The text shown under the banner on the public page (appearance.text) is typed as raw HTML into a <textarea> (EditText in src/pages/appearance_settings.rs) and rendered with inner_html in src/pages/public.rs. A customer without HTML knowledge can only write one unformatted paragraph, and a mistyped tag can break the page.
The stored HTML is not sanitized. Only an administrator can change it, but it is rendered to every visitor.
Title and text are edited in two dialogs that each carry the other value in a hidden field.
Proposed change
A simple WYSIWYG editor: bold, italic, heading, bullet and numbered list, link. Nothing else (no images, colours, font sizes, tables).
The server sanitizes the HTML before storing it with an allow-list of tags and attributes matching the toolbar (p, br, strong/b, em/i, h2–h4, ul, ol, li, a with href limited to http, https, mailto and tel), e.g. with the ammonia crate. Links get rel="noopener noreferrer".
Existing texts are kept; they go through the same sanitization the first time they are saved.
Title and text are edited directly on the settings page, without the hidden-field dialogs.
Notes
The editor runs only in the browser: contenteditable and anything from web_sys must not run during SSR, and the markup rendered on the server has to match the hydrated one.
To decide during implementation: a small own contenteditable toolbar, or a bundled third-party editor (must be served from assets/, not from a CDN). Prefer the smaller one.
The editor must be usable in the dark theme of the admin portal.
Pasted content (e.g. from Word) is reduced to the allowed formatting by the same sanitization.
Acceptance
Formatted text can be written without knowing HTML and shows the same on the public page.
<script>, event handler attributes, javascript: links and inline styles do not survive saving; covered by unit tests of the sanitization.
Checked in a browser with a full reload, no hydration errors.
Independent of the other appearance issues.
## Current state
- The text shown under the banner on the public page (`appearance.text`) is typed as raw HTML into a `<textarea>` (`EditText` in `src/pages/appearance_settings.rs`) and rendered with `inner_html` in `src/pages/public.rs`. A customer without HTML knowledge can only write one unformatted paragraph, and a mistyped tag can break the page.
- The stored HTML is not sanitized. Only an administrator can change it, but it is rendered to every visitor.
- Title and text are edited in two dialogs that each carry the other value in a hidden field.
## Proposed change
- A simple WYSIWYG editor: bold, italic, heading, bullet and numbered list, link. Nothing else (no images, colours, font sizes, tables).
- The server sanitizes the HTML before storing it with an allow-list of tags and attributes matching the toolbar (`p`, `br`, `strong`/`b`, `em`/`i`, `h2`–`h4`, `ul`, `ol`, `li`, `a` with `href` limited to `http`, `https`, `mailto` and `tel`), e.g. with the `ammonia` crate. Links get `rel="noopener noreferrer"`.
- Existing texts are kept; they go through the same sanitization the first time they are saved.
- Title and text are edited directly on the settings page, without the hidden-field dialogs.
## Notes
- The editor runs only in the browser: `contenteditable` and anything from `web_sys` must not run during SSR, and the markup rendered on the server has to match the hydrated one.
- To decide during implementation: a small own `contenteditable` toolbar, or a bundled third-party editor (must be served from `assets/`, not from a CDN). Prefer the smaller one.
- The editor must be usable in the dark theme of the admin portal.
- Pasted content (e.g. from Word) is reduced to the allowed formatting by the same sanitization.
## Acceptance
- Formatted text can be written without knowing HTML and shows the same on the public page.
- `<script>`, event handler attributes, `javascript:` links and inline styles do not survive saving; covered by unit tests of the sanitization.
- Checked in a browser with a full reload, no hydration errors.
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Independent of the other appearance issues.
Current state
appearance.text) is typed as raw HTML into a<textarea>(EditTextinsrc/pages/appearance_settings.rs) and rendered withinner_htmlinsrc/pages/public.rs. A customer without HTML knowledge can only write one unformatted paragraph, and a mistyped tag can break the page.Proposed change
p,br,strong/b,em/i,h2–h4,ul,ol,li,awithhreflimited tohttp,https,mailtoandtel), e.g. with theammoniacrate. Links getrel="noopener noreferrer".Notes
contenteditableand anything fromweb_sysmust not run during SSR, and the markup rendered on the server has to match the hydrated one.contenteditabletoolbar, or a bundled third-party editor (must be served fromassets/, not from a CDN). Prefer the smaller one.Acceptance
<script>, event handler attributes,javascript:links and inline styles do not survive saving; covered by unit tests of the sanitization.