id,summary,reporter,owner,description,type,status,priority,component,severity,resolution,keywords,cc,release
3979,can not include external html,jholg,coderanger,Whilst logged in with INCLUDE_URL permission I am not able to include valid html.\r\nI'm currently looking into adding intertrac capabilities to includemacro and started out with simply trying to include stuff from other trac projects via a fully qualified URL. However_ these are always empty. \r\nBy accident_ I used NewsFlashMacro on one of these pages_ and suddenly this page could be successfully included.\r\n\r\nI found out that using NewsFlashMacro with the [[NewsFlashStart]] and [NewsFlashEnd]] directives subtly breaks invalid xhtml-1.0-strict (should add another bug report over there...):\r\n\r\nValidation Output:  49 Errors\r\n\r\n   1. Error Line 87_ Column 22: document type does not allow element "div" here; missing one of "object"_ "ins"_ "del"_ "map"_ "button" start-tag.\r\n\r\n      <div class="newsflash">\r\n\r\n      ✉\r\n\r\n      The mentioned element is not allowed to appear in the context in which you've placed it; the other mentioned elements are the only ones that are both allowed there and can contain the element mentioned. This might mean that you need a containing element_ or possibly that you've forgotten to close a previous element.\r\n\r\n      One possible cause for this message is that you have attempted to put a block-level element (such as "<p>" or "<table>") inside an inline element (such as "<a>"_ "<span>"_ or "<font>").\r\n   2. Error Line 88_ Column 3: end tag for "div" omitted_ but OMITTAG NO was specified.\r\n\r\n      </p>\r\n\r\n      ✉\r\n\r\n      You may have neglected to close an element_ or perhaps you meant to "self-close" an element_ that is_ ending it with "/>" instead of ">".\r\n   3. Info Line 87_ Column 0: start tag was here.\r\n\r\n      <div class="newsflash">\r\n\r\n   4. Error Line 90_ Column 5: end tag for "p" omitted_ but OMITTAG NO was specified.\r\n\r\n      </div>\r\n\r\n      ✉\r\n\r\n      You may have neglected to close an element_ or perhaps you meant to "self-close" an element_ that is_ ending it with "/>" instead of ">".\r\n\r\n\r\nHowever_ as a side effect_ this suddenly makes the included content (well_ parts of it) visible in the including wiki page.\r\n\r\nI ''think'' this is due to the genshi HTMLSanitizer running on the included page: If the included page is valid xhtml_ then nothing will ever be included because the <html> tag is not an allowed tag in the HTMLSanitizer default configuration. Otherwise_ by producing invalid xhtml_ the genshi parser suddenly throws the parsed token in a different order. In effect_ this produces START and END yields ''after'' </html> has been given to the sanitizer.\r\n\r\nSo I suspect using the HTMLSanitizer the way it is used here will always filter out the whole content of any xhtml-strict page.\r\n\r\n???\r\nHave to look into this further...\r\nAny hints appreciated.\r\n\r\nHolger\r\n\r\n,defect,closed,normal,IncludeMacro,normal,wontfix,xhtml_ xhtml-strict,,0.11
