This topic has been resolved by the Discourse Team. I’m leaving the original topic up for archival purposes, but this has been resolved by @Roman and the team. I recently rebuilt Discourse to update my SMTP settings and my global notice’s HTML tags are now rendered out. This is what it looks li…

We have re-enabled HTML support on the global notice setting. We want to figure a better way to guarantee a smooth transition. https://github.com/discourse/discourse/pull/14521

Hm, just my 2 cents but the 2 have very different purpose. Global banner is there for a purpose, i.e., when I want to notify the forum about an important topic. If a user has closed the banner this setting stays and they can’t see an update that would otherwise be visible with a global notice.

Yes, we decided to keep the setting because we know how useful it is to a non-dismissable banner during an urgent situation, but allowing unsanitized HTML could be potentially dangerous.

If someone has permissions to set a global notice, then they’re permitted to create a theme component as well? So there is no extra attack vector here?

To be clear, we don’t consider this to be a security issue as only admins can update this setting. It’s part of an ongoing effort to disallow HTML in site settings and use other tools designed to support this.

Let me lay out a case for allowing HTML. I’m working with a client who is starting a forum for investors.(Closed beta started yesterday, as it happens.) Their legal team insists on a disclaimer. It must: Be prominently displayed on every page of the forums. Not be dismissable. In other words, a g…

My initial reasoning for this is for further protection of database entries, mainly because of encoding issues with an old forum I used. Emojis on the forum were converted to &# format and when quoted, would cause “Invalid byte sequence in utf-8” errors upon conversion, and the forum displays the e…

[이미지] jericson: Is there an explanation of the reasoning somewhere? If y’all are working on another tool to support non-dismissable global banners which allow links,[^3] it would be helpful to know when it will be ready. I’d rather avoid having to set up a customization if possible. I apologize…

In the description below the global notice field, you might put: “HTML support will be removed in a future version” Also when it was disabled, the description still said “HTML allowed”.

@Roman_Rizzi When is the release with the global notice going out?

We discussed about this and we decided to keep the HTML support for the global notice setting, so it’s not going out anytime soon.

전역 공지사항에 HTML이 없습니다

제품 지원

Roman (Roman Rizzi) 10월 5, 2021, 6:17오후 14

불편을 드려 죄송합니다. 비닫힘 가능 배너를 생성하려면 다음 테마 컴포넌트를 확인해 주세요:

이것은 전역 공지(Global notice)보다 훨씬 강력하고 커스터마이징이 가능합니다.

글		댓글	조회수
HTML stopped working for a global notice Product Support	2	611	10월 5, 2021
Global Banner No Longer Supports HTML Bug	5	918	12월 29, 2019
Target=blank in global notice Product Support	1	162	12월 24, 2024
Write my own Global Alerts Product Support	7	816	10월 5, 2020
Global notice does not appear on some pages Bug	2	1246	8월 5, 2015

전역 공지사항에 HTML이 없습니다

Related topics