Escape story fields and clean story HTML with HTML Purifier.

Add HTML Purifier 4.19.1. Stories are purified when they are saved and
when they are shown.

lib/htmlpurifier-4.19.1/library/HTMLPurifier/HTMLModule/Nofollow.php

@@ -0,0 +1,25 @@
+<?php
+
+/**
+ * Module adds the nofollow attribute transformation to a tags.  It
+ * is enabled by HTML.Nofollow
+ */
+class HTMLPurifier_HTMLModule_Nofollow extends HTMLPurifier_HTMLModule
+{
+
+    /**
+     * @type string
+     */
+    public $name = 'Nofollow';
+
+    /**
+     * @param HTMLPurifier_Config $config
+     */
+    public function setup($config)
+    {
+        $a = $this->addBlankElement('a');
+        $a->attr_transform_post[] = new HTMLPurifier_AttrTransform_Nofollow();
+    }
+}
+
+// vim: et sw=4 sts=4