Redmine

I'm playing with the idea of developing a textile wysiwyg editor plugin for redmine. The current wysiwyg editor has it use but you need to convert all your existing pages to html and you loose the macro features of a wiki.

Since textile is the wiki format which is quite close to html, I'm using a system which converts the wiki textile page to html for use in Tinymce. Then once editing is complete it is converted back to textile. For the conversion process I'm using a modified versions of html2textile and RedCloth to convert to html.

My current prototype system displays the normal redmine editor however the user can switch to Tinymce via a radio button when editing a wiki page. It seems to work reasonably well except for a few formatting problems and some embedded images are displayed as "link not found" while in the wysiwyg editor.

My question is:-
I'm using a new Conversion controller which does the conversion between the two formats for the wiki editor page. What I was wondering is do I need to set any authorization "before" functions on my methods and/or do some initial string escaping to avoid string inserting attacks. I'm not sure this is necessary since my routines don't run any SQL commands just string manipulation routines.

The routes file is defined as..

#custom routes for this plugin
ActionController::Routing::Routes.draw do |map|
  map.with_options :controller => 'convert' do |convert_routes|
    convert_routes.connect "convert/wysiwygtohtmltotextile", :conditions => { :method => [:post, :put] }, :action 

=> 'wysiwygtohtmltotextile'
    convert_routes.connect "convert/wysiwygtotextiletohtml", :conditions => { :method => [:post, :put] }, :action 

=> 'wysiwygtotextiletohtml'
  end
end

and for example the code to convert from textile to html is...

def wysiwygtotextiletohtml
    @text=params[:content][:text]
    @text=HTMLFormatter.new(@text).to_html
    File.open("after_tohtml.txt", 'w') {|g| 
        g.write(@text)
    }
    render :partial => 'convert'
  end