Escape story fields and clean story HTML with HTML Purifier.

Add HTML Purifier 4.19.1. Stories are purified when they are saved and when they are shown.
2026-09-25 21:34:10 +02:00
parent e881ddb458
commit 00e1829f8b
385 changed files with 33174 additions and 12 deletions
@@ -0,0 +1,49 @@
+<?php
+
+/**
+ * XHTML 1.1 Image Module provides basic image embedding.
+ * @note There is specialized code for removing empty images in
+ *       HTMLPurifier_Strategy_RemoveForeignElements
+ */
+class HTMLPurifier_HTMLModule_Image extends HTMLPurifier_HTMLModule
+{
+
+    /**
+     * @type string
+     */
+    public $name = 'Image';
+
+    /**
+     * @param HTMLPurifier_Config $config
+     */
+    public function setup($config)
+    {
+        $max = $config->get('HTML.MaxImgLength');
+        $img = $this->addElement(
+            'img',
+            'Inline',
+            'Empty',
+            'Common',
+            array(
+                'alt*' => 'Text',
+                // According to the spec, it's Length, but percents can
+                // be abused, so we allow only Pixels.
+                'height' => 'Pixels#' . $max,
+                'width' => 'Pixels#' . $max,
+                'longdesc' => 'URI',
+                'src*' => new HTMLPurifier_AttrDef_URI(true), // embedded
+            )
+        );
+        if ($max === null || $config->get('HTML.Trusted')) {
+            $img->attr['height'] =
+            $img->attr['width'] = 'Length';
+        }
+
+        // kind of strange, but splitting things up would be inefficient
+        $img->attr_transform_pre[] =
+        $img->attr_transform_post[] =
+            new HTMLPurifier_AttrTransform_ImgRequired();
+    }
+}
+
+// vim: et sw=4 sts=4