tim/xxx
1
0
Fork 0
Code Issues Pull Requests Releases Activity

Escape story fields and clean story HTML with HTML Purifier.

Browse Source 
Add HTML Purifier 4.19.1. Stories are purified when they are saved and
when they are shown.
This commit is contained in:
tim
2026-09-25 21:34:10 +02:00
parent e881ddb458
commit 00e1829f8b
385 changed files with 33174 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files
get_data.lib.php
+21 -11
View File
@@ -1,5 +1,11 @@
<?php
require_once('open_db.lib.php');
require_once(__DIR__ . '/lib/purify.inc.php');
// Escape plain text for HTML (existing entities such as &hellip; are kept)
function h($string) {
return htmlspecialchars((string)$string, ENT_QUOTES | ENT_SUBSTITUTE, 'UTF-8', FALSE);
}
function display_stories($id = NULL) {
global $db, $is_admin, $editable, $action;
@@ -49,43 +55,47 @@ searches the title, author, date, and the text of each article.</p>'."\n";
if (empty($entry['id']) && isset($_SESSION['allow_queue_image'])) {
$entry['id'] = $_SESSION['allow_queue_image'];
}
// Escape everything that goes into the page
$entry_id = (int)$entry['id'];
$queue_url = $entry['queue_url'] ? 1 : 0;
$title = h($entry['title']);
if ($entry['date'])
$date = '<time datetime="'.date("Y-m-d\TH:i:sP", strtotime($entry['date'])).'">' .
date("Y-m-d H:i", strtotime($entry['date'])) . '</time>';
$page .= '<li class="box">';
$page .= '<article>';
if ($is_admin && !$editable) {
$page .= '<span class="right">[<a href="/publish/edit?id='.$entry['id'].'&amp;queue='.$entry['queue_url'].'">edit</a>]</span>';
$page .= '<span class="right">[<a href="/publish/edit?id='.$entry_id.'&amp;queue='.$queue_url.'">edit</a>]</span>';
}
$page .= '<h3 class="articletitle">';
if ($nolink) {
$page .= $entry['title'];
$page .= $title;
} else if ($is_admin && $editable) {
$page .= '<a href="/publish/edit?id='.$entry['id'].'&amp;queue='.$entry['queue_url'].'">';
$page .= $entry['title'];
$page .= '<a href="/publish/edit?id='.$entry_id.'&amp;queue='.$queue_url.'">';
$page .= $title;
$page .= '</a>';
} else {
$page .= '<a href="/article?id='.$entry['id'].'">';
$page .= $entry['title'];
$page .= '<a href="/article?id='.$entry_id.'">';
$page .= $title;
$page .= '</a>';
}
$page .= '</h3>';
$page .= '<dl>';
if ($entry['hidden'])
$page .= '<span class="right red">[hidden]</span>';
$page .= '<dt class="author">By</dt> <dd class="author">' . $entry['author'] . '</dd>';
$page .= '<dt class="author">By</dt> <dd class="author">' . h($entry['author']) . '</dd>';
$page .= '<dt class="date">Posted</dt> <dd class="date">' . $date . '</dd>';
$page .= '</dl>';
if (isset($file_src)) {
$page .= '<img src="'.$file_src.'" alt="'.$entry['title'].'" />';
$page .= '<img src="'.h($file_src).'" alt="'.$title.'" />';
} else if (!empty($entry['img']) || !empty($entry['uploaded'])) {
if ($editable) {
$page .= '<img src="/display?id='.$entry['id'].'&amp;queue='.$entry['queue_url'].'" alt="'.$entry['title'].'" />';
$page .= '<img src="/display?id='.$entry_id.'&amp;queue='.$queue_url.'" alt="'.$title.'" />';
} else {
$page .= '<img src="/display?id='.$entry['id'].'" alt="'.$entry['title'].'" />';
$page .= '<img src="/display?id='.$entry_id.'" alt="'.$title.'" />';
}
} else {
$page .= $entry['story']."\n";
$page .= purify_story($entry['story'])."\n";
}
$page .= "</article>\n</li>\n";
}