Escape story fields and clean story HTML with HTML Purifier.

Add HTML Purifier 4.19.1. Stories are purified when they are saved and
when they are shown.

lib/purify.inc.php

@@ -0,0 +1,27 @@
+<?php
+/*
+ * Clean story HTML with HTML Purifier. Only the markup that the TinyMCE
+ * toolbar can produce (plus a few tags that older stories use) is kept;
+ * scripts, event handlers and unsafe URLs are removed.
+ */
+require_once(__DIR__ . '/htmlpurifier-4.19.1/library/HTMLPurifier.auto.php');
+
+function purify_story($html) {
+  static $purifier = NULL;
+  if ($purifier === NULL) {
+    $config = HTMLPurifier_Config::createDefault();
+    $config->set('HTML.Allowed',
+      'p[style|align],br,strong,b,em,i,u,sup,sub,hr,pre,code,' .
+      'blockquote[style],div[style|align],span[style],ul,ol,li,a[href|title]');
+    $config->set('CSS.AllowedProperties', array('text-align', 'padding-left', 'margin-left'));
+    $config->set('URI.AllowedSchemes', array('http' => TRUE, 'https' => TRUE, 'mailto' => TRUE));
+    // HTML Purifier caches its definitions; keep the cache out of the web root
+    $cache = sys_get_temp_dir() . '/xxx-htmlpurifier';
+    if (!is_dir($cache))
+      @mkdir($cache, 0700, TRUE);
+    $config->set('Cache.SerializerPath', $cache);
+    $purifier = new HTMLPurifier($config);
+  }
+  return $purifier->purify((string)$html);
+}
+?>