diff options
22 files changed, 44 insertions, 40 deletions
diff --git a/modules/comment/controllers/comments.php b/modules/comment/controllers/comments.php index 99ecc8e0..2840ba67 100644 --- a/modules/comment/controllers/comments.php +++ b/modules/comment/controllers/comments.php @@ -41,7 +41,7 @@ class Comments_Controller extends REST_Controller { "id" => $comment->id, "author_name" => p::clean($comment->author_name()), "created" => $comment->created, - "text" => p::clean($comment->text)); + "text" => p::purify($comment->text)); } print json_encode($data); break; @@ -128,7 +128,7 @@ class Comments_Controller extends REST_Controller { "id" => $comment->id, "author_name" => p::clean($comment->author_name()), "created" => $comment->created, - "text" => p::clean($comment->text)))); + "text" => p::purify($comment->text)))); } else { $view = new Theme_View("comment.html", "fragment"); $view->comment = $comment; diff --git a/modules/comment/helpers/comment_rss.php b/modules/comment/helpers/comment_rss.php index ef2d176e..746c6161 100644 --- a/modules/comment/helpers/comment_rss.php +++ b/modules/comment/helpers/comment_rss.php @@ -23,7 +23,7 @@ class comment_rss_Core { $feeds["comment/newest"] = t("All new comments"); if ($item) { $feeds["comment/item/$item->id"] = - t("Comments on %title", array("title" => p::clean($item->title))); + t("Comments on %title", array("title" => p::purify($item->title))); } return $feeds; } diff --git a/modules/comment/views/admin_block_recent_comments.html.php b/modules/comment/views/admin_block_recent_comments.html.php index af4d946e..893c1a63 100644 --- a/modules/comment/views/admin_block_recent_comments.html.php +++ b/modules/comment/views/admin_block_recent_comments.html.php @@ -10,7 +10,7 @@ <?= gallery::date_time($comment->created) ?> <?= t('<a href="#">%author_name</a> said <em>%comment_text</em>', array("author_name" => p::clean($comment->author_name()), - "comment_text" => text::limit_words(p::clean($comment->text), 50))); ?> + "comment_text" => text::limit_words(p::purify($comment->text), 50))); ?> </li> <? endforeach ?> </ul> diff --git a/modules/comment/views/admin_comments.html.php b/modules/comment/views/admin_comments.html.php index 453cf849..489605d5 100644 --- a/modules/comment/views/admin_comments.html.php +++ b/modules/comment/views/admin_comments.html.php @@ -122,7 +122,7 @@ <a href="<?= $item->url() ?>"> <? if ($item->has_thumb()): ?> <img src="<?= $item->thumb_url() ?>" - alt="<?= p::clean($item->title) ?>" + alt="<?= p::purify($item->title) ?>" <?= photo::img_dimensions($item->thumb_width, $item->thumb_height, 75) ?> /> <? else: ?> @@ -132,7 +132,7 @@ </div> </div> <p><?= gallery::date($comment->created) ?></p> - <?= p::clean($comment->text) ?> + <?= p::purify($comment->text) ?> </td> <td> <ul class="gButtonSetVertical"> diff --git a/modules/comment/views/comment.html.php b/modules/comment/views/comment.html.php index 6d2cc592..15121d08 100644 --- a/modules/comment/views/comment.html.php +++ b/modules/comment/views/comment.html.php @@ -13,6 +13,6 @@ "author_name" => p::clean($comment->author_name()))) ?> </p> <div> - <?= p::clean($comment->text) ?> + <?= p::purify($comment->text) ?> </div> </li> diff --git a/modules/comment/views/comments.html.php b/modules/comment/views/comments.html.php index d9405e5f..2d754791 100644 --- a/modules/comment/views/comments.html.php +++ b/modules/comment/views/comments.html.php @@ -21,7 +21,7 @@ "name" => p::clean($comment->author_name()))); ?> </p> <div> - <?= p::clean($comment->text) ?> + <?= p::purify($comment->text) ?> </div> </li> <? endforeach ?> diff --git a/modules/digibug/controllers/digibug.php b/modules/digibug/controllers/digibug.php index 49fb51ad..d881db9b 100644 --- a/modules/digibug/controllers/digibug.php +++ b/modules/digibug/controllers/digibug.php @@ -50,7 +50,7 @@ class Digibug_Controller extends Controller { "image_width_1" => $item->width, "thumb_height_1" => $item->thumb_height, "thumb_width_1" => $item->thumb_width, - "title_1" => p::clean($item->title)); + "title_1" => p::purify($item->title)); print $v; } diff --git a/modules/gallery/controllers/quick.php b/modules/gallery/controllers/quick.php index 5d3d8885..53af2ba6 100644 --- a/modules/gallery/controllers/quick.php +++ b/modules/gallery/controllers/quick.php @@ -89,7 +89,7 @@ class Quick_Controller extends Controller { access::required("view", $item->parent()); access::required("edit", $item->parent()); - $msg = t("Made <b>%title</b> this album's cover", array("title" => p::clean($item->title))); + $msg = t("Made <b>%title</b> this album's cover", array("title" => p::purify($item->title))); item::make_album_cover($item); message::success($msg); @@ -105,10 +105,10 @@ class Quick_Controller extends Controller { if ($item->is_album()) { print t( "Delete the album <b>%title</b>? All photos and movies in the album will also be deleted.", - array("title" => p::clean($item->title))); + array("title" => p::purify($item->title))); } else { print t("Are you sure you want to delete <b>%title</b>?", - array("title" => p::clean($item->title))); + array("title" => p::purify($item->title))); } $form = item::get_delete_form($item); @@ -122,9 +122,9 @@ class Quick_Controller extends Controller { access::required("edit", $item); if ($item->is_album()) { - $msg = t("Deleted album <b>%title</b>", array("title" => p::clean($item->title))); + $msg = t("Deleted album <b>%title</b>", array("title" => p::purify($item->title))); } else { - $msg = t("Deleted photo <b>%title</b>", array("title" => p::clean($item->title))); + $msg = t("Deleted photo <b>%title</b>", array("title" => p::purify($item->title))); } $item->delete(); diff --git a/modules/gallery/helpers/p.php b/modules/gallery/helpers/p.php index fe53102c..862c769b 100644 --- a/modules/gallery/helpers/p.php +++ b/modules/gallery/helpers/p.php @@ -20,6 +20,10 @@ class p_Core { private static $_purifier = null; static function clean($dirty_html) { + return html::specialchars($dirty_html); + } + + static function purify($dirty_html) { if (empty(self::$_purifier)) { require_once(dirname(__file__) . "/../lib/HTMLPurifier/HTMLPurifier.auto.php"); $config = HTMLPurifier_Config::createDefault(); diff --git a/modules/gallery/views/permissions_browse.html.php b/modules/gallery/views/permissions_browse.html.php index 36394877..888a27f7 100644 --- a/modules/gallery/views/permissions_browse.html.php +++ b/modules/gallery/views/permissions_browse.html.php @@ -42,7 +42,7 @@ <? endforeach ?> <li> <a href="javascript:show(<?= $item->id ?>)"> - <?= p::clean($item->title) ?> + <?= p::purify($item->title) ?> </a> <div class="form" id="edit-<?= $item->id ?>"> <?= $form ?> diff --git a/modules/gallery/views/simple_uploader.html.php b/modules/gallery/views/simple_uploader.html.php index eee29679..56b1c656 100644 --- a/modules/gallery/views/simple_uploader.html.php +++ b/modules/gallery/views/simple_uploader.html.php @@ -6,7 +6,7 @@ <!-- hack to set the title for the dialog --> <form id="gAddPhotosForm" action="<?= url::site("simple_uploader/finish?csrf=$csrf") ?>"> <fieldset> - <legend> <?= t("Add photos to %album_title", array("album_title" => p::clean($item->title))) ?> </legend> + <legend> <?= t("Add photos to %album_title", array("album_title" => p::purify($item->title))) ?> </legend> </fieldset> </form> @@ -28,7 +28,7 @@ <? foreach ($item->parents() as $parent): ?> <li> <?= p::clean($parent->title) ?> </li> <? endforeach ?> - <li class="active"> <?= p::clean($item->title) ?> </li> + <li class="active"> <?= p::purify($item->title) ?> </li> </ul> <p> @@ -185,7 +185,7 @@ $("#gUploadQueueInfo").text("(completed " + stats.successful_uploads + " of " + (stats.files_queued + stats.successful_uploads + stats.upload_errors + stats.upload_cancelled + stats.queue_errors) + ")"); } - + // Auto start the upload this.startUpload(); } diff --git a/modules/info/views/info_block.html.php b/modules/info/views/info_block.html.php index db621006..ccb564d3 100644 --- a/modules/info/views/info_block.html.php +++ b/modules/info/views/info_block.html.php @@ -2,12 +2,12 @@ <ul class="gMetadata"> <li> <strong class="caption"><?= t("Title:") ?></strong> - <?= p::clean($item->title) ?> + <?= p::purify($item->title) ?> </li> <? if ($item->description): ?> <li> <strong class="caption"><?= t("Description:") ?></strong> - <?= p::clean($item->description) ?> + <?= p::purify($item->description) ?> </li> <? endif ?> <? if ($item->id != 1): ?> diff --git a/modules/notification/views/comment_published.html.php b/modules/notification/views/comment_published.html.php index ff2ba0bc..70709979 100644 --- a/modules/notification/views/comment_published.html.php +++ b/modules/notification/views/comment_published.html.php @@ -8,7 +8,7 @@ <table> <tr> <td><?= t("Comment:") ?></td> - <td><?= p::clean($comment->text) ?></td> + <td><?= p::purify($comment->text) ?></td> </tr> <tr> <td><?= t("Author Name:") ?></td> diff --git a/modules/notification/views/item_added.html.php b/modules/notification/views/item_added.html.php index 32857c08..4fa5d42d 100644 --- a/modules/notification/views/item_added.html.php +++ b/modules/notification/views/item_added.html.php @@ -8,7 +8,7 @@ <table> <tr> <td><?= t("Title:") ?></td> - <td><?= p::clean($item->title) ?></td> + <td><?= p::purifys($item->title) ?></td> </tr> <tr> <td><?= t("Url:") ?></td> @@ -21,7 +21,7 @@ <? if ($item->description): ?> <tr> <td><?= t("Description:") ?></td> - <td><?= p::clean($item->description) ?></td> + <td><?= p::purify($item->description) ?></td> </tr> <? endif ?> </table> diff --git a/modules/notification/views/item_deleted.html.php b/modules/notification/views/item_deleted.html.php index 2d6d5738..92215211 100644 --- a/modules/notification/views/item_deleted.html.php +++ b/modules/notification/views/item_deleted.html.php @@ -9,7 +9,7 @@ <tr> <td colspan="2"> <?= t("To view the changed album %title use the link below.", - array("title" => p::clean($item->parent()->title))) ?> + array("title" => p::purify($item->parent()->title))) ?> </td> </tr> <tr> diff --git a/modules/organize/controllers/organize.php b/modules/organize/controllers/organize.php index 5f80805c..6792573d 100644 --- a/modules/organize/controllers/organize.php +++ b/modules/organize/controllers/organize.php @@ -62,8 +62,8 @@ class Organize_Controller extends Controller { access::required("edit", $item); print json_encode( - array("title" => p::clean($item->title), - "description" => empty($item->description) ? "" : p::clean($item->description))); + array("title" => p::purify($item->title), + "description" => empty($item->description) ? "" : p::purify($item->description))); } function tree($item, $parent) { @@ -283,10 +283,10 @@ class Organize_Controller extends Controller { if ($item->is_album()) { log::success("content", "Updated album", "<a href=\"albums/$item->id\">view</a>"); - $message = t("Saved album %album_title", array("album_title" => p::clean($item->title))); + $message = t("Saved album %album_title", array("album_title" => p::purify($item->title))); } else { log::success("content", "Updated photo", "<a href=\"photos/$item->id\">view</a>"); - $message = t("Saved photo %photo_title", array("photo_title" => p::clean($item->title))); + $message = t("Saved photo %photo_title", array("photo_title" => p::purify($item->title))); } print json_encode(array("form" => $form->__toString(), "message" => $message)); } else { @@ -325,7 +325,7 @@ class Organize_Controller extends Controller { module::event("item_updated", $orig, $item); log::success("content", "Updated album", "<a href=\"albums/$item->id\">view</a>"); - $message = t("Saved album %album_title", array("album_title" => p::clean($item->title))); + $message = t("Saved album %album_title", array("album_title" => p::purify($item->title))); print json_encode(array("form" => $form->__toString(), "message" => $message)); } else { print json_encode(array("form" => $form->__toString())); diff --git a/modules/organize/views/organize.html.php b/modules/organize/views/organize.html.php index 6e5bfcea..65d67d04 100644 --- a/modules/organize/views/organize.html.php +++ b/modules/organize/views/organize.html.php @@ -16,7 +16,7 @@ var CONFIRM_DELETE = "<?= t("Do you really want to delete the selected albums an }); </script> <fieldset style="display: none"> - <legend><?= t("Organize %name", array("name" => p::clean($item->title))) ?></legend> + <legend><?= t("Organize %name", array("name" => p::purify($item->title))) ?></legend> </fieldset> <div id="doc3" class="yui-t7"> <div id="bd"> diff --git a/modules/search/views/search.html.php b/modules/search/views/search.html.php index 5db07bad..d173f734 100644 --- a/modules/search/views/search.html.php +++ b/modules/search/views/search.html.php @@ -31,10 +31,10 @@ <a href="<?= url::site("items/$item->id") ?>"> <?= $item->thumb_img() ?> <p> - <?= p::clean($item->title) ?> + <?= p::purify($item->title) ?> </p> <div> - <?= p::clean($item->description) ?> + <?= p::purify($item->description) ?> </div> </a> </li> diff --git a/themes/default/views/album.html.php b/themes/default/views/album.html.php index 46b0d29a..273b8a4e 100644 --- a/themes/default/views/album.html.php +++ b/themes/default/views/album.html.php @@ -2,8 +2,8 @@ <? // @todo Set hover on AlbumGrid list items for guest users ?> <div id="gInfo"> <?= $theme->album_top() ?> - <h1><?= p::clean($item->title) ?></h1> - <div class="gDescription"><?= p::clean($item->description) ?></div> + <h1><?= p::purify($item->title) ?></h1> + <div class="gDescription"><?= p::purify($item->description) ?></div> </div> <ul id="gAlbumGrid"> diff --git a/themes/default/views/header.html.php b/themes/default/views/header.html.php index 51f55b41..5428d9fd 100644 --- a/themes/default/views/header.html.php +++ b/themes/default/views/header.html.php @@ -19,10 +19,10 @@ <? foreach ($parents as $parent): ?> <li> <a href="<?= url::site("albums/{$parent->id}?show=$item->id") ?>"> - <?= p::clean($parent->title) ?> + <?= p::purify($parent->title) ?> </a> </li> <? endforeach ?> - <li class="active"><?= p::clean($item->title) ?></li> + <li class="active"><?= p::purify($item->title) ?></li> </ul> <? endif ?> diff --git a/themes/default/views/movie.html.php b/themes/default/views/movie.html.php index c2fb0e30..2cd9806f 100644 --- a/themes/default/views/movie.html.php +++ b/themes/default/views/movie.html.php @@ -15,8 +15,8 @@ <?= $item->movie_img(array("class" => "gMovie", "id" => "gMovieId-{$item->id}")) ?> <div id="gInfo"> - <h1><?= p::clean($item->title) ?></h1> - <div><?= p::clean($item->description) ?></div> + <h1><?= p::purify($item->title) ?></h1> + <div><?= p::purify($item->description) ?></div> </div> <script type="text/javascript"> diff --git a/themes/default/views/photo.html.php b/themes/default/views/photo.html.php index 4765a4e3..dc3a9dfd 100644 --- a/themes/default/views/photo.html.php +++ b/themes/default/views/photo.html.php @@ -50,8 +50,8 @@ </div> <div id="gInfo"> - <h1><?= p::clean($item->title) ?></h1> - <div><?= p::clean($item->description) ?></div> + <h1><?= p::purify($item->title) ?></h1> + <div><?= p::purify($item->description) ?></div> </div> <script type="text/javascript"> |