# User styled posts?

**URL:** https://meta.discourse.org/t/user-styled-posts/89632
**Category:** Support
**Created:** [June 11, 2018, 7:07pm UTC](https://meta.discourse.org/t/user-styled-posts/89632 "2018-06-11T19:07:09Z")
**Posts on this page:** 16
**Page:** 1

<div class="post-metadata">

### Author: ![UncleL](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/unclel/32/119866_2.png) [@UncleL](https://meta.discourse.org/u/UncleL)
#### Post date: [June 11, 2018, 7:07pm UTC](https://meta.discourse.org/t/user-styled-posts/89632/1 "2018-06-11T19:07:09Z")

</div>

I’ve been testing a move to Discourse for my company’s community.

We were on Vanilla but we don’t plan to import it to Discourse.

However, one feature of Vanilla that our community really loves is the ability to write custom CSS, HTML to make styled posts. We have a fairly active group of users who offer design work to other users and they use those types of posts as a way of showing off their skill.

I understand how that activity seems counter to Discourse’ current product, but I’m wondering if anyone has ever successfully figured out a way to allow users to create styled posts on Discourse.

---

<div class="post-metadata">

### Author: ![tophee](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/tophee/32/73406_2.png) [@tophee](https://meta.discourse.org/u/tophee)
#### Post date: [June 11, 2018, 8:21pm UTC](https://meta.discourse.org/t/user-styled-posts/89632/2 "2018-06-11T20:21:10Z")

</div>

Would it help if they could use a limited set of divs which would be defined in site wide CSS?

See here:

> [@How can I whitelist a class in a theme?](https://meta.discourse.org/t/how-can-i-whitelist-a-class-in-a-theme/79520/16):
>
> This is great news! star_struck Well I tried anyway sweat_smile[https://github.com/discourse/discourse/pull/5598](https://github.com/discourse/discourse/pull/5598) PR submitted

---

<div class="post-metadata">

### Author: ![sam](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/sam/32/102149_2.png) [@sam](https://meta.discourse.org/u/sam)
#### Post date: [June 12, 2018, 12:00am UTC](https://meta.discourse.org/t/user-styled-posts/89632/3 "2018-06-12T00:00:49Z")

</div>

Per post CSS would require a custom plugin at the moment, have not seen this request pop up too much over the years.

One thing you could lean on is [Theme Creator, create and show themes without installing Discourse!](https://meta.discourse.org/t/theme-creator-create-and-show-themes-without-installing-discourse/84942) this would allow your community to create full fledged Discourse themes and components.

---

<div class="post-metadata">

### Author: ![UncleL](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/unclel/32/119866_2.png) [@UncleL](https://meta.discourse.org/u/UncleL)
#### Post date: [June 12, 2018, 12:46am UTC](https://meta.discourse.org/t/user-styled-posts/89632/4 "2018-06-12T00:46:59Z")

</div>

Whoa, very cool. Thank you and please keep up the good work

---

<div class="post-metadata">

### Author: ![awesomerobot](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/awesomerobot/32/142900_2.png) [@awesomerobot](https://meta.discourse.org/u/awesomerobot)
#### Post date: [June 12, 2018, 2:11am UTC](https://meta.discourse.org/t/user-styled-posts/89632/5 "2018-06-12T02:11:53Z")

</div>

Also, if someone creates a theme you want to share, your community’s admin can import it and enable anyone in the community to set it as their personal default.

---

<div class="post-metadata">

### Author: ![Kat\_F](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/kat_f/32/161990_2.png) [@Kat\_F](https://meta.discourse.org/u/Kat_F)
#### Post date: [September 14, 2019, 7:28pm UTC](https://meta.discourse.org/t/user-styled-posts/89632/6 "2019-09-14T19:28:02Z")

</div>

Please excuse me for revisiting this. The OP in this thread _was_ the one who created our Community, but is no longer in that position. I admit to being clueless and please excuse me if I’m out of line here, but _is_ there something we can do that will allow users to use .css in threads to make styled opening posts for their topics?

The recent update to close the exploit killed the coding they were using.

I’ve tried to make sense out of what I’ve read here, but it’s a bit beyond me. Is it possible to create a theme that will allow users to use .css in posts without ruining security?

---

<div class="post-metadata">

### Author: ![codinghorror](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/codinghorror/32/110067_2.png) [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [September 14, 2019, 9:49pm UTC](https://meta.discourse.org/t/user-styled-posts/89632/7 "2019-09-14T21:49:10Z")

</div>

> [@Kat\_F](#):
>
> it possible to create a theme that will allow users to use .css in posts without ruining security?

Not really? If you need a full CSS playground that suggests the use of something like [codepen.com](http://codepen.com) versus Discourse.

---

<div class="post-metadata">

### Author: ![Kat\_F](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/kat_f/32/161990_2.png) [@Kat\_F](https://meta.discourse.org/u/Kat_F)
#### Post date: [September 14, 2019, 9:55pm UTC](https://meta.discourse.org/t/user-styled-posts/89632/8 "2019-09-14T21:55:08Z")

</div>

We have an existing Discourse forum.The recent patch killed the styling / coding used to individualize threads (and apparently we are not the only ones). We’d prefer finding a way to allow css or html for things to shutting down our present forum and moving to a new system.

---

<div class="post-metadata">

### Author: ![zogstrip](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/zogstrip/32/512781_2.png) [@zogstrip](https://meta.discourse.org/u/zogstrip)
#### Post date: [September 28, 2019, 3:56pm UTC](https://meta.discourse.org/t/user-styled-posts/89632/9 "2019-09-28T15:56:54Z")

</div>

Can you share your CSS? There might be selectors that were too strict and might need some “broadening”.

---

<div class="post-metadata">

### Author: ![Kat\_F](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/kat_f/32/161990_2.png) [@Kat\_F](https://meta.discourse.org/u/Kat_F)
#### Post date: [September 28, 2019, 4:10pm UTC](https://meta.discourse.org/t/user-styled-posts/89632/10 "2019-09-28T16:10:26Z")

</div>

Right now it’s the standard Discourse with BBcode andBBcode color enabled through Plugin. The ability to use the code was (as I understand) added to the whitelist, but no longer functions since the security update. The irony is that it was us that alerted to the security problem, thus causing the demise of our coding ability. What I have been told we need is a plugin, but I simply have no time or resources to make one myself.

---

<div class="post-metadata">

### Author: ![zogstrip](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/zogstrip/32/512781_2.png) [@zogstrip](https://meta.discourse.org/u/zogstrip)
#### Post date: [September 28, 2019, 4:13pm UTC](https://meta.discourse.org/t/user-styled-posts/89632/11 "2019-09-28T16:13:46Z")

</div>

Mind sharing some examples of BBCode coloring? The whitelisting might be too strict.

---

<div class="post-metadata">

### Author: ![Kat\_F](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/kat_f/32/161990_2.png) [@Kat\_F](https://meta.discourse.org/u/Kat_F)
#### Post date: [September 28, 2019, 4:25pm UTC](https://meta.discourse.org/t/user-styled-posts/89632/12 "2019-09-28T16:25:08Z")

</div>

We’re using these plugins.

[https://github.com/discourse/discourse-bbcode-color/](https://github.com/discourse/discourse-bbcode-color/)  
[https://github.com/discourse/discourse-bbcode](https://github.com/discourse/discourse-bbcode)

Previously `<span>` would allow some thread post modifications. The previous admin added this to the whitelist. A user identified a possible clickjack exploit which I reported and the resulting update killed the ability to use `<span>`. If we whitelist again, it might work but will likely be wiped out in any new updates. This will not happen (or so I’ve been told) with a proper plugin.

---

<div class="post-metadata">

### Author: ![zogstrip](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/zogstrip/32/512781_2.png) [@zogstrip](https://meta.discourse.org/u/zogstrip)
#### Post date: [September 28, 2019, 4:30pm UTC](https://meta.discourse.org/t/user-styled-posts/89632/13 "2019-09-28T16:30:03Z")

</div>

I meant can you share some examples of posts that have some BBCode coloring that aren’t working? These plugins are officials and supported. If they have a bug, we’ll fix it.

---

<div class="post-metadata">

### Author: ![Kat\_F](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/kat_f/32/161990_2.png) [@Kat\_F](https://meta.discourse.org/u/Kat_F)
#### Post date: [September 28, 2019, 4:37pm UTC](https://meta.discourse.org/t/user-styled-posts/89632/14 "2019-09-28T16:37:49Z")

</div>

OK.

The code for clickjacking was discovered by a user and passed on to me.  
I’m not a coder. All I know about the connection was what I was told, specifically:

> please note this is specific to the bbcode and bbcode-color plugins, so it isn’t an issue that affects all Discourse sites. Thanks for bringing it to our attention, we’ll certainly get it fixed.

I’ll send the info via PM as I don’t want to just drop possibly malicious code in public.

---

<div class="post-metadata">

### Author: ![system](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/system/32/443519_2.png) [@system](https://meta.discourse.org/u/system)
#### Post date: [May 20, 2023, 2:09pm UTC](https://meta.discourse.org/t/user-styled-posts/89632/17 "2023-05-20T14:09:42Z")

</div>



---

<div class="post-metadata">

### Author: ![JammyDodger](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/jammydodger/32/254611_2.png) [@JammyDodger](https://meta.discourse.org/u/JammyDodger)
#### Post date: [May 22, 2023, 7:13am UTC](https://meta.discourse.org/t/user-styled-posts/89632/18 "2023-05-22T07:13:20Z")

</div>


