From d6648c0affd122407b7567442aa924e9138104e7 Mon Sep 17 00:00:00 2001 From: Tim Almdal Date: Sat, 4 Jul 2009 08:17:12 -0700 Subject: Fix for ticket #477. Use nl2br method when rendering comment::text and item::description. In addition add p::clean or p::purify to places that xss cleaning had missed (i.e. rss feeds) --- modules/comment/helpers/comment_rss.php | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) (limited to 'modules/comment/helpers/comment_rss.php') diff --git a/modules/comment/helpers/comment_rss.php b/modules/comment/helpers/comment_rss.php index 746c6161..ab3d2283 100644 --- a/modules/comment/helpers/comment_rss.php +++ b/modules/comment/helpers/comment_rss.php @@ -53,13 +53,13 @@ class comment_rss_Core { $item = $comment->item(); $feed->children[] = new ArrayObject( array("pub_date" => date("D, d M Y H:i:s T", $comment->created), - "text" => $comment->text, + "text" => nl2br(p::purify($comment->text)), "thumb_url" => $item->thumb_url(), "thumb_height" => $item->thumb_height, "thumb_width" => $item->thumb_width, "item_uri" => url::abs_site("{$item->type}s/$item->id"), - "title" => $item->title, - "author" => $comment->author_name()), + "title" => p::purify($item->title), + "author" => p::clean($comment->author_name())), ArrayObject::ARRAY_AS_PROPS); } -- cgit v1.2.3