search

lml / sketchily

Embed SVG-edit in Rails HTML forms
MIT License
26 stars 9 forks source link

Completely remove image tool? #7

Closed Dantemss closed 11 years ago

Dantemss commented 11 years ago

The way sketchily_show displays svg images (inside img tags), links and scripts are disabled, so the image tool will not work, ever.

I'm thinking I should disable the image tool by default, but should I instead completely remove it?

For an explanation as to why we need to display svg's in a safe way, visit: http://golem.ph.utexas.edu/~distler/blog/files/evil.svg (no it will not kill your computer)

jpslav commented 11 years ago

Is this for users embedding images into their drawing or for the background images. I care more about background images working.

Is the problem due to the encoding of the displayed SVG? If so, I'd recommend just disabling the image tool and providing a way for users to not use the encoded form of the SVG image (this would definitely not be the default and it'd be at their own risk).

JP

On Mar 5, 2013, at 12:05 PM, Dantemss notifications@github.com wrote:

The way sketchily_show displays svg images (inside img tags), links and scripts are disabled, so the image tool will not work, ever.

I'm thinking I should disable the image tool by default, but should I instead completely remove it?

For an explanation as to why we need to display svg's in a safe way, visit: http://golem.ph.utexas.edu/~distler/blog/files/evil.svg

— Reply to this email directly or view it on GitHub.

Dantemss commented 11 years ago

This is for users embedding images (backgrounds are already working in the editor and I'm adding them to the show function in the next version). I actually figured out how to fix this by forcing svg-edit to always embed images into the svg instead of linking to them.