tim
00e1829f8b
Add HTML Purifier 4.19.1. Stories are purified when they are saved and when they are shown.
28 lines
1.1 KiB
PHP
28 lines
1.1 KiB
PHP
<?php
|
|
/*
|
|
* Clean story HTML with HTML Purifier. Only the markup that the TinyMCE
|
|
* toolbar can produce (plus a few tags that older stories use) is kept;
|
|
* scripts, event handlers and unsafe URLs are removed.
|
|
*/
|
|
require_once(__DIR__ . '/htmlpurifier-4.19.1/library/HTMLPurifier.auto.php');
|
|
|
|
function purify_story($html) {
|
|
static $purifier = NULL;
|
|
if ($purifier === NULL) {
|
|
$config = HTMLPurifier_Config::createDefault();
|
|
$config->set('HTML.Allowed',
|
|
'p[style|align],br,strong,b,em,i,u,sup,sub,hr,pre,code,' .
|
|
'blockquote[style],div[style|align],span[style],ul,ol,li,a[href|title]');
|
|
$config->set('CSS.AllowedProperties', array('text-align', 'padding-left', 'margin-left'));
|
|
$config->set('URI.AllowedSchemes', array('http' => TRUE, 'https' => TRUE, 'mailto' => TRUE));
|
|
// HTML Purifier caches its definitions; keep the cache out of the web root
|
|
$cache = sys_get_temp_dir() . '/xxx-htmlpurifier';
|
|
if (!is_dir($cache))
|
|
@mkdir($cache, 0700, TRUE);
|
|
$config->set('Cache.SerializerPath', $cache);
|
|
$purifier = new HTMLPurifier($config);
|
|
}
|
|
return $purifier->purify((string)$html);
|
|
}
|
|
?>
|