Split the clean method into two clean and purify. clean is a light weight

approach using html::specialchars and purify uses HTMLPurifier to intelligently
cleanse the output fields. Use purifier for text and title fields where it is
likely that a user would enter html to format their data.

6 files changed, 8 insertions, 8 deletions

diff --git a/modules/comment/controllers/comments.php b/modules/comment/controllers/comments.php
index 99ecc8e0..2840ba67 100644
--- a/modules/comment/controllers/comments.php
+++ b/modules/comment/controllers/comments.php
@@ -41,7 +41,7 @@ class Comments_Controller extends REST_Controller {
           "id" => $comment->id,
           "author_name" => p::clean($comment->author_name()),
           "created" => $comment->created,
-          "text" => p::clean($comment->text));
+          "text" => p::purify($comment->text));
       }
       print json_encode($data);
       break;
@@ -128,7 +128,7 @@ class Comments_Controller extends REST_Controller {
                 "id" => $comment->id,
                 "author_name" => p::clean($comment->author_name()),
                 "created" => $comment->created,
-                "text" => p::clean($comment->text))));
+                "text" => p::purify($comment->text))));
     } else {
       $view = new Theme_View("comment.html", "fragment");
       $view->comment = $comment;
diff --git a/modules/comment/helpers/comment_rss.php b/modules/comment/helpers/comment_rss.php
index ef2d176e..746c6161 100644
--- a/modules/comment/helpers/comment_rss.php
+++ b/modules/comment/helpers/comment_rss.php
@@ -23,7 +23,7 @@ class comment_rss_Core {
     $feeds["comment/newest"] = t("All new comments");
     if ($item) {
       $feeds["comment/item/$item->id"] =
-        t("Comments on %title", array("title" => p::clean($item->title)));
+        t("Comments on %title", array("title" => p::purify($item->title)));
     }
     return $feeds;
   }
diff --git a/modules/comment/views/admin_block_recent_comments.html.php b/modules/comment/views/admin_block_recent_comments.html.php
index af4d946e..893c1a63 100644
--- a/modules/comment/views/admin_block_recent_comments.html.php
+++ b/modules/comment/views/admin_block_recent_comments.html.php
@@ -10,7 +10,7 @@
     <?= gallery::date_time($comment->created) ?>
     <?= t('<a href="#">%author_name</a> said <em>%comment_text</em>',
           array("author_name" => p::clean($comment->author_name()),
-                "comment_text" => text::limit_words(p::clean($comment->text), 50))); ?>
+                "comment_text" => text::limit_words(p::purify($comment->text), 50))); ?>
   </li>
   <? endforeach ?>
 </ul>
diff --git a/modules/comment/views/admin_comments.html.php b/modules/comment/views/admin_comments.html.php
index 453cf849..489605d5 100644
--- a/modules/comment/views/admin_comments.html.php
+++ b/modules/comment/views/admin_comments.html.php
@@ -122,7 +122,7 @@
             <a href="<?= $item->url() ?>">
               <? if ($item->has_thumb()): ?>
               <img src="<?= $item->thumb_url() ?>"
-                 alt="<?= p::clean($item->title) ?>"
+                 alt="<?= p::purify($item->title) ?>"
                  <?= photo::img_dimensions($item->thumb_width, $item->thumb_height, 75) ?>
               />
               <? else: ?>
@@ -132,7 +132,7 @@
           </div>
         </div>
         <p><?= gallery::date($comment->created) ?></p>
-        <?= p::clean($comment->text) ?>
+        <?= p::purify($comment->text) ?>
       </td>
       <td>
         <ul class="gButtonSetVertical">
diff --git a/modules/comment/views/comment.html.php b/modules/comment/views/comment.html.php
index 6d2cc592..15121d08 100644
--- a/modules/comment/views/comment.html.php
+++ b/modules/comment/views/comment.html.php
@@ -13,6 +13,6 @@
                 "author_name" => p::clean($comment->author_name()))) ?>
   </p>
   <div>
-    <?= p::clean($comment->text) ?>
+    <?= p::purify($comment->text) ?>
   </div>
 </li>
diff --git a/modules/comment/views/comments.html.php b/modules/comment/views/comments.html.php
index d9405e5f..2d754791 100644
--- a/modules/comment/views/comments.html.php
+++ b/modules/comment/views/comments.html.php
@@ -21,7 +21,7 @@
                   "name" => p::clean($comment->author_name()))); ?>
     </p>
     <div>
-      <?= p::clean($comment->text) ?>
+      <?= p::purify($comment->text) ?>
     </div>
   </li>
   <? endforeach ?>