Add-on Redactor Editor

[Robbo]

If I had time I would undertake something like this because this editor frustrates me a lot as well. And so do all editors other than redactor. I have it working in backends and it is very smooth especially with how it handles adding images. Redactor + plugins to do some nice things for forums could be very good.

 

[cclaerhout]

I've never really understood why we need to use bbCode as an intermediary, or anywhere at all. It just seems like an unnecessary middle-man when a small subset of white listed HTML tags could do the same thing.

Because that middle-man is your best bodyguard to avoid any problems with html injection. A white list of html tags? It's not a really open system (you can't create anymore any customized tags) and it is difficult to efficiently protect. Any html in messages should be avoided if you don't have a full control on which members can use it. Now there are other systems than BbCodes such as Markdown and WikiText, but I'm not sure it would be better...

 

[TrevC]

Because that middle-man is your best bodyguard to avoid any problems with html injection. A white list of html tags? It's not a really open system (you can't create anymore any customized tags) and it is difficult to efficiently protect. Any html in messages should be avoided if you don't have a full control on which members can use it. Now there are other systems than BbCodes such as Markdown and WikiText, but I'm not sure it would be better...

Thanks for the insight Cédric. That makes sense. However, it seems other sites (Tumblr being a good example) seem to manage fine with out bbCode. I assume they must have fairly robust fail-safes to sanitize HTML, prevent code-injection, etc?

I acknowledge that my goals may be different than some, but I do believe the vast majority of forum-goers and communities simply don't need access to bbCode or HTML in any form. Sure, the older forum-goers and technical users enjoy editing code, but I think that's quickly becoming a very edge-case scenario.

In the context of a forum where users would not see or interact with any markup, is something like bbCode still required for that layer of security? Is a bbCode parser really that much safer than an HTML parser?

Is there perhaps an even simpler way to provide something along the lines of an enhanced textarea (which would insert only pre-defined HTML snippets)? Could a purely client-side(JS) solution insert hidden markers for the server to process in to pre-defined HTML output?

How many people really need more than the following buttons: bold, italic, lists, quotes, links, smilies, attachments?

I suppose the bottom-line is this: I think it's time to re-evaluate how visitors are actually using the text editor on a modern forum. Having better mobile support, like a plain textarea (with a few added perks) would seem far more valuable than a "full featured" editor like TinyMCE, which is bandwidth heavy and still uses a rats-nest of 1990's tables to display a basic toolbar.

 

[Robbo]

Bbcode isn't there just to stop injections... it's not hard to limit what html can be used...

 

[cclaerhout]

In the context of a forum where users would not see or interact with any markup, is something like bbCode still required for that layer of security? Is a bbCode parser really that much safer than an HTML parser?

In XenForo all posts are saved with BbCodes. When opening a message a safe html parser will format them inside the RTE . When saving the HTML message (From TinyMCE structure) will be converted to BbCodes using a BbCode parser. So the solution already exists inside XenForo and is invisible for RTE users.

I'm not sure what you're calling html parser, but the html is parsed by your browser. A BbCode 'coding [html=>bbcode]/decoding [bbcode=>html]' system is an extra layer that controls what must or not be parsed.

 

[TrevC]

My apologies. I'm fairly knowledgeable, but that skill-set and experience really only spans the realm from Photoshop to modern website front-end work (think HTML5, Sass, etc). I'm not much of a developer, but have a better understanding than most designers

By HTML "parser" I was actually trying to refer to any security-type functions that sanitise user HTML (whether directly input or auto-generated) for output.

On an unrelated note: where does TinyMCE define all of the crazy toolbar and buttons output HTML? Can I re-write this template somewhere?

 

[cclaerhout]

On an unrelated note: where does TinyMCE define all of the crazy toolbar and buttons output HTML? Can I re-write this template somewhere?

In the Tiny Mce main js file... and trust me you don't want to edit it ^^ But you can have a look in tiny_mce_src.js

 

[TrevC]

I was afraid you were going to say that. I'd been assuming that file was a "compiled" version of it sourced from an actual template.

 

[cclaerhout]

I was afraid you were going to say that. I'd been assuming that file was a "compiled" version of it sourced from an actual template.

Before doing anything and spend too much time to do it, you should wait:
1) The settlement conference, since it appears it's the next big event of the "IB/XenForo" case (hoping the next date won't be 2 months later). So we can dialogue with the developers...
2) The next version of TinyMCE is almost done and should be mostly compatible with addons (so with XenForo modifications)

When can we see the TinyMCE 4.0 ? or preview or schedule...

It's about 95% done so very soon.

Source

Some API changes will happen so we will provide an migration guide. But most of the API will be the same.

Source

 

[TrevC]

Yeah, I can't really afford to be hacking apart TinyMCE. It would waste too much time.

Honestly, I could almost switch-off TinyMCE site-wide and use the textarea. The biggest complaint would be that "there's no smilies". Strange but true

 

[Xarcell]

Redactor changed there license and now it's just way to expensive.

 

[Sage Knight]

Redactor changed there license and now it's just way to expensive.

If a dev bought the OEM licence, they're eligible to use them on their products for their customers.

http://imperavi.com/redactor/download/

 

[rdn]

Yeah, I can't really afford to be hacking apart TinyMCE. It would waste too much time.

Honestly, I could almost switch-off TinyMCE site-wide and use the textarea. The biggest complaint would be that "there's no smilies". Strange but true

How can I do that on certain themes only?

 

[TrevC]

Redactor changed there license and now it's just way to expensive.

I don't think it's too expensive. If development continues at a reasonable pace, perhaps with better iOS support, I'd happily pay $500+ for a nicer editor. TinyMCE needs to go, ASAP.

 

[Robbo]

I'll be getting a developer license soon and if I find the time see if I can make it work with XenForo. If I can then I would either get an OEM license or if I couldn't afford it do a kickstarter to get the money.

 

[Robbo]

Actually just realized I could use their developer license if I sell the add-on, I need one of the others if I release for free.

 

[Xarcell]

I don't think it's too expensive. If development continues at a reasonable pace, perhaps with better iOS support, I'd happily pay $500+ for a nicer editor. TinyMCE needs to go, ASAP.

If you want a nice editor, one that's free, try Sam Clarke's Editor: http://www.sceditor.com/

The toolbar could use a make over, but I prefer it now over Redactor.

 

[cclaerhout]

If you want a nice editor, one that's free, try Sam Clarke's Editor: http://www.sceditor.com/

The toolbar could use a make over, but I prefer it now over Redactor.

It looks very nice and is well documented. It could be a good complement to full editor.

 

[MOZ]

And it is a BBCode Editor

 

[TrevC]

It looks very nice and is well documented. It could be a good complement to full editor.

Notice how nicely it handles [ quote ] [ /quote ] too? No nasty markup exposed to average users

Good find.