X-Git-Url: https://sipb.mit.edu/gitweb.cgi/ikiwiki.git/blobdiff_plain/96125d8da512d992012560a1115eb3a8115bafbe..068fa7d079195d66ade6728963d9f9102588d09c:/doc/plugins/htmlscrubber.mdwn diff --git a/doc/plugins/htmlscrubber.mdwn b/doc/plugins/htmlscrubber.mdwn index 8e37a5bd5..0aa0ab3c0 100644 --- a/doc/plugins/htmlscrubber.mdwn +++ b/doc/plugins/htmlscrubber.mdwn @@ -17,12 +17,16 @@ While I believe that this makes ikiwiki as resistant to malicious html content as anything else on the web, I cannot guarantee that it will actually protect every user of every browser from every browser security hole, badly designed feature, etc. I can provide NO WARRANTY, like it says -in ikiwiki's [GPL](GPL) license. +in ikiwiki's [[GPL]] license. The web's security model is *fundamentally broken*; ikiwiki's html sanitisation is only a patch on the underlying gaping hole that is your web browser. +Note that enabling or disabling the htmlscrubber plugin also affects some other +HTML-related functionality, such as whether [[meta]] allows potentially unsafe +HTML tags. + ---- Some examples of embedded javascript that won't be let through when this