Security Concerns

[thabaum]

A point made in the developer meeting was the concern on maintaining security. I would like to open this discussion up further to see what would need to be done to allow us to keep this part of Oqtane secure.

Would we be able to follow the Radzen HTML code base to apply latest code fixes for things like this? I believe the community uses this component library a lot so we should have ears on the ground here is my opinion.

[ADefWebserver]

I think that as soon as Oqtane made a single change to the code then we are on our own :(

@iJungleboy points were good. This is big and may not be a choice because it would need someone (not me) to spend a lot of time maintaining it.

[ADefWebserver]

I agree with all the talking points. At the same time we need to either redo the current HTML or make it so we can install this as a second module?

Yes that seems to be what everyone wants right now, a second module.

This would need to be included in the framework and supported by those interested. If others dont want to use it for any reason they can opt to build their own correct?

Yes. But not "included" in the Core, just installed like any other module.

Same with the current HTML editor, everyone just makes their own as this one falls short for Oqtane out of the box experience in my opinion.

Yes

the WYSIWYG is garbage...

You mean this module (or the Quill version)?

[thabaum]

You mean this module (or the Quill version)?

Not this version, the Quill version works, and dont work at the same time. As soon as you do something it don't like in the RAW editor it is blank... on top of that it does not style well with any themes.

I would like to be sure we can style this easily and remove any binding packages as we can such as bootstrap/material and make it more generic so it can match a theme with little work if any and if possible.

[ADefWebserver]

Not this version, the Quill version works, and dont work at the same time. As soon as you do something it don't like in the RAW editor it is blank... on top of that it does not style well with any themes.

I would like to be sure we can style this easily and remove any binding packages as we can such as bootstrap/material and make it more generic so it can match a theme with little work if any and if possible.

The one good thing is we have access to all-source-code so anything can be done :)

[thabaum]

The one good thing is we have access to all-source-code so anything can be done :)

that is a big plus and why I am in favor of this project going forward. I maybe an outcast here but I feel it will pay dividends down the road for the community.

[ADefWebserver]

I feel it will pay dividends down the road for the community.

People will jump on-board when they see it 😎

[iJungleboy]

Basically we must decide if "the needs of everybody" are within the responsibility of the core, or if people outside the core can contribute to this.

If Oqtane itself tries to solve everybody's needs in terms of WYSIWYG, it is a huge burden. It's a rabbit hole with on end - there's always another feature to provide.

• ... something to add
• ... something to batten down
• ... some API to surface
• ... some features to disable because it's not for that use case
• ... crazy configuration options to be able to do it all, but differently in scenario X (eg. portal 7, user group Y module "Forum" should be ...)
• all this in 4 variants: SSR, Server-Prerender, WASM, and the automatic-transitioning thingy...

Placing this responsibility on the core platform - especially at this stage - is IMHO beyond the capacity of the current contributors.
And once it's in, you cannot back down any more without collateral damage.

To me the only feasible option is:

1. Provide a minimal implementation
2. Enable developers to inject their own alternatives
3. let the community create alternatives...
4. ...and if one or two really begin to show they are worthy, make sure that installing these alternatives is super easy - but still keep the responsibility out of the core

My 2¢

[ADefWebserver]

@iJungleboy - Yes that's the current plan :)

[thabaum]

This is going to be an installable module. The core currently has an editor it comes with we have to work on anyhow. We are just opting for a potentially better option to support as a community in or out the core.