Here's a fun little game for you all!

I'm looking into adding support for using HTML markup in addition to WakabaMark, but since most boards use XHTML, I can't just let through any old HTML, and most people can't write well-formed XHTML. Also, I don't want any cross-site scripting going on. So I've tried to write a piece of code that takes any horribly written piece of HTML, sanitizes it by removing all tags and attributes that are not an approved list, checks the attribute values, and turns it into well-formed XML.

Now I'd like to see if anyone can break this. The objective is to get some Javascript onto the page, or making the page break in Firefox (or any other browser that parses XML strictly), or otherwise causing trouble. Have at it!

http://wakaba.c3.cx/test/sanitize.pl

>>154 YOUdqn!

Why would there be any use in writing actual HTML in posts? Seems to me like it's just inviting abuse.

>>123

Noted. I've been struggling with that same problem for naming things internally in the code, and obviously it distracted me from noticing the same problem in the GUI.

>>151 It's all public domain, I believe.

How come this is now the by far biggest thread on this board?

Maybe it's because I'm posting useless replies like this one!

> change the no-ID-on-email option to no-ID-on-sage
> multi-page links (1-, 101-, 201-, etc) at the top of subpages

Already implemented.

> config.pl parameter to permasage after a certain thread filesize/total number of characters has been reached

Isn't this essentially the same as saying "Please don't talk so much?"

> no EMAIL_ID parameter (most if not everyone uses "Heaven" anyway, and if they really want to change it they can easily find the string in kareha.pl)

The choice of this string is so weird and arbitary, I feel better keeping it as an option so that I can disclaim responsibility!

> better configuration of date and time (with optional timezone offsets), parsing certain characters for individual elements (ie, yyyy/MM/dd(D) hh:mm:ss -5:00:00) and also accepting numerical inputs for fixed dates and times (Eternal September)
> red, bold thread filesize indicator near the bottom of subpages

Pretty useless. I'd rather not waste work and code on something that has no actual use. (Timezone offsets would be useful, but this is such an incredibly hairy issue to get right, I don't want to even try. Just handling Daylight Savings Time would make my head explode, and I can't just leave it out, because then either the admin has to keep changing the offset, or the time will be wrong half the year anyway.)

> non-bolded post numbers
> colons before dates
> colons before names (thread subpages only)

what

And this:

だってよ。

231 ：ひろゆき ◆3SHRUNYAXA ＠どうやら管理人 ★：04/02/05 14:13 ID:???
ハンマー投げゲーム機能つけてみました。
名前の欄に『murofusianasan』と書き込めば
【６０ｍ】とか【７５ｍ】とか記録が出ます。
数値はランダムで０～１００くらいまでありますよ。。。
お暇なら遊んでください。

> You still end up with no way to link the fusianasan post with the name/trip one without IDs enabled (unless the ID method is known and no secret data is used).

You'd figure that people who know what fusianasan is will also know how to trigger IDs.

> You spelled it fusiansan once.

So I misspelled one word once.

Sue me!

> Also, how is Kahera unrivaled when there are still large sites that are not running it? Shiichan is still on world4ch, Thorn on parts of wakachan for example.

Neither world4ch nor Pichan are by any means "large". Also, yes, as Shii said, their webmasters are stubborn.

> Did you ditch customizable capcodes?

No, I removed the dumbass capcode I put in as a demonstration, because I don't like capcodes.

> Using "◆" as the default tripkey character.

I dunno, I always thought that was a kind of big and annoying symbol. Especially when it's so close visually to the question-mark-in-diamond marker some fonts use for characters they don't support.

> How about placing the Formatting menu to the left or right of the "File: " field? I'd also like to see WakabaMark changed to its real name (Markdown).

The File field is almost never there. Also, WakabaMark is similar to, but not the same as Markdown. There are significant differences that make them incompatible (since Markdown is designed to be used when you know you're using it, but WakabaMark tries as best as it can to not do unexpected things if you don't know about it). I might add optional support for real Markdown at some point.

> In Pseud0ch, post numbers should be the same size/format as the rest of the header text

I tried, and it looked much worse than the current solution. Besides, post numbers in Kareha and 0ch aren't the same, since they're clickable here.

> PS. What's "Raw HTML"?

Pretty useless. I'll probably remove it. It's HTML input without turning newlines into <br/>.

> Oh, and "AA mode" should be changed to "Text art mode"

Maybe just "Text art"... hmm.

Additionally, I'd like WakabaMark to be fixed somehow.
I don't know how, though. You know my resentments.

Finally, thanks for your fine work throughout all this time.
It is appreciated!

> Frankly, the combinations of many things into unrelated fields is a design flaw.

I don't think so, not in these cases. What's the alternative? Having a different field for fusianasan, a new checkbox for sage, etc.? That's just cluttering up the interface.

> What if you want to use a name/trip and fusianasan?

Then just make one post with your name/trip and one with fusianasan and let your ID show up in both.
fusiansan is just intended for rare or special cases anyway, as is the whole subject of identification on anonymous message boards.

> What if your email address contains the string 'sage'?

Huh?

> What if you want to sage a thread, but have an ID still?

Then the board has to be configurated to just do that (it already can).

> why should I have to remember something so foreign?

It's rarely needed anyway. Also, these things are pretty easy to remember. "sage" and "fusianasan" is all there is, really.

And this:

だってよ。

231 ：ひろゆき ◆3SHRUNYAXA ＠どうやら管理人 ★：04/02/05 14:13 ID:???
ハンマー投げゲーム機能つけてみました。
名前の欄に『murofusianasan』と書き込めば
【６０ｍ】とか【７５ｍ】とか記録が出ます。
数値はランダムで０～１００くらいまでありますよ。。。
お暇なら遊んでください。

And this:

だってよ。

231 ：ひろゆき ◆3SHRUNYAXA ＠どうやら管理人 ★：04/02/05 14:13 ID:???
ハンマー投げゲーム機能つけてみました。
名前の欄に『murofusianasan』と書き込めば
【６０ｍ】とか【７５ｍ】とか記録が出ます。
数値はランダムで０～１００くらいまでありますよ。。。
お暇なら遊んでください。

> change the no-ID-on-email option to no-ID-on-sage
> multi-page links (1-, 101-, 201-, etc) at the top of subpages

Already implemented.

> config.pl parameter to permasage after a certain thread filesize/total number of characters has been reached

Isn't this essentially the same as saying "Please don't talk so much?"

> no EMAIL_ID parameter (most if not everyone uses "Heaven" anyway, and if they really want to change it they can easily find the string in kareha.pl)

The choice of this string is so weird and arbitary, I feel better keeping it as an option so that I can disclaim responsibility!

> better configuration of date and time (with optional timezone offsets), parsing certain characters for individual elements (ie, yyyy/MM/dd(D) hh:mm:ss -5:00:00) and also accepting numerical inputs for fixed dates and times (Eternal September)
> red, bold thread filesize indicator near the bottom of subpages

Pretty useless. I'd rather not waste work and code on something that has no actual use. (Timezone offsets would be useful, but this is such an incredibly hairy issue to get right, I don't want to even try. Just handling Daylight Savings Time would make my head explode, and I can't just leave it out, because then either the admin has to keep changing the offset, or the time will be wrong half the year anyway.)

> non-bolded post numbers
> colons before dates
> colons before names (thread subpages only)

what

>>305

Shift-reload already! Also, most people are familiar with "More options..." links and know when and when not to click them. I might see about styling it, though.

> Put the Entire thread link on the top of the thread, not the bottom.

Well, since the current update has removed almost all links to entire threads, I won't do THAT, but I guess a Last 50 link could be snuck in somewhere... Maybe the thread title should be an l50 link?

Copyright only applies to the literal code, not to features, ideas, or algorithm. Patents do, to some extent, but that's not the issue here. Since I'm not going to write the exact same code, there's little they can do.

This my just be me, but I'd like a link to the entire thread in karaha at the top of threads.

>>183

No, that's just plain wrong. It is very much the job of the programmer to decide on such issues, and make sure they work consistently across boards.

>>63
Nevermind, the issues seem to have resolved themselves within the hour of the new version being uploaded.

More stuff:

To more closely resemble the 2ch look, how about prefixing thread title headers in the main board page with a 【position:postcount】thingie?

And as suggested before, the navigation links on the bottom of individual thread pages should include "Previous 100" (ie, all posts before the first post in the URL) and "Next 100" (ie, all posts after the last post in the URL). Of course, this could get screwy if you're using reverse order and out-of-order posts in the URL, so I dunno how well it could be implemented.

The "First 100" link should also be removed from the bottom of individual thread pages, and there should be a link to to thread-list included below the reply box of each previewed thread on the front page.

Bonus:

Change "Del" links to widget buttons.

In order for the CSS selector not to take over the entire header, how about turning it into a drop-down menu? The same could be done with the Admin functions (appearing only after one correctly inputs the password), placing it on the right side of the board and thread title headers (this would also allow admins the convenience of deleting and permasaging threads from the front-page).

and would something like this work (given that all boards share the same root directory)?

>>>>sup/1129153864/1-100
>>>1129153864/1-100

P.S. When you mentioned serving dynamic pages in >>46, were you referring to individual thread pages? As I mentioned before, it'd be nice to make the front page as dynamic and flexible as thread pages when it comes to viewing options (via PATH_INFO).

Weird, ¦ now stays ¦.
Testing #¦ now.

>>249 Then the default should be no markup.

Oops, here's the screenshot. orz

>>209

>> More information on the all threads page, date of the last post? file size?

Well, I had already proposed the filesize indicator in >>208, but optimally I would actually prefer that subback resemble the one in 0ch (ie, same as the main page thread list, but without CSS).

And single-post links don't include the thread's first post anyway, so there's no need for >>n. Quoting an entire post is not wise either.

>>211

>Isn't this essentially the same as saying "Please don't talk so much?"

In a sense, yes. Just like the postcount limit could be interpreted as "Please don't talk so long".

>what

main page -- 161 Name：◆WAHa.06x36：2005/10/21(Fri) 14:44 ID:Heaven
subpage -- 4 ：◆WAHa.06x36：2005/10/21 14:44 ID:Heaven

Question: does Kareha have a 1001th post message like "Name: 1001:Over 1000 Thread" for when a thread exceeds its postcount limit?

> He meant saging a thread just because a part of the actual e-mail address contains the word "sage."
> You know, like [email protected].

Well, then you are out of luck, aren't you? So you want to enter your E-Mail but cannot because then the post wouldn't bump then? Solution: Write it in the comment field, problem fixed.
There is no reason to change well-known keywords for this or even turn this into a frustratingly unconvenient tickbox/checkbox.

> I'd like to have the interface reduced to what is absolutely neccessary

That's why there is a "More options..." link, instead of putting the controls there on every single thread everywhere.

> Would it maybe make sense to make a separate thread creation page?

Considering that the ratio of users who start new threads to those who don't is pretty small on most message boards, I think it does.
A seperate page could also be used to put a more visible disclaimer/set of rules, as a seperate page with a different layout is likely to generate more attention from the user. Stuff that can be put there also wouldn't clutter up the frontpage.
I don't think this is an urgent matter, though.