Filter out img, video and audio tags in notice HTML

[quix0rs-gnu-social.git] / lib / util.php

diff --git a/lib/util.php b/lib/util.php
index 9a70d8d44ebaf9f010675b0c88d5691b01258101..14cfd96ee135bba06c64f279c7c9717c89555355 100644 (file)
--- a/lib/util.php
+++ b/lib/util.php
@@ -580,9 +580,18 @@ function common_purify($html)
 {
     require_once INSTALLDIR.'/extlib/htmLawed/htmLawed.php';
 
-    $config = array('safe' => 1,
+    $config = array('safe' => 1,    // means that elements=* means elements=*-applet-embed-iframe-object-script or so
+                    'elements' => '*',
                     'deny_attribute' => 'id,style,on*');
 
+    // Remove more elements than what the 'safe' filter gives (elements must be '*' before this)
+    // http://www.bioinformatics.org/phplabware/internal_utilities/htmLawed/htmLawed_README.htm#s3.6
+    foreach (common_config('htmlfilter') as $tag=>$filter) {
+        if ($filter === true) {
+            $config['elements'] .= "-{$tag}";
+        }
+    }
+
     $html = common_remove_unicode_formatting($html);
 
     return htmLawed($html, $config);
@@ -1141,6 +1150,13 @@ function common_xml_safe_str($str)
 
 function common_slugify($str)
 {
+    // php5-intl is highly recommended...
+    if (!function_exists('transliterator_transliterate')) {
+        $str = preg_replace('/[^\pL\pN]/u', '', $str);
+        $str = mb_convert_case($str, MB_CASE_LOWER, 'UTF-8');
+        $str = substr($str, 0, 64);
+        return $str;
+    }
     $str = transliterator_transliterate(
                         'Any-Latin;' .      // any charset to latin compatible
                             'NFD;' .        // decompose
@@ -1253,7 +1269,7 @@ function common_local_url($action, $args=null, $params=null, $fragment=null, $ad
         $path = $r->build($action, $args, $params, $fragment);
 
         $ssl = common_config('site', 'ssl') === 'always'
-                || StatusNet::isHTTPS()
+                || GNUsocial::isHTTPS()
                 || common_is_sensitive($action);
 
         if (common_config('site','fancy')) {
@@ -1297,7 +1313,7 @@ function common_path($relative, $ssl=false, $addSession=true)
     $pathpart = (common_config('site', 'path')) ? common_config('site', 'path')."/" : '';
 
     if (($ssl && (common_config('site', 'ssl') === 'sometimes'))
-        || StatusNet::isHTTPS()
+        || GNUsocial::isHTTPS()
         || common_config('site', 'ssl') === 'always') {
         $proto = 'https';
         if (is_string(common_config('site', 'sslserver')) &&
@@ -1922,9 +1938,14 @@ function common_negotiate_type($cprefs, $sprefs)
     return $besttype;
 }
 
-function common_config($main, $sub)
+function common_config($main, $sub=null)
 {
     global $config;
+    if (is_null($sub)) {
+        // Return the config category array
+        return array_key_exists($main, $config) ? $config[$main] : array();
+    }
+    // Return the config value
     return (array_key_exists($main, $config) &&
             array_key_exists($sub, $config[$main])) ? $config[$main][$sub] : false;
 }