Security guidelines for custom macros¶
Feel free to update this Wiki page with your guidelines.
- Avoid using variables for CSS rules
Otherwise, users may be able to alter the visibility of your custom content, and more.
You can use variables as CSS class names instead.
- Always enclose arguments into double quotes for JavaScript
Otherwise, users will be able to change many things on the page.