Black/white list please?

[pauljherring]

I think we need either a whitelist, or blacklist, of things that can be used.

We've had to disable Mathjax on our instance due to stuff like the following:

$$\class{modal modal-backdrop btn}{\style{position:fixed;left:0;}{\bbox[700px]{\text{this may be annoying}}}}$$

A working version of that post is on my test instance at: http://pjh.homeip.net/t/annoying-background/83

[dpvc]

You may want to consider adding the "Safe" extension to your configuration, which can be used to limit the styles that can be applied and the class names that can be used, and so on (see the documentation for details). Or you could make a configuration that removes \class, \style, \cssId and \href commands entirely.

[pauljherring]

How/where does one go about adding that sorta thing in Discourse? There isn't a lot in the way of configuration options:

http://i.imgur.com/0iFI5Yw.png

[dpvc]

Others will have to tell you that -- I don't use it myself. But certainly this file would be one place it could be done.

[pauljherring]

But certainly this file would be one place it could be done.

I see.

Unfortunately due to how plugins work in Discourse (of this this is one) work, messing around with the source code on an installation is not a feasible way of configuring them.

It's looking like we'll simply have to do without this one.

[kasperpeulen]

@pauljherring

In theory we could maybe also allow the user to configure mathjax a bit more.
Not really sure if that would be a good idea though.

You could also fork this repo, change the configuration, and then install the plugin with:

bundle exec rake plugin:install repo=https://github.com/pauljherring/discourse-mathjax

[dpvc]

Well, for the Safe extension, you can get that in another way: by adding ",Safe" after the configuration file name, e.g., "TeX-AMS-MML_HTMLorMML,Safe", though you will have to take the default settings for it if you do that.

On the other hand, if you can add HTML to your theme or header or some other part of the page, then you might be able to configure MathJax by adding

<script type="text/x-mathjax-config">
MathJax.Hub.Config({
  Safe: {
     ... your configuration here ...
  }
});
</script>

to the page (whether MathJax is able to pick this up or not will depend on how Discourse loads MathJax.

It's too bad the plugin doesn't allow more direct control of the configuration.

[kasperpeulen]

It's too bad the plugin doesn't allow more direct control of the configuration.

@dpvc Any ideas how to make the plugin more configurable ? It's been a long time since I've done ruby/javascript programming. I guess the best way would be to let the user to configure a JSON string, then convert this to an object and pass that to MathJax.Hub.Config ?

[dpvc]

@kasperpeulen, yes, that would work.