[dtomvan]

either per-page or per-site

Fixes #62

[facundoolano]

I have to notes about this:

• unsafe is too generic for a config, I'd rather make it something like allow_unsafe_html
• more importantly, is there any case where allowing unsafe would be a risk? I'm leaning more towards just enabling by default rather than adding a new config and passing it around

[dtomvan]

• unsafe is too generic for a config, I'd rather make it something like allow_unsafe_html

Fair enough. I'll go ahead and do that.

• more importantly, is there any case where allowing unsafe would be a risk? I'm leaning more towards just enabling by default rather than adding a new config and passing it around

Not sure, to play devil's advocate I could imagine a usecase where someone isn't using this solely for personal purposes, and letting other people supply markdown for whatever static site that they are building (I don't know, something like allowing people to submit reactions over micropub? Not sure). In other cases users might actually expect that the markdown gets vetted against XSS by Jorge (they might've seen the <-- raw HTML omitted --> banner before), which will result in unfortunate mistakes if we'd change the existing behaviour.

Either way, it's obviously your call. If you don't want it configurable, you can just close this and make the 2-line change yourself :)

[facundoolano]

yeah lets just hardcode the allow flag internally. thanks!