01 September 2016, 1:10

Hello,

I'm using Mahara 16.04.3 and adopted the different static pages (About us, Policy etc.). If I'm defining links in the standard WYSYWIG-editor there is no option to open the target in a new window.

So I used the HTML-view and added target="_blank" after src-information. But after saving the added code and reopening it in HTML-view there is not added code at all.

Does anybody know a solution for that?

Kind regards,

Guenter

01 September 2016, 3:45

Hi Günter,

earlier i have similar problem, it is fixed with Aarons help:

"Hi Laszlo,

We removed the "target" options from throughout Mahara for security reasons. See https://bugs.launchpad.net/mahara/+bug/1558361

If you'd like to add it back into TinyMCE, you'll need to patch your site to revert this change:

https://reviews.mahara.org/#/c/6167/4/htdocs/lib/web.php

... and delete the "htmlpurifier" directory in your dataroot so that HTMLPurifier will update its rules cache.

Cheers,

Aaron"

Bests,

László

01 September 2016, 6:56

Hello Laszlo,

thank you for your help.

If I am understanding the solution correct, I would have to do the described patching and deleting after each update.

That doesn't sound really useful. I can't understand this security feature. Nearly every CMS and also Moodle is offering this linking option. Mahara development should be sure AND userfriendly. It's hard enough to convince students and teachers to use Mahara. This kind of development decisions do not help to make things easier.

Kind regards,

Guenter

02 September 2016, 12:14

Hello Guenter,

Yes, lots of applications still use the insecure feature that has been in existence for a very long time. That doesn't mean that we should, too, only because others haven't fixed their code yet. ;-) There are possible solutions around, but at the time when the security hack became known publicly widely, no solution worked across any browser.

There is a simple solution: Open a link that you definitely want to open in a new window with a right mouse click or a long-press on touch devices. Since I never know which links would open in a new window and which ones wouldn't, I open any links, no matter whether they have a target blank or not always with a right mouse click and then there is no security concern anymore. It may take a bit getting used to, but beats exposing your environment to security hacks.

Cheers

Kristina

02 September 2016, 19:49

Hello Kristina,

thank you for your answer. At first I want to say that all developers of Mahara do a briliant job.

Maybe the other systems are insecure, but I think users should be able to do some coding by themselves. I can understand to cancel the possibility to define the target of linking inside the editor for security reasons.

The right clicking "solution" requires a certain level of media literacy and in my opinion an e-portfolio should be as simple as possible in its functionality.

Kind regards,

Guenter

03 September 2016, 15:18

Hello Guenter,

If you do want to bring back target blank, you can follow Aaron's suggestion. At Catalyst, we use Git to manage our code repository. That way, we are alerted to conflicts within files when new code is deployed and can see the merge conflicts easily rather than having to keep a running text file with all the changes and having to apply them again after each update or upgrade.

Mahara is available via Git at https://git.mahara.org/mahara/mahara.git or https://github.com/MaharaProject/mahara.git if you want to get started managing your code base that way.

Cheers

Kristina