The Local Yarn

 

Saturday January 18, 2014

Markdown Comments in Textpattern

I’ve switched the formatting syntax in the comment processor from Textile to the more well-known Markdown — specifically Michel Fortin’s MarkdownExtra, since I wanted readers to have the access to such amenities as footnotes, tables, and the like.

Fortin’s recommended method of installing MarkdownExtra for Textpattern is to rename markdown.php to classTextile.php and drop this file in place of Textpattern’s old one. This works well but it brings a big security hazard: Markdown syntax explicitly allows the use of plain HTML, but Fortin’s class does no filtering for malicious content (unlike Textile, which has options for escaping all HTML when processing user comments). This means that if you don’t do any extra work, you leave yourself pretty wide open to XSS attacks.

My solution was to bolt on the excellent HTML Purifier package. After installing it on the server, edit the new classTextile.php, and add this line just above the definition for class Textile:

require_once '/path/to/web/plugins/htmlpurifier/HTMLPurifier.standalone.php';

Then change the TextileRestricted function to read as follows:

function TextileRestricted($text, $lite='', $noimage='') {
    $purifier = new HTMLPurifier();
    $text = $purifier->purify($text);
    return $this->TextileThis($text, $lite);
}

Read more from The Blog, or from the series ‘Technicalities’

Add to the original piece by submitting your note below. Think of yourself as a co-author on the piece above and write accordingly. These aren't normal blog comments: this is a submission for publication. Read the guidelines below the form if you’re new here.


(Will not display)


For future comments: this info


Formatting syntax: all basic & extra Markdown is supported.
*italics*, **bold**, -- em-dash [Link](http://wikipedia.org)
> Block quotation

Subscribe by email or RSS to be notified of new comments.

  • Notes will be discarded if they lack relevance, substance, clarity, accuracy, or delightfulness that is of a kind with that of the original article.
  • Published notes will be included in the blog and sent to email and RSS subscribers, as well as being added to this page.
  • If you prefer, write up your thoughts on your own blog, and submit a short note with a link to your post (we also support webmentions for this). Or if someone else has already made a good argument you agree with, submit a short note with a link. We’ll almost always publish these kinds of notes, as long as the posts they link to are relevant.
  • If making claims, cite sources wherever possible.
  • It’s never too late to submit a note. Notes are often added to posts several years old.
  • If you just want to leave a general note of appreciation or complaint, use our feedback form instead.

Your note will be reviewed before being published. This site has the squelch filter set higher than most, in order to eliminate low-substance chatter, and to create a curated exhibit of related ideas. We may follow up with you via email if we feel edits are needed.


Subscribe by Email or RSS
Send Feedback

The Local Yarn is a publication by Joel & Jessica Dueck of original writing, commentary, and art, and is only partially fictitious.

· Since 1998 ·
Colophon, Errata