[Proposal] Admin option to turn on HTML

[Oreolek]

Here's a code to turn on HTML tags in all worlds (disable HTML escaping):

function create_text_node(val)
{
  return val;
}

This enables the authors to include images and background music and fancy CSS and Javascript things, everything they want to. BUT this is also a great security risk, so don't do it.

What I'm proposing is to make an option for the admin to turn off HTML escaping in a specific world or for a specific user, so that the admin could check that the user is trusted and the world is good and give them the gift of do-whatever-you-want.

This is a great design decision and it would result in a much greater variety and the only reason to have it is to be able to break the house style, but there is a demand for this and we need to discuss it.

[erkyrath]

I understand what you want here, but I don't think this is the right way to approach it.

A simple "admin option" model would mean that some users are completely trusted and others are not, which is a bad fault line. You'd wind up with a lot of pressure to give out HTML access for simple things; also, anybody who had malicious intent would have a low bar of fooling you for a little while.

It's also not a good idea to implement this by changing create_text_node, because that changes the meaning of all text in that world (or for that user, or whatever). You couldn't build a test world and then switch it on safely.

[Oreolek]

It's a cheap way to get a lot of features (like #183, #75, #19, #5 and then some) for little programming manpower, if one's willing to compromise the unified design style and maybe some security concerns. But yes, this is a dirty and highly questionable hack.