strk/friendica
1
0
Fork 0
Code Issues Pull requests Releases Wiki Activity

make sure content is unaltered

Browse source
This commit is contained in:
Friendika 2011-02-01 17:50:49 -08:00
parent 968e8bb9c4
commit bafae56b39
1 changed files with 18 additions and 15 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

33
include/items.php
View file

@ -388,7 +388,8 @@ function get_atom_elements($feed,$item) {
$have_real_body = true; $have_real_body = true;
$res['body'] = $rawenv[0]['data']; $res['body'] = $rawenv[0]['data'];
$res['body'] = str_replace(array(' ',"\t","\r","\n"), array('','','',''),$res['body']); $res['body'] = str_replace(array(' ',"\t","\r","\n"), array('','','',''),$res['body']);
$res['body'] = base64url_decode($res['body']); // make sure nobody is trying to sneak some html tags by us
$res['body'] = notags(base64url_decode($res['body']));
$res['realbody'] = true; $res['realbody'] = true;
} }
@ -407,27 +408,29 @@ function get_atom_elements($feed,$item) {
// html. // html.
if((! $have_real_body) || (strpos($res['body'],'<')) || (strpos($res['body'],'>'))) { if(! $have_real_body) {
if((strpos($res['body'],'<')) || (strpos($res['body'],'>'))) {
$res['body'] = preg_replace('#<object[^>]+>.+?' . 'http://www.youtube.com/((?:v|cp)/[A-Za-z0-9\-_=]+).+?</object>#s', $res['body'] = preg_replace('#<object[^>]+>.+?' . 'http://www.youtube.com/((?:v|cp)/[A-Za-z0-9\-_=]+).+?</object>#s',
'[youtube]$1[/youtube]', $res['body']); '[youtube]$1[/youtube]', $res['body']);
$res['body'] = oembed_html2bbcode($res['body']); $res['body'] = oembed_html2bbcode($res['body']);
$config = HTMLPurifier_Config::createDefault(); $config = HTMLPurifier_Config::createDefault();
$config->set('Cache.DefinitionImpl', null); $config->set('Cache.DefinitionImpl', null);
// we shouldn't need a whitelist, because the bbcode converter // we shouldn't need a whitelist, because the bbcode converter
// will strip out any unsupported tags. // will strip out any unsupported tags.
// $config->set('HTML.Allowed', 'p,b,a[href],i'); // $config->set('HTML.Allowed', 'p,b,a[href],i');
$purifier = new HTMLPurifier($config); $purifier = new HTMLPurifier($config);
$res['body'] = $purifier->purify($res['body']); $res['body'] = $purifier->purify($res['body']);
$res['body'] = html2bbcode($res['body']); $res['body'] = html2bbcode($res['body']);
}
else
$res['body'] = escape_tags($res['body']);
} }
else
$res['body'] = escape_tags($res['body']);
$allow = $item->get_item_tags(NAMESPACE_DFRN,'comment-allow'); $allow = $item->get_item_tags(NAMESPACE_DFRN,'comment-allow');