GNUsocial/gnu-social
4
0
Fork 1
Code Issues Releases Wiki Activity

Replace htmLawed with HTMLPurifier

Browse Source
This commit is contained in:
Mikael Nordfeldth
2016-01-28 18:57:36 +01:00
parent daea5647b6
commit 7e6783bb8f
384 changed files with 31999 additions and 5797 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
plugins/Oembed/OembedPlugin.php
View File

@@ -233,16 +233,14 @@ class OembedPlugin extends Plugin
// the 'photo' type is shown through ordinary means, using StartShowAttachmentRepresentation!
switch ($oembed->type) {
case 'rich':
case 'video':
case 'link':
if (!empty($oembed->html)
&& (GNUsocial::isAjax() || common_config('attachments', 'show_html'))) {
require_once INSTALLDIR.'/extlib/htmLawed/htmLawed.php';
$config = array(
'safe'=>1,
'elements'=>'*+object+embed');
$out->raw(htmLawed($oembed->html,$config));
require_once INSTALLDIR.'/extlib/HTMLPurifier/HTMLPurifier.auto.php';
$purifier = new HTMLPurifier();
// FIXME: do we allow <object> and <embed> here? we did that when we used htmLawed, but I'm not sure anymore...
$out->raw($purifier->purify($oembed->html));
}
return false;
break;