Extension:SecureHTML

**MediaWiki extensions manual**
SecureHTML; Release status: beta
Implementation	Tag, User rights
Description	This extension securely inserts HTML section(s) or pages on a wiki page.
Author(s)	Jean-Lou Dupont
Latest version	2.3.0
MediaWiki	1.10.0 - 1.15.x
Licence	No licence specified
Download	Download extension ; Git [?]: Browse repository (GitHub); Gerrit code review; Git commit log; Download source tarball;
	Translate the SecureHTML extension if it is available at translatewiki.net

This extension allows editors to add HTML section(s) or pages on a wiki page. This extension can only be used on protected pages, but allows an editor to add a protected template on an unprotected, editable page. The extension uses the '$wgRawHtml' global variable of Mediawiki.

Features

Cascading: if the base page is allowed to use 'html' tags, then all included pages will be processed as if they could.
Namespace exemption: configured namespaces are exempted from 'protection' requirement
Parser cache friendliness:
- The extension must be enabled to continue the support of the inserted content
Support for the parser function {{#html}}
{{#shtml}} is very well suited for securely embedding widgets such as the ones created with SproutBuilder or GoogleGadgets.
- The page where the shtml parser function is used does not need to be protected but the template page where the javascript/html widget code is located must though.
- This behavior makes it easy for administrator to allow selected widgets to be included by the user population of the wiki

Usage

< html> tag

Use the standard <html> tags (see Manual:$wgRawHtml) within a protected page. One can either protect the page before or after the inclusion of the said tag(s).
Complete usage example for using iframes tag:

<html><iframe src="http://stim.com/" width=600 height=500></iframe></html>

{{ #html}} parser function

Use: {{#html:page_name [|optional parameters]}} where:

page_name is the page name of the article to include
optional parameters are of the form:
- param_x = value_x | param_y = value_y

The page where this parser function is used must be edit protected.

{{ #shtml }} parser function

Same usage as for #html with difference that the origin page where this parser function is used does not need to be edit protected. The target page's edit protection attribute ensures security.

Example

Test Page

{{#html:Template:Page1|param1=value1}}

Template:Page1

This parameter will be replaced when called from Test:Page >> {@{param1}@}

Required extensions

StubManager extension
ParserFunctionsHelper extension is optional and only required for the parser function #shtml

Template:Pear

Reason for the {{ #html}} parser function

It is sometimes useful to include, in a secure fashion, a template containing 'raw html' in another page. This enables, for example, the construction of gadgets.

Through the added functionality of parameterization using the {@{parameter_here}@}, the said templates can be customized on a per-page basis without resorting to convoluted escape patterns (e.g. </html>{{{parameter_here}}}<html>) which renders page viewing difficult to humans.

History

added namespace exemption functionality i.e. namespaces where article do not need to be protected in order to use 'html' tags
- use SecureHTMLclass::enableExemptNamespaces = false; to turn off
- use SecureHTMLclass::exemptNamespaces[] = NS_XYZ; to add namespaces
enhanced with functionality to 'add' content to the document's 'head' section
Removed dependency on ExtensionClass
Enabled for 'StubManager'
Added 'addExemptNamespaces' function

1.1.0

Added, by default, NS_MEDIAWIKI namespace to the exemptNamespaces

2.0.0

Addition of the parser function {{ #html}}

2.1.0

Addition of the parser function #shtml (requires Extension:ParserFunctionsHelper)

Todo

Fix for allowing more customization of 'exempt' namespaces even when using StubManager
Think about renaming the extension to be more distinct from Extension:Secure HTML