H. G. Muller wrote on Tue, Nov 24, 2015 07:21 AM UTC:
> Disallowing arbitrary use of scripts sounds good.
Actually disallowing scripts sounds very bad, in the member-submitted articles. There is no reason why the submitter should not be in full control over how the page looks, and what it does. We have an approval period during which editors review any contribution, so if it turns out that there can be undesirable applications of scripting, the contribution can simply be rejected. It is not like you couldn't do arbitrarily unacceptable things using pure HTML, or even only plain text...
This of course would be different in forum posts, like this comment listing, where the user postings share a page with postings of other users. In theory scripts could be used there to alter the way other people's comments are displayed in the client of anyone that views them.
I can add that several of my member-submitted articles now make essential use of scripting. I have incorporated the interactive diagram in most of those, now, and in most cases (such as Mighty-Lion Chess and Elven Chess) the standard betza.js script for the diagram is all that is needed. But the large Shogi variants (Dai Dai and Maka Dai Dai, and my shrunken versions Cashew and Macadamia Shogi) have unusual and complex promotion rules (pieces promote on capture, and whether such promotion is mandatory or optional, or even what you have to promote to, can depend on what you capture. Werewolf Chess also uses a contageous piece. This exceeds the general treatment of promotion the betza.js script can provide, so the pages need to define their own function to decide what the piece will become after the move.
For the Shogi variants I also provide buttons that switch the diagram between piece representations: mnemonic, western-style pictograms or kanji tiles. The 'onclick' specifier in those buttons does contain JavaScript snippets to alter values of variable used in the betza.js script, making it take the images from an other directory. See for instance the article Macadamia Shogi.
> Disallowing arbitrary use of scripts sounds good.
Actually disallowing scripts sounds very bad, in the member-submitted articles. There is no reason why the submitter should not be in full control over how the page looks, and what it does. We have an approval period during which editors review any contribution, so if it turns out that there can be undesirable applications of scripting, the contribution can simply be rejected. It is not like you couldn't do arbitrarily unacceptable things using pure HTML, or even only plain text...
This of course would be different in forum posts, like this comment listing, where the user postings share a page with postings of other users. In theory scripts could be used there to alter the way other people's comments are displayed in the client of anyone that views them.
I can add that several of my member-submitted articles now make essential use of scripting. I have incorporated the interactive diagram in most of those, now, and in most cases (such as Mighty-Lion Chess and Elven Chess) the standard betza.js script for the diagram is all that is needed. But the large Shogi variants (Dai Dai and Maka Dai Dai, and my shrunken versions Cashew and Macadamia Shogi) have unusual and complex promotion rules (pieces promote on capture, and whether such promotion is mandatory or optional, or even what you have to promote to, can depend on what you capture. Werewolf Chess also uses a contageous piece. This exceeds the general treatment of promotion the betza.js script can provide, so the pages need to define their own function to decide what the piece will become after the move.
For the Shogi variants I also provide buttons that switch the diagram between piece representations: mnemonic, western-style pictograms or kanji tiles. The 'onclick' specifier in those buttons does contain JavaScript snippets to alter values of variable used in the betza.js script, making it take the images from an other directory. See for instance the article Macadamia Shogi.