In a discussion titled ‘User styled posts?’, users explore whether Discourse can support user-created styled posts using custom CSS or HTML, similar to a feature previously available in Vanilla forums. UncleL initiated the thread seeking a workaround, noting their community values design showcases. tophee suggested using whitelisted divs via site-wide CSS, while sam noted that per-post CSS would require a custom plugin, and pointed to the Theme Creator as an alternative for community-designed themes. Later, Kat_F, now managing the forum, explained that a recent security update disabled previously allowed styling (via <span> tags and BBCode plugins), which users relied on for personalized topic openers. codinghorror cautioned that allowing full CSS in posts compromises security and recommended external tools like CodePen. zogstrip offered to review their CSS or BBCode examples to see if selectors could be adjusted, but Kat_F clarified that the issue stems from whitelisting being revoked post-security patch, and that a proper plugin is needed for lasting support. zogstrip reassured that official BBCode plugins are supported and bugs can be fixed — Kat_F agreed to share examples privately to avoid exposing potential exploits. The consensus is that while Discourse doesn’t natively support user CSS in posts, community themes or official plugin fixes may offer partial solutions — though full styling freedom remains incompatible with Discourse’s security model.
I’ve been testing a move to Discourse for my company’s community.
We were on Vanilla but we don’t plan to import it to Discourse.
However, one feature of Vanilla that our community really loves is the ability to write custom CSS, HTML to make styled posts. We have a fairly active group of users who offer design work to other users and they use those types of posts as a way of showing off their skill.
I understand how that activity seems counter to Discourse’ current product, but I’m wondering if anyone has ever successfully figured out a way to allow users to create styled posts on Discourse.
Also, if someone creates a theme you want to share, your community’s admin can import it and enable anyone in the community to set it as their personal default.
Please excuse me for revisiting this. The OP in this thread was the one who created our Community, but is no longer in that position. I admit to being clueless and please excuse me if I’m out of line here, but is there something we can do that will allow users to use .css in threads to make styled opening posts for their topics?
The recent update to close the exploit killed the coding they were using.
I’ve tried to make sense out of what I’ve read here, but it’s a bit beyond me. Is it possible to create a theme that will allow users to use .css in posts without ruining security?
We have an existing Discourse forum.The recent patch killed the styling / coding used to individualize threads (and apparently we are not the only ones). We’d prefer finding a way to allow css or html for things to shutting down our present forum and moving to a new system.
Right now it’s the standard Discourse with BBcode andBBcode color enabled through Plugin. The ability to use the code was (as I understand) added to the whitelist, but no longer functions since the security update. The irony is that it was us that alerted to the security problem, thus causing the demise of our coding ability. What I have been told we need is a plugin, but I simply have no time or resources to make one myself.
Previously <span> would allow some thread post modifications. The previous admin added this to the whitelist. A user identified a possible clickjack exploit which I reported and the resulting update killed the ability to use <span>. If we whitelist again, it might work but will likely be wiped out in any new updates. This will not happen (or so I’ve been told) with a proper plugin.
I meant can you share some examples of posts that have some BBCode coloring that aren’t working? These plugins are officials and supported. If they have a bug, we’ll fix it.
The code for clickjacking was discovered by a user and passed on to me.
I’m not a coder. All I know about the connection was what I was told, specifically:
please note this is specific to the bbcode and bbcode-color plugins, so it isn’t an issue that affects all Discourse sites. Thanks for bringing it to our attention, we’ll certainly get it fixed.
I’ll send the info via PM as I don’t want to just drop possibly malicious code in public.