Jump to content


From mediawiki.org
This page is a translated version of the page Manual:$wgRawHtml and the translation is 4% complete.
HTML: $wgRawHtml
Allow raw, unchecked HTML in ‎<html>...‎</html> sections.
Xuất hiện lần đầu trên phiên bản:1.3.4
Đã bị loại bỏ khỏi phiên bản:đang được sử dụng
Các giá trị cho phép:(boolean)
Giá trị mặc định:false


Insert $wgRawHtml = true; into the file LocalSettings.php in your main MediaWiki directory and the wiki will allow you to insert raw unchecked HTML. However, you must embed your html within the ‎<html>...‎</html> tags so that MediaWiki can differentiate it.

Cảnh báo Cảnh báo: This is very dangerous on a publicly editable site, because it allows for arbitrary JavaScript code to be inserted, opening the door for session hijacking. Thus, you shouldn't enable RawHtml unless you've restricted editing to trusted users only with $wgGroupPermissions . See Manual:Preventing access for more information on restricting write access.
This option does not affect how wikicode outside of ‎<html>...‎</html> tags is handled.
Phiên bản MediaWiki:

Kể từ MediaWiki 1.29, thẻ HTML thô không có hiệu lực trong không gian tên 8 (MediaWiki): phabricator:T156184.

Is enabling raw HTML necessary?

Some HTML tags are permitted in wikitext, even with $wgRawHtml = false. See Help:HTML in wikitext . The vast majority of fancy formatting seen on Wikimedia sites is achieved using these limited tags (e.g. tables with CSS style tags). If you can make do with these limitations (leave $wgRawHtml = false), your wiki will be more secure.

Also note that the "limited" wiki syntax is actually a deliberate design feature of wikis. It is a compact simplified markup which is easily understood even by non-technical users, easily visualised in diff displays, and discourages stylistic tinkering in favor of getting on with writing useful/interesting text.

There are a number of extensions which promise to allow more HTML flexibility, while improving the security situation. Some require setting $wgRawHtml = true in conjunction with using the extension, while others offer an alternative.

Extension Status Description
Extension:HTMLets unmaintained allows pre-defined HTML snippets with $wgRawHtml = false;
Extension:HTML Tags stable allows for adding HTML from a set of tags and attributes defined in the wiki's settings
Extension:Secure HTML unmaintained adds 'Secret key' protection for html sections
Extension:SaferHTMLTag stable, has known security vulnerability prevents edition of pages that contain the ‎‎<html> tag by unauthorized users and groups
Extension:HTMLPurifier beta allows users to input raw HTML by using HTML Purifier to sanitize it
Extension:Widgets stable allows for defining HTML- and JavaScript-based "widgets", with optional parameters

Another way get custom HTML appearing within your wiki articles is to develop your own tag extension. Do not be tempted to develop an extension which allows arbitrary HTML, otherwise the same serious security issues apply as with setting $wgRawHtml = true.