Add menu entry to directly collapse posts

[friendica.git] / src / Object / OEmbed.php

diff --git a/src/Object/OEmbed.php b/src/Object/OEmbed.php
index 3eebcc22653d2b7c63aa983ad88ca231710a2c23..3f53f48cd18d5287af17d41eea02eb17638f51ec 100644 (file)
--- a/src/Object/OEmbed.php
+++ b/src/Object/OEmbed.php
@@ -1,4 +1,23 @@
 <?php
+/**
+ * @copyright Copyright (C) 2010-2023, the Friendica project
+ *
+ * @license GNU AGPL version 3 or any later version
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <https://www.gnu.org/licenses/>.
+ *
+ */
 
 namespace Friendica\Object;
 
@@ -7,7 +26,7 @@ namespace Friendica\Object;
  *
  * @see https://oembed.com/#section2.3
  *
- * @author Hypolite Petovan <mrpetovan@gmail.com>
+ * @author Hypolite Petovan <hypolite@mrpetovan.com>
  */
 class OEmbed
 {
@@ -15,6 +34,7 @@ class OEmbed
 
        public $type             = '';
        public $title            = '';
+       public $description      = '';
        public $author_name      = '';
        public $author_url       = '';
        public $provider_name    = '';
@@ -42,6 +62,19 @@ class OEmbed
                }
 
                foreach ($properties as $key => $value) {
+                       if (in_array($key, ['thumbnail_width', 'thumbnail_height', 'width', 'height'])) {
+                               // These values should be numbers, so ensure that they really are numbers.
+                               $value = (int)$value;
+                       } elseif (is_array($value)) {
+                               // Ignoring arrays.
+                       } elseif ($key != 'html') {
+                               // Avoid being able to inject some ugly stuff through these fields.
+                               $value = htmlentities($value);
+                       } else {
+                               /// @todo Add a way to sanitize the html as well, possibly with an <iframe>?
+                               $value = mb_convert_encoding($value, 'HTML-ENTITIES', mb_detect_encoding($value));
+                       }
+
                        if (property_exists(__CLASS__, $key)) {
                                $this->{$key} = $value;
                        }