PHPBB3-10418 - WYSIWYG Editor/Rich Text Editor

[exx8]

only as reminder, that a genius solution already exists
viewtopic.php?f=108&t=35703&start=320#p275451

Meaning, it was proven that no harm will be made if it will be the default.
Because most of the users support it, now we need to let it be part of the phpbb official releases.

[DavidIQ]

Shall I bring the context?
Actually, is it relevant if it belongs to the notifications feature or the extensions feature?

Sure is relevant. One is part of the core (notifications) while the other one isn't (extensions) and even for the latter it was only a possible issue for a small fraction of extensions, not to mention the extension needed to be badly written. Nice try though.

The writer meant, that by sending a request to phpbb file, you were able to begin an infinite loop. We can see that he doesn't mean to extensions because, when he begins talking about extensions, he says it clearly:

Further, once you installed an extension,

That makes it pretty clear that it requires an extension and is not an issue on its own. Thanks for clearing that up.

By the way, you have yet to present any vulnerabilities, that will risk the board's security. The only argument you presented is that XSS issues might need to be taken care, though is easy to solve, and actually, there is a php function that deals this exact task.
No really risk for SQL injection or something that risks the database.

As I've said already there is a possibility of XSS when you factor in that this depends on the BBcode work that has been done elsewhere, even though that might not be an issue. Even then the WYSIWYG library could be susceptible to them. If you don't consider XSS to be a security issue then you have no business talking about security.

Also you have not provided anything constructive in this discussion. You've started with a bunch of complaint comments about how phpBB not having a WYSIWYG editor makes it fall behind other products and how it's so useles to not have it, and other things, which do absolutely nothing to help anything at all. If you have nothing constructive to say to help with the completion of the work to get the WYSIWYG editor into 3.2 then there is no reason for you to continue replying. Bottom line is there will be a WYSIWYG editor in 3.2 IF the work is done. If not then expect it in the following version. People complaining like you have don't help that at all. It likely has the opposite effect. Therefore if this derailment of actual RFC discussion continues then those posts, yours or anyone else's, will be deleted.

[Jessica.]

Even though I'm not a fan of WYSIWYG, I'm fine with it being added in phpBB, as long as there's an enable/disable option. I know that SMF has one in the user control panel ("Show WYSIWYG editor on post page by default."), so users can choose (instead of it being the admin).

[brunoais]

The whole idea is to have the SCE editor replacing the current phpBB editor.
This also means all buttons are meant to go away. I will want to get feedback on what users think of it first.
I decided to do it like that because SCE in source code mode is, in fact, (believe it or not) a superset of phpBB's editor.
Unless you have a reason/issue SCE can't properly solve, the current phpBB editor is a goner.

[DavidIQ]

I don't see why it can't be disabled and the old form displayed. It really needs to have a disable option individually at the UCP level and globally at the ACP level as this has been echoed from the very start of this project by many people both here and on the main site and thus is what we would prefer. All you would need to do is have the SCE stuff on one template file and the old form in another. This is part of the reason the current editor already exists in a separate template file.

Also I don't see how SCE, or any other WYSIWYG editor really, would work properly in mobile/responsive mode.

[brunoais]

In my tests, SCE works as well or better on mobile (depends on the browser itself, including the version) than phpBB's editor.

On my plans, there's an ACP option and an UCP option. The ACP option sets the edit and button default modes. The UCP option is the mode for that specific user.
The modes, so far, are RTE/WYSIWYG and source mode.
The button modes are image, image + text and text.
Whether or not it will be an RTE or a WYSIWYG depends on the BBCode definitions in the ACP.

In the ACP's BBCode setup, there are two new fields.
One is used to define how the replacement works for the editor in RTE/WYSIWYG mode. It looks the exact same way as the replacement field except this is for the editor only. This is supposed to be used for BBCode that is too odd or difficult to modify in a full WYSIWYG way. A good example of that is the spoiler tag.
The other is used to send the icon for that BBCode (optional).

Until now, no good reason has been given on why defaulting SCE is a bad idea given the comparison of features of both editors.

[DavidIQ]

Have you tried it on an actual mobile device? Shrinking the browser doesn't count.

[brunoais]

I did, yes. I did it with my own phone. Both with Opera mini and my phone's native browser.

[master412160]

I did, yes. I did it with my own phone. Both with Opera mini and my phone's native browser.

Excellent, got a question that you might have answered already but for custom bbcodes how will these be added to the new SCE editor? Will we have na option to define an icon, order of the new button and all that?

[brunoais]

That's the idea but I don't know if I will include in the first release. The same way as with TextFormatter. The first version will just include the barebones (which is really a LOT already) to have it working for, I hope, most of what you can throw at it.
Using custom icons or any icons at all requires some different handling and extra code which I'm planning to implement for a following installment. For now, just text in the buttons... and I hope to work correctly.

BTW, I'll use this opportunity to give an update on my work.
I'm now at a minor setback related to how buttons work and should work. I'm solving the issue on how to deal with toggleable buttons for inline BBCodes (b, i, u, etc...) and I'm tuning on how to make the automated dropdown making work properly.
After that, I'll start placing the so-needed events to allow best extensibility while impacting performance at the minimal level.
I'm also at the finishing touches on coding for placing emoticons in the editor as I think that the way phpBB structures emoticon list is better than SCE's.