Giving web designers autonomy to publish

Question

I would like to give web designers autonomy to publish web pages but letting them to edit aspx files is a serious security risk as they don't have the required programming skills.

I was thinking about two approaches:

1. They are only able to edit html files and call services with ajax;
2. Let them to edit xslt files associated to services that return xml.

But both have a drawback: limited use of templates.

How would you deal with this situation?

Answer 1

This is an issue that's already been addressed in most CMS systems. Have a look at joomla, drupal, SharePoint, etc etc.

Answer 2

If the developer is on his own domain then its safe to give him full access to JavaScript. However if he is sharing this domain then by giving him access to javascript you open the door to XSS. This allows the publisher to hijack other user accounts (usually by access document.cookie, but there are other same-origin policy abuses). One possilbity is to use Html Purifier, which prevents javascript all together.

There is a better alternative and that is a Google-Caja, which places restrictions on the javascript a developer can execute. This is important for apps written for social networking sites.