Extension:Secure HTML - Revision history

Tenshi Hinanawi: Undid edits by ~2025-35609-0 (talk) to last version by NDG: unexplained content removal

2025-11-03T15:48:19Z

Undid edits by ~2025-35609-0 (talk) to last version by NDG: unexplained content removal

@@ Line 93: / Line 93: @@
 $wgSecureHTMLSpecialDropdown = False;
 </syntaxhighlight>
 ==See also==

~2025-35609-0: algorithms /

2025-11-03T15:47:07Z

algorithms /

@@ Line 93: / Line 93: @@
 $wgSecureHTMLSpecialDropdown = False;
 </syntaxhighlight>
 ==See also==

NDG: Undid edits by ~2025-35609-0 (talk) to last version by Tenshi Hinanawi: unexplained content removal

2025-11-03T15:46:31Z

Undid edits by ~2025-35609-0 (talk) to last version by Tenshi Hinanawi: unexplained content removal

@@ Line 36: / Line 36: @@
 If the user uses a valid shared secret to build the hashed {{tag|shtml|open}} snippet and includes it in a wiki page, the snippet is rendered as the raw HTML contained within the tag.  If the shared secret is invalid, the snippet is rendered as an error message (but does not contain the HTML).
 * Go to ''Special:SecureHTML'' and use the page to create a hashed snippet of raw HTML using the key secrets defined.
 * Add the hashed snippet to your desired wiki page.
@@ Line 43: / Line 51: @@
 == Configuration ==
-Secure HTML uses HMAC digests to sign a piece tag, using a shared secret key.  The $wgSecureHTMLSecrets configuration array may have multiple shared secrets and is
+Secure HTML uses HMAC digests to sign a piece of raw HTML in a {{tag|shtml|open}} tag, using a shared secret key.  The $wgSecureHTMLSecrets configuration array may have multiple shared secrets and is in the format:
 == Usage ==

~2025-35609-0: /Configuration /

2025-11-03T15:46:17Z

/Configuration /

@@ Line 43: / Line 43: @@
 == Configuration ==
-Secure HTML uses HMAC digests to sign a piece of raw HTML in a {{tag|shtml|open}} tag, using a shared secret key.  The $wgSecureHTMLSecrets configuration array may have multiple shared secrets and is in the format:
+Secure HTML uses HMAC digests to sign a piece tag, using a shared secret key.  The $wgSecureHTMLSecrets configuration array may have multiple shared secrets and is
 == Usage ==

~2025-35609-0: /Installation /

2025-11-03T15:45:01Z

/Installation /

← Older revision		Revision as of 15:45, 3 November 2025
Line 36:		Line 36:
	If the user uses a valid shared secret to build the hashed {{tag\|shtml\|open}} snippet and includes it in a wiki page, the snippet is rendered as the raw HTML contained within the tag. If the shared secret is invalid, the snippet is rendered as an error message (but does not contain the HTML).		If the user uses a valid shared secret to build the hashed {{tag\|shtml\|open}} snippet and includes it in a wiki page, the snippet is rendered as the raw HTML contained within the tag. If the shared secret is invalid, the snippet is rendered as an error message (but does not contain the HTML).

	== Installation ==
	Secure HTML is compatible with MediaWiki 1.23 and later.

	{{ExtensionInstall\|SecureHTML\|registration=1\|localsettings=
	$wgSecureHTMLSecrets = [
	'keyname' => 'keysecret',
	];
	\|custom-steps=
	* Modify $wgSecureHTMLSecrets as per below.
	* Go to ''Special:SecureHTML'' and use the page to create a hashed snippet of raw HTML using the key secrets defined.		* Go to ''Special:SecureHTML'' and use the page to create a hashed snippet of raw HTML using the key secrets defined.
	* Add the hashed snippet to your desired wiki page.		* Add the hashed snippet to your desired wiki page.

Tenshi Hinanawi: Undid edits by ~2025-35609-0 (talk) to last version by Kghbln: unexplained content removal

2025-11-03T15:44:29Z

Undid edits by ~2025-35609-0 (talk) to last version by Kghbln: unexplained content removal

← Older revision		Revision as of 15:44, 3 November 2025
Line 27:		Line 27:
	The extension uses a special page, ''Special:SecureHTML'' which helps you build a tag, {{tag\|shtml\|open}}, which acts as a wrapper around raw HTML.		The extension uses a special page, ''Special:SecureHTML'' which helps you build a tag, {{tag\|shtml\|open}}, which acts as a wrapper around raw HTML.

			==Example==

			<syntaxhighlight lang="html">
			<shtml
			hash="7fa503206cb1de131dd6acdca576e92262dd6d176cc3466073a343863743b8ed"
			><strong>Hello world!</strong></shtml>
			</syntaxhighlight>

	If the user uses a valid shared secret to build the hashed {{tag\|shtml\|open}} snippet and includes it in a wiki page, the snippet is rendered as the raw HTML contained within the tag. If the shared secret is invalid, the snippet is rendered as an error message (but does not contain the HTML).		If the user uses a valid shared secret to build the hashed {{tag\|shtml\|open}} snippet and includes it in a wiki page, the snippet is rendered as the raw HTML contained within the tag. If the shared secret is invalid, the snippet is rendered as an error message (but does not contain the HTML).

~2025-35609-0: /Example /

2025-11-03T15:44:06Z

/Example /

← Older revision		Revision as of 15:44, 3 November 2025
Line 27:		Line 27:
	The extension uses a special page, ''Special:SecureHTML'' which helps you build a tag, {{tag\|shtml\|open}}, which acts as a wrapper around raw HTML.		The extension uses a special page, ''Special:SecureHTML'' which helps you build a tag, {{tag\|shtml\|open}}, which acts as a wrapper around raw HTML.


	==Example==
	<syntaxhighlight lang="html">
	<shtml
	hash="7fa503206cb1de131dd6acdca576e92262dd6d176cc3466073a343863743b8ed"
	><strong>Hello world!</strong></shtml>
	</syntaxhighlight>

	If the user uses a valid shared secret to build the hashed {{tag\|shtml\|open}} snippet and includes it in a wiki page, the snippet is rendered as the raw HTML contained within the tag. If the shared secret is invalid, the snippet is rendered as an error message (but does not contain the HTML).		If the user uses a valid shared secret to build the hashed {{tag\|shtml\|open}} snippet and includes it in a wiki page, the snippet is rendered as the raw HTML contained within the tag. If the shared secret is invalid, the snippet is rendered as an error message (but does not contain the HTML).

Kghbln: redact a bit

2024-11-22T17:08:07Z

redact a bit

← Older revision		Revision as of 17:08, 22 November 2024
Line 20:		Line 20:
	\|example = [[finnix:Support_Finnix\|{{tag\|shtml\|open}} tag (PayPal forms)]], [[finnix:Special:SecureHTML\|Special:SecureHTML]]		\|example = [[finnix:Support_Finnix\|{{tag\|shtml\|open}} tag (PayPal forms)]], [[finnix:Special:SecureHTML\|Special:SecureHTML]]
	}}		}}
			The '''Secure HTML''' extension lets you include arbitrary HTML in an authorized and secure way

			== Rationale ==
	Occasionally you need to display [[w:HTML\|HTML]] within a wiki, but allowing it site-wide opens you up to various [[w:cross-site scripting\|XSS]] attacks. This extension solves that problem by letting you specify arbitrary HTML, but only if the HTML includes a corresponding hash ~~that is~~ created by signing the HTML input with a secret ~~that~~ only authorized people know.		Occasionally, you need to display [[w:HTML\|HTML]] within a wiki, but allowing it site-wide opens you up to various [[w:cross-site scripting\|XSS]] attacks. This extension solves that problem by letting you specify arbitrary HTML, but only if the HTML includes a corresponding hash created by signing the HTML input with a secret only authorized people know.

	The extension uses a special page, ''Special:SecureHTML'' which helps you build a tag, {{tag\|shtml\|open}}, which acts as a wrapper around raw HTML.		The extension uses a special page, ''Special:SecureHTML'' which helps you build a tag, {{tag\|shtml\|open}}, which acts as a wrapper around raw HTML.
Line 32:		Line 34:
	</syntaxhighlight>		</syntaxhighlight>

	If the user uses a valid shared secret to build the hashed {{tag\|shtml\|open}} snippet and includes it in a wiki page, the snippet is rendered as the raw HTML contained within the tag. If the shared secret is invalid, the snippet is rendered as an error message (but not ~~containing~~ the HTML~~, obviously~~).		If the user uses a valid shared secret to build the hashed {{tag\|shtml\|open}} snippet and includes it in a wiki page, the snippet is rendered as the raw HTML contained within the tag. If the shared secret is invalid, the snippet is rendered as an error message (but does not contain the HTML).

	== Installation ==		== Installation ==
Line 38:		Line 40:

	{{ExtensionInstall\|SecureHTML\|registration=1\|localsettings=		{{ExtensionInstall\|SecureHTML\|registration=1\|localsettings=
	$wgSecureHTMLSecrets = ~~array(~~		$wgSecureHTMLSecrets = [
	'keyname' => 'keysecret',		'keyname' => 'keysecret',
	);		];
	\|custom-steps=		\|custom-steps=
	* Modify $wgSecureHTMLSecrets as per below.		* Modify $wgSecureHTMLSecrets as per below.
Line 49:		Line 51:
	== Configuration ==		== Configuration ==

	Secure HTML uses HMAC digests to sign a piece of raw HTML in a {{tag\|shtml\|open}} tag, using a shared secret key. The $wgSecureHTMLSecrets configuration array may have multiple shared secrets, and is in the format:		Secure HTML uses HMAC digests to sign a piece of raw HTML in a {{tag\|shtml\|open}} tag, using a shared secret key. The $wgSecureHTMLSecrets configuration array may have multiple shared secrets and is in the format:

	<syntaxhighlight lang="php">		<syntaxhighlight lang="php">
	$wgSecureHTMLSecrets = ~~array(~~		$wgSecureHTMLSecrets = [
	'Wiki admin' => 'zX6Zn2WRKlQt',		'Wiki admin' => 'zX6Zn2WRKlQt',
	'developers' => '7RCkFRjw68CL',		'developers' => '7RCkFRjw68CL',
	'Support department' => 'NL9g5QntWNbC',		'Support department' => 'NL9g5QntWNbC',
	);		];
	</syntaxhighlight>		</syntaxhighlight>

Line 78:		Line 80:
	</syntaxhighlight>		</syntaxhighlight>

	== ~~Special:SecureHTML~~ ==		== Usage ==

	The special page ''Special:SecureHTML'' is used to build the snippet, specifying the raw HTML, the key secret, and (optionally) the key name. If a key name is not specified, the first entry in $wgSecureHTMLSecrets is assumed. When the form is submitted, the signed ~~snipped~~ is displayed, and an attempt to render the snippet is made. If the key secret is incorrect, ~~this~~ will ~~show you~~ the results immediately, before ~~you try to add~~ the snippet to a page.		The special page ''Special:SecureHTML'' is used to build the snippet, specifying the raw HTML, the key secret, and (optionally) the key name. If a key name is not specified, the first entry in $wgSecureHTMLSecrets is assumed. When the form is submitted, the signed snip is displayed, and an attempt to render the snippet is made. If the key secret is incorrect, you will see the results immediately before adding the snippet to a page.

	Special:SecureHTML is restricted to users ~~who have~~ the 'edit' right; the rationale ~~being~~ the user needs to be able to edit pages anyway to ~~make~~ use of this extension. If you ~~would like~~ to change this right, set $wgSecureHTMLSpecialRight to another right, or set to <nowiki>''</nowiki> to allow anyone to use the special page.		Special:SecureHTML is restricted to users with the 'edit' right; the rationale is that the user needs to be able to edit pages anyway to use this extension. If you want to change this right, set $wgSecureHTMLSpecialRight to another right or set it to <nowiki>''</nowiki> to allow anyone to use the special page.

	Note that this restriction does not provide much extra security. If your MediaWiki installation requires users to be logged in to edit, it does provide superficial protection against anonymous dictionary attacks (checking the preview result) against a key. However, if ~~a user~~ already ~~knows~~ a key secret, they can build the signed snippet manually; the special page is not strictly needed.		Note that this restriction does not provide much extra security. If your MediaWiki installation requires users to be logged in to edit, it does provide superficial protection against anonymous dictionary attacks (checking the preview result) against a key. However, if users already know a key secret, they can build the signed snippet manually; the special page is not strictly needed.

	By default, Special:SecureHTML presents a dropdown list of configured key names to select ~~from~~. If you would rather not show all key names, set the following to turn the field into a freeform text input:		By default, Special:SecureHTML presents a dropdown list of configured key names from which to select. If you would rather not show all key names, set the following to turn the field into a freeform text input:

	<syntaxhighlight lang="php">		<syntaxhighlight lang="php">
Line 94:		Line 96:
	== Hash algorithms ==		== Hash algorithms ==

	Beginning with version 3.0, HMAC hash algorithms are configurable per-key. The default is HMAC SHA256 when the key value is a string (the secret), but may be extended, for example:		Beginning with version 3.0, HMAC hash algorithms are configurable per key. The default is HMAC SHA256 when the key value is a string (the secret), but may be extended, for example:

	<syntaxhighlight lang="php">		<syntaxhighlight lang="php">
	$wgSecureHTMLSecrets = ~~array(~~		$wgSecureHTMLSecrets = [
	'default sha256' => 'vwJ2prl4B4bg',		'default sha256' => 'vwJ2prl4B4bg',
	'custom sha512' => ~~array(~~		'custom sha512' => [
	'algorithm' => 'sha512',		'algorithm' => 'sha512',
	'secret' => 'RZQ8R99C95Xn',		'secret' => 'RZQ8R99C95Xn',
	),		],
	'custom whirlpool' => ~~array(~~		'custom whirlpool' => [
	'algorithm' => 'whirlpool',		'algorithm' => 'whirlpool',
	'secret' => 'FXtN2QHflVPf',		'secret' => 'FXtN2QHflVPf',
	),		],
	);		];
	</syntaxhighlight>		</syntaxhighlight>

	SHA256 should be secure for most purposes, but if you do pick a custom algorithm, be careful ~~with~~ which one you choose. For example, adler32 would be a very bad choice for hashing.		SHA256 should be secure for most purposes, but if you pick a custom algorithm, be careful which one you choose. For example, adler32 would be a very bad choice for hashing.

	Version 1.0 used a simple data + secret MD5 hash which is now considered cryptographically insecure. This format was deprecated in version 2.0 in favor of HMAC SHA256 hashes, and removed in 3.0. Any existing version 1.0 hashes must be converted to new hashes.		Version 1.0 used a simple data + secret MD5 hash, which is now considered cryptographically insecure. This format was deprecated in version 2.0 in favor of HMAC SHA256 hashes and removed in 3.0. Any existing version 1.0 hashes must be converted to new hashes.

	== Internationalization ==

	Translation of the extension strings is managed by [[Translatewiki.net]] ([http://translatewiki.net/w/i.php?title=Special%3ATranslate&taction=translate&group=ext-securehtml direct extension link]). Please contribute translations there.

	==See also==		==See also==

Pppery: -archived

2024-06-18T15:32:28Z

-archived

← Older revision		Revision as of 15:32, 18 June 2024
Line 120:		Line 120:
	==See also==		==See also==
	* {{ll\|HTML_restriction}} - list of extensions that allow for the inclusion of raw HTML		* {{ll\|HTML_restriction}} - list of extensions that allow for the inclusion of raw HTML
	* [[Extension:NamespaceHTML]] - Allows raw HTML in specified namespaces
	* [[Extension:SaferHTMLTag]] - Allows only sysops and certain user groups to edit pages containing the {{tag\|html\|open}} tag		* [[Extension:SaferHTMLTag]] - Allows only sysops and certain user groups to edit pages containing the {{tag\|html\|open}} tag

Kghbln: remove duplicate content

2024-01-10T19:52:30Z

remove duplicate content

← Older revision		Revision as of 19:52, 10 January 2024
Line 46:		Line 46:
	* Add the hashed snippet to your desired wiki page.		* Add the hashed snippet to your desired wiki page.
	}}		}}
	=== Download from Git ===
	{{WikimediaGitCheckout\|SecureHTML}}

	== Configuration ==		== Configuration ==