I've been testing out Codoforum and discover something I found strange.

I tried to create a signature using markdown or bbCode, but when I save, I find that my signature is wrapped in p tags. Thankfully, signatures are apparently limited in what HTML can be posted (no script tags).

Are signatures supposed to be HTML? It seems inconsistent with the Markdown/bbCode used elsewhere.

UPDATE: On that same note, greater-than and less-than signs are being converted to < and > when in code tags, which is unpleasant. They are also inconsistent with the live preview.

Are signatures supposed to be HTML? It seems inconsistent with the Markdown/bbCode used elsewhere.

Using HTML for the signature makes it very easy to store it in the database.

UPDATE: On that same note, greater-than and less-than signs are being converted to < and > when in code tags, which is unpleasant. They are also inconsistent with the live preview.

Can you give us an example .
It seems like it is working fine, for eg.

<>

<hello>

PS: After checking it again, looks like it does not work with single backtick eg. <
We will correct this in the soon to be released V2.5

Using HTML for the signature makes it very easy to store it in the database.

I see. I guess I would prefer a system like what posts use, where it stores both the source markdown for editing and the rendered HTML for display in the database. Maybe I'll have to write a plugin for that.

Incidentally, do you know or is there somewhere I can find what subset of HTML is allowed for signatures?

PS: After checking it again, looks like it does not work with single backtick eg. <
We will correct this in the soon to be released V2.5

Glad to hear!

The signature as well the posts both are filtered using the same whitelist.

Below is the list of supported tags:

    'p' => array('style', 'class', 'align'),
    'div' => array('style', 'class', 'align'),
    'span' => array('style', 'class'),
    'br' => array('style', 'class'),
    'hr' => array('style', 'class'),
    'h1' => array('style', 'class'),
    'h2' => array('style', 'class'),
    'h3' => array('style', 'class'),
    'h4' => array('style', 'class'),
    'h5' => array('style', 'class'),
    'h6' => array('style', 'class'),
    'strong' => array('style', 'class'),
    'em' => array('style', 'class'),
    'i' => array('style', 'class'),
    'b' => array('style', 'class'),
    'u' => array('style', 'class'),
    'strike' => array('style', 'class'),
    'del' => array('style', 'class'),
    'ol' => array('style', 'class'),
    'ul' => array('style', 'class'),
    'li' => array('style', 'class'),
    'code' => array('style', 'class'),
    'pre' => array('style', 'class'),
    'sup' => array('style', 'class'),
    'sub' => array('style', 'class'),
    'marquee' => array('style', 'class'),
    // Took out 'rel' and 'title', because we're using those below
    'a' => array('style', 'class', 'href', 'target'),
    'img' => array('style', 'class', 'src', 'height',
        'width', 'alt', 'longdesc', 'title',
        'hspace', 'vspace'),
    'table' => array('style', 'class', 'border-collapse',
        'cellspacing', 'cellpadding'),
    'thead' => array('style', 'class'),
    'tbody' => array('style', 'class'),
    'tfoot' => array('style', 'class'),
    'tr' => array('style', 'class'),
    'td' => array('style', 'class',
        'colspan', 'rowspan'),
    'th' => array('style', 'class', 'scope', 'colspan',
        'rowspan'),
    'q' => array('style', 'class', 'cite'),
    'cite' => array('style', 'class'),
    'abbr' => array('style', 'class'),
    'blockquote' => array('style', 'class'),
    // Stripped out
    'body' => array()//,

I guess I would prefer a system like what posts use, where it stores both the source markdown for editing and the rendered HTML for display in the database

If we get more requests for this, we will definitely add it.

Yikes! Unrestricted style attributes. Unfortunately, I could see that being misused.

<a href="http://example.com" style="display:block;position:fixed;background:white;left:0;top:0;right:0;bottom:0;z-index:999999;padding:1em;font-size:10em;" title="example.com " rel="nofollow">Click me!</a>

An invisible variation on that could be used in a click-jacking attack.

Yes, you are right.

We noticed it right away when you posted the first message about HTML in signatures.
It has already been fixed in V2.5 , so you don't have to worry about that.