How to enable rich text support in waldur-homeport for Offering Descriptions?

[mazekeeper]

Dear community,
I've noticed that several Waldur instances have Descriptions of offerings in plain text, whereas the authoring environment offers both Rich Text plug-ins and markdown support. Upon attempting, the "user view" only renders plain text per default, rather than support for headings, lists, images (stored elsewhere) et cetera. I probably need to do some config or settings, am running the Docker version of waldur-mastermind and supporting components.

best regards

/

Alex

[livenson]

Hi, it seems that you are running a too old version of Waldur, at least on the recent ones that text is rendered correctly if Markdown is provided. Can you please try to update?

[mazekeeper]

As I wrote earlier, the update cleared a lot of the issues at hand. I'm still looking for a solution on
how to include in-line images, i.e. how I can tweek our local installation to allow a fine mix of text and images in
the descriptions of service offerings. e.g. adjust the DOM sanitizer or similar?

[mazekeeper]

Thanks! Edited .env before I pulled:
WALDUR_MASTERMIND_IMAGE_TAG=7.7.0
WALDUR_HOMEPORT_IMAGE_TAG=7.7.0
Works like a charm for text, still an issue with in-line images though.

when I do
![A placed cat here](https://placecats.com/300/200 "Standard Cat")
I get:
Parsing of the following markdown structure failed: {"type":"image","name":"N/A"}.
The user gets the markdown "A placed cat here"

Read up a bit more... per default images are not enabled... would it be possible to let the sanitizer allow them?

p.s. doing "docker compose restart" wasn't enough for updating, had the old version cached somewhere as ususal with Docker,
but a healthy "docker compose down" and "docker compose up -d" works

[livenson]

1. Thanks, I've updated the documentation to be more explicit about image update.
2. Allowing images - I think we can add a toggle for that, there are a lot of attacks with images that can be done so by default we don't want to allow it, but if you control env fully, I think it is ok. I will try to push something later today.

[livenson]

Latest + next version release will have support for a feature toggle allow_display_of_images_in_markdown that enables rendering of image references.

In principle, we could also add support for image upload to Waldur, but it is a bit more complicated and would require a solid use case.

[mazekeeper]

That's great, I so much appriciate the addition of such a feature ! I also agree on the evident risk in general of getting executable stuff come in via image resources. There are of course a number of ways of restricting, "only known, registered users can add content" being an important gatekeeper, and there we are already in our case. Other than so, only allow image URLs from the same and/or whitelisted domains could be another viable addition, in coming releases.

Being able to upload images for in-line editorial use is another way of filtering out malicious files coming in, as they can be scanned for malware during the upload process, apart from the fact that it would be a big help in streamlining the editorial process as such, as we'll have non-techy users coming in to write service descriptions in our Waldur instance(s).

[livenson]

ok, I think upload is pretty convenient, I will add it to the task list.

image URLs from the same and/or whitelisted domains
this is one of the options, there are more things to consider like to e.g. scan SVG XMLs for malicious external links etc that come to mind for validation, but in principle the main concern is typically that it is quite a lot of work - and we'd like to make sure that it brings value then to some concrete case.

So if you think that you will use Waldur for the cataloguing use case, I can schedule this e.g. for October or so.

[mazekeeper]

That's a great feature to have, I'd like to vote for it, especially for editorial use in the hands of regular, less-savvy staff !

[mazekeeper]

Upgraded again to the latest? 7.7.7 (following the diffs), should I be looking for a toggle "allow_display_of_images_in_markdown" inside of Administration->Settings->Features or specifically Administration->Settings->Marketplace

[mazekeeper]

I've toggled it now, but somewhat unexpected result, please hava a go and see if you get pics or the yield icon too.-
I've tried different file endings too.

[mazekeeper]

Updated to 7.7.9 now, giving it a try with our logo :-), I get the alt text as a user, i.e. "RISE logo"

[livenson]

Hi, sorry for delay, investigating. Strange issue, works in dev build but crashes in production.

[livenson]

ok, the problem is indeed in production deployment, where we set CSP policy. E.g. in your browser's console window, you should see something similar to: "Refused to load the image 'https://placecats.com/300/200' because it violates the following Content Security Policy directive: "img-src 'self' www.google-analytics.com *.gravatar.com *.tile.openstreetmap.org rest-test.nodeconductor.com blob: data:"."

As a short term workaround, if e.g. you are using docker compose to test out Waldur, you can add the server from where you load images to the allowed list in: https://github.com/waldur/waldur-docker-compose/blob/cbdebc364dae76a9fc015491e1e7306140e317e5/Caddyfile#L40

[mazekeeper]

Works like a charm, edited the Caddyfile line 40, and as I found that you can restart just the caddy service,
found the quick deploy method, everyone probably knew this already : "docker compose restart caddy-router" (that's my name for the caddy service, do "docker compose ps" to find out)