# Wie kann ich eine Klasse in einem Theme whitelisten?

**URL:** https://meta.discourse.org/t/how-can-i-whitelist-a-class-in-a-theme/79520
**Category:** Development
**Created:** [1. Februar 2018 um 04:18 UTC](https://meta.discourse.org/t/how-can-i-whitelist-a-class-in-a-theme/79520 "2018-02-01T04:18:54Z")
**Posts on this page:** 16
**Page:** 1

<div class="post-metadata">

### Author: ![Johani](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/johani/32/176920_2.png) [@Johani](https://meta.discourse.org/u/Johani)
#### Post date: [1. Februar 2018 um 04:18 UTC](https://meta.discourse.org/t/how-can-i-whitelist-a-class-in-a-theme/79520/1 "2018-02-01T04:18:54Z")

</div>

I have a working carousel which I would like to package as a theme:

 ![](https://global.discourse-cdn.com/meta/original/3X/d/2/d22a48379b1a7222d9414b6ae9ee01dfa06b6f0c.gif)

I’ve been trying to figure out how to whitelist a class or attribute for the script to target that would work with under a theme.

I’ve read:

[https://meta.discourse.org/t/whitelisting-some-html-tags/24280](https://meta.discourse.org/t/whitelisting-some-html-tags/24280)

and

[Whitelist all the code inside of a div tag? - #4 by Alex\_Rabolin](https://meta.discourse.org/t/whitelist-all-the-code-inside-of-a-div-tag/51391/4)

But these topics cover plugin structure and I could not get any of the methods to work in a theme.

I’ve used the `[dir]` attribute - white-listed by default - in another theme [here](https://meta.discourse.org/t/discourse-masonry-gallery-theme-component/79076)

However, that won’t work for two reasons:

1- the Next and Previous buttons will be mixed up based on the text direction  
2- The slides can contain text like so:

 ![slideshow](https://global.discourse-cdn.com/meta/original/3X/9/9/991558b60814588064e68db7e079ea39e4f0dce6.gif)

and I’d really rather not go down that rabbit hole where I override the text direction with CSS - that’s just too hacky even for me.

I’m pretty much stuck here 😅

The current selector I’m using to initialize the script on the container is:

```plaintext
$('.cooked>div[dir*="rtl"]')

```

* * *

So my question is:

**How can I while-list a class or attribute for a div in a theme?**

---

<div class="post-metadata">

### Author: ![sam](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/sam/32/102149_2.png) [@sam](https://meta.discourse.org/u/sam)
#### Post date: [1. Februar 2018 um 04:33 UTC](https://meta.discourse.org/t/how-can-i-whitelist-a-class-in-a-theme/79520/2 "2018-02-01T04:33:15Z")

</div>

Oh you can not do that yet, what I would like to do is just have `.theme-[a-z]+` automatically whitelisted, but it requires fiddling with the whitelister a bit.

Assigning this to me, but may take a few weeks to get around to it.

If @angus or @david feel like giving it a shot, be my guest.

---

<div class="post-metadata">

### Author: ![Johani](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/johani/32/176920_2.png) [@Johani](https://meta.discourse.org/u/Johani)
#### Post date: [1. Februar 2018 um 04:54 UTC](https://meta.discourse.org/t/how-can-i-whitelist-a-class-in-a-theme/79520/4 "2018-02-01T04:54:12Z")

</div>

No worries @sam 🌻

Thank you for taking this on - no rush at all I’m sure your plate is full 😅

I have one last followup question.

Does defining new tags like:

```plaintext
[foo] 
// slides
[/foo]

```

to be later converted into

```plaintext
<div class="foo">
// slides
</div>

```

in the cooked output also require a plugin for now?

---

<div class="post-metadata">

### Author: ![sam](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/sam/32/102149_2.png) [@sam](https://meta.discourse.org/u/sam)
#### Post date: [1. Februar 2018 um 04:59 UTC](https://meta.discourse.org/t/how-can-i-whitelist-a-class-in-a-theme/79520/5 "2018-02-01T04:59:05Z")

</div>

Yeah if you are trying to amend the markdown pipeline I think you need a plugin. One thing that is good security wise with themes is that they are not allowed to run on the server, this would change it.

---

<div class="post-metadata">

### Author: ![Johani](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/johani/32/176920_2.png) [@Johani](https://meta.discourse.org/u/Johani)
#### Post date: [1. Februar 2018 um 08:07 UTC](https://meta.discourse.org/t/how-can-i-whitelist-a-class-in-a-theme/79520/6 "2018-02-01T08:07:09Z")

</div>

I spent a bit more time trying out different things and here's what I found

1- `<div dir="foo"></div>` is not filtered out even if the value does not match `rtl` or `ltr`  
2- `<div dir></div>` is also not filtered out

* * *

This line has can be selected with [dir="foo"] 

This line can be selected with div[dir=""] 

![Capture](https://global.discourse-cdn.com/meta/original/3X/7/a/7a6560fec4d6d890df1a80b0158df59b834feebf.PNG)

* * *
So I can technically make 

```plaintext
<div dir="carousel"> 
// slides
</div>

```

work but I have a feeling that you might be interested in preventing this behavior. I will wait and see what you think.

---

<div class="post-metadata">

### Author: ![tshenry](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/tshenry/32/119495_2.png) [@tshenry](https://meta.discourse.org/u/tshenry)
#### Post date: [14. Februar 2018 um 10:43 UTC](https://meta.discourse.org/t/how-can-i-whitelist-a-class-in-a-theme/79520/7 "2018-02-14T10:43:54Z")

</div>

Wow, this looks fantastic. Really hoping this sees the light of day.

---

<div class="post-metadata">

### Author: ![Falco](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/falco/32/179432_2.png) [@Falco](https://meta.discourse.org/u/Falco)
#### Post date: [14. Februar 2018 um 20:03 UTC](https://meta.discourse.org/t/how-can-i-whitelist-a-class-in-a-theme/79520/8 "2018-02-14T20:03:48Z")

</div>

I wonder if we could adopt this somehow [GitHub - markdown-it/markdown-it-container: Fenced container plugin for markdown-it markdown parser · GitHub](https://github.com/markdown-it/markdown-it-container)

Maybe under a site setting or a plugin.

---

<div class="post-metadata">

### Author: ![sam](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/sam/32/102149_2.png) [@sam](https://meta.discourse.org/u/sam)
#### Post date: [14. Februar 2018 um 20:15 UTC](https://meta.discourse.org/t/how-can-i-whitelist-a-class-in-a-theme/79520/9 "2018-02-14T20:15:36Z")

</div>

In general we do blocks in bbcode, so it gets a bit confusing to add another pattern.

The issue here is the whitelister per:

[https://github.com/discourse/discourse/blob/master/app/assets/javascripts/pretty-text/white-lister.js.es6#L114-L179](https://github.com/discourse/discourse/blob/master/app/assets/javascripts/pretty-text/white-lister.js.es6#L114-L179)

But our DSL is a bit too limited atm to add `theme-*` as a whitelisted class so we need to fix that.

---

<div class="post-metadata">

### Author: ![Johani](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/johani/32/176920_2.png) [@Johani](https://meta.discourse.org/u/Johani)
#### Post date: [15. Februar 2018 um 03:16 UTC](https://meta.discourse.org/t/how-can-i-whitelist-a-class-in-a-theme/79520/10 "2018-02-15T03:16:41Z")

</div>

```plaintext
<aside data-carousel="true"></aside>

```

Would also work.

This line can be selected with [data-carousel="true"]

![Capture](https://global.discourse-cdn.com/meta/original/3X/9/d/9d796297c8ece488e8a831168167f4d8ffa9567a.PNG)

And unlike

`<div dir="foo"></div>`  
or  
`<div dir></div>`

`<aside data-carousel="true"></aside>` is valid html

Still feels a bit unorthodox though 😶

---

<div class="post-metadata">

### Author: ![sam](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/sam/32/102149_2.png) [@sam](https://meta.discourse.org/u/sam)
#### Post date: [15. Februar 2018 um 04:55 UTC](https://meta.discourse.org/t/how-can-i-whitelist-a-class-in-a-theme/79520/11 "2018-02-15T04:55:52Z")

</div>

Oh, I can add data-\* to div quite easily, does that help?

---

<div class="post-metadata">

### Author: ![Johani](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/johani/32/176920_2.png) [@Johani](https://meta.discourse.org/u/Johani)
#### Post date: [15. Februar 2018 um 05:04 UTC](https://meta.discourse.org/t/how-can-i-whitelist-a-class-in-a-theme/79520/12 "2018-02-15T05:04:46Z")

</div>

> [@sam](#):
>
> Oh, I can add data-\* to div quite easily, does that help?

Yes! 🔥

I think that would work and pretty much cover everything.

attribute selectors work with jQuery and CSS just fine. 🍷

---

<div class="post-metadata">

### Author: ![riking](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/riking/32/170938_2.png) [@riking](https://meta.discourse.org/u/riking)
#### Post date: [15. Februar 2018 um 06:19 UTC](https://meta.discourse.org/t/how-can-i-whitelist-a-class-in-a-theme/79520/13 "2018-02-15T06:19:17Z")

</div>

Perhaps data-custom-\* or data-c-\* – you don’t want to get stuff confused with data-lazyYT

---

<div class="post-metadata">

### Author: ![j.jaffeux](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/j.jaffeux/32/60297_2.png) [@j.jaffeux](https://meta.discourse.org/u/j.jaffeux)
#### Post date: [15. Februar 2018 um 07:34 UTC](https://meta.discourse.org/t/how-can-i-whitelist-a-class-in-a-theme/79520/14 "2018-02-15T07:34:03Z")

</div>

yes and AFAIK it doesn’t have any noticeable performance hit

---

<div class="post-metadata">

### Author: ![sam](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/sam/32/102149_2.png) [@sam](https://meta.discourse.org/u/sam)
#### Post date: [15. Februar 2018 um 08:19 UTC](https://meta.discourse.org/t/how-can-i-whitelist-a-class-in-a-theme/79520/15 "2018-02-15T08:19:29Z")

</div>

Sure then, can you do a PR to add `data-theme-*` on DIV, I think it makes good sense and will not clash.

---

<div class="post-metadata">

### Author: ![Johani](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/johani/32/176920_2.png) [@Johani](https://meta.discourse.org/u/Johani)
#### Post date: [15. Februar 2018 um 08:48 UTC](https://meta.discourse.org/t/how-can-i-whitelist-a-class-in-a-theme/79520/16 "2018-02-15T08:48:16Z")

</div>

> [@sam](#):
>
> I think it makes good sense and will not clash.

This is great news! 🤩

> [@sam](#):
>
> can you do a PR to add data-theme-\* on DIV

Well I tried anyway 😅

[https://github.com/discourse/discourse/pull/5598](https://github.com/discourse/discourse/pull/5598)

PR submitted

---

<div class="post-metadata">

### Author: ![bekircem](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/bekircem/32/44582_2.png) [@bekircem](https://meta.discourse.org/u/bekircem)
#### Post date: [15. Mai 2020 um 10:37 UTC](https://meta.discourse.org/t/how-can-i-whitelist-a-class-in-a-theme/79520/17 "2020-05-15T10:37:03Z")

</div>

Können wir data-theme-\* für p-Tags verwenden?
