<?php
/*
 * Clean story HTML with HTML Purifier. Only the markup that the story
 * editor (publish/editor.js) can produce (plus a few tags that older
 * stories use) is kept; scripts, event handlers and unsafe URLs are removed.
 */
require_once(__DIR__ . '/htmlpurifier-4.19.1/library/HTMLPurifier.auto.php');

function purify_story($html) {
  static $purifier = NULL;
  if ($purifier === NULL) {
    $config = HTMLPurifier_Config::createDefault();
    $config->set('HTML.Allowed',
      'p[style|align],br,strong,b,em,i,u,sup,sub,hr,pre,code,' .
      'blockquote[style],div[style|align],span[style],ul,ol,li,a[href|title]');
    $config->set('CSS.AllowedProperties', array('text-align', 'padding-left', 'margin-left'));
    $config->set('URI.AllowedSchemes', array('http' => TRUE, 'https' => TRUE, 'mailto' => TRUE));
    // HTML Purifier caches its definitions; keep the cache out of the web root
    $cache = sys_get_temp_dir() . '/xxx-htmlpurifier';
    if (!is_dir($cache))
      @mkdir($cache, 0700, TRUE);
    $config->set('Cache.SerializerPath', $cache);
    $purifier = new HTMLPurifier($config);
  }
  return $purifier->purify((string)$html);
}
?>