Allow script uploads for character sheets

Follow

Yiamiyo

• July 08, 2020 07:30

On the campaign edit page, along with the description/notes fields, add one more field (`Character sheet script`) and inject the provided code when a character of that campaign loads their sheet. You could also ask for confirmation on first load, making sure the player trusts the DM (resetting each time the field is updated), or maybe just add it as a toggle in character preferences.

 

Context: https://www.dndbeyond.com/forums/d-d-beyond-general/d-d-beyond-feedback/73886-character-sheet-scripts

-1

• 

  Moridrin

  • July 08, 2020 09:53
  • Edited

  No, this would be a major security risk. I can honestly think of way more ways this would go wrong and degrade the user experience instead of improving it.

   

  For those unfamiliar, the problem is called Cross Site Scripting (XSS) and even though, this change might be useful for the more tech savvy, a platform should prioritize the safety of the less tech savvy users over providing features for the more tech savvy. 

  0

  Comment actions Permalink

Please sign in to leave a comment.