" id="name_required" /><br /><label for="email">email</label><input type="text" name="email" id="email" /><br /><label for="selbox">SELECT BOX</label><select name="s ...
|
|
A Greasemonkey script for SNS
from PEAK XOOPS
(2007/8/29 3:53)
|
Sorry, No english content.
|
|
Ping feature Implemented into d3pipes
from PEAK XOOPS
(2007/8/24 6:37)
|
With d3pipes>=0.54, you can send Ping from any pipes just inserting Ping joint. You should know the ping rule of d3pipes. - Minimum interval is 30 minutes. - Just send a ping when the data in pipe is different from previous ping And you shold also check whether the pipe is active/public. Both RSS/DISP should be checked in pipe admin.
|
