Allow us to use CSS to personalize profile themes?

Ok, serious, i support that idea. However they need to strip out some things linke :before/after and too big font sizes.

I support the idea too in a way, but indeed would whitelist the tags as mentioned in my post earlier. That way you would not have any trouble when tags/features are added to the html/css specifications.

It's not possible to put HTML into `content`. I've tried it. Even with unicode escaping. Whatever you do, it will only be displayed as text.
This seems to support it: http://stackoverflow.com/questions/4505093/css-content-property-is-it-possible-to-insert-html-instead-of-text

So it's safe.

@Stoeptegeltje: Which tags are you talkin' 'bout?!

God no.  Half the profiles already look like rejects from the MySpace era, let's not allow any more customization of profiles.

Valid point.

But that's because they only allow to change some colours.

okey you are right it would not be easy if not impossible to do some damage.  

I looked at css insertion for my own site a few years ago, and so it seems IE made it more safe since then, nontheless I never trust user input hence the whitelist as in: https://code.google.com/p/google-caja/wiki/CajaWhitelists

Yes, whitelisting is important, not blacklisting. For example, to make sure my first example is not possible do probably not include value "none;" for property "display" into the whitelist and under no circumstances do include the pseudo selectors ":before" and ":after". This requires a css parser and transformer.

Is this caja such a css parser which cleans up the css based on a json style whitelist ("Schema for whitelists used by the Cajoler " is a difficult to understand description)?

Caja is a tool that would support for this feature/make it possible, more info: https://developers.google.com/caja/

What about `color: transparent;` it makes text invisible too, or even making `color` same as `background-color`!?

Are you going to whitelist every possible color name and value? Also you can't possibly catch the later.

I think this Caja stuff is just some bull he found via Google. Seems like it hasn't really been updated since 2008 either.

Sorry, but that doesn't seem applicable here at all.

More info: http://en.wikipedia.org/wiki/Caja_project

Not all of it but they could use the whitelist. Caja is activly used in google sites and Google apps scripts

I've never heard of "Google Sites" or the other thing. D:

But whatever, i support your idea, but think the should do it throug a whitelist (caja was just a sample). Seems you are just trying to bully every comment i make.

See ya

Just saying. Seems like Google Sites is not very popular.

To be quite honest though I dislike people like you.

You talk about stuff you have no clue of. This has become apparent at least already in post #10.

I can't help it, I just dislike people who talk sht in topics they have no business in, sorry. :)

You dislike a lot of people then

Currently we only have the option to customize a couple of background colors, font colors and borders. While this is enuff for the average joe allowing us to leverage CSS could yield some amazing and creative designs.

------------------------------------------------------------------------------------------------

This sounds very interesting. Could you post some of your design renderings?

9

Good Morning,

Yes, That is possible. The user could add the text of my first example as a comment, eg. and then white everything else out.

Then there is also the problem of white background images and white font, and the possibility of hex color values in combination with html color names.

The more i think about it, it is really difficult, yes. Maybe this form of automated whitelisting does not work.

A possibility is a chess.com forum, where users post their layouts and if they are ok, chess.com includes them into a list of User-Layouts.

Thanks for the Caja link, Stope. I like you . Your links in #10 also scared me, but to be true, i think the dudes writing those texts are often posers. Otherwise they would clearly explain what they mean. So i dont take this serious.

As chess.com does not want to pay money for extra admins checking the css i guess they have to work with extended user rights. I guess that is on their to do list, as there are many things that can be done with extended user rights, eg the spam problem can be solved with this.