Escape story fields and clean story HTML with HTML Purifier.

Add HTML Purifier 4.19.1. Stories are purified when they are saved and
when they are shown.

publish/post.lib.php

@@ -241,7 +241,8 @@ function sanitise($story) {
     $story = SmartyPants($story);
     #include_once('../lib/convert_entities.inc.php');
     #$story = html_entity_decode_full($story); // Convert named entities to numeric entities
-    // Won't worry about HTML Purifier yet
+    // Remove any unsafe markup; this must stay the last step
+    $story = purify_story($story);
   }
   return $story;
 }