Fix for ticket #477. Use nl2br method when rendering comment::text and

item::description.  In addition add p::clean or p::purify to places that
xss cleaning had missed (i.e. rss feeds)

1 files changed, 3 insertions, 3 deletions

diff --git a/modules/comment/helpers/comment_rss.php b/modules/comment/helpers/comment_rss.php
index 746c6161..ab3d2283 100644
--- a/modules/comment/helpers/comment_rss.php
+++ b/modules/comment/helpers/comment_rss.php
@@ -53,13 +53,13 @@ class comment_rss_Core {
         $item = $comment->item();
         $feed->children[] = new ArrayObject(
           array("pub_date" => date("D, d M Y H:i:s T", $comment->created),
-                "text" => $comment->text,
+                "text" => nl2br(p::purify($comment->text)),
                 "thumb_url" => $item->thumb_url(),
                 "thumb_height" => $item->thumb_height,
                 "thumb_width" => $item->thumb_width,
                 "item_uri" => url::abs_site("{$item->type}s/$item->id"),
-                "title" => $item->title,
-                "author" => $comment->author_name()),
+                "title" => p::purify($item->title),
+                "author" => p::clean($comment->author_name())),
           ArrayObject::ARRAY_AS_PROPS);
       }