Advanced search  

News:

cpg1.5.48 Security release - upgrade mandatory!
The Coppermine development team is releasing a security update for Coppermine in order to counter a recently discovered vulnerability. It is important that all users who run version cpg1.5.46 or older update to this latest version as soon as possible.
[more]

Pages: [1]   Go Down

Author Topic: Not a good idea: Using Inline CSS in the output of the Content  (Read 2703 times)

0 Members and 1 Guest are viewing this topic.

iamwhatiam

  • Coppermine newbie
  • Offline Offline
  • Posts: 3
Not a good idea: Using Inline CSS in the output of the Content
« on: September 04, 2011, 12:26:05 pm »

Using CSS inline styles in HTML tags like "<td style="width: 100%">" makes it really hard to style the gallery by myself. Overwriting these tags is really hard, maybe impossible for much people. This could be the reason for the few styles available for Coppermine-Gallery.

Btw: The verification on register AND posting really makes no fun. I know the problems of bots, but if posting is only allowed to registered users, the capcha may be enough at registering and maybe could be removed at posting for registered users, since others are not allowed to post anything.
Logged

iamwhatiam

  • Coppermine newbie
  • Offline Offline
  • Posts: 3
Re: Not a good idea: Using Inline CSS in the output of the Content
« Reply #1 on: September 04, 2011, 04:36:32 pm »

To make it more clear (it may be unclear):

Coppermine itselfs is rendering (giving out) CSS within HTML tags, which makes it hard to style (create themes) for coppermine with CSS.
Logged

Αndré

  • Administrator
  • Coppermine addict
  • *****
  • Country: de
  • Offline Offline
  • Gender: Male
  • Posts: 15764
Re: Not a good idea: Using Inline CSS in the output of the Content
« Reply #2 on: September 05, 2011, 09:58:37 am »

Can you please post some examples where that inline CSS occurs?
Logged

iamwhatiam

  • Coppermine newbie
  • Offline Offline
  • Posts: 3
Re: Not a good idea: Using Inline CSS in the output of the Content
« Reply #3 on: September 05, 2011, 09:47:43 pm »

<table align="center" width="600" cellspacing="1" cellpadding="0" class="maintable ">
                      <td class="tableb" width="40%">Benutzername</td>
                      <td class="tableb" width="60%"><input type="text" class="textinput" name="username" style="width: 100%" tabindex="1" /></td>
<div class="footer" align="center" style="padding:10px;display:block;visibility:visible; font-family: Verdana,Arial,sans-serif;">Powered by <a href="http://coppermine-gallery.net/" title="Coppermine Photo Gallery" rel="external">Coppermine Photo Gallery</a></div>

And that only on the login page. Also the classes could be given better, so the creators of themes could be more free at their work and distinguish more elements.

Btw: As there are remote exploits available for Coppermine, I would suggest you to add an option to remove the HTML comment which provides the version number of Coppermine. Thanks for reading and your answer.
Logged

Αndré

  • Administrator
  • Coppermine addict
  • *****
  • Country: de
  • Offline Offline
  • Gender: Male
  • Posts: 15764
Re: Not a good idea: Using Inline CSS in the output of the Content
« Reply #4 on: September 06, 2011, 10:18:16 am »

Also the classes could be given better
You're welcome to contribute code change proposals for the next major release (cpg1.6.x).


As there are remote exploits available for Coppermine, I would suggest you to add an option to remove the HTML comment which provides the version number of Coppermine.
Security through obscurity is no option imo. But we don't need to discuss that in this thread.
Logged

KoD

  • Translator
  • Coppermine newbie
  • **
  • Offline Offline
  • Posts: 13
Re: Not a good idea: Using Inline CSS in the output of the Content
« Reply #5 on: September 13, 2011, 02:26:33 pm »

in that cause what I suggest is that
we can use external CSS file that will keep the style information away from the page code
also its good practice for many features for example we can have 3 style files and invoke them depending on what user desire using PHP function that uses style number as parameter.
also, it will be easier if just define the class or the ID in the html tags
I can slightly help in CSS cause I have some background but I like to contribute in PHP coding more than CSS
Logged
Pages: [1]   Go Up
 

Page created in 0.019 seconds with 19 queries.