Strip out ALL javascript from HTML source.

If it were a public blog then I would say you would be right and I wouldn’t be so worried but this app is not for a blog.

I’ve been considering the suggestion of creating custom

Cheers

Thanx for the link. At my first quick glance it looks like the WhiteList plugin will do these things as well with a few tweaks.

I will have a bit better look at it when I get a chance