Forums

I've been working on a similar Node editing module. I noticed that your editor has a similar problem as my initial rough take on it where a user might enter something that would look like an html tag say "<foo" and the result would be an invisible uneditable node.

Do you have plans to address this? Also, are there plans to make this more extensible, say with a select box or autocomplete?

I added a bug in your issue tracker with more details as to how this can potentially be exploited to cause a XSS attack.

Unfortunately, the best way to address this is probably to set up a whitelist of allowed tags and attributes, but this has to be processed prior to setting innerHTML. This is a REALLY tricky area.

I'd like to see enhancements like:
* Highlighting the editable node on mouseenter (not all nodes are going to say "edit me!")
* Configurable editors including but not limited to text, textarea (or even a rich text editor), select box, radio buttons, checkboxes, and autocomplete. Some of these you already have.
* An IO plugin that will contact the server to inform it of the change. This may be synchronous or asynchronous.