Escape story fields and clean story HTML with HTML Purifier.

Add HTML Purifier 4.19.1. Stories are purified when they are saved and
when they are shown.

lib/htmlpurifier-4.19.1/library/HTMLPurifier/Injector/DisplayLinkURI.php

@@ -0,0 +1,40 @@
+<?php
+
+/**
+ * Injector that displays the URL of an anchor instead of linking to it, in addition to showing the text of the link.
+ */
+class HTMLPurifier_Injector_DisplayLinkURI extends HTMLPurifier_Injector
+{
+    /**
+     * @type string
+     */
+    public $name = 'DisplayLinkURI';
+
+    /**
+     * @type array
+     */
+    public $needed = array('a');
+
+    /**
+     * @param $token
+     */
+    public function handleElement(&$token)
+    {
+    }
+
+    /**
+     * @param HTMLPurifier_Token $token
+     */
+    public function handleEnd(&$token)
+    {
+        if (isset($token->start->attr['href'])) {
+            $url = $token->start->attr['href'];
+            unset($token->start->attr['href']);
+            $token = array($token, new HTMLPurifier_Token_Text(" ($url)"));
+        } else {
+            // nothing to display
+        }
+    }
+}
+
+// vim: et sw=4 sts=4