tree bcd03cfd3e218bd39d845555782cbd742c420092
parent 1240580f1fd284684ed5a7e3e83d703b0c3345db
author Edwin Kempin <edwin.kempin@sap.com> 1411721922 +0200
committer Edwin Kempin <edwin.kempin@sap.com> 1411722278 +0200

Make it configurable whether HTML is suppressed for Markdown

Until now inline HTML blocks as well as inline HTML tags in Markdown
were suppressed because allowing HTML for user-provided input is a
security risk, e.g. code for XSS attacks may be contained in the HTML.

However the basic idea of Markdown is to provide a simple syntax for
basic formatting and fall back to HTML if a more sophisticated
formatting is needed. With supressing HTML this fall back is not
possible.

Enable Gerrit administrators to allow HTML in Markdown in spite of the
security risk. This may make sense for closed Gerrit installations
with a trusted user base.

Change-Id: If2acbb21414a9fa8c00af2865597b2502da4ae3e
Signed-off-by: Edwin Kempin <edwin.kempin@sap.com>