3

Assume you're building a bulletproof CMS for your company. Cost, time, and technology are no issue. You've got developers ready to go with the knowledge and experience to crank out outstanding code.

Now, you have to answer the age old CMS question: what steps do you take to ensure that the code entered into the CMS by the user is acceptable for your site? I'm thinking beyond just technically escaping a string to make it able to go into a database--there are considerations for w3 standards, filtering for inappropriate content, spelling, and such conundrums as Microsoft Word code scrubbing. Certainly, there are concerns that I've missed...

Improve this question
3
  • Is your question more about "What are things to consider" vs "How to actually safeguard against x, y & z"? I feel like the first question would be a good Community Wiki. There are a lot of variables to consider for the second question. – jessegavin Aug 6 '10 at 15:25
  • Jesse, I would say it's mostly about things to consider, but I'm always interested in the solutions to the concerns. If someone has a list of tools they use, perhaps the tools could highlight the bigger picture considerations. BTW, Go Gophers! – bpeterson76 Aug 6 '10 at 15:54
  • I've converted this to wiki, as there clearly is no possibility for a single correct answer. – Tim Post Aug 6 '10 at 16:01
1

I think the question here is:

"How do I get exactly what I want from my users by making input absurdly easy for them"

The only instance where I see users actually needing to use HTML directly in some form of input is when / if they are formatting tabular data. However, in that case, its much easier to give them a form that can do the same, or any one of the popular grids available in various libraries.

I think the golden rule, at least for me is, use a system of markup that is not HTML, which your form handlers can then use to construct beautiful, standards compliant and semantically correct HTML.

Third party scanners can (normally) detect most problems with uploaded files. I personally like ClamAV - which is available for both *nix and Windows.

That solves the problem of making sure everything is arranged nicely, formatted correctly and no undesirable stuff is being served to visitors, or is it?

The other thing you need to do is review any content that they submit, a human being has to have some part in this or stuff is going to be missed. Is that image appropriate? Does that link lead to malware or something else that you would rather not link to? Etc.

Providing a flagging mechanism helps, but is always not effective. For instance, if you provide an answer to a two year old question on stackoverflow.com, the question is immediately bumped to the front page where the community is sure to review what was just added. Not all systems are designed with that sort of safeguard in mind.

If you do a significant amount of volume when it comes to user contributed content, its probably worth your time to explore using contractors who simply review submissions to make sure inappropriate media / links are weeded out quickly. Or, perhaps you can enlist help from your community of users (if one exists) to do the same, in exchange for some kind of special privileges or extra perks that normal users don't enjoy.

Improve this answer
0

I would answer this by spinning it into more of a "What tools do I need to implement" as then you can start thinking about a set of utilities, tools and plugins that you can use to implement the safeguards.

Such things as TinyMCE for complex input, as it's got a 'paste from word' function which is ideal for eliminating lots of Word character issues.

I notice that you say "The code entered into the cms" so are we talking actual code rather than content? As that would change the landscape of the application quite a bit in my opinion.

Otherwise I agree with the comment by jessegavin, there could be lots and lots of answers to this question. I have to admit, I don't quite understand the question as it stands. As being a developer myself, these safeguards are things that I would code anyway when building the CMS.

Although I think many of the safeguards could be covered in the Use Case design phase.

Improve this answer
2
  • David, thanks. Word HTML is biting me as I type this, so when I speak of code, I am thinking both HTML and plain text and that beast that could stand on its own as "Word Code" Now, what happens if a user fails to "Paste from Word" as so many choose....what about the new overhead that was just introduced thanks to Word's jibberish? Does that mean post processing is necessary as well? – bpeterson76 Aug 6 '10 at 15:56
  • 1
    I would post process the input anyway. If you have a validation module you can include some processing for the input here. Then it gives you flexibility to implement it only when you need it, without creating a consistent code overhead. – David Yell Aug 9 '10 at 8:29
0

Well, if I was building a CMS (and, actually, I have done) I wouldn't care what content was entered into it, so long as that content can be stored and retrieved. It's not the job of a content-management system to second-guess what is acceptable and what isn't, as it varies depending on usage.

All you need to do is ensure the content is moderated (ie. goes through a workflow approval process). This is why you have content editors, whose job it is to review content that is entered and then decide what should be published, what should be rejected and what needs tidying up. Whilst it's relatively easy to tidy-up WYSIWYG content programmatically, it takes a human to really decide if content is suitable for publication.

Never let users enter content directly into your site - always review it.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.