Escape story fields and clean story HTML with HTML Purifier.

Add HTML Purifier 4.19.1. Stories are purified when they are saved and when they are shown.
2026-09-25 21:34:10 +02:00
parent e881ddb458
commit 00e1829f8b
385 changed files with 33174 additions and 12 deletions
@@ -0,0 +1,67 @@
+<?php
+
+/**
+ * Definition that uses different definitions depending on context.
+ *
+ * The del and ins tags are notable because they allow different types of
+ * elements depending on whether or not they're in a block or inline context.
+ * Chameleon allows this behavior to happen by using two different
+ * definitions depending on context.  While this somewhat generalized,
+ * it is specifically intended for those two tags.
+ */
+class HTMLPurifier_ChildDef_Chameleon extends HTMLPurifier_ChildDef
+{
+
+    /**
+     * Instance of the definition object to use when inline. Usually stricter.
+     * @type HTMLPurifier_ChildDef_Optional
+     */
+    public $inline;
+
+    /**
+     * Instance of the definition object to use when block.
+     * @type HTMLPurifier_ChildDef_Optional
+     */
+    public $block;
+
+    /**
+     * @type string
+     */
+    public $type = 'chameleon';
+
+    /**
+     * @param array $inline List of elements to allow when inline.
+     * @param array $block List of elements to allow when block.
+     */
+    public function __construct($inline, $block)
+    {
+        $this->inline = new HTMLPurifier_ChildDef_Optional($inline);
+        $this->block = new HTMLPurifier_ChildDef_Optional($block);
+        $this->elements = $this->block->elements;
+    }
+
+    /**
+     * @param HTMLPurifier_Node[] $children
+     * @param HTMLPurifier_Config $config
+     * @param HTMLPurifier_Context $context
+     * @return bool
+     */
+    public function validateChildren($children, $config, $context)
+    {
+        if ($context->get('IsInline') === false) {
+            return $this->block->validateChildren(
+                $children,
+                $config,
+                $context
+            );
+        } else {
+            return $this->inline->validateChildren(
+                $children,
+                $config,
+                $context
+            );
+        }
+    }
+}
+
+// vim: et sw=4 sts=4