X-Git-Url: https://git.mxchange.org/?a=blobdiff_plain;f=src%2FObject%2FOEmbed.php;h=bd336f7583fb6c994da174bfe7b9584ed8ddcd49;hb=ced4911c4ab268c9e502a3c3e1aa43ebda837044;hp=3eebcc22653d2b7c63aa983ad88ca231710a2c23;hpb=5a8654194af6edcb74c86606821c5ee75392ab12;p=friendica.git

diff --git a/src/Object/OEmbed.php b/src/Object/OEmbed.php
index 3eebcc2265..bd336f7583 100644
--- a/src/Object/OEmbed.php
+++ b/src/Object/OEmbed.php
@@ -7,7 +7,7 @@ namespace Friendica\Object;
  *
  * @see https://oembed.com/#section2.3
  *
- * @author Hypolite Petovan <mrpetovan@gmail.com>
+ * @author Hypolite Petovan <hypolite@mrpetovan.com>
  */
 class OEmbed
 {
@@ -42,6 +42,17 @@ class OEmbed
 		}
 
 		foreach ($properties as $key => $value) {
+			if (in_array($key, ['thumbnail_width', 'thumbnail_height', 'width', 'height'])) {
+				// These values should be numbers, so ensure that they really are numbers.
+				$value = (int)$value;
+			} elseif ($key != 'html') {
+				// Avoid being able to inject some ugly stuff through these fields.
+				$value = htmlentities($value);
+			} else {
+				/// @todo Add a way to sanitize the html as well, possibly with an <iframe>?
+				$value = mb_convert_encoding($value, 'HTML-ENTITIES', mb_detect_encoding($value));
+			}
+
 			if (property_exists(__CLASS__, $key)) {
 				$this->{$key} = $value;
 			}