From 84e98e830c4967c277dfcb5bb6d18c0ec3313355 Mon Sep 17 00:00:00 2001
From: Tim Almdal <tnalmdal@shaw.ca>
Date: Fri, 26 Jun 2009 08:25:24 -0700
Subject: Move the inclusion of photo and movie specific javascript into
 gallery_theme

---
 themes/default/views/photo.html.php | 1 -
 1 file changed, 1 deletion(-)

(limited to 'themes/default/views/photo.html.php')

diff --git a/themes/default/views/photo.html.php b/themes/default/views/photo.html.php
index 1c3b81a7..4765a4e3 100644
--- a/themes/default/views/photo.html.php
+++ b/themes/default/views/photo.html.php
@@ -2,7 +2,6 @@
 
 <? if (access::can("view_full", $theme->item())): ?>
 <!-- Use javascript to show the full size as an overlay on the current page -->
-<script src="<?= url::file("lib/gallery.show_full_size.js") ?>" type="text/javascript"></script>
 <script>
   $(document).ready(function() {
     $(".gFullSizeLink").click(function() {
-- 
cgit v1.2.3


From 54ffea24196e8f5d88cf9d8607455f0f6aab305c Mon Sep 17 00:00:00 2001
From: Tim Almdal <tnalmdal@shaw.ca>
Date: Fri, 3 Jul 2009 21:44:10 -0700
Subject: Split the clean method into two clean and purify. clean is a light
 weight approach using html::specialchars and purify uses HTMLPurifier to
 intelligently cleanse the output fields. Use purifier for text and title
 fields where it is likely that a user would enter html to format their data.

---
 modules/comment/controllers/comments.php                   |  4 ++--
 modules/comment/helpers/comment_rss.php                    |  2 +-
 modules/comment/views/admin_block_recent_comments.html.php |  2 +-
 modules/comment/views/admin_comments.html.php              |  4 ++--
 modules/comment/views/comment.html.php                     |  2 +-
 modules/comment/views/comments.html.php                    |  2 +-
 modules/digibug/controllers/digibug.php                    |  2 +-
 modules/gallery/controllers/quick.php                      | 10 +++++-----
 modules/gallery/helpers/p.php                              |  4 ++++
 modules/gallery/views/permissions_browse.html.php          |  2 +-
 modules/gallery/views/simple_uploader.html.php             |  6 +++---
 modules/info/views/info_block.html.php                     |  4 ++--
 modules/notification/views/comment_published.html.php      |  2 +-
 modules/notification/views/item_added.html.php             |  4 ++--
 modules/notification/views/item_deleted.html.php           |  2 +-
 modules/organize/controllers/organize.php                  | 10 +++++-----
 modules/organize/views/organize.html.php                   |  2 +-
 modules/search/views/search.html.php                       |  4 ++--
 themes/default/views/album.html.php                        |  4 ++--
 themes/default/views/header.html.php                       |  4 ++--
 themes/default/views/movie.html.php                        |  4 ++--
 themes/default/views/photo.html.php                        |  4 ++--
 22 files changed, 44 insertions(+), 40 deletions(-)

(limited to 'themes/default/views/photo.html.php')

diff --git a/modules/comment/controllers/comments.php b/modules/comment/controllers/comments.php
index 99ecc8e0..2840ba67 100644
--- a/modules/comment/controllers/comments.php
+++ b/modules/comment/controllers/comments.php
@@ -41,7 +41,7 @@ class Comments_Controller extends REST_Controller {
           "id" => $comment->id,
           "author_name" => p::clean($comment->author_name()),
           "created" => $comment->created,
-          "text" => p::clean($comment->text));
+          "text" => p::purify($comment->text));
       }
       print json_encode($data);
       break;
@@ -128,7 +128,7 @@ class Comments_Controller extends REST_Controller {
                 "id" => $comment->id,
                 "author_name" => p::clean($comment->author_name()),
                 "created" => $comment->created,
-                "text" => p::clean($comment->text))));
+                "text" => p::purify($comment->text))));
     } else {
       $view = new Theme_View("comment.html", "fragment");
       $view->comment = $comment;
diff --git a/modules/comment/helpers/comment_rss.php b/modules/comment/helpers/comment_rss.php
index ef2d176e..746c6161 100644
--- a/modules/comment/helpers/comment_rss.php
+++ b/modules/comment/helpers/comment_rss.php
@@ -23,7 +23,7 @@ class comment_rss_Core {
     $feeds["comment/newest"] = t("All new comments");
     if ($item) {
       $feeds["comment/item/$item->id"] =
-        t("Comments on %title", array("title" => p::clean($item->title)));
+        t("Comments on %title", array("title" => p::purify($item->title)));
     }
     return $feeds;
   }
diff --git a/modules/comment/views/admin_block_recent_comments.html.php b/modules/comment/views/admin_block_recent_comments.html.php
index af4d946e..893c1a63 100644
--- a/modules/comment/views/admin_block_recent_comments.html.php
+++ b/modules/comment/views/admin_block_recent_comments.html.php
@@ -10,7 +10,7 @@
     <?= gallery::date_time($comment->created) ?>
     <?= t('<a href="#">%author_name</a> said <em>%comment_text</em>',
           array("author_name" => p::clean($comment->author_name()),
-                "comment_text" => text::limit_words(p::clean($comment->text), 50))); ?>
+                "comment_text" => text::limit_words(p::purify($comment->text), 50))); ?>
   </li>
   <? endforeach ?>
 </ul>
diff --git a/modules/comment/views/admin_comments.html.php b/modules/comment/views/admin_comments.html.php
index 453cf849..489605d5 100644
--- a/modules/comment/views/admin_comments.html.php
+++ b/modules/comment/views/admin_comments.html.php
@@ -122,7 +122,7 @@
             <a href="<?= $item->url() ?>">
               <? if ($item->has_thumb()): ?>
               <img src="<?= $item->thumb_url() ?>"
-                 alt="<?= p::clean($item->title) ?>"
+                 alt="<?= p::purify($item->title) ?>"
                  <?= photo::img_dimensions($item->thumb_width, $item->thumb_height, 75) ?>
               />
               <? else: ?>
@@ -132,7 +132,7 @@
           </div>
         </div>
         <p><?= gallery::date($comment->created) ?></p>
-        <?= p::clean($comment->text) ?>
+        <?= p::purify($comment->text) ?>
       </td>
       <td>
         <ul class="gButtonSetVertical">
diff --git a/modules/comment/views/comment.html.php b/modules/comment/views/comment.html.php
index 6d2cc592..15121d08 100644
--- a/modules/comment/views/comment.html.php
+++ b/modules/comment/views/comment.html.php
@@ -13,6 +13,6 @@
                 "author_name" => p::clean($comment->author_name()))) ?>
   </p>
   <div>
-    <?= p::clean($comment->text) ?>
+    <?= p::purify($comment->text) ?>
   </div>
 </li>
diff --git a/modules/comment/views/comments.html.php b/modules/comment/views/comments.html.php
index d9405e5f..2d754791 100644
--- a/modules/comment/views/comments.html.php
+++ b/modules/comment/views/comments.html.php
@@ -21,7 +21,7 @@
                   "name" => p::clean($comment->author_name()))); ?>
     </p>
     <div>
-      <?= p::clean($comment->text) ?>
+      <?= p::purify($comment->text) ?>
     </div>
   </li>
   <? endforeach ?>
diff --git a/modules/digibug/controllers/digibug.php b/modules/digibug/controllers/digibug.php
index 49fb51ad..d881db9b 100644
--- a/modules/digibug/controllers/digibug.php
+++ b/modules/digibug/controllers/digibug.php
@@ -50,7 +50,7 @@ class Digibug_Controller extends Controller {
       "image_width_1" => $item->width,
       "thumb_height_1" => $item->thumb_height,
       "thumb_width_1" => $item->thumb_width,
-      "title_1" => p::clean($item->title));
+      "title_1" => p::purify($item->title));
 
     print $v;
   }
diff --git a/modules/gallery/controllers/quick.php b/modules/gallery/controllers/quick.php
index 5d3d8885..53af2ba6 100644
--- a/modules/gallery/controllers/quick.php
+++ b/modules/gallery/controllers/quick.php
@@ -89,7 +89,7 @@ class Quick_Controller extends Controller {
     access::required("view", $item->parent());
     access::required("edit", $item->parent());
 
-    $msg = t("Made <b>%title</b> this album's cover", array("title" => p::clean($item->title)));
+    $msg = t("Made <b>%title</b> this album's cover", array("title" => p::purify($item->title)));
 
     item::make_album_cover($item);
     message::success($msg);
@@ -105,10 +105,10 @@ class Quick_Controller extends Controller {
     if ($item->is_album()) {
       print t(
         "Delete the album <b>%title</b>? All photos and movies in the album will also be deleted.",
-        array("title" => p::clean($item->title)));
+        array("title" => p::purify($item->title)));
     } else {
       print t("Are you sure you want to delete <b>%title</b>?",
-              array("title" => p::clean($item->title)));
+              array("title" => p::purify($item->title)));
     }
 
     $form = item::get_delete_form($item);
@@ -122,9 +122,9 @@ class Quick_Controller extends Controller {
     access::required("edit", $item);
 
     if ($item->is_album()) {
-      $msg = t("Deleted album <b>%title</b>", array("title" => p::clean($item->title)));
+      $msg = t("Deleted album <b>%title</b>", array("title" => p::purify($item->title)));
     } else {
-      $msg = t("Deleted photo <b>%title</b>", array("title" => p::clean($item->title)));
+      $msg = t("Deleted photo <b>%title</b>", array("title" => p::purify($item->title)));
     }
 
     $item->delete();
diff --git a/modules/gallery/helpers/p.php b/modules/gallery/helpers/p.php
index fe53102c..862c769b 100644
--- a/modules/gallery/helpers/p.php
+++ b/modules/gallery/helpers/p.php
@@ -20,6 +20,10 @@
 class p_Core {
   private static $_purifier = null;
   static function clean($dirty_html) {
+    return html::specialchars($dirty_html);
+  }
+
+  static function purify($dirty_html) {
     if (empty(self::$_purifier)) {
       require_once(dirname(__file__) . "/../lib/HTMLPurifier/HTMLPurifier.auto.php");
       $config = HTMLPurifier_Config::createDefault();
diff --git a/modules/gallery/views/permissions_browse.html.php b/modules/gallery/views/permissions_browse.html.php
index 36394877..888a27f7 100644
--- a/modules/gallery/views/permissions_browse.html.php
+++ b/modules/gallery/views/permissions_browse.html.php
@@ -42,7 +42,7 @@
         <? endforeach ?>
         <li>
           <a href="javascript:show(<?= $item->id ?>)">
-            <?= p::clean($item->title) ?>
+            <?= p::purify($item->title) ?>
           </a>
           <div class="form" id="edit-<?= $item->id ?>">
             <?= $form ?>
diff --git a/modules/gallery/views/simple_uploader.html.php b/modules/gallery/views/simple_uploader.html.php
index eee29679..56b1c656 100644
--- a/modules/gallery/views/simple_uploader.html.php
+++ b/modules/gallery/views/simple_uploader.html.php
@@ -6,7 +6,7 @@
 <!-- hack to set the title for the dialog -->
 <form id="gAddPhotosForm" action="<?= url::site("simple_uploader/finish?csrf=$csrf") ?>">
   <fieldset>
-    <legend> <?= t("Add photos to %album_title", array("album_title" => p::clean($item->title))) ?> </legend>
+    <legend> <?= t("Add photos to %album_title", array("album_title" => p::purify($item->title))) ?> </legend>
   </fieldset>
 </form>
 
@@ -28,7 +28,7 @@
     <? foreach ($item->parents() as $parent): ?>
     <li> <?= p::clean($parent->title) ?> </li>
     <? endforeach ?>
-    <li class="active"> <?= p::clean($item->title) ?> </li>
+    <li class="active"> <?= p::purify($item->title) ?> </li>
   </ul>
 
   <p>
@@ -185,7 +185,7 @@
       $("#gUploadQueueInfo").text("(completed " + stats.successful_uploads +
                                   " of " + (stats.files_queued + stats.successful_uploads + stats.upload_errors + stats.upload_cancelled + stats.queue_errors) + ")");
     }
-    
+
     // Auto start the upload
     this.startUpload();
   }
diff --git a/modules/info/views/info_block.html.php b/modules/info/views/info_block.html.php
index db621006..ccb564d3 100644
--- a/modules/info/views/info_block.html.php
+++ b/modules/info/views/info_block.html.php
@@ -2,12 +2,12 @@
 <ul class="gMetadata">
   <li>
     <strong class="caption"><?= t("Title:") ?></strong>
-    <?= p::clean($item->title) ?>
+    <?= p::purify($item->title) ?>
   </li>
   <? if ($item->description): ?>
   <li>
     <strong class="caption"><?= t("Description:") ?></strong>
-    <?= p::clean($item->description) ?>
+    <?= p::purify($item->description) ?>
   </li>
   <? endif ?>
   <? if ($item->id != 1): ?>
diff --git a/modules/notification/views/comment_published.html.php b/modules/notification/views/comment_published.html.php
index ff2ba0bc..70709979 100644
--- a/modules/notification/views/comment_published.html.php
+++ b/modules/notification/views/comment_published.html.php
@@ -8,7 +8,7 @@
     <table>
       <tr>
         <td><?= t("Comment:") ?></td>
-        <td><?= p::clean($comment->text) ?></td>
+        <td><?= p::purify($comment->text) ?></td>
       </tr>
       <tr>
         <td><?= t("Author Name:") ?></td>
diff --git a/modules/notification/views/item_added.html.php b/modules/notification/views/item_added.html.php
index 32857c08..4fa5d42d 100644
--- a/modules/notification/views/item_added.html.php
+++ b/modules/notification/views/item_added.html.php
@@ -8,7 +8,7 @@
     <table>
       <tr>
         <td><?= t("Title:") ?></td>
-        <td><?= p::clean($item->title) ?></td>
+        <td><?= p::purifys($item->title) ?></td>
       </tr>
       <tr>
         <td><?= t("Url:") ?></td>
@@ -21,7 +21,7 @@
       <? if ($item->description): ?>
       <tr>
         <td><?= t("Description:") ?></td>
-        <td><?= p::clean($item->description) ?></td>
+        <td><?= p::purify($item->description) ?></td>
       </tr>
       <? endif ?>
     </table>
diff --git a/modules/notification/views/item_deleted.html.php b/modules/notification/views/item_deleted.html.php
index 2d6d5738..92215211 100644
--- a/modules/notification/views/item_deleted.html.php
+++ b/modules/notification/views/item_deleted.html.php
@@ -9,7 +9,7 @@
       <tr>
         <td colspan="2">
           <?= t("To view the changed album %title use the link below.",
-              array("title" => p::clean($item->parent()->title))) ?>
+              array("title" => p::purify($item->parent()->title))) ?>
         </td>
       </tr>
       <tr>
diff --git a/modules/organize/controllers/organize.php b/modules/organize/controllers/organize.php
index 5f80805c..6792573d 100644
--- a/modules/organize/controllers/organize.php
+++ b/modules/organize/controllers/organize.php
@@ -62,8 +62,8 @@ class Organize_Controller extends Controller {
     access::required("edit", $item);
 
     print json_encode(
-      array("title" => p::clean($item->title),
-            "description" => empty($item->description) ? "" : p::clean($item->description)));
+      array("title" => p::purify($item->title),
+            "description" => empty($item->description) ? "" : p::purify($item->description)));
   }
 
   function tree($item, $parent) {
@@ -283,10 +283,10 @@ class Organize_Controller extends Controller {
 
       if ($item->is_album()) {
         log::success("content", "Updated album", "<a href=\"albums/$item->id\">view</a>");
-        $message = t("Saved album %album_title", array("album_title" => p::clean($item->title)));
+        $message = t("Saved album %album_title", array("album_title" => p::purify($item->title)));
       } else {
         log::success("content", "Updated photo", "<a href=\"photos/$item->id\">view</a>");
-        $message = t("Saved photo %photo_title", array("photo_title" => p::clean($item->title)));
+        $message = t("Saved photo %photo_title", array("photo_title" => p::purify($item->title)));
       }
       print json_encode(array("form" => $form->__toString(), "message" => $message));
     } else {
@@ -325,7 +325,7 @@ class Organize_Controller extends Controller {
       module::event("item_updated", $orig, $item);
 
       log::success("content", "Updated album", "<a href=\"albums/$item->id\">view</a>");
-      $message = t("Saved album %album_title", array("album_title" => p::clean($item->title)));
+      $message = t("Saved album %album_title", array("album_title" => p::purify($item->title)));
       print json_encode(array("form" => $form->__toString(), "message" => $message));
     } else {
       print json_encode(array("form" => $form->__toString()));
diff --git a/modules/organize/views/organize.html.php b/modules/organize/views/organize.html.php
index 6e5bfcea..65d67d04 100644
--- a/modules/organize/views/organize.html.php
+++ b/modules/organize/views/organize.html.php
@@ -16,7 +16,7 @@ var CONFIRM_DELETE = "<?= t("Do you really want to delete the selected albums an
   });
 </script>
 <fieldset style="display: none">
-  <legend><?= t("Organize %name", array("name" => p::clean($item->title))) ?></legend>
+  <legend><?= t("Organize %name", array("name" => p::purify($item->title))) ?></legend>
 </fieldset>
 <div id="doc3" class="yui-t7">
   <div id="bd">
diff --git a/modules/search/views/search.html.php b/modules/search/views/search.html.php
index 5db07bad..d173f734 100644
--- a/modules/search/views/search.html.php
+++ b/modules/search/views/search.html.php
@@ -31,10 +31,10 @@
       <a href="<?= url::site("items/$item->id") ?>">
         <?= $item->thumb_img() ?>
         <p>
-          <?= p::clean($item->title) ?>
+          <?= p::purify($item->title) ?>
         </p>
         <div>
-          <?= p::clean($item->description) ?>
+          <?= p::purify($item->description) ?>
         </div>
       </a>
     </li>
diff --git a/themes/default/views/album.html.php b/themes/default/views/album.html.php
index 46b0d29a..273b8a4e 100644
--- a/themes/default/views/album.html.php
+++ b/themes/default/views/album.html.php
@@ -2,8 +2,8 @@
 <? // @todo Set hover on AlbumGrid list items for guest users ?>
 <div id="gInfo">
   <?= $theme->album_top() ?>
-  <h1><?= p::clean($item->title) ?></h1>
-  <div class="gDescription"><?= p::clean($item->description) ?></div>
+  <h1><?= p::purify($item->title) ?></h1>
+  <div class="gDescription"><?= p::purify($item->description) ?></div>
 </div>
 
 <ul id="gAlbumGrid">
diff --git a/themes/default/views/header.html.php b/themes/default/views/header.html.php
index 51f55b41..5428d9fd 100644
--- a/themes/default/views/header.html.php
+++ b/themes/default/views/header.html.php
@@ -19,10 +19,10 @@
   <? foreach ($parents as $parent): ?>
   <li>
     <a href="<?= url::site("albums/{$parent->id}?show=$item->id") ?>">
-      <?= p::clean($parent->title) ?>
+      <?= p::purify($parent->title) ?>
     </a>
   </li>
   <? endforeach ?>
-  <li class="active"><?= p::clean($item->title) ?></li>
+  <li class="active"><?= p::purify($item->title) ?></li>
 </ul>
 <? endif ?>
diff --git a/themes/default/views/movie.html.php b/themes/default/views/movie.html.php
index c2fb0e30..2cd9806f 100644
--- a/themes/default/views/movie.html.php
+++ b/themes/default/views/movie.html.php
@@ -15,8 +15,8 @@
   <?= $item->movie_img(array("class" => "gMovie", "id" => "gMovieId-{$item->id}")) ?>
 
   <div id="gInfo">
-    <h1><?= p::clean($item->title) ?></h1>
-    <div><?= p::clean($item->description) ?></div>
+    <h1><?= p::purify($item->title) ?></h1>
+    <div><?= p::purify($item->description) ?></div>
   </div>
 
   <script type="text/javascript">
diff --git a/themes/default/views/photo.html.php b/themes/default/views/photo.html.php
index 4765a4e3..dc3a9dfd 100644
--- a/themes/default/views/photo.html.php
+++ b/themes/default/views/photo.html.php
@@ -50,8 +50,8 @@
   </div>
 
   <div id="gInfo">
-    <h1><?= p::clean($item->title) ?></h1>
-    <div><?= p::clean($item->description) ?></div>
+    <h1><?= p::purify($item->title) ?></h1>
+    <div><?= p::purify($item->description) ?></div>
   </div>
 
   <script type="text/javascript">
-- 
cgit v1.2.3


From d6648c0affd122407b7567442aa924e9138104e7 Mon Sep 17 00:00:00 2001
From: Tim Almdal <tnalmdal@shaw.ca>
Date: Sat, 4 Jul 2009 08:17:12 -0700
Subject: Fix for ticket #477. Use nl2br method when rendering comment::text
 and item::description.  In addition add p::clean or p::purify to places that
 xss cleaning had missed (i.e. rss feeds)

---
 modules/comment/controllers/comments.php                   | 4 ++--
 modules/comment/helpers/comment_rss.php                    | 6 +++---
 modules/comment/views/admin_block_recent_comments.html.php | 2 +-
 modules/comment/views/admin_comments.html.php              | 2 +-
 modules/comment/views/comment.html.php                     | 2 +-
 modules/comment/views/comment.mrss.php                     | 4 ++--
 modules/gallery/helpers/gallery_rss.php                    | 4 ++--
 modules/info/views/info_block.html.php                     | 2 +-
 modules/notification/views/comment_published.html.php      | 2 +-
 modules/notification/views/item_added.html.php             | 2 +-
 modules/search/views/search.html.php                       | 2 +-
 themes/default/views/album.html.php                        | 2 +-
 themes/default/views/movie.html.php                        | 2 +-
 themes/default/views/photo.html.php                        | 2 +-
 14 files changed, 19 insertions(+), 19 deletions(-)

(limited to 'themes/default/views/photo.html.php')

diff --git a/modules/comment/controllers/comments.php b/modules/comment/controllers/comments.php
index 2840ba67..02c38491 100644
--- a/modules/comment/controllers/comments.php
+++ b/modules/comment/controllers/comments.php
@@ -41,7 +41,7 @@ class Comments_Controller extends REST_Controller {
           "id" => $comment->id,
           "author_name" => p::clean($comment->author_name()),
           "created" => $comment->created,
-          "text" => p::purify($comment->text));
+          "text" => nl2br(p::purify($comment->text)));
       }
       print json_encode($data);
       break;
@@ -128,7 +128,7 @@ class Comments_Controller extends REST_Controller {
                 "id" => $comment->id,
                 "author_name" => p::clean($comment->author_name()),
                 "created" => $comment->created,
-                "text" => p::purify($comment->text))));
+                "text" => nl2br(p::purify($comment->text)))));
     } else {
       $view = new Theme_View("comment.html", "fragment");
       $view->comment = $comment;
diff --git a/modules/comment/helpers/comment_rss.php b/modules/comment/helpers/comment_rss.php
index 746c6161..ab3d2283 100644
--- a/modules/comment/helpers/comment_rss.php
+++ b/modules/comment/helpers/comment_rss.php
@@ -53,13 +53,13 @@ class comment_rss_Core {
         $item = $comment->item();
         $feed->children[] = new ArrayObject(
           array("pub_date" => date("D, d M Y H:i:s T", $comment->created),
-                "text" => $comment->text,
+                "text" => nl2br(p::purify($comment->text)),
                 "thumb_url" => $item->thumb_url(),
                 "thumb_height" => $item->thumb_height,
                 "thumb_width" => $item->thumb_width,
                 "item_uri" => url::abs_site("{$item->type}s/$item->id"),
-                "title" => $item->title,
-                "author" => $comment->author_name()),
+                "title" => p::purify($item->title),
+                "author" => p::clean($comment->author_name())),
           ArrayObject::ARRAY_AS_PROPS);
       }
 
diff --git a/modules/comment/views/admin_block_recent_comments.html.php b/modules/comment/views/admin_block_recent_comments.html.php
index 893c1a63..4ff24f86 100644
--- a/modules/comment/views/admin_block_recent_comments.html.php
+++ b/modules/comment/views/admin_block_recent_comments.html.php
@@ -10,7 +10,7 @@
     <?= gallery::date_time($comment->created) ?>
     <?= t('<a href="#">%author_name</a> said <em>%comment_text</em>',
           array("author_name" => p::clean($comment->author_name()),
-                "comment_text" => text::limit_words(p::purify($comment->text), 50))); ?>
+                "comment_text" => text::limit_words(nl2br(p::purify($comment->text)), 50))); ?>
   </li>
   <? endforeach ?>
 </ul>
diff --git a/modules/comment/views/admin_comments.html.php b/modules/comment/views/admin_comments.html.php
index 489605d5..ad0ae8f3 100644
--- a/modules/comment/views/admin_comments.html.php
+++ b/modules/comment/views/admin_comments.html.php
@@ -132,7 +132,7 @@
           </div>
         </div>
         <p><?= gallery::date($comment->created) ?></p>
-        <?= p::purify($comment->text) ?>
+           <?= nl2br(p::purify($comment->text)) ?>
       </td>
       <td>
         <ul class="gButtonSetVertical">
diff --git a/modules/comment/views/comment.html.php b/modules/comment/views/comment.html.php
index 15121d08..ab72a0c8 100644
--- a/modules/comment/views/comment.html.php
+++ b/modules/comment/views/comment.html.php
@@ -13,6 +13,6 @@
                 "author_name" => p::clean($comment->author_name()))) ?>
   </p>
   <div>
-    <?= p::purify($comment->text) ?>
+  <?= nl2br(p::purify($comment->text)) ?>
   </div>
 </li>
diff --git a/modules/comment/views/comment.mrss.php b/modules/comment/views/comment.mrss.php
index 4f520144..e27bc44f 100644
--- a/modules/comment/views/comment.mrss.php
+++ b/modules/comment/views/comment.mrss.php
@@ -22,14 +22,14 @@
     <lastBuildDate><?= $pub_date ?></lastBuildDate>
     <? foreach ($feed->children as $child): ?>
     <item>
-      <title><?= p::clean($child->title) ?></title>
+      <title><?= p::purify($child->title) ?></title>
       <link><?= p::clean($child->item_uri) ?></link>
       <author><?= p::clean($child->author) ?></author>
       <guid isPermaLink="true"><?= $child->item_uri ?></guid>
       <pubDate><?= $child->pub_date ?></pubDate>
       <content:encoded>
         <![CDATA[
-          <p><?= p::clean($child->text) ?></p>
+          <p><?= nl2br(p::purify($child->text)) ?></p>
           <p>
             <img alt="" src="<?= $child->thumb_url ?>"
                  height="<?= $child->thumb_height ?>" width="<?= $child->thumb_width ?>" />
diff --git a/modules/gallery/helpers/gallery_rss.php b/modules/gallery/helpers/gallery_rss.php
index 6e966bdb..7daf6170 100644
--- a/modules/gallery/helpers/gallery_rss.php
+++ b/modules/gallery/helpers/gallery_rss.php
@@ -52,9 +52,9 @@ class gallery_rss_Core {
         ->viewable()
         ->descendants($limit, $offset, "photo");
       $feed->max_pages = ceil($item->viewable()->descendants_count("photo") / $limit);
-      $feed->title = $item->title;
+      $feed->title = p::purify($item->title);
       $feed->link = url::abs_site("albums/{$item->id}");
-      $feed->description = $item->description;
+      $feed->description = nl2br(p::purify($item->description));
 
       return $feed;
     }
diff --git a/modules/info/views/info_block.html.php b/modules/info/views/info_block.html.php
index ccb564d3..9f544376 100644
--- a/modules/info/views/info_block.html.php
+++ b/modules/info/views/info_block.html.php
@@ -7,7 +7,7 @@
   <? if ($item->description): ?>
   <li>
     <strong class="caption"><?= t("Description:") ?></strong>
-    <?= p::purify($item->description) ?>
+     <?= nl2br(p::purify($item->description)) ?>
   </li>
   <? endif ?>
   <? if ($item->id != 1): ?>
diff --git a/modules/notification/views/comment_published.html.php b/modules/notification/views/comment_published.html.php
index 70709979..4a56cdad 100644
--- a/modules/notification/views/comment_published.html.php
+++ b/modules/notification/views/comment_published.html.php
@@ -8,7 +8,7 @@
     <table>
       <tr>
         <td><?= t("Comment:") ?></td>
-        <td><?= p::purify($comment->text) ?></td>
+  <td><?= nl2br(p::purify($comment->text)) ?></td>
       </tr>
       <tr>
         <td><?= t("Author Name:") ?></td>
diff --git a/modules/notification/views/item_added.html.php b/modules/notification/views/item_added.html.php
index 4fa5d42d..87ea90fa 100644
--- a/modules/notification/views/item_added.html.php
+++ b/modules/notification/views/item_added.html.php
@@ -21,7 +21,7 @@
       <? if ($item->description): ?>
       <tr>
         <td><?= t("Description:") ?></td>
-        <td><?= p::purify($item->description) ?></td>
+         <td><?= nl2br(p::purify($item->description)) ?></td>
       </tr>
       <? endif ?>
     </table>
diff --git a/modules/search/views/search.html.php b/modules/search/views/search.html.php
index d173f734..6a222ef1 100644
--- a/modules/search/views/search.html.php
+++ b/modules/search/views/search.html.php
@@ -34,7 +34,7 @@
           <?= p::purify($item->title) ?>
         </p>
         <div>
-          <?= p::purify($item->description) ?>
+    <?= nl2br(p::purify($item->description)) ?>
         </div>
       </a>
     </li>
diff --git a/themes/default/views/album.html.php b/themes/default/views/album.html.php
index 273b8a4e..65ea3381 100644
--- a/themes/default/views/album.html.php
+++ b/themes/default/views/album.html.php
@@ -3,7 +3,7 @@
 <div id="gInfo">
   <?= $theme->album_top() ?>
   <h1><?= p::purify($item->title) ?></h1>
-  <div class="gDescription"><?= p::purify($item->description) ?></div>
+  <div class="gDescription"><?= nl2br(p::purify($item->description)) ?></div>
 </div>
 
 <ul id="gAlbumGrid">
diff --git a/themes/default/views/movie.html.php b/themes/default/views/movie.html.php
index 2cd9806f..66c80ded 100644
--- a/themes/default/views/movie.html.php
+++ b/themes/default/views/movie.html.php
@@ -16,7 +16,7 @@
 
   <div id="gInfo">
     <h1><?= p::purify($item->title) ?></h1>
-    <div><?= p::purify($item->description) ?></div>
+       <div><?= nl2br(p::purify($item->description)) ?></div>
   </div>
 
   <script type="text/javascript">
diff --git a/themes/default/views/photo.html.php b/themes/default/views/photo.html.php
index dc3a9dfd..bf4d9da3 100644
--- a/themes/default/views/photo.html.php
+++ b/themes/default/views/photo.html.php
@@ -51,7 +51,7 @@
 
   <div id="gInfo">
     <h1><?= p::purify($item->title) ?></h1>
-    <div><?= p::purify($item->description) ?></div>
+    <div><?= nl2br(p::purify($item->description)) ?></div>
   </div>
 
   <script type="text/javascript">
-- 
cgit v1.2.3