From fbaa0f05ad28fe5dff69333a3622d7b62affde8e Mon Sep 17 00:00:00 2001 From: William Jacoby Date: Wed, 23 Sep 2026 18:02:12 -0500 Subject: [PATCH] Resolve TODO: templates are admin-configurable via ACP Adds the follow-up questions that decision raises: what template content is allowed to contain, and what sanitization admin-authored template content needs before landing in the edit form. Co-Authored-By: Claude Sonnet 5 --- docs/TODO.md | 16 +++++++++++++--- 1 file changed, 13 insertions(+), 3 deletions(-) diff --git a/docs/TODO.md b/docs/TODO.md index aec59cd..669682f 100644 --- a/docs/TODO.md +++ b/docs/TODO.md @@ -17,6 +17,16 @@ The template picker lives on the edit page itself (not the overview page's quick-create box, which still just takes you straight to a blank edit form and lets you pick there). -Not scoped further yet — open question: should templates be -admin-configurable/extensible beyond these two, or are "Blank" and "Generic" -enough? +Templates are admin-configurable: admins can add new templates beyond the +built-in "Blank" and "Generic" ones, via an ACP page. + +Still needs deciding before implementation: + +- What a template is allowed to contain (plain text with placeholders? + BBCode? anything the message parser accepts?) and how that's authored in + the ACP form. +- What sanitization that admin-authored template content needs before it's + inserted into the edit form's message body — it's admin-authored rather + than end-user input, but still ends up in content regular members see and + can build on, so it shouldn't get a free pass on the same checks normal + article content goes through.