Posting Skype links on the platform is currently impossible due to security concerns. Seleren reported an issue with posting Skype links, and riking explained that this is intentional as certain URL schemes can execute code on a user’s computer when clicked. To whitelist a scheme, an extension point is needed in Discourse.Markdown’s urlAllowed function. riking provided a link to the relevant code on GitHub. Seleren attempted to modify the JavaScript code but encountered issues with the changes not taking effect, despite recompiling assets and updating browsers.
When trying to post a skype link in such way:
[Skype link](skype:?chat&blob=RandomLongNumbersAndCharacters)
the result becomes an <a> without href.
Here’s an example.
Skype link
This cannot even be worked around by using the <a></a> link notation.
Yes, this is on purpose. Some URL schemes can effectively execute code on the computer when you click on them, so the links are stripped out if the scheme isn’t whitelisted.
How do you whitelist a scheme, then? I haven’t found anything in the settings.
An extension point is needed in Discourse.Markdown’s urlAllowed function.
This might not be the best place to ask this, but after changing the JS and recompiling the assets, nothing changes. The old assets are still used and even if I overwrite the old assets with the new ones, Skype links are still accessible. I did check in multiple browsers and made sure that my browser was using the new version of the JS.
Any tips/ideas?