Jsoup Clean HTML Feedback - security

After jsoup cleans the html with a safelist or whitelist, can we get the result of what jsoup has cleaned, which tags has it removed, what elements were blocked. If jsoup doesnt have the feature which other api has this functionality.
Requirement is user needs to know what has been removed in his designed html when I clean using jsoup. So he can adjust according based on feedback.

Related

Liferay static url for dynamic data

I want to serve some data from an static url in Liferay. For example, say to serve a json containing the logged user from "http://server.com/whatever/user" so all the portlets in the proyect can read it. Right now I can do it with a portlet, but then I have to set the url with the configuration panel and I don't like that.
I've seen that I can put jsp files with the static content, but don't know how to access the information of session, users, etc.
Friendly urls seem to accomplish something similar but seem overly complicated and focused in getting a short easy url, something I don't care.
So, how can I get some internal data in an static url (I don't mind if it's friendly, long or short, but always the same) so every element of a Liferay proyect can read it?
FOURTH EDIT: Another way to put it...
In my eclipse I have this tree:
/whatever-war/docroot/html/fancy-porlet/list.jsp
How do I access that jsp in a browser without having to go the Liferay panel and putting the portlet in the menus of the web?
FIFTH EDIT: I haven't had the time to research any more, but I have this in my notes...
https://server/language/c/portal/layout?p_l_id=plid
This goes straight to the portlet, sometimes. plid comes from
PortalUtil.getPlidFromPortletId(themeDisplay.getScopeGroupId(), name_of_portlet_and_war)
It's no solution for me because, it doesn't always work. Sometimes you get a numeric identifier, sometimes you get a zero. I'd bet on the name of portlet and war being incorrect so it doesn't find the portlet, but then, how do you find the new name of the portlet? Sadly, I discarded the code where the name came from, but is coming from Liferay.
SIXTH EDIT: What I want to do is to be able to call a fixed url, with some data internal to Liferay, and get information based on that data back.
There are several aspects here:
Every portlet already has access to the user through a request attribute called ThemeDisplay:
ThemeDisplay themeDisplay = (ThemeDisplay) request.getAttribute(WebKeys.THEME_DISPLAY);
Check ThemeDisplay's interface for the various options that you have in order to get the current user's id or object.
You've asked about JSON delivery - this will need to go through Liferay and not (directly) through a JSP in your individual web application. The reason is that any request processed by Liferay will contain the user's information, but as any proper webapp, it's completely separate from any request directed at another webapp: Unless included by Liferay, your JSP will have a different session that has nothing to do with Liferay's session. (I hope this explanation makes sense)
If you write a servletFilter hook, you might not yet have the portal context initialized (Liferay 6.x has been a while for me, pardon for being vague here). If you're on the portlet side, you might have to do more than you expected.
One option that you have is to embed a portlet on every page, automatically (e.g. when it's deployed, it's available). You can configure a portlet to be automatically included on every page, it's done for the chat portlet, for example. That portlet does not need to have any UI, it just needs to expose its resourceURL, so that you can use it from everywhere.
However, I somehow doubt that you use it, given that every portlet has the information already at hand.
But I might also just not understand all of your requirements...

Programatically retrieve the updated og:image of a page in an extension

There seem to be many pages where the the og:image does not change as I keep browsing from one page to another. The og:image always points to the first (landing) page. This is true of youtube videos, for instance. Of course, reloading the page provides the correct og:image
I am wondering if there is a way, within a custom extension on Chrome and Safari, to force refresh the og:image data without affecting user experience?
Dynamically updated sites (aka AJAX sites) change only a portion of the page with the new content on intra-site navigation. The meta information in head element like og:image isn't updated usually.
A universal workaround for any site with AJAX navigation would be to make a XMLHttpRequest for the current URL, convert the response into DOM via DOMParser API and extract the og:image tag.
Or you can write site-specific code and try to find an internal variable or element that contains the og:image. It requires some reverse-engineering, and your code would break on site changes.

Output token values within body in Orchard CMS

I'm using Orchard CMS and I have a custom form that I want to redirect to a confirmation page after it has been submitted. On this page I would like to output some of the details from the submitted form.
To achieve this I am planning on setting up a workflow which performs a redirect action and passes specific form values through in the query string of the URL that it redirects to.
Is there a way to output these query string values from within the BodyPart of the page that I'm redirecting to? Can I embed tokens within the body of the page?
Is there an alternative method to achieve this using the built-in features of Orchard?
It appears that Orchard 1.9 will contain Orchard.Tokens.HtmlFilter within the Orchard.Tokens module.
1.9 is imminent, they are just checking it now. You can download the 1.x source. And I have also noticed a 1.9-int source, which is probably what they are using to prep 1.9 for distribution.
You should, with 1.9 (or 1.x or 1.9-int) be able to enable that feature and then do something like:
#{Content.Fields.MyForm.FirstName}
within the Body of a page (or content type with the BodyPart), for example.

Display web sites and web apps with Chromecast

Can Chromecast be used to display a web site or web app? All the sample sender/receivers I've seen so far show how to play videos. The docs posted so far are minimal as best, just an API reference with little explanation what any of it does. I just want to send a URL of my choosing and have that page displayed on the TV. There's no user interaction required past that point. Assuming that's possible, does anyone have sample Chrome sender and receiver code for that?
I was able to modify the Github sample Project > googlecast/CastHelloText-chrome
to show a web page.
In the receiver.html file, I replaced the DIV with an IFRAME and styled it for 100% width and height.
Then in the displayText() function I changed innerHTML to src.
The only modification made to the sender chromehellotext.html was to replace YOUR_APPLICATION_ID with the app id created by registering the receiver.
Note that some sites like Google and Yahoo will not display inside an iframe. If you really needed to do that you could skip the iframe and just set window.location.href to the URL. That, of course, will overwrite your receiver code so the only way to change URLs would be to manually disconnect first and reload. I tried using window.open instead but that did not work.
One could imagine writing a Custom Receiver that has an iframe that wraps any website. Your sender would could then send webpages to your receiver, and the onLoad would set the the URL of the iframe. Don't have any code, but it's fairly simple to write.
There is a simple way to do that with the hellotext sample. You can send the html by typing that into the text field.
<iframe src="http://mywebpage.com" style="width:1280px;height:720px"></iframe>
To provide extra info from the current answer, as this post comes up near top on most searches.
Thing to search for is Digital Signage, this is the sort of industry word.
following GreenScreen Chromecast works okay. Greenscreen
host solution is Sign Simple - which looks to be same approach as Greenscreen without you needing to host the receiver web page.
Similar hosted solutions using Raspberry Pi can be found.
Of note: with GreenScreen and the CastHelloText, I could not get 1080p only 720p, some comments mention Video only in 1080p, but Images in 720p, which I take to mean html pages aswell.
Chromecast can indeed be used to display an arbitrary URL.
This can be done from plain old Chrome, using 'url-cast-receiver'. (Usable 'demo' page, GitHub project page.)

Like Button (Social Plugin) and custom og:type mix-up

A while ago I experimented with facebook apps and I specified custom og:types on my website.
It's a photo website with about 20,000 individual URL's and growing by about 1000 per week and the two object types I specified were these:
<meta property="og:type" content="mynamespace:album" />
(for thumbnail overview pages of a photo album, currently about 200 of these)
<meta property="og:type" content="mynamespace:picture" />
(for detail view of individual images, currently about 20,000 of these)
However, I never followed through with developing a custom app because I felt it wasn't worth users having to sign in and authorise my app just to like/share pictures so I ended up using the standard social plugin "like button" on these pages.
Unfortunately I forgot to remove the custom object types though. Now the likes on the social button seems to be counting correctly and the facebook linter doesn't complain about anything, but I am a bit worried if there are any adverse implications by leaving it like that, because when I removed the custom type temporarily (which I thought would then default to og:type website) the debugger warned me that the object previously had another type and that data might be corrupted. It is now using the custom object types again until I can find a solution...
So what should I do? Remove the custom types or leave them? What are the implications of either option? Is my content being shared correctly on the users walls if a user clicks the social plugin "like" and it finds a custom og:type?
Would be grateful if someone could clarify the best way out of this mess without screwing up all the accumulated user activity from the social plugin.
Thank you!
Facebook encourages developers to tag their content using open graph tags using tags that relate as closely as possible to the content itself. There will be no adverse effects to changing the tags present in a pre-existing tag, and it is just a warning that Facebook outputs, in case you had changed the tags by mistake.
Facebook uses the tags to categorise incoming posts (as the first time it is liked, Facebook sends a scraper to your page to find out what it can about it), and in the end, "anything helps". By changing the tag, it won't affect the classification of the posts published previously, but any new posts will have the new tag information.
If your new tags more closely resemble the content, then change away.

Resources