New Tutorial on How to Create Custom Web Pages in Hubzilla

Fri, 16 Dec 2022 15:43:03 +0100

scott@loves.tech

Scott M. Stolz wrote the following post Fri, 16 Dec 2022 15:36:23 +0100

New Tutorial on How to Create Custom Web Pages

We just added a new article on Complete Hosting Guide about creating your own custom web pages using Hubzilla. This allows you to use the built-in webpages app to create custom web pages. You can use whatever layout and style you want, or you can use an existing theme to wrap around your content.

Check out the article here:
https://completehostingguide.com/article/creating-a-custom-page-on-a-channel-in-hubzilla

Your suggestions, corrections, questions, and comments are welcome.

show all 18 Comments

Fri, 16 Dec 2022 17:36:27 +0100

Crow

crow@commonworlds.org

"It's appearance" should be "Its appearance."

Fri, 16 Dec 2022 17:42:24 +0100

Scott M. Stolz

scott@loves.tech

@Crow Thanks. I missed that. Fixed.

Sun, 18 Dec 2022 16:38:07 +0100 last edited: Sun, 18 Dec 2022 16:39:59 +0100

Hilmar R (u-zapalot)

hi-u@zapalot.in-eu.net

#webpages
It is always welcome when descriptions try to explain facts. The best usable description of Webpages so far I think I found at lazyteddy, because it really addresses unprejudiced users. The Lazy Teddy - lazyteddy@hubzilla.lazyteddy.eu

Sun, 18 Dec 2022 16:44:15 +0100

Scott M. Stolz

scott@loves.tech

@Hilmar R (u-zapalot) Thanks for sharing that. That's a really nice set of articles (technically, wiki entries).

I plan on adding more articles that go over each step in depth and explain more. The article I created was meant as a tutorial, instead of a set of articles explaining concepts.

Sun, 18 Dec 2022 17:12:36 +0100

Hilmar R (u-zapalot)

hi-u@zapalot.in-eu.net

#webpages
Just an important additional technical note about web pages. It is pointed out again and again that for the production of web pages an administrative permission for the code execution is necessary (e.g. php).

Maybe I am a bit naive in my approach to webpages, but I am deeply convinced that such permission is neither necessary nor useful. And if it is, it is a task to change the Hubzilla Api to avoid such a thing, thus to avoid a ride to hell.

Sun, 18 Dec 2022 17:17:59 +0100

Scott M. Stolz

scott@loves.tech

@Hilmar R (u-zapalot)

Maybe I am a bit naive in my approach to webpages, but I am deeply convinced that such permission is neither necessary nor useful.

Allowing PHP is very useful for certain situations, but I think that there should be separate permissions.

1. Allow Full HTML (i.e. unfiltered)
2. Allow PHP

For example, if you want to give a privileged user access to PHP without giving them access to the web hosting account, having an option allows that. For users who only need unfiltered HTML access, you wouldn't have to give them access to PHP.

Most people won't need PHP (and you would not want to give them PHP access), but for some of us who do use that feature, we would not want to see it go away.

Sun, 18 Dec 2022 17:19:45 +0100

Scott M. Stolz

scott@loves.tech

@Hilmar R (u-zapalot)

It is pointed out again and again that for the production of web pages an administrative permission for the code execution is necessary (e.g. php).

Technically, you don't need code access to build web pages in Hubzilla. But if you do not turn on code access, the HTML is filtered.

Sun, 18 Dec 2022 18:00:26 +0100

Hilmar R (u-zapalot)

hi-u@zapalot.in-eu.net

Yes, filtered is the precise description. But I stand by my statement. Unconditionally. Sorry, is only imo

Sun, 18 Dec 2022 19:47:00 +0100

Witcraft (Hubzilla)

witcraft@hubzilla.fediversum.de

@Hilmar R (u-zapalot)
It should be possible to avoid this...

The key problem is the include, which you need for Frameworks, which you need for Websites with responsive design. Many people use mobile devices today, so a Website should cater for that.

Hubzilla comes with the Bootstrap and the Foundation 6 framework. However, you need to include which one. If you want a different version, or a completely different framework (like Tailwind in Emanuel's draft), then you also need to provide it in your site installation, or link to an external source (which is even more vulnerable).

So the more flexible you want to be, the more problematic it gets.

So I think it should be possible to

either provide one framework, include it per default - Not sure if you need to enable the Code flag for just using it. (KISS approach: Keep it simple and stupid - Lowest threshhold, but also least flexible).
or keep the framework inclusion out of webpages by clearly huided configuration that does not allows malicious code instead (e.g. drop down which of the internal frameworks to use).
or keep it seperated by defining the theming outside of the Webpage editor, either by hand, or by a separate editor with code control specialized for this. (I think this is what could help Scott's approach.)

Sun, 18 Dec 2022 20:08:43 +0100 last edited: Sun, 18 Dec 2022 20:09:40 +0100

Scott M. Stolz

scott@loves.tech

Ideally, the theme already has the necessary CSS and JS files, and webpages (created in the Hubzilla webpages app) only contain content (HTML between the <body> tags).

You should only use the "none" template if your CSS and JS will conflict with the theme you are using.

I'll have to create more documentation to explain all of your options.

Sun, 18 Dec 2022 20:17:34 +0100

Mike Macgirvin

mike@macgirvin.com

On a multi-user site, there is no substantial difference between PHP access and unfiltered HTML access (which is technically JavaScript access). Either one can fully take over a website and access all the content and all the private information of all the site members, including the administrator. So yes, code access is absolutely required to permit unfiltered JavaScript on a multi-user system. On a single user system, we don't care because there's little value in hacking your own account. I would not be giving this access to a complete stranger. And you can type HTML until the cows come home. As long as you don't use any JavaScript you'll probably be fine. There are only a few things that are inaccessible - such as iframe and script and event attributes.

Sun, 18 Dec 2022 20:32:03 +0100

Scott M. Stolz

scott@loves.tech

@Mike Macgirvin The filter seems to strip class names too.

Sun, 18 Dec 2022 21:30:00 +0100

Mike Macgirvin

mike@macgirvin.com

To my recollection it only strips class names which have a history of being used maliciously, such as those controlling popups. It's incredibly lenient in accepting safe HTML and you can certainly suggest exceptions if you disagree with the filter decisions. We just need to validate why a particular class was excluded and ensure it can't be exploited. For instance position attributes are generally a no-no (it lets you cover up login form fields with your own and steal passwords), but we allow them in certain controlled circumstances.

Sun, 18 Dec 2022 22:21:58 +0100

Hilmar R (u-zapalot)

hi-u@zapalot.in-eu.net

Includes are not the problem. A php code that can be controlled by an online editor is. Every admin of a portal with e.g. ssh shell access has the full right to ruin it at will. An onlne user with a web browser should not be given this privilege.

But for reassurance: Comanche scripting, markdown, bbcode, js, css, less and the template engine all together are so much powerfull enough, so not one php snippet is needed for varying style and design on the fly beyond that what is prepared in advance and is called a framework or similar.

Sun, 18 Dec 2022 22:52:29 +0100

Mike Macgirvin

mike@macgirvin.com

Feel free to remove PHP permission completely if that makes you happy. It gets used very infrequently. We provided that so somebody on a single user site could create blocks with code in them - which is exactly the same thing that widgets do, but with less overhead. Just like they can do on their WordPress or Drupal sites.

Sun, 18 Dec 2022 23:26:48 +0100

Mike Macgirvin

mike@macgirvin.com

Anyway thanks for the reminder - we don't need code access in the streams repository for anything at all and I probably should just get rid of it.

Someday folks will discover that you can actually build entire websites In Hubzilla without code access. Maybe this option should be removed from Hubzilla as well - and force people to use their noggins instead of always relying on JavaScript.

Sun, 18 Dec 2022 23:34:40 +0100 last edited: Mon, 19 Dec 2022 06:06:28 +0100

Witcraft (Hubzilla)

witcraft@hubzilla.fediversum.de

@Hilmar R (u-zapalot)

But for reassurance: Comanche scripting, markdown, bbcode, js, css, less and the template engine all together are so much powerfull enough, so not one php snippet is needed for varying style and design on the fly beyond that what is prepared in advance and is called a framework or similar.

You might need to teach people to do that. But you will be very welcome to do so, I'd be the first in in to learn :slight_smile: After loosing two clones because of Code permissions not being handled, I certainly will not rely on that anymore.

Mon, 19 Dec 2022 03:58:44 +0100

Scott M. Stolz

scott@loves.tech

@Mike Macgirvin It kept stripping out Bootstrap class tags and CSS I needed.