tim
a9daa6a792
TinyMCE 4.2.8 has known XSS bugs. publish/editor.js has the same toolbar and writes the same HTML. The textarea still posts the story.
28 lines
1.1 KiB
PHP
28 lines
1.1 KiB
PHP
<?php
|
|
/*
|
|
* Clean story HTML with HTML Purifier. Only the markup that the story
|
|
* editor (publish/editor.js) can produce (plus a few tags that older
|
|
* stories use) is kept; scripts, event handlers and unsafe URLs are removed.
|
|
*/
|
|
require_once(__DIR__ . '/htmlpurifier-4.19.1/library/HTMLPurifier.auto.php');
|
|
|
|
function purify_story($html) {
|
|
static $purifier = NULL;
|
|
if ($purifier === NULL) {
|
|
$config = HTMLPurifier_Config::createDefault();
|
|
$config->set('HTML.Allowed',
|
|
'p[style|align],br,strong,b,em,i,u,sup,sub,hr,pre,code,' .
|
|
'blockquote[style],div[style|align],span[style],ul,ol,li,a[href|title]');
|
|
$config->set('CSS.AllowedProperties', array('text-align', 'padding-left', 'margin-left'));
|
|
$config->set('URI.AllowedSchemes', array('http' => TRUE, 'https' => TRUE, 'mailto' => TRUE));
|
|
// HTML Purifier caches its definitions; keep the cache out of the web root
|
|
$cache = sys_get_temp_dir() . '/xxx-htmlpurifier';
|
|
if (!is_dir($cache))
|
|
@mkdir($cache, 0700, TRUE);
|
|
$config->set('Cache.SerializerPath', $cache);
|
|
$purifier = new HTMLPurifier($config);
|
|
}
|
|
return $purifier->purify((string)$html);
|
|
}
|
|
?>
|