Filter out img, video and audio tags in notice HTML

[quix0rs-gnu-social.git] / lib / default.php

diff --git a/lib/default.php b/lib/default.php
index 465a5142a3bcb55ee2795a8a249e5c0f60297e79..c0d559e1cc27dcba88d396bba939a7abbe3fa559 100644 (file)
--- a/lib/default.php
+++ b/lib/default.php
@@ -33,7 +33,7 @@ $default =
               'nickname' => 'gnusocial',
               'wildcard' => null,
               'server' => $_server,
-              'theme' => 'neo',
+              'theme' => 'neo-gnu',
               'path' => $_path,
               'logfile' => null,
               'logo' => null,
@@ -53,11 +53,11 @@ $default =
               'broughtbyurl' => null,
               'closed' => false,
               'inviteonly' => true,
-              'private' => true,
+              'private' => false,
               'ssl' => 'never',
               'sslserver' => null,
               'dupelimit' => 60, // default for same person saying the same thing
-              'textlimit' => 0, // in chars; 0 == no limit
+              'textlimit' => 1000, // in chars; 0 == no limit
               'indent' => true,
               'use_x_sendfile' => false,
               'notice' => null, // site wide notice text
@@ -126,6 +126,7 @@ $default =
         'profile' =>
         array('banned' => array(),
               'biolimit' => null,
+              'changenick' => false,
               'backup' => true,
               'restore' => true,
               'delete' => false,
@@ -206,6 +207,9 @@ $default =
         'newuser' =>
         array('default' => null,
               'welcome' => null),
+        'linkify' => array(
+            'bare_domains' => false,  // convert domain.com to <a href="http://domain.com/" ...>domain.com</a> ?
+        ),
         'attachments' =>
         array('server' => null,
               'dir' => INSTALLDIR . '/file/',
@@ -249,15 +253,17 @@ $default =
               'user_quota' => 50000000,
               'monthly_quota' => 15000000,
               'uploads' => true,
+              'filename_base' => 'hash',   // for new files, choose one: 'upload', 'hash'
               'show_html' => false,  // show (filtered) text/html attachments (and oEmbed HTML etc.). Doesn't affect AJAX calls.
               'show_thumbs' => true, // show thumbnails in notice lists for uploaded images, and photos and videos linked remotely that provide oEmbed info
               'process_links' => true, // check linked resources for embeddable photos and videos; this will hit referenced external web sites when processing new messages.
               ),
         'thumbnail' =>
         array('crop' => false,      // overridden to true if thumb height === null
-              'maxsize' => 600,     // thumbs with an edge larger than this will not be generated
+              'maxsize' => 1000,     // thumbs with an edge larger than this will not be generated
               'width' => 450,
-              'height' => 600),
+              'height' => 600,
+              'animated' => false), // null="UseFileAsThumbnail", false="can use still frame". true requires ImageMagickPlugin
         'application' =>
         array('desclimit' => null),
         'group' =>
@@ -279,6 +285,11 @@ $default =
         array('handle' => false,   // whether to handle sessions ourselves
               'debug' => false,    // debugging output for sessions
               'gc_limit' => 1000), // max sessions to expire at a time
+        'htmlfilter' => array(  // purify HTML through htmLawed
+            'img' => true,
+            'video' => true,
+            'audio' => true,
+        ),
         'notice' =>
         array('contentlimit' => null,
               'defaultscope' => null, // null means 1 if site/private, 0 otherwise
@@ -292,9 +303,11 @@ $default =
         array('disabled' => true),
         'plugins' =>
         array('core' => array(
+                            'ActivityVerb' => array(),
                             'AuthCrypt' => array(),
                             'Cronish' => array(),
                             'Favorite' => array(),
+                            'Share' => array(),
                             'LRDD' => array(),
                             'StrictTransportSecurity' => array(),
                         ),
@@ -303,6 +316,7 @@ $default =
                             'AntiBrute' => array(),
                             'Bookmark' => array(),
                             'ClientSideShorten' => array(),
+                            'DefaultLayout' => array(),
                             'Directory' => array(),
                             'DirectMessage' => array(),
                             'EmailAuthentication' => array(),
@@ -345,7 +359,8 @@ $default =
               'maxurllength' => 100,
               'maxnoticelength' => -1),
         'http' => // HTTP client settings when contacting other sites
-        array('ssl_cafile' => false, // To enable SSL cert validation, point to a CA bundle (eg '/usr/lib/ssl/certs/ca-certificates.crt')
+        array('ssl_cafile' => false, // To enable SSL cert validation, point to a CA bundle (eg '/usr/lib/ssl/certs/ca-certificates.crt') (this activates "ssl_verify_peer")
+              'ssl_verify_host' => true,    // HTTPRequest2 makes sure this is set to CURLOPT_SSL_VERIFYHOST==2 if using curl
               'curl' => false, // Use CURL backend for HTTP fetches if available. (If not, PHP's socket streams will be used.)
               'proxy_host' => null,
               'proxy_port' => null,