81ea0f8117
HTMLPurifier defangs arbitrary submitted HTML. We're using it in the OStatus plugin, but it may be valuable for other parts of the codebase (I think OEmbed might benefit, for example).
16 lines
381 B
PHP
16 lines
381 B
PHP
<?php
|
|
|
|
class HTMLPurifier_AttrTransform_SafeEmbed extends HTMLPurifier_AttrTransform
|
|
{
|
|
public $name = "SafeEmbed";
|
|
|
|
public function transform($attr, $config, $context) {
|
|
$attr['allowscriptaccess'] = 'never';
|
|
$attr['allownetworking'] = 'internal';
|
|
$attr['type'] = 'application/x-shockwave-flash';
|
|
return $attr;
|
|
}
|
|
}
|
|
|
|
// vim: et sw=4 sts=4
|