This topic has been resolved by the Discourse Team. I’m leaving the original topic up for archival purposes, but this has been resolved by @Roman and the team. I recently rebuilt Discourse to update my SMTP settings and my global notice’s HTML tags are now rendered out. This is what it looks li…

We have re-enabled HTML support on the global notice setting. We want to figure a better way to guarantee a smooth transition. FIX: Reenable global setting HTML support. main ← reenable_html_global_notice …

Hm, just my 2 cents but the 2 have very different purpose. Global banner is there for a purpose, i.e., when I want to notify the forum about an important topic. If a user has closed the banner this setting stays and they can’t see an update that would otherwise be visible with a global notice.

Yes, we decided to keep the setting because we know how useful it is to a non-dismissable banner during an urgent situation, but allowing unsanitized HTML could be potentially dangerous.

If someone has permissions to set a global notice, then they’re permitted to create a theme component as well? So there is no extra attack vector here?

To be clear, we don’t consider this to be a security issue as only admins can update this setting. It’s part of an ongoing effort to disallow HTML in site settings and use other tools designed to support this.

Let me lay out a case for allowing HTML. I’m working with a client who is starting a forum for investors.(Closed beta started yesterday, as it happens.) Their legal team insists on a disclaimer. It must: Be prominently displayed on every page of the forums. Not be dismissable. In other words, a g…

My initial reasoning for this is for further protection of database entries, mainly because of encoding issues with an old forum I used. Emojis on the forum were converted to &# format and when quoted, would cause “Invalid byte sequence in utf-8” errors upon conversion, and the forum displays the e…

[Bild] jericson: Is there an explanation of the reasoning somewhere? If y’all are working on another tool to support non-dismissable global banners which allow links,[^3] it would be helpful to know when it will be ready. I’d rather avoid having to set up a customization if possible. I apologiz…

In the description below the global notice field, you might put: “HTML support will be removed in a future version” Also when it was disabled, the description still said “HTML allowed”.

@Roman_Rizzi When is the release with the global notice going out?

We discussed about this and we decided to keep the HTML support for the global notice setting, so it’s not going out anytime soon.

Kein HTML in globaler Benachrichtigung

Unterstützung

Roman (Roman Rizzi) 5. Oktober 2021 um 18:17 14

Entschuldigt bitte die Unannehmlichkeiten. Um ein nicht abwählbares Banner zu erstellen, schaut euch bitte diese Theme-Komponente an:

Sie ist weitaus leistungsfähiger und anpassbarer als die globale Mitteilung.

Thema		Antworten	Aufrufe
HTML stopped working for a global notice Support	3	555	5. Oktober 2021
Global Banner No Longer Supports HTML Bug	6	809	29. Dezember 2019
Target=blank in global notice Support	1	85	24. Dezember 2024
Write my own Global Alerts Support	8	685	4. November 2020
Global notice does not appear on some pages Bug	3	1188	5. August 2015

Kein HTML in globaler Benachrichtigung

Verwandte Themen