Test wysiwyg and input formats

johnw's picture

Consider input formats and rich-text vs plain editors. Probably people with minimal rights shouldn't be allowed to add full html (e.g. javascript exploits), but should have option to use rich-text wysiwyg.  I (johnw) got in a right pickle going from basic input (with blank lines auto inserting para breaks) to full html (because I wanted to add an <h2> tag) at which point all my para breaks vanished.  This is not good!

Wysiwyg editor seems to have some nasty glitches, as follows:

  • If you start with non-wysiwyg and limited html, then switch to full html with wysiwyg, you lose all your paragraph separators (this is a show-stopper, in johnw's opinion)
  • For authenticated users with minimum privileges, we need to be able to offer them limited html with wysiwyg.  Such users, who've only been validated by captcha, must be assumed to be potentially evil, so full html is out of the question for them (think javascript and other exploits).
  • When full html is selected, the wysiwyg editor is offered, but it seems very limited in what it allows.  This may be a good thing for many users (stops the design-challenged from created a ragbag page in technicolor and a feast of fonts), but it may also be a bad limitation.