aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorzotlabs <mike@macgirvin.com>2017-03-20 19:50:09 -0700
committerzotlabs <mike@macgirvin.com>2017-03-20 19:50:09 -0700
commit8821986d87b36b8b5ea311bcb73d348dc0bed262 (patch)
tree12403d35c66b9fdeb0d8cd39b4a6dd77326eef31
parent35fc7328de3237ef9727e6f729ffe4df4697a421 (diff)
downloadvolse-hubzilla-8821986d87b36b8b5ea311bcb73d348dc0bed262.tar.gz
volse-hubzilla-8821986d87b36b8b5ea311bcb73d348dc0bed262.tar.bz2
volse-hubzilla-8821986d87b36b8b5ea311bcb73d348dc0bed262.zip
after all of this, I would be very hesitant to use any multi-user system which uses markdown and which doesn't have a large security budget.
-rw-r--r--Zotlabs/Lib/MarkdownSoap.php2
1 files changed, 1 insertions, 1 deletions
diff --git a/Zotlabs/Lib/MarkdownSoap.php b/Zotlabs/Lib/MarkdownSoap.php
index cf1446f45..e5f3c81dd 100644
--- a/Zotlabs/Lib/MarkdownSoap.php
+++ b/Zotlabs/Lib/MarkdownSoap.php
@@ -82,7 +82,7 @@ class MarkdownSoap {
$s = str_replace(' ','&nbsp;',$s);
$s = purify_html($s);
$s = str_replace(['&nbsp;', mb_convert_encoding('&#x00a0;','UTF-8','HTML-ENTITIES')], [ ' ', ' ' ],$s);
- $s = str_replace(['<br>','<br />'],["\n","\n"],$s);
+ $s = str_replace(['<br>','<br />', '&lt;', '&gt;' ],["\n","\n", '<', '>'],$s);
return $s;
}