aboutsummaryrefslogtreecommitdiffstats
path: root/include
diff options
context:
space:
mode:
authorfriendica <info@friendica.com>2013-05-22 18:22:41 -0700
committerfriendica <info@friendica.com>2013-05-22 18:22:41 -0700
commitaa1eb2d89e7e4011ed43fdb391e6ced695a9521f (patch)
tree2d45ab19258541d2b771d0ee645b583a0c64630b /include
parent75e4d446ef8d84ba1e07612b9a8a8ec839defb41 (diff)
downloadvolse-hubzilla-aa1eb2d89e7e4011ed43fdb391e6ced695a9521f.tar.gz
volse-hubzilla-aa1eb2d89e7e4011ed43fdb391e6ced695a9521f.tar.bz2
volse-hubzilla-aa1eb2d89e7e4011ed43fdb391e6ced695a9521f.zip
add basic input filtering to the simple activity posting
Diffstat (limited to 'include')
-rwxr-xr-xinclude/items.php20
1 files changed, 20 insertions, 0 deletions
diff --git a/include/items.php b/include/items.php
index dc2d6b11b..37a6d5fed 100755
--- a/include/items.php
+++ b/include/items.php
@@ -113,6 +113,12 @@ function post_activity_item($arr) {
return $ret;
}
+ if(array_key_exists('content_type',$arr) && $arr['content_type'] == 'text/html')
+ $arr['body'] = purify_html($arr['body']);
+ else
+ $arr['body'] = escape_tags($arr['body']);
+
+
$arr['mid'] = ((x($arr,'mid')) ? $arr['mid'] : item_message_id());
$arr['parent_mid'] = ((x($arr,'parent_mid')) ? $arr['parent_mid'] : $arr['mid']);
$arr['thr_parent'] = ((x($arr,'thr_parent')) ? $arr['thr_parent'] : $arr['mid']);
@@ -160,6 +166,20 @@ function post_activity_item($arr) {
}
+function purify_html($s) {
+ require_once('library/HTMLPurifier.auto.php');
+ require_once('include/html2bbcode.php');
+
+// FIXME this function has html output, not bbcode - so safely purify these
+// $s = html2bb_video($s);
+// $s = oembed_html2bbcode($s);
+
+ $config = HTMLPurifier_Config::createDefault();
+ $config->set('Cache.DefinitionImpl', null);
+
+ $purifier = new HTMLPurifier($config);
+ return $purifier->purify($s);
+}
function get_public_feed($channel,$params) {