From 54ffea24196e8f5d88cf9d8607455f0f6aab305c Mon Sep 17 00:00:00 2001
From: Tim Almdal <tnalmdal@shaw.ca>
Date: Fri, 3 Jul 2009 21:44:10 -0700
Subject: Split the clean method into two clean and purify. clean is a light
 weight approach using html::specialchars and purify uses HTMLPurifier to
 intelligently cleanse the output fields. Use purifier for text and title
 fields where it is likely that a user would enter html to format their data.

---
 modules/organize/controllers/organize.php | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

(limited to 'modules/organize/controllers')

diff --git a/modules/organize/controllers/organize.php b/modules/organize/controllers/organize.php
index 5f80805c..6792573d 100644
--- a/modules/organize/controllers/organize.php
+++ b/modules/organize/controllers/organize.php
@@ -62,8 +62,8 @@ class Organize_Controller extends Controller {
     access::required("edit", $item);
 
     print json_encode(
-      array("title" => p::clean($item->title),
-            "description" => empty($item->description) ? "" : p::clean($item->description)));
+      array("title" => p::purify($item->title),
+            "description" => empty($item->description) ? "" : p::purify($item->description)));
   }
 
   function tree($item, $parent) {
@@ -283,10 +283,10 @@ class Organize_Controller extends Controller {
 
       if ($item->is_album()) {
         log::success("content", "Updated album", "<a href=\"albums/$item->id\">view</a>");
-        $message = t("Saved album %album_title", array("album_title" => p::clean($item->title)));
+        $message = t("Saved album %album_title", array("album_title" => p::purify($item->title)));
       } else {
         log::success("content", "Updated photo", "<a href=\"photos/$item->id\">view</a>");
-        $message = t("Saved photo %photo_title", array("photo_title" => p::clean($item->title)));
+        $message = t("Saved photo %photo_title", array("photo_title" => p::purify($item->title)));
       }
       print json_encode(array("form" => $form->__toString(), "message" => $message));
     } else {
@@ -325,7 +325,7 @@ class Organize_Controller extends Controller {
       module::event("item_updated", $orig, $item);
 
       log::success("content", "Updated album", "<a href=\"albums/$item->id\">view</a>");
-      $message = t("Saved album %album_title", array("album_title" => p::clean($item->title)));
+      $message = t("Saved album %album_title", array("album_title" => p::purify($item->title)));
       print json_encode(array("form" => $form->__toString(), "message" => $message));
     } else {
       print json_encode(array("form" => $form->__toString()));
-- 
cgit v1.2.3