Serendipity Forums

Problem: When someone posts a comment and writes an url in the comment, the url is not automatically converted into a link.

Is there a plugin to do that? Any other solutions?

chessnut wrote:Problem: When someone posts a comment and writes an url in the comment, the url is not automatically converted into a link.

... because HTML is not allowed in comments in Serendipity by default for some kind of security reason Garvin can explain way better than I can

chessnut wrote:Is there a plugin to do that? Any other solutions?

There's the event plugin "Transforms HTML for comments" (serendipity_event_unstrip_tags), which is available via http://spartacus.s9y.org.

YL

Hi!

The problem of automatic link conversion is still that the regexp to auto-convert a link is very hard and complicated, even though it sounds a very easy thing to do.

Every time when this issue comes up on the forums, I ask people if they have a code example or regexp that we could use...because I don't have a reliable one

Regards,
Garvin

yellowled wrote:There's the event plugin "Transforms HTML for comments" (serendipity_event_unstrip_tags), which is available via http://spartacus.s9y.org.

Thanks for the suggestion! But I don't want to give the user full html-capabilities. Furthermore I think most of the users are too lazy to write html-code for links.

Well, but what does the "Make external links clickable?"-Option in Configuration do then? Because urls and links (with html-tags <a href>) are not made clickable in the comments... And I also don't see any plugin that overwrites this behaviour.

garvinhicking wrote: Every time when this issue comes up on the forums, I ask people if they have a code example or regexp that we could use...because I don't have a reliable one

Does it really have to be a perfect solution? Why not making one, that fits for most of the common links?
One of these here should fit:
http://www.google.ch/search?q=regexp+url
(BTW: phpBB uses a regExp that seems to work quite good...)

Hi!

Well, but what does the "Make external links clickable?"-Option in Configuration do then? Because urls and links (with html-tags <a href>) are not made clickable in the comments... And I also don't see any plugin that overwrites this behaviour.

This only applies to links displayed in the Top Referrers and Top Exits sidebar plugins.

Does it really have to be a perfect solution?

IMHO yes, a partially working or XSS-affectionate solution isn't acceptable.

(BTW: phpBB uses a regExp that seems to work quite good...)

It doesn't work with "!" inside the URL. Something, that s9y does not strip and which might often occur.

Regards,
Garvin

garvinhicking wrote:

Does it really have to be a perfect solution?

IMHO yes, a partially working or XSS-affectionate solution isn't acceptable.

How can automatic linking be XSS-affectionate?

garvinhicking wrote:

(BTW: phpBB uses a regExp that seems to work quite good...)

It doesn't work with "!" inside the URL. Something, that s9y does not strip and which might often occur.

Wikipedia-Regexp works with "!".
My suggestion: It would be good to start with a regexp from phpBB or Wikipedia and develop it further as bugreports come in.

Hi!

How can automatic linking be XSS-affectionate?

Imagine this link from a user:

http://www.google.de"><script>alert(document.cookie);</script><span class="

this could be autoconverted to:

<a href="http://www.google.de"><script>alert(document.cookie);</script><span class=""></a>

That wouldn't be good, and there's the XSS.

My suggestion: It would be good to start with a regexp from phpBB or Wikipedia and develop it further as bugreports come in.

The plugin serendipity_event_regexpmarkup already hs a rule "ClickableURL". Maybe that could be used as a starting point, maybe it already is sufficient for your cases?


Regards,
Garvin

garvinhicking wrote: The plugin serendipity_event_regexpmarkup already hs a rule "ClickableURL". Maybe that could be used as a starting point,

definitly!

I did some tests with it:

<a href="http://www.google.de"><script>alert(document.cookie);</script><span class=""></a>

Is not a problem, because parentheses ("()") are not parsed.
But angle-brackets ("<>") are not really part of the url-specification, right? so they could be excluded from the regexp, so XSS could be prevented. Or are there any other characters, that are critical for XSS?


but exclamation marks ("!") are also not parsed, so they would have to be included.