From 54ffea24196e8f5d88cf9d8607455f0f6aab305c Mon Sep 17 00:00:00 2001
From: Tim Almdal <tnalmdal@shaw.ca>
Date: Fri, 3 Jul 2009 21:44:10 -0700
Subject: Split the clean method into two clean and purify. clean is a light
 weight approach using html::specialchars and purify uses HTMLPurifier to
 intelligently cleanse the output fields. Use purifier for text and title
 fields where it is likely that a user would enter html to format their data.

---
 modules/gallery/views/permissions_browse.html.php | 2 +-
 modules/gallery/views/simple_uploader.html.php    | 6 +++---
 2 files changed, 4 insertions(+), 4 deletions(-)

(limited to 'modules/gallery/views')

diff --git a/modules/gallery/views/permissions_browse.html.php b/modules/gallery/views/permissions_browse.html.php
index 36394877..888a27f7 100644
--- a/modules/gallery/views/permissions_browse.html.php
+++ b/modules/gallery/views/permissions_browse.html.php
@@ -42,7 +42,7 @@
         <? endforeach ?>
         <li>
           <a href="javascript:show(<?= $item->id ?>)">
-            <?= p::clean($item->title) ?>
+            <?= p::purify($item->title) ?>
           </a>
           <div class="form" id="edit-<?= $item->id ?>">
             <?= $form ?>
diff --git a/modules/gallery/views/simple_uploader.html.php b/modules/gallery/views/simple_uploader.html.php
index eee29679..56b1c656 100644
--- a/modules/gallery/views/simple_uploader.html.php
+++ b/modules/gallery/views/simple_uploader.html.php
@@ -6,7 +6,7 @@
 <!-- hack to set the title for the dialog -->
 <form id="gAddPhotosForm" action="<?= url::site("simple_uploader/finish?csrf=$csrf") ?>">
   <fieldset>
-    <legend> <?= t("Add photos to %album_title", array("album_title" => p::clean($item->title))) ?> </legend>
+    <legend> <?= t("Add photos to %album_title", array("album_title" => p::purify($item->title))) ?> </legend>
   </fieldset>
 </form>
 
@@ -28,7 +28,7 @@
     <? foreach ($item->parents() as $parent): ?>
     <li> <?= p::clean($parent->title) ?> </li>
     <? endforeach ?>
-    <li class="active"> <?= p::clean($item->title) ?> </li>
+    <li class="active"> <?= p::purify($item->title) ?> </li>
   </ul>
 
   <p>
@@ -185,7 +185,7 @@
       $("#gUploadQueueInfo").text("(completed " + stats.successful_uploads +
                                   " of " + (stats.files_queued + stats.successful_uploads + stats.upload_errors + stats.upload_cancelled + stats.queue_errors) + ")");
     }
-    
+
     // Auto start the upload
     this.startUpload();
   }
-- 
cgit v1.2.3