web commit by JoshTriplett: Fix incomplete sentence. Sign.

[git.ikiwiki.info.git] / doc / plugins / htmlscrubber.mdwn

diff --git a/doc/plugins/htmlscrubber.mdwn b/doc/plugins/htmlscrubber.mdwn
index e3652a847999f2cf7076bf0d3b99f05089af2abd..1255d7723613793d611b494e3aad4a0e8e2910aa 100644 (file)
--- a/doc/plugins/htmlscrubber.mdwn
+++ b/doc/plugins/htmlscrubber.mdwn
@@ -1,6 +1,5 @@
-[[template id=plugin name=htmlscrubber core=1 included=1
-author="[[Joey]]"]]
-[[tag type/html type/core]]
+[[template id=plugin name=htmlscrubber core=1 author="[[Joey]]"]]
+[[tag type/html]]

 
 This plugin is enabled by default. It sanitizes the html on pages it renders
 to avoid XSS attacks and the like.
 
 This plugin is enabled by default. It sanitizes the html on pages it renders
 to avoid XSS attacks and the like.


@@ -10,7 +9,7 @@ whitelisted using the same lists as used by Mark Pilgrim's Universal Feed
 Parser, documented at <http://feedparser.org/docs/html-sanitization.html>.
 Notably it strips `style`, `link`, and the `style` attribute.
 
 Parser, documented at <http://feedparser.org/docs/html-sanitization.html>.
 Notably it strips `style`, `link`, and the `style` attribute.
 

-It uses the HTML::Scrubber perl module to perform its html
+It uses the [[cpan HTML::Scrubber]] perl module to perform its html

 sanitisation, and this perl module also deals with various entity encoding
 tricks.
 
 sanitisation, and this perl module also deals with various entity encoding
 tricks.
 


@@ -24,6 +23,10 @@ The web's security model is *fundamentally broken*; ikiwiki's html
 sanitisation is only a patch on the underlying gaping hole that is your web
 browser.
 
 sanitisation is only a patch on the underlying gaping hole that is your web
 browser.
 

+Note that enabling or disabling the htmlscrubber plugin also affects some other
+HTML-related functionality, such as whether [[meta]] allows potentially unsafe
+HTML tags.
+

 ----
 
 Some examples of embedded javascript that won't be let through when this
 ----
 
 Some examples of embedded javascript that won't be let through when this