From 54ffea24196e8f5d88cf9d8607455f0f6aab305c Mon Sep 17 00:00:00 2001
From: Tim Almdal <tnalmdal@shaw.ca>
Date: Fri, 3 Jul 2009 21:44:10 -0700
Subject: Split the clean method into two clean and purify. clean is a light
 weight approach using html::specialchars and purify uses HTMLPurifier to
 intelligently cleanse the output fields. Use purifier for text and title
 fields where it is likely that a user would enter html to format their data.

---
 modules/notification/views/comment_published.html.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'modules/notification/views/comment_published.html.php')

diff --git a/modules/notification/views/comment_published.html.php b/modules/notification/views/comment_published.html.php
index ff2ba0bc..70709979 100644
--- a/modules/notification/views/comment_published.html.php
+++ b/modules/notification/views/comment_published.html.php
@@ -8,7 +8,7 @@
     <table>
       <tr>
         <td><?= t("Comment:") ?></td>
-        <td><?= p::clean($comment->text) ?></td>
+        <td><?= p::purify($comment->text) ?></td>
       </tr>
       <tr>
         <td><?= t("Author Name:") ?></td>
-- 
cgit v1.2.3


From d6648c0affd122407b7567442aa924e9138104e7 Mon Sep 17 00:00:00 2001
From: Tim Almdal <tnalmdal@shaw.ca>
Date: Sat, 4 Jul 2009 08:17:12 -0700
Subject: Fix for ticket #477. Use nl2br method when rendering comment::text
 and item::description.  In addition add p::clean or p::purify to places that
 xss cleaning had missed (i.e. rss feeds)

---
 modules/comment/controllers/comments.php                   | 4 ++--
 modules/comment/helpers/comment_rss.php                    | 6 +++---
 modules/comment/views/admin_block_recent_comments.html.php | 2 +-
 modules/comment/views/admin_comments.html.php              | 2 +-
 modules/comment/views/comment.html.php                     | 2 +-
 modules/comment/views/comment.mrss.php                     | 4 ++--
 modules/gallery/helpers/gallery_rss.php                    | 4 ++--
 modules/info/views/info_block.html.php                     | 2 +-
 modules/notification/views/comment_published.html.php      | 2 +-
 modules/notification/views/item_added.html.php             | 2 +-
 modules/search/views/search.html.php                       | 2 +-
 themes/default/views/album.html.php                        | 2 +-
 themes/default/views/movie.html.php                        | 2 +-
 themes/default/views/photo.html.php                        | 2 +-
 14 files changed, 19 insertions(+), 19 deletions(-)

(limited to 'modules/notification/views/comment_published.html.php')

diff --git a/modules/comment/controllers/comments.php b/modules/comment/controllers/comments.php
index 2840ba67..02c38491 100644
--- a/modules/comment/controllers/comments.php
+++ b/modules/comment/controllers/comments.php
@@ -41,7 +41,7 @@ class Comments_Controller extends REST_Controller {
           "id" => $comment->id,
           "author_name" => p::clean($comment->author_name()),
           "created" => $comment->created,
-          "text" => p::purify($comment->text));
+          "text" => nl2br(p::purify($comment->text)));
       }
       print json_encode($data);
       break;
@@ -128,7 +128,7 @@ class Comments_Controller extends REST_Controller {
                 "id" => $comment->id,
                 "author_name" => p::clean($comment->author_name()),
                 "created" => $comment->created,
-                "text" => p::purify($comment->text))));
+                "text" => nl2br(p::purify($comment->text)))));
     } else {
       $view = new Theme_View("comment.html", "fragment");
       $view->comment = $comment;
diff --git a/modules/comment/helpers/comment_rss.php b/modules/comment/helpers/comment_rss.php
index 746c6161..ab3d2283 100644
--- a/modules/comment/helpers/comment_rss.php
+++ b/modules/comment/helpers/comment_rss.php
@@ -53,13 +53,13 @@ class comment_rss_Core {
         $item = $comment->item();
         $feed->children[] = new ArrayObject(
           array("pub_date" => date("D, d M Y H:i:s T", $comment->created),
-                "text" => $comment->text,
+                "text" => nl2br(p::purify($comment->text)),
                 "thumb_url" => $item->thumb_url(),
                 "thumb_height" => $item->thumb_height,
                 "thumb_width" => $item->thumb_width,
                 "item_uri" => url::abs_site("{$item->type}s/$item->id"),
-                "title" => $item->title,
-                "author" => $comment->author_name()),
+                "title" => p::purify($item->title),
+                "author" => p::clean($comment->author_name())),
           ArrayObject::ARRAY_AS_PROPS);
       }
 
diff --git a/modules/comment/views/admin_block_recent_comments.html.php b/modules/comment/views/admin_block_recent_comments.html.php
index 893c1a63..4ff24f86 100644
--- a/modules/comment/views/admin_block_recent_comments.html.php
+++ b/modules/comment/views/admin_block_recent_comments.html.php
@@ -10,7 +10,7 @@
     <?= gallery::date_time($comment->created) ?>
     <?= t('<a href="#">%author_name</a> said <em>%comment_text</em>',
           array("author_name" => p::clean($comment->author_name()),
-                "comment_text" => text::limit_words(p::purify($comment->text), 50))); ?>
+                "comment_text" => text::limit_words(nl2br(p::purify($comment->text)), 50))); ?>
   </li>
   <? endforeach ?>
 </ul>
diff --git a/modules/comment/views/admin_comments.html.php b/modules/comment/views/admin_comments.html.php
index 489605d5..ad0ae8f3 100644
--- a/modules/comment/views/admin_comments.html.php
+++ b/modules/comment/views/admin_comments.html.php
@@ -132,7 +132,7 @@
           </div>
         </div>
         <p><?= gallery::date($comment->created) ?></p>
-        <?= p::purify($comment->text) ?>
+           <?= nl2br(p::purify($comment->text)) ?>
       </td>
       <td>
         <ul class="gButtonSetVertical">
diff --git a/modules/comment/views/comment.html.php b/modules/comment/views/comment.html.php
index 15121d08..ab72a0c8 100644
--- a/modules/comment/views/comment.html.php
+++ b/modules/comment/views/comment.html.php
@@ -13,6 +13,6 @@
                 "author_name" => p::clean($comment->author_name()))) ?>
   </p>
   <div>
-    <?= p::purify($comment->text) ?>
+  <?= nl2br(p::purify($comment->text)) ?>
   </div>
 </li>
diff --git a/modules/comment/views/comment.mrss.php b/modules/comment/views/comment.mrss.php
index 4f520144..e27bc44f 100644
--- a/modules/comment/views/comment.mrss.php
+++ b/modules/comment/views/comment.mrss.php
@@ -22,14 +22,14 @@
     <lastBuildDate><?= $pub_date ?></lastBuildDate>
     <? foreach ($feed->children as $child): ?>
     <item>
-      <title><?= p::clean($child->title) ?></title>
+      <title><?= p::purify($child->title) ?></title>
       <link><?= p::clean($child->item_uri) ?></link>
       <author><?= p::clean($child->author) ?></author>
       <guid isPermaLink="true"><?= $child->item_uri ?></guid>
       <pubDate><?= $child->pub_date ?></pubDate>
       <content:encoded>
         <![CDATA[
-          <p><?= p::clean($child->text) ?></p>
+          <p><?= nl2br(p::purify($child->text)) ?></p>
           <p>
             <img alt="" src="<?= $child->thumb_url ?>"
                  height="<?= $child->thumb_height ?>" width="<?= $child->thumb_width ?>" />
diff --git a/modules/gallery/helpers/gallery_rss.php b/modules/gallery/helpers/gallery_rss.php
index 6e966bdb..7daf6170 100644
--- a/modules/gallery/helpers/gallery_rss.php
+++ b/modules/gallery/helpers/gallery_rss.php
@@ -52,9 +52,9 @@ class gallery_rss_Core {
         ->viewable()
         ->descendants($limit, $offset, "photo");
       $feed->max_pages = ceil($item->viewable()->descendants_count("photo") / $limit);
-      $feed->title = $item->title;
+      $feed->title = p::purify($item->title);
       $feed->link = url::abs_site("albums/{$item->id}");
-      $feed->description = $item->description;
+      $feed->description = nl2br(p::purify($item->description));
 
       return $feed;
     }
diff --git a/modules/info/views/info_block.html.php b/modules/info/views/info_block.html.php
index ccb564d3..9f544376 100644
--- a/modules/info/views/info_block.html.php
+++ b/modules/info/views/info_block.html.php
@@ -7,7 +7,7 @@
   <? if ($item->description): ?>
   <li>
     <strong class="caption"><?= t("Description:") ?></strong>
-    <?= p::purify($item->description) ?>
+     <?= nl2br(p::purify($item->description)) ?>
   </li>
   <? endif ?>
   <? if ($item->id != 1): ?>
diff --git a/modules/notification/views/comment_published.html.php b/modules/notification/views/comment_published.html.php
index 70709979..4a56cdad 100644
--- a/modules/notification/views/comment_published.html.php
+++ b/modules/notification/views/comment_published.html.php
@@ -8,7 +8,7 @@
     <table>
       <tr>
         <td><?= t("Comment:") ?></td>
-        <td><?= p::purify($comment->text) ?></td>
+  <td><?= nl2br(p::purify($comment->text)) ?></td>
       </tr>
       <tr>
         <td><?= t("Author Name:") ?></td>
diff --git a/modules/notification/views/item_added.html.php b/modules/notification/views/item_added.html.php
index 4fa5d42d..87ea90fa 100644
--- a/modules/notification/views/item_added.html.php
+++ b/modules/notification/views/item_added.html.php
@@ -21,7 +21,7 @@
       <? if ($item->description): ?>
       <tr>
         <td><?= t("Description:") ?></td>
-        <td><?= p::purify($item->description) ?></td>
+         <td><?= nl2br(p::purify($item->description)) ?></td>
       </tr>
       <? endif ?>
     </table>
diff --git a/modules/search/views/search.html.php b/modules/search/views/search.html.php
index d173f734..6a222ef1 100644
--- a/modules/search/views/search.html.php
+++ b/modules/search/views/search.html.php
@@ -34,7 +34,7 @@
           <?= p::purify($item->title) ?>
         </p>
         <div>
-          <?= p::purify($item->description) ?>
+    <?= nl2br(p::purify($item->description)) ?>
         </div>
       </a>
     </li>
diff --git a/themes/default/views/album.html.php b/themes/default/views/album.html.php
index 273b8a4e..65ea3381 100644
--- a/themes/default/views/album.html.php
+++ b/themes/default/views/album.html.php
@@ -3,7 +3,7 @@
 <div id="gInfo">
   <?= $theme->album_top() ?>
   <h1><?= p::purify($item->title) ?></h1>
-  <div class="gDescription"><?= p::purify($item->description) ?></div>
+  <div class="gDescription"><?= nl2br(p::purify($item->description)) ?></div>
 </div>
 
 <ul id="gAlbumGrid">
diff --git a/themes/default/views/movie.html.php b/themes/default/views/movie.html.php
index 2cd9806f..66c80ded 100644
--- a/themes/default/views/movie.html.php
+++ b/themes/default/views/movie.html.php
@@ -16,7 +16,7 @@
 
   <div id="gInfo">
     <h1><?= p::purify($item->title) ?></h1>
-    <div><?= p::purify($item->description) ?></div>
+       <div><?= nl2br(p::purify($item->description)) ?></div>
   </div>
 
   <script type="text/javascript">
diff --git a/themes/default/views/photo.html.php b/themes/default/views/photo.html.php
index dc3a9dfd..bf4d9da3 100644
--- a/themes/default/views/photo.html.php
+++ b/themes/default/views/photo.html.php
@@ -51,7 +51,7 @@
 
   <div id="gInfo">
     <h1><?= p::purify($item->title) ?></h1>
-    <div><?= p::purify($item->description) ?></div>
+    <div><?= nl2br(p::purify($item->description)) ?></div>
   </div>
 
   <script type="text/javascript">
-- 
cgit v1.2.3