diff options
| author | Laria Carolin Chabowski <laria@laria.me> | 2020-09-25 22:19:37 +0200 |
|---|---|---|
| committer | Laria Carolin Chabowski <laria@laria.me> | 2020-09-25 22:19:37 +0200 |
| commit | 3de03d4f83817e59c1be4bc361fee8eca781789b (patch) | |
| tree | a12de586570159af2e9160f41473ae46e18125ae /ratatoeskr/sys | |
| parent | 5db841cbaafe2d4f4bfe9009f5ecca996f21b4d3 (diff) | |
| download | ratatoeskr-cms-3de03d4f83817e59c1be4bc361fee8eca781789b.tar.gz ratatoeskr-cms-3de03d4f83817e59c1be4bc361fee8eca781789b.tar.bz2 ratatoeskr-cms-3de03d4f83817e59c1be4bc361fee8eca781789b.zip | |
Replace kses with HTMLPurifier
This gets rid of our last non-compüoser dependency! :)
Diffstat (limited to 'ratatoeskr/sys')
| -rw-r--r-- | ratatoeskr/sys/models.php | 8 |
1 files changed, 5 insertions, 3 deletions
diff --git a/ratatoeskr/sys/models.php b/ratatoeskr/sys/models.php index caf14ad..b820e6f 100644 --- a/ratatoeskr/sys/models.php +++ b/ratatoeskr/sys/models.php @@ -14,7 +14,6 @@ use r7r\cms\sys\Env; require_once(dirname(__FILE__) . "/db.php"); require_once(dirname(__FILE__) . "/utils.php"); -require_once(dirname(__FILE__) . "/../libs/kses.php"); require_once(dirname(__FILE__) . "/textprocessors.php"); require_once(dirname(__FILE__) . "/pluginpackage.php"); @@ -1207,7 +1206,7 @@ class Comment extends BySQLRowEnabled /** * Creates the HTML representation of a comment text. It applies the page's comment textprocessor on it - * and filters some potentially harmful tags using kses. + * and filters some potentially harmful tags using HTMLPurifier. * * @param string $text Text to HTMLize. * @return string HTML code. @@ -1218,7 +1217,10 @@ class Comment extends BySQLRowEnabled $textprocessors = $textprocessors ?? Env::getGlobal()->textprocessors(); - return kses($textprocessors->mustApply($text, $ratatoeskr_settings["comment_textprocessor"]), [ + $purifierConfig = HTMLPurifier_Config::createDefault(); + $purifier = new HTMLPurifier($purifierConfig); + + return $purifier->purify($textprocessors->mustApply($text, $ratatoeskr_settings["comment_textprocessor"]), [ "a" => ["href" => 1, "hreflang" => 1, "title" => 1, "rel" => 1, "rev" => 1], "b" => [], "i" => [], |