This topic has been resolved by the Discourse Team. I’m leaving the original topic up for archival purposes, but this has been resolved by @Roman and the team. I recently rebuilt Discourse to update my SMTP settings and my global notice’s HTML tags are now rendered out. This is what it looks li…

We have re-enabled HTML support on the global notice setting. We want to figure a better way to guarantee a smooth transition. FIX: Reenable global setting HTML support. main ← reenable_html_global_notice …

Hm, just my 2 cents but the 2 have very different purpose. Global banner is there for a purpose, i.e., when I want to notify the forum about an important topic. If a user has closed the banner this setting stays and they can’t see an update that would otherwise be visible with a global notice.

Yes, we decided to keep the setting because we know how useful it is to a non-dismissable banner during an urgent situation, but allowing unsanitized HTML could be potentially dangerous.

If someone has permissions to set a global notice, then they’re permitted to create a theme component as well? So there is no extra attack vector here?

To be clear, we don’t consider this to be a security issue as only admins can update this setting. It’s part of an ongoing effort to disallow HTML in site settings and use other tools designed to support this.

Let me lay out a case for allowing HTML. I’m working with a client who is starting a forum for investors.(Closed beta started yesterday, as it happens.) Their legal team insists on a disclaimer. It must: Be prominently displayed on every page of the forums. Not be dismissable. In other words, a g…

My initial reasoning for this is for further protection of database entries, mainly because of encoding issues with an old forum I used. Emojis on the forum were converted to &# format and when quoted, would cause “Invalid byte sequence in utf-8” errors upon conversion, and the forum displays the e…

[imagen] jericson: Is there an explanation of the reasoning somewhere? If y’all are working on another tool to support non-dismissable global banners which allow links,[^3] it would be helpful to know when it will be ready. I’d rather avoid having to set up a customization if possible. I apolog…

In the description below the global notice field, you might put: “HTML support will be removed in a future version” Also when it was disabled, the description still said “HTML allowed”.

@Roman_Rizzi When is the release with the global notice going out?

We discussed about this and we decided to keep the HTML support for the global notice setting, so it’s not going out anytime soon.

Sin HTML en el aviso global

Soporte

Roman (Roman Rizzi) 5 Octubre, 2021 18:17 14

Disculpas por las molestias. Para crear un banner no desechable, consulta este componente del tema:

Es mucho más potente y personalizable que el aviso global.

Tema		Respuestas	Vistas
HTML stopped working for a global notice Support	3	555	5 Octubre 2021
Global Banner No Longer Supports HTML Bug	6	809	29 Diciembre 2019
Target=blank in global notice Support	1	85	24 Diciembre 2024
Write my own Global Alerts Support	8	685	4 Noviembre 2020
Global notice does not appear on some pages Bug	3	1188	5 Agosto 2015

Sin HTML en el aviso global

Temas relacionados