diff options
| author | friendica <info@friendica.com> | 2013-02-26 19:41:44 -0800 |
|---|---|---|
| committer | friendica <info@friendica.com> | 2013-02-26 19:41:44 -0800 |
| commit | 70e766c2bfb4f145564912837864f27aafc82ea2 (patch) | |
| tree | a27aea06e255265af6819a3a836414978444098f /include | |
| parent | ed2ff18cac816fccf28ab2450fdd0f9541427286 (diff) | |
| download | volse-hubzilla-70e766c2bfb4f145564912837864f27aafc82ea2.tar.gz volse-hubzilla-70e766c2bfb4f145564912837864f27aafc82ea2.tar.bz2 volse-hubzilla-70e766c2bfb4f145564912837864f27aafc82ea2.zip | |
xss attack vector in bbcode.php - check for proc_open being disabled for security reasons in install
Diffstat (limited to 'include')
| -rw-r--r-- | include/bbcode.php | 22 |
1 files changed, 11 insertions, 11 deletions
diff --git a/include/bbcode.php b/include/bbcode.php index 4938db37d..021f2ac27 100644 --- a/include/bbcode.php +++ b/include/bbcode.php @@ -502,22 +502,22 @@ function bbcode($Text,$preserve_nl = false, $tryoembed = true) { // Clean up the HTML by loading and saving the HTML with the DOM // Only do it when it has to be done - for performance reasons - if (!$tryoembed) { - $doc = new DOMDocument(); - $doc->preserveWhiteSpace = false; +// if (!$tryoembed) {// +// $doc = new DOMDocument(); +// $doc->preserveWhiteSpace = false; - $Text = mb_convert_encoding($Text, 'HTML-ENTITIES', "UTF-8"); +// $Text = mb_convert_encoding($Text, 'HTML-ENTITIES', "UTF-8"); - $doctype = '<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN" "http://www.w3.org/TR/REC-html40/loose.dtd">'; - @$doc->loadHTML($doctype."<html><body>".$Text."</body></html>"); +// $doctype = '<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN" "http://www.w3.org/TR/REC-html40/loose.dtd">'; +// @$doc->loadHTML($doctype."<html><body>".$Text."</body></html>"); - $Text = $doc->saveHTML(); - $Text = str_replace(array("<html><body>", "</body></html>", $doctype), array("", "", ""), $Text); +// $Text = $doc->saveHTML(); +// $Text = str_replace(array("<html><body>", "</body></html>", $doctype), array("", "", ""), $Text); - $Text = str_replace('<br></li>','</li>', $Text); +// $Text = str_replace('<br></li>','</li>', $Text); - $Text = mb_convert_encoding($Text, "UTF-8", 'HTML-ENTITIES'); - } +// $Text = mb_convert_encoding($Text, "UTF-8", 'HTML-ENTITIES'); +// } call_hooks('bbcode',$Text); |