aboutsummaryrefslogtreecommitdiffstats
path: root/Zotlabs
diff options
context:
space:
mode:
authorMario <mario@mariovavti.com>2024-02-21 10:44:56 +0000
committerMario <mario@mariovavti.com>2024-02-21 10:44:56 +0000
commit17e2877c91dfc889ab5edb62fc6e00dd7dcbba01 (patch)
tree27ec3a55fd853caec3877cadb1b80433b00a00b3 /Zotlabs
parentb7bc28c33356e95f4d45a7d5d2585e67ebd04648 (diff)
downloadvolse-hubzilla-17e2877c91dfc889ab5edb62fc6e00dd7dcbba01.tar.gz
volse-hubzilla-17e2877c91dfc889ab5edb62fc6e00dd7dcbba01.tar.bz2
volse-hubzilla-17e2877c91dfc889ab5edb62fc6e00dd7dcbba01.zip
make sure to decode html special chars before sending over the wire and
Diffstat (limited to 'Zotlabs')
-rw-r--r--Zotlabs/Lib/Activity.php10
-rw-r--r--Zotlabs/Module/Item.php5
2 files changed, 7 insertions, 8 deletions
diff --git a/Zotlabs/Lib/Activity.php b/Zotlabs/Lib/Activity.php
index ab96423d7..4db116b5e 100644
--- a/Zotlabs/Lib/Activity.php
+++ b/Zotlabs/Lib/Activity.php
@@ -517,7 +517,7 @@ class Activity {
}
if ($i['title'])
- $ret['name'] = $i['title'];
+ $ret['name'] = unescape_tags($i['title']);
$ret['published'] = datetime_convert('UTC', 'UTC', $i['created'], ATOM_TIME);
if ($i['created'] !== $i['edited'])
@@ -564,11 +564,11 @@ class Activity {
if ($i['mimetype'] === 'text/bbcode') {
if ($i['title'])
- $ret['name'] = bbcode($i['title'], ['cache' => true]);
+ $ret['name'] = unescape_tags($i['title']);
if ($i['summary'])
- $ret['summary'] = bbcode($i['summary'], ['cache' => true]);
- $ret['content'] = bbcode($i['body'], ['cache' => true]);
- $ret['source'] = ['content' => $i['body'], 'mediaType' => 'text/bbcode'];
+ $ret['summary'] = unescape_tags($i['summary']);
+ $ret['content'] = bbcode(unescape_tags($i['body']), ['cache' => true]);
+ $ret['source'] = ['content' => unescape_tags($i['body']), 'mediaType' => 'text/bbcode'];
}
$actor = self::encode_person($i['author'], false);
diff --git a/Zotlabs/Module/Item.php b/Zotlabs/Module/Item.php
index 09e4904c1..574dffc69 100644
--- a/Zotlabs/Module/Item.php
+++ b/Zotlabs/Module/Item.php
@@ -679,7 +679,7 @@ class Item extends Controller {
$verb = $orig_post['verb'];
$app = $orig_post['app'];
$title = escape_tags(trim($_REQUEST['title']));
- $summary = trim($_REQUEST['summary']);
+ $summary = escape_tags(trim($_REQUEST['summary']));
$body = trim($_REQUEST['body']);
$item_flags = $orig_post['item_flags'];
$item_origin = $orig_post['item_origin'];
@@ -740,7 +740,7 @@ class Item extends Controller {
$coord = ((isset($_REQUEST['coord'])) ? notags(trim($_REQUEST['coord'])) : '');
$verb = ((isset($_REQUEST['verb'])) ? notags(trim($_REQUEST['verb'])) : '');
$title = ((isset($_REQUEST['title'])) ? escape_tags(trim($_REQUEST['title'])) : '');
- $summary = ((isset($_REQUEST['summary'])) ? trim($_REQUEST['summary']) : '');
+ $summary = ((isset($_REQUEST['summary'])) ? escape_tags(trim($_REQUEST['summary'])) : '');
$body = ((isset($_REQUEST['body'])) ? trim($_REQUEST['body']) : '');
$body .= ((isset($_REQUEST['attachment'])) ? trim($_REQUEST['attachment']) : '');
$postopts = '';
@@ -793,7 +793,6 @@ class Item extends Controller {
&& ($channel['channel_pageflags'] & PAGE_ALLOWCODE)) ? true : false);
if ($preview) {
- $summary = z_input_filter($summary, $mimetype, $execflag);
$body = z_input_filter($body, $mimetype, $execflag);
}