Thursday, 15 March 2012

javascript - rails-Bootstrap-markdown gem not parsing to html on save -



javascript - rails-Bootstrap-markdown gem not parsing to html on save -

i using bootstrap-markdown add together markdown editor page , save content parsed html in database. problem (although believe should) not save html result raw text instead.

this code:

<div class="well col-md-10 col-md-offset-1"> <%= form_for(:post, :url => {:action => 'create'}) |f| %> <%= f.text_field(:title, class: 'form-control')%> <%= f.text_field(:description, class: 'form-control')%> <%= f.text_area(:content, rows: 15, "data-provide" => "markdown")%> <%= f.button "submit", type: 'submit', class: 'btn col-md-4 col-md-offset-4 btn-large btn-success' %> <% end %> </div>

i have added libraries follows:

//= require jquery //= require bootstrap-sprockets //= require jquery_ujs //= require turbolinks //= require markdown.js //= require to-markdown.js //= require bootstrap-markdown-bundle //= require_tree . *= require_tree . *= require_self *= require bootstrap-markdown

this html output:

<button class="btn col-md-4 col-md-offset-4 btn-large btn-success" name="button" type="submit">submit</button>

...the primary purpose of plugin provide markdown editor

it not intended convert html (conversion from/to html , markdown done 3rd party plugins included bundle). markdown editor, not html editor.

reasons not save html:

1) can not output part of html without breaking layout (in case not closed tags) or using third-party libs prepare chunks;

2) if edit markdown markdown editor - utilize markdown source editing, or 1 day you'll have problems converting , html , markdown, causes info loss + not can converted (this note written on to-markdown.js plugin site).

3) you need prevent possible xss-attacks, have work after storing html, because plugins not save (and storing vulnerable chunks of code not idea, cause you'll have output raw html). anyone can bypass editor , send insecure content, later output on site.

and on , forth...

javascript ruby-on-rails textarea markdown erb

No comments:

Post a Comment