Split the clean method into two clean and purify. clean is a light weight

approach using html::specialchars and purify uses HTMLPurifier to intelligently
cleanse the output fields. Use purifier for text and title fields where it is
likely that a user would enter html to format their data.

4 files changed, 8 insertions, 8 deletions

diff --git a/themes/default/views/album.html.php b/themes/default/views/album.html.php
index 46b0d29a..273b8a4e 100644
--- a/themes/default/views/album.html.php
+++ b/themes/default/views/album.html.php
@@ -2,8 +2,8 @@
 <? // @todo Set hover on AlbumGrid list items for guest users ?>
 <div id="gInfo">
   <?= $theme->album_top() ?>
-  <h1><?= p::clean($item->title) ?></h1>
-  <div class="gDescription"><?= p::clean($item->description) ?></div>
+  <h1><?= p::purify($item->title) ?></h1>
+  <div class="gDescription"><?= p::purify($item->description) ?></div>
 </div>
 
 <ul id="gAlbumGrid">
diff --git a/themes/default/views/header.html.php b/themes/default/views/header.html.php
index 51f55b41..5428d9fd 100644
--- a/themes/default/views/header.html.php
+++ b/themes/default/views/header.html.php
@@ -19,10 +19,10 @@
   <? foreach ($parents as $parent): ?>
   <li>
     <a href="<?= url::site("albums/{$parent->id}?show=$item->id") ?>">
-      <?= p::clean($parent->title) ?>
+      <?= p::purify($parent->title) ?>
     </a>
   </li>
   <? endforeach ?>
-  <li class="active"><?= p::clean($item->title) ?></li>
+  <li class="active"><?= p::purify($item->title) ?></li>
 </ul>
 <? endif ?>
diff --git a/themes/default/views/movie.html.php b/themes/default/views/movie.html.php
index c2fb0e30..2cd9806f 100644
--- a/themes/default/views/movie.html.php
+++ b/themes/default/views/movie.html.php
@@ -15,8 +15,8 @@
   <?= $item->movie_img(array("class" => "gMovie", "id" => "gMovieId-{$item->id}")) ?>
 
   <div id="gInfo">
-    <h1><?= p::clean($item->title) ?></h1>
-    <div><?= p::clean($item->description) ?></div>
+    <h1><?= p::purify($item->title) ?></h1>
+    <div><?= p::purify($item->description) ?></div>
   </div>
 
   <script type="text/javascript">
diff --git a/themes/default/views/photo.html.php b/themes/default/views/photo.html.php
index 4765a4e3..dc3a9dfd 100644
--- a/themes/default/views/photo.html.php
+++ b/themes/default/views/photo.html.php
@@ -50,8 +50,8 @@
   </div>
 
   <div id="gInfo">
-    <h1><?= p::clean($item->title) ?></h1>
-    <div><?= p::clean($item->description) ?></div>
+    <h1><?= p::purify($item->title) ?></h1>
+    <div><?= p::purify($item->description) ?></div>
   </div>
 
   <script type="text/javascript">