Could someone clarify what this means? For example, what does it mean that the short_description field is Unchanged in unsafe filters for a Privilege?
Add a comment
|
1 Answer
See the "Safety" heading in the "Custom Filters" doc. The difference between a "safe" (default) filter and an "unsafe" filter, is that the unsafe data might return data that could result in a script injection if the data was directly inserted in an HTML document. (EG: '<script src="PwnYaSucka.com">...')
Some fields are apparently inherently devoid of potential injection problems, so even in "unsafe" filters, there is supposedly no risk of script injection. Those fields return the same data in both "safe" and "unsafe" filters and you do not have to worry about sanitizing problematic tags.
Fields that are inherently safe, like that, are tagged with the "unchanged in unsafe filters" disclaimer.
answered Jul 31, 2012 at 13:43
-
Thanks for the explanation... I figured it was something like that. If this is true, don't you think "unchanged in unsafe filters" should be re-worded somehow? I couldn't figure out what "unchanged" referred to... maybe "safe in unsafe filters?" Or maybe even something more detailed...? Commented Jul 31, 2012 at 14:01
-
By calling it "unchanged", they carefully avoid the claim that it is "safe"... A possible CYA? ;) I don't control the verbiage, but yes, it might possibly be clearer for newbies, but they do link to the doc section that explains it. Commented Jul 31, 2012 at 14:12