rename function and update calls.
if (!$update) {
$tab = 'posts';
if (x($_GET, 'tab')) {
- $tab = Strings::removeTags(trim($_GET['tab']));
+ $tab = Strings::escapeTags(trim($_GET['tab']));
}
if ($tab === 'posts') {
/*
*/
function sanitise_acl(&$item) {
if (intval($item)) {
- $item = '<' . intval(Strings::removeTags(trim($item))) . '>';
+ $item = '<' . intval(Strings::escapeTags(trim($item))) . '>';
} else {
unset($item);
}
);
} elseif ($type == 'x') {
// autocomplete for global contact search (e.g. navbar search)
- $search = Strings::removeTags(trim($_REQUEST['search']));
+ $search = Strings::escapeTags(trim($_REQUEST['search']));
$mode = $_REQUEST['smode'];
$r = ACL::contactAutocomplete($search, $mode);
// Add new item to blocklist
$blocklist = Config::get('system', 'blocklist');
$blocklist[] = [
- 'domain' => Strings::removeTags(trim($_POST['newentry_domain'])),
- 'reason' => Strings::removeTags(trim($_POST['newentry_reason']))
+ 'domain' => Strings::escapeTags(trim($_POST['newentry_domain'])),
+ 'reason' => Strings::escapeTags(trim($_POST['newentry_reason']))
];
Config::set('system', 'blocklist', $blocklist);
info(L10n::t('Server added to blocklist.') . EOL);
$blocklist = [];
foreach ($_POST['domain'] as $id => $domain) {
// Trimming whitespaces as well as any lingering slashes
- $domain = Strings::removeTags(trim($domain, "\x00..\x1F/"));
- $reason = Strings::removeTags(trim($_POST['reason'][$id]));
+ $domain = Strings::escapeTags(trim($domain, "\x00..\x1F/"));
+ $reason = Strings::escapeTags(trim($_POST['reason'][$id]));
if (!x($_POST['delete'][$id])) {
$blocklist[] = [
'domain' => $domain,
BaseModule::checkFormSecurityTokenRedirectOnError('/admin/deleteitem/', 'admin_deleteitem');
if (x($_POST['page_deleteitem_submit'])) {
- $guid = trim(Strings::removeTags($_POST['deleteitemguid']));
+ $guid = trim(Strings::escapeTags($_POST['deleteitemguid']));
// The GUID should not include a "/", so if there is one, we got an URL
// and the last part of it is most likely the GUID.
if (strpos($guid, '/')) {
}
// end relocate
- $sitename = ((x($_POST,'sitename')) ? Strings::removeTags(trim($_POST['sitename'])) : '');
- $hostname = ((x($_POST,'hostname')) ? Strings::removeTags(trim($_POST['hostname'])) : '');
- $sender_email = ((x($_POST,'sender_email')) ? Strings::removeTags(trim($_POST['sender_email'])) : '');
+ $sitename = ((x($_POST,'sitename')) ? Strings::escapeTags(trim($_POST['sitename'])) : '');
+ $hostname = ((x($_POST,'hostname')) ? Strings::escapeTags(trim($_POST['hostname'])) : '');
+ $sender_email = ((x($_POST,'sender_email')) ? Strings::escapeTags(trim($_POST['sender_email'])) : '');
$banner = ((x($_POST,'banner')) ? trim($_POST['banner']) : false);
- $shortcut_icon = ((x($_POST,'shortcut_icon')) ? Strings::removeTags(trim($_POST['shortcut_icon'])) : '');
- $touch_icon = ((x($_POST,'touch_icon')) ? Strings::removeTags(trim($_POST['touch_icon'])) : '');
+ $shortcut_icon = ((x($_POST,'shortcut_icon')) ? Strings::escapeTags(trim($_POST['shortcut_icon'])) : '');
+ $touch_icon = ((x($_POST,'touch_icon')) ? Strings::escapeTags(trim($_POST['touch_icon'])) : '');
$info = ((x($_POST,'info')) ? trim($_POST['info']) : false);
- $language = ((x($_POST,'language')) ? Strings::removeTags(trim($_POST['language'])) : '');
- $theme = ((x($_POST,'theme')) ? Strings::removeTags(trim($_POST['theme'])) : '');
- $theme_mobile = ((x($_POST,'theme_mobile')) ? Strings::removeTags(trim($_POST['theme_mobile'])) : '');
+ $language = ((x($_POST,'language')) ? Strings::escapeTags(trim($_POST['language'])) : '');
+ $theme = ((x($_POST,'theme')) ? Strings::escapeTags(trim($_POST['theme'])) : '');
+ $theme_mobile = ((x($_POST,'theme_mobile')) ? Strings::escapeTags(trim($_POST['theme_mobile'])) : '');
$maximagesize = ((x($_POST,'maximagesize')) ? intval(trim($_POST['maximagesize'])) : 0);
$maximagelength = ((x($_POST,'maximagelength')) ? intval(trim($_POST['maximagelength'])) : MAX_IMAGE_LENGTH);
$jpegimagequality = ((x($_POST,'jpegimagequality')) ? intval(trim($_POST['jpegimagequality'])) : JPEG_QUALITY);
$register_text = ((x($_POST,'register_text')) ? strip_tags(trim($_POST['register_text'])) : '');
- $allowed_sites = ((x($_POST,'allowed_sites')) ? Strings::removeTags(trim($_POST['allowed_sites'])) : '');
- $allowed_email = ((x($_POST,'allowed_email')) ? Strings::removeTags(trim($_POST['allowed_email'])) : '');
- $forbidden_nicknames = ((x($_POST,'forbidden_nicknames')) ? strtolower(Strings::removeTags(trim($_POST['forbidden_nicknames']))) : '');
+ $allowed_sites = ((x($_POST,'allowed_sites')) ? Strings::escapeTags(trim($_POST['allowed_sites'])) : '');
+ $allowed_email = ((x($_POST,'allowed_email')) ? Strings::escapeTags(trim($_POST['allowed_email'])) : '');
+ $forbidden_nicknames = ((x($_POST,'forbidden_nicknames')) ? strtolower(Strings::escapeTags(trim($_POST['forbidden_nicknames']))) : '');
$no_oembed_rich_content = x($_POST,'no_oembed_rich_content');
- $allowed_oembed = ((x($_POST,'allowed_oembed')) ? Strings::removeTags(trim($_POST['allowed_oembed'])) : '');
+ $allowed_oembed = ((x($_POST,'allowed_oembed')) ? Strings::escapeTags(trim($_POST['allowed_oembed'])) : '');
$block_public = ((x($_POST,'block_public')) ? True : False);
$force_publish = ((x($_POST,'publish_all')) ? True : False);
- $global_directory = ((x($_POST,'directory')) ? Strings::removeTags(trim($_POST['directory'])) : '');
+ $global_directory = ((x($_POST,'directory')) ? Strings::escapeTags(trim($_POST['directory'])) : '');
$newuser_private = ((x($_POST,'newuser_private')) ? True : False);
$enotify_no_content = ((x($_POST,'enotify_no_content')) ? True : False);
$private_addons = ((x($_POST,'private_addons')) ? True : False);
$max_author_posts_community_page = ((x($_POST,'max_author_posts_community_page')) ? intval(trim($_POST['max_author_posts_community_page'])) : 0);
$verifyssl = ((x($_POST,'verifyssl')) ? True : False);
- $proxyuser = ((x($_POST,'proxyuser')) ? Strings::removeTags(trim($_POST['proxyuser'])) : '');
- $proxy = ((x($_POST,'proxy')) ? Strings::removeTags(trim($_POST['proxy'])) : '');
+ $proxyuser = ((x($_POST,'proxyuser')) ? Strings::escapeTags(trim($_POST['proxyuser'])) : '');
+ $proxy = ((x($_POST,'proxy')) ? Strings::escapeTags(trim($_POST['proxy'])) : '');
$timeout = ((x($_POST,'timeout')) ? intval(trim($_POST['timeout'])) : 60);
$maxloadavg = ((x($_POST,'maxloadavg')) ? intval(trim($_POST['maxloadavg'])) : 50);
$maxloadavg_frontend = ((x($_POST,'maxloadavg_frontend')) ? intval(trim($_POST['maxloadavg_frontend'])) : 50);
$dbclean_expire_days = ((x($_POST,'dbclean_expire_days')) ? intval($_POST['dbclean_expire_days']) : 0);
$dbclean_unclaimed = ((x($_POST,'dbclean_unclaimed')) ? intval($_POST['dbclean_unclaimed']) : 0);
$suppress_tags = ((x($_POST,'suppress_tags')) ? True : False);
- $itemcache = ((x($_POST,'itemcache')) ? Strings::removeTags(trim($_POST['itemcache'])) : '');
+ $itemcache = ((x($_POST,'itemcache')) ? Strings::escapeTags(trim($_POST['itemcache'])) : '');
$itemcache_duration = ((x($_POST,'itemcache_duration')) ? intval($_POST['itemcache_duration']) : 0);
$max_comments = ((x($_POST,'max_comments')) ? intval($_POST['max_comments']) : 0);
- $temppath = ((x($_POST,'temppath')) ? Strings::removeTags(trim($_POST['temppath'])) : '');
- $basepath = ((x($_POST,'basepath')) ? Strings::removeTags(trim($_POST['basepath'])) : '');
- $singleuser = ((x($_POST,'singleuser')) ? Strings::removeTags(trim($_POST['singleuser'])) : '');
+ $temppath = ((x($_POST,'temppath')) ? Strings::escapeTags(trim($_POST['temppath'])) : '');
+ $basepath = ((x($_POST,'basepath')) ? Strings::escapeTags(trim($_POST['basepath'])) : '');
+ $singleuser = ((x($_POST,'singleuser')) ? Strings::escapeTags(trim($_POST['singleuser'])) : '');
$proxy_disabled = ((x($_POST,'proxy_disabled')) ? True : False);
$only_tag_search = ((x($_POST,'only_tag_search')) ? True : False);
$rino = ((x($_POST,'rino')) ? intval($_POST['rino']) : 0);
- $check_new_version_url = ((x($_POST, 'check_new_version_url')) ? Strings::removeTags(trim($_POST['check_new_version_url'])) : 'none');
+ $check_new_version_url = ((x($_POST, 'check_new_version_url')) ? Strings::escapeTags(trim($_POST['check_new_version_url'])) : 'none');
$worker_queues = ((x($_POST,'worker_queues')) ? intval($_POST['worker_queues']) : 10);
$worker_dont_fork = ((x($_POST,'worker_dont_fork')) ? True : False);
$worker_frontend = ((x($_POST,'worker_frontend')) ? True : False);
$relay_directly = ((x($_POST,'relay_directly')) ? True : False);
- $relay_server = ((x($_POST,'relay_server')) ? Strings::removeTags(trim($_POST['relay_server'])) : '');
+ $relay_server = ((x($_POST,'relay_server')) ? Strings::escapeTags(trim($_POST['relay_server'])) : '');
$relay_subscribe = ((x($_POST,'relay_subscribe')) ? True : False);
- $relay_scope = ((x($_POST,'relay_scope')) ? Strings::removeTags(trim($_POST['relay_scope'])) : '');
- $relay_server_tags = ((x($_POST,'relay_server_tags')) ? Strings::removeTags(trim($_POST['relay_server_tags'])) : '');
+ $relay_scope = ((x($_POST,'relay_scope')) ? Strings::escapeTags(trim($_POST['relay_scope'])) : '');
+ $relay_server_tags = ((x($_POST,'relay_server_tags')) ? Strings::escapeTags(trim($_POST['relay_server_tags'])) : '');
$relay_user_tags = ((x($_POST,'relay_user_tags')) ? True : False);
// Has the directory url changed? If yes, then resubmit the existing profiles there
if (x($_POST, "page_logs")) {
BaseModule::checkFormSecurityTokenRedirectOnError('/admin/logs', 'admin_logs');
- $logfile = ((x($_POST,'logfile')) ? Strings::removeTags(trim($_POST['logfile'])) : '');
+ $logfile = ((x($_POST,'logfile')) ? Strings::escapeTags(trim($_POST['logfile'])) : '');
$debugging = ((x($_POST,'debugging')) ? true : false);
$loglevel = ((x($_POST,'loglevel')) ? intval(trim($_POST['loglevel'])) : 0);
$cid = 0;
$hidden = intval(defaults($handsfree, 'hidden' , 0));
} else {
- $dfrn_id = Strings::removeTags(trim(defaults($_POST, 'dfrn_id' , '')));
+ $dfrn_id = Strings::escapeTags(trim(defaults($_POST, 'dfrn_id' , '')));
$intro_id = intval(defaults($_POST, 'intro_id' , 0));
$duplex = intval(defaults($_POST, 'duplex' , 0));
$cid = intval(defaults($_POST, 'contact_id', 0));
}
}
- $dfrn_id = ((x($_POST,'dfrn_id')) ? Strings::removeTags(trim($_POST['dfrn_id'])) : '');
+ $dfrn_id = ((x($_POST,'dfrn_id')) ? Strings::escapeTags(trim($_POST['dfrn_id'])) : '');
$dfrn_version = ((x($_POST,'dfrn_version')) ? (float) $_POST['dfrn_version'] : 2.0);
- $challenge = ((x($_POST,'challenge')) ? Strings::removeTags(trim($_POST['challenge'])) : '');
+ $challenge = ((x($_POST,'challenge')) ? Strings::escapeTags(trim($_POST['challenge'])) : '');
$data = ((x($_POST,'data')) ? $_POST['data'] : '');
$key = ((x($_POST,'key')) ? $_POST['key'] : '');
$rino_remote = ((x($_POST,'rino')) ? intval($_POST['rino']) : 0);
$dissolve = ((x($_POST,'dissolve')) ? intval($_POST['dissolve']) : 0);
- $perm = ((x($_POST,'perm')) ? Strings::removeTags(trim($_POST['perm'])) : 'r');
- $ssl_policy = ((x($_POST,'ssl_policy')) ? Strings::removeTags(trim($_POST['ssl_policy'])): 'none');
+ $perm = ((x($_POST,'perm')) ? Strings::escapeTags(trim($_POST['perm'])) : 'r');
+ $ssl_policy = ((x($_POST,'ssl_policy')) ? Strings::escapeTags(trim($_POST['ssl_policy'])): 'none');
$page = ((x($_POST,'page')) ? intval($_POST['page']) : 0);
$forum = (($page == 1) ? 1 : 0);
* If this is a duplex communication, ours will be the opposite.
*/
- $dfrn_id = Strings::removeTags(trim($_GET['dfrn_id']));
+ $dfrn_id = Strings::escapeTags(trim($_GET['dfrn_id']));
$dfrn_version = (float) $_GET['dfrn_version'];
$rino_remote = ((x($_GET,'rino')) ? intval($_GET['rino']) : 0);
$type = "";
if ((x($_POST, 'localconfirm')) && ($_POST['localconfirm'] == 1)) {
// Ensure this is a valid request
if (local_user() && ($a->user['nickname'] == $a->argv[1]) && (x($_POST, 'dfrn_url'))) {
- $dfrn_url = Strings::removeTags(trim($_POST['dfrn_url']));
+ $dfrn_url = Strings::escapeTags(trim($_POST['dfrn_url']));
$aes_allow = (((x($_POST, 'aes_allow')) && ($_POST['aes_allow'] == 1)) ? 1 : 0);
$confirm_key = ((x($_POST, 'confirm_key')) ? $_POST['confirm_key'] : "");
$hidden = ((x($_POST, 'hidden-contact')) ? intval($_POST['hidden-contact']) : 0);
}
}
- $real_name = x($_POST, 'realname') ? Strings::removeTags(trim($_POST['realname'])) : '';
+ $real_name = x($_POST, 'realname') ? Strings::escapeTags(trim($_POST['realname'])) : '';
$url = trim($_POST['dfrn_url']);
if (!strlen($url)) {
intval($uid),
intval($contact_record['id']),
((x($_POST,'knowyou') && ($_POST['knowyou'] == 1)) ? 1 : 0),
- DBA::escape(Strings::removeTags(trim(defaults($_POST, 'dfrn-request-message', '')))),
+ DBA::escape(Strings::escapeTags(trim(defaults($_POST, 'dfrn-request-message', '')))),
DBA::escape($hash),
DBA::escape(DateTimeFormat::utcNow())
);
return Login::form();
}
- $dfrn_url = Strings::removeTags(trim(hex2bin($_GET['dfrn_url'])));
+ $dfrn_url = Strings::escapeTags(trim(hex2bin($_GET['dfrn_url'])));
$aes_allow = x($_GET, 'aes_allow') && $_GET['aes_allow'] == 1 ? 1 : 0;
$confirm_key = x($_GET, 'confirm_key') ? $_GET['confirm_key'] : "";
Nav::setSelected('directory');
if (x($a->data, 'search')) {
- $search = Strings::removeTags(trim($a->data['search']));
+ $search = Strings::escapeTags(trim($a->data['search']));
} else {
- $search = ((x($_GET, 'search')) ? Strings::removeTags(trim(rawurldecode($_GET['search']))) : '');
+ $search = ((x($_GET, 'search')) ? Strings::escapeTags(trim(rawurldecode($_GET['search']))) : '');
}
$gdirpath = '';
$local = Config::get('system','poco_local_search');
- $search = $prefix.Strings::removeTags(trim(defaults($_REQUEST, 'search', '')));
+ $search = $prefix.Strings::escapeTags(trim(defaults($_REQUEST, 'search', '')));
$header = '';
}
$uid = local_user();
- $url = Strings::removeTags(trim($_REQUEST['url']));
+ $url = Strings::escapeTags(trim($_REQUEST['url']));
$return_path = 'contacts';
// Makes the connection request for friendica contacts easier
}
$uid = local_user();
- $url = Strings::removeTags(trim($_REQUEST['url']));
+ $url = Strings::escapeTags(trim($_REQUEST['url']));
$submit = L10n::t('Submit Request');
if (($a->argc == 2) && ($a->argv[1] === 'new')) {
BaseModule::checkFormSecurityTokenRedirectOnError('/group/new', 'group_edit');
- $name = Strings::removeTags(trim($_POST['groupname']));
+ $name = Strings::escapeTags(trim($_POST['groupname']));
$r = Model\Group::create(local_user(), $name);
if ($r) {
info(L10n::t('Group created.') . EOL);
return; // NOTREACHED
}
$group = $r[0];
- $groupname = Strings::removeTags(trim($_POST['groupname']));
+ $groupname = Strings::escapeTags(trim($_POST['groupname']));
if (strlen($groupname) && ($groupname != $group['name'])) {
$r = q("UPDATE `group` SET `name` = '%s' WHERE `uid` = %d AND `id` = %d",
DBA::escape($groupname),
$title = basename($path);
$filename = $path;
$text = load_doc_file('doc/' . $path . '.md');
- $a->page['title'] = L10n::t('Help:') . ' ' . str_replace('-', ' ', Strings::removeTags($title));
+ $a->page['title'] = L10n::t('Help:') . ' ' . str_replace('-', ' ', Strings::escapeTags($title));
}
$home = load_doc_file('doc/Home.md');
$recipients = !empty($_POST['recipients']) ? explode("\n", $_POST['recipients']) : [];
- $message = !empty($_POST['message']) ? Strings::removeTags(trim($_POST['message'])) : '';
+ $message = !empty($_POST['message']) ? Strings::escapeTags(trim($_POST['message'])) : '';
$total = 0;
$objecttype = $orig_post['object-type'];
$app = $orig_post['app'];
$categories = $orig_post['file'];
- $title = Strings::removeTags(trim($_REQUEST['title']));
+ $title = Strings::escapeTags(trim($_REQUEST['title']));
$body = Strings::escapeHtml(trim($_REQUEST['body']));
$private = $orig_post['private'];
$pubmail_enabled = $orig_post['pubmail'];
$str_contact_deny = perms2str(defaults($_REQUEST, 'contact_deny', ''));
}
- $title = Strings::removeTags(trim(defaults($_REQUEST, 'title' , '')));
- $location = Strings::removeTags(trim(defaults($_REQUEST, 'location', '')));
- $coord = Strings::removeTags(trim(defaults($_REQUEST, 'coord' , '')));
- $verb = Strings::removeTags(trim(defaults($_REQUEST, 'verb' , '')));
- $emailcc = Strings::removeTags(trim(defaults($_REQUEST, 'emailcc' , '')));
+ $title = Strings::escapeTags(trim(defaults($_REQUEST, 'title' , '')));
+ $location = Strings::escapeTags(trim(defaults($_REQUEST, 'location', '')));
+ $coord = Strings::escapeTags(trim(defaults($_REQUEST, 'coord' , '')));
+ $verb = Strings::escapeTags(trim(defaults($_REQUEST, 'verb' , '')));
+ $emailcc = Strings::escapeTags(trim(defaults($_REQUEST, 'emailcc' , '')));
$body = Strings::escapeHtml(trim(defaults($_REQUEST, 'body' , '')));
- $network = Strings::removeTags(trim(defaults($_REQUEST, 'network' , Protocol::DFRN)));
+ $network = Strings::escapeTags(trim(defaults($_REQUEST, 'network' , Protocol::DFRN)));
$guid = System::createUUID();
$postopts = defaults($_REQUEST, 'postopts', '');
}
- $verb = Strings::removeTags(trim($_GET['verb']));
+ $verb = Strings::escapeTags(trim($_GET['verb']));
if (!$verb) {
$verb = 'like';
}
- $item_id = (($a->argc > 1) ? Strings::removeTags(trim($a->argv[1])) : 0);
+ $item_id = (($a->argc > 1) ? Strings::escapeTags(trim($a->argv[1])) : 0);
$r = Item::performLike($item_id, $verb);
if (!$r) {
function lostpass_post(App $a)
{
- $loginame = Strings::removeTags(trim($_POST['login-name']));
+ $loginame = Strings::escapeTags(trim($_POST['login-name']));
if (!$loginame) {
$a->internalRedirect();
}
return;
}
- $replyto = x($_REQUEST, 'replyto') ? Strings::removeTags(trim($_REQUEST['replyto'])) : '';
- $subject = x($_REQUEST, 'subject') ? Strings::removeTags(trim($_REQUEST['subject'])) : '';
+ $replyto = x($_REQUEST, 'replyto') ? Strings::escapeTags(trim($_REQUEST['replyto'])) : '';
+ $subject = x($_REQUEST, 'subject') ? Strings::escapeTags(trim($_REQUEST['subject'])) : '';
$body = x($_REQUEST, 'body') ? Strings::escapeHtml(trim($_REQUEST['body'])) : '';
$recipient = x($_REQUEST, 'messageto') ? intval($_REQUEST['messageto']) : 0;
$star = intval(defaults($_GET, 'star' , 0));
$bmark = intval(defaults($_GET, 'bmark', 0));
$conv = intval(defaults($_GET, 'conv' , 0));
- $order = Strings::removeTags(defaults($_GET, 'order', 'comment'));
+ $order = Strings::escapeTags(defaults($_GET, 'order', 'comment'));
$nets = defaults($_GET, 'nets' , '');
if ($cid) {
}
$url = ((x($_REQUEST,'url') && strlen($_REQUEST['url']))
- ? urlencode(Strings::removeTags(trim($_REQUEST['url']))) : '');
+ ? urlencode(Strings::escapeTags(trim($_REQUEST['url']))) : '');
$title = ((x($_REQUEST,'title') && strlen($_REQUEST['title']))
- ? '&title=' . urlencode(Strings::removeTags(trim($_REQUEST['title']))) : '');
+ ? '&title=' . urlencode(Strings::escapeTags(trim($_REQUEST['title']))) : '');
$description = ((x($_REQUEST,'description') && strlen($_REQUEST['description']))
- ? '&description=' . urlencode(Strings::removeTags(trim($_REQUEST['description']))) : '');
+ ? '&description=' . urlencode(Strings::escapeTags(trim($_REQUEST['description']))) : '');
$tags = ((x($_REQUEST,'tags') && strlen($_REQUEST['tags']))
- ? '&tags=' . urlencode(Strings::removeTags(trim($_REQUEST['tags']))) : '');
+ ? '&tags=' . urlencode(Strings::escapeTags(trim($_REQUEST['tags']))) : '');
$s = Network::fetchUrl(System::baseUrl() . '/parse_url?f=&url=' . $url . $title . $description . $tags);
if (is_array($attr) && count($attr)) {
foreach ($attr as $k => $v) {
if ($k === 'namePerson/friendly') {
- $nick = Strings::removeTags(trim($v));
+ $nick = Strings::escapeTags(trim($v));
}
if($k === 'namePerson/first') {
- $first = Strings::removeTags(trim($v));
+ $first = Strings::escapeTags(trim($v));
}
if($k === 'namePerson') {
- $args .= '&username=' . urlencode(Strings::removeTags(trim($v)));
+ $args .= '&username=' . urlencode(Strings::escapeTags(trim($v)));
}
if ($k === 'contact/email') {
- $args .= '&email=' . urlencode(Strings::removeTags(trim($v)));
+ $args .= '&email=' . urlencode(Strings::escapeTags(trim($v)));
}
if ($k === 'media/image/aspect11') {
$photosq = bin2hex(trim($v));
$args .= '&photo=' . urlencode($photo);
}
- $args .= '&openid_url=' . urlencode(Strings::removeTags(trim($authid)));
+ $args .= '&openid_url=' . urlencode(Strings::escapeTags(trim($authid)));
$a->internalRedirect('register?' . $args);
}
// RENAME photo album
- $newalbum = Strings::removeTags(trim($_POST['albumname']));
+ $newalbum = Strings::escapeTags(trim($_POST['albumname']));
if ($newalbum != $album) {
q("UPDATE `photo` SET `album` = '%s' WHERE `album` = '%s' AND `uid` = %d",
DBA::escape($newalbum),
}
if ($a->argc > 2 && (!empty($_POST['desc']) || !empty($_POST['newtag']) || !empty($_POST['albname']) !== false)) {
- $desc = !empty($_POST['desc']) ? Strings::removeTags(trim($_POST['desc'])) : '';
- $rawtags = !empty($_POST['newtag']) ? Strings::removeTags(trim($_POST['newtag'])) : '';
+ $desc = !empty($_POST['desc']) ? Strings::escapeTags(trim($_POST['desc'])) : '';
+ $rawtags = !empty($_POST['newtag']) ? Strings::escapeTags(trim($_POST['newtag'])) : '';
$item_id = !empty($_POST['item_id']) ? intval($_POST['item_id']) : 0;
- $albname = !empty($_POST['albname']) ? Strings::removeTags(trim($_POST['albname'])) : '';
- $origaname = !empty($_POST['origaname']) ? Strings::removeTags(trim($_POST['origaname'])) : '';
+ $albname = !empty($_POST['albname']) ? Strings::escapeTags(trim($_POST['albname'])) : '';
+ $origaname = !empty($_POST['origaname']) ? Strings::escapeTags(trim($_POST['origaname'])) : '';
$str_group_allow = !empty($_POST['group_allow']) ? perms2str($_POST['group_allow']) : '';
$str_contact_allow = !empty($_POST['contact_allow']) ? perms2str($_POST['contact_allow']) : '';
Addon::callHooks('photo_post_init', $_POST);
// Determine the album to use
- $album = !empty($_REQUEST['album']) ? Strings::removeTags(trim($_REQUEST['album'])) : '';
- $newalbum = !empty($_REQUEST['newalbum']) ? Strings::removeTags(trim($_REQUEST['newalbum'])) : '';
+ $album = !empty($_REQUEST['album']) ? Strings::escapeTags(trim($_REQUEST['album'])) : '';
+ $newalbum = !empty($_REQUEST['newalbum']) ? Strings::escapeTags(trim($_REQUEST['newalbum'])) : '';
Logger::log('mod/photos.php: photos_post(): album= ' . $album . ' newalbum= ' . $newalbum , Logger::DEBUG);
}
if ($a->argc > 1) {
- $user = Strings::removeTags(trim($a->argv[1]));
+ $user = Strings::escapeTags(trim($a->argv[1]));
}
if (empty($user)) {
$c = q("SELECT * FROM `pconfig` WHERE `cat` = 'system' AND `k` = 'suggestme' AND `v` = 1");
return;
}
- $verb = Strings::removeTags(trim($_GET['verb']));
+ $verb = Strings::escapeTags(trim($_GET['verb']));
$verbs = L10n::getPokeVerbs();
if (!$update) {
$tab = false;
if (!empty($_GET['tab'])) {
- $tab = Strings::removeTags(trim($_GET['tab']));
+ $tab = Strings::escapeTags(trim($_GET['tab']));
}
$o .= Profile::getTabs($a, $is_owner, $a->profile['nickname']);
$is_default = (($orig[0]['is-default']) ? 1 : 0);
- $profile_name = Strings::removeTags(trim($_POST['profile_name']));
+ $profile_name = Strings::escapeTags(trim($_POST['profile_name']));
if (! strlen($profile_name)) {
notice(L10n::t('Profile Name is required.') . EOL);
return;
}
}
- $name = Strings::removeTags(trim($_POST['name']));
+ $name = Strings::escapeTags(trim($_POST['name']));
if (! strlen($name)) {
$name = '[No Name]';
$namechanged = true;
}
- $pdesc = Strings::removeTags(trim($_POST['pdesc']));
- $gender = Strings::removeTags(trim($_POST['gender']));
- $address = Strings::removeTags(trim($_POST['address']));
- $locality = Strings::removeTags(trim($_POST['locality']));
- $region = Strings::removeTags(trim($_POST['region']));
- $postal_code = Strings::removeTags(trim($_POST['postal_code']));
- $country_name = Strings::removeTags(trim($_POST['country_name']));
- $pub_keywords = profile_clean_keywords(Strings::removeTags(trim($_POST['pub_keywords'])));
- $prv_keywords = profile_clean_keywords(Strings::removeTags(trim($_POST['prv_keywords'])));
- $marital = Strings::removeTags(trim($_POST['marital']));
- $howlong = Strings::removeTags(trim($_POST['howlong']));
+ $pdesc = Strings::escapeTags(trim($_POST['pdesc']));
+ $gender = Strings::escapeTags(trim($_POST['gender']));
+ $address = Strings::escapeTags(trim($_POST['address']));
+ $locality = Strings::escapeTags(trim($_POST['locality']));
+ $region = Strings::escapeTags(trim($_POST['region']));
+ $postal_code = Strings::escapeTags(trim($_POST['postal_code']));
+ $country_name = Strings::escapeTags(trim($_POST['country_name']));
+ $pub_keywords = profile_clean_keywords(Strings::escapeTags(trim($_POST['pub_keywords'])));
+ $prv_keywords = profile_clean_keywords(Strings::escapeTags(trim($_POST['prv_keywords'])));
+ $marital = Strings::escapeTags(trim($_POST['marital']));
+ $howlong = Strings::escapeTags(trim($_POST['howlong']));
- $with = ((x($_POST,'with')) ? Strings::removeTags(trim($_POST['with'])) : '');
+ $with = ((x($_POST,'with')) ? Strings::escapeTags(trim($_POST['with'])) : '');
if (! strlen($howlong)) {
$howlong = DBA::NULL_DATETIME;
}
/// @TODO Not flexible enough for later expansion, let's have more OOP here
- $sexual = Strings::removeTags(trim($_POST['sexual']));
- $xmpp = Strings::removeTags(trim($_POST['xmpp']));
- $homepage = Strings::removeTags(trim($_POST['homepage']));
+ $sexual = Strings::escapeTags(trim($_POST['sexual']));
+ $xmpp = Strings::escapeTags(trim($_POST['xmpp']));
+ $homepage = Strings::escapeTags(trim($_POST['homepage']));
if ((strpos($homepage, 'http') !== 0) && (strlen($homepage))) {
// neither http nor https in URL, add them
$homepage = 'http://'.$homepage;
}
- $hometown = Strings::removeTags(trim($_POST['hometown']));
- $politic = Strings::removeTags(trim($_POST['politic']));
- $religion = Strings::removeTags(trim($_POST['religion']));
+ $hometown = Strings::escapeTags(trim($_POST['hometown']));
+ $politic = Strings::escapeTags(trim($_POST['politic']));
+ $religion = Strings::escapeTags(trim($_POST['religion']));
$likes = Strings::escapeHtml(trim($_POST['likes']));
$dislikes = Strings::escapeHtml(trim($_POST['dislikes']));
function pubsub_init(App $a)
{
- $nick = (($a->argc > 1) ? Strings::removeTags(trim($a->argv[1])) : '');
+ $nick = (($a->argc > 1) ? Strings::escapeTags(trim($a->argv[1])) : '');
$contact_id = (($a->argc > 2) ? intval($a->argv[2]) : 0 );
if ($_SERVER['REQUEST_METHOD'] === 'GET') {
- $hub_mode = Strings::removeTags(trim(defaults($_GET, 'hub_mode', '')));
- $hub_topic = Strings::removeTags(trim(defaults($_GET, 'hub_topic', '')));
- $hub_challenge = Strings::removeTags(trim(defaults($_GET, 'hub_challenge', '')));
- $hub_lease = Strings::removeTags(trim(defaults($_GET, 'hub_lease_seconds', '')));
- $hub_verify = Strings::removeTags(trim(defaults($_GET, 'hub_verify_token', '')));
+ $hub_mode = Strings::escapeTags(trim(defaults($_GET, 'hub_mode', '')));
+ $hub_topic = Strings::escapeTags(trim(defaults($_GET, 'hub_topic', '')));
+ $hub_challenge = Strings::escapeTags(trim(defaults($_GET, 'hub_challenge', '')));
+ $hub_lease = Strings::escapeTags(trim(defaults($_GET, 'hub_lease_seconds', '')));
+ $hub_verify = Strings::escapeTags(trim(defaults($_GET, 'hub_verify_token', '')));
Logger::log('Subscription from ' . $_SERVER['REMOTE_ADDR'] . ' Mode: ' . $hub_mode . ' Nick: ' . $nick);
Logger::log('Data: ' . print_r($_GET,true), Logger::DATA);
Logger::log('Feed arrived from ' . $_SERVER['REMOTE_ADDR'] . ' for ' . $a->cmd . ' with user-agent: ' . $_SERVER['HTTP_USER_AGENT']);
Logger::log('Data: ' . $xml, Logger::DATA);
- $nick = (($a->argc > 1) ? Strings::removeTags(trim($a->argv[1])) : '');
+ $nick = (($a->argc > 1) ? Strings::escapeTags(trim($a->argv[1])) : '');
$contact_id = (($a->argc > 2) ? intval($a->argv[2]) : 0 );
$importer = DBA::selectFirst('user', [], ['nickname' => $nick, 'account_expired' => false, 'account_removed' => false]);
use Friendica\Util\Strings;
function post_var($name) {
- return (x($_POST, $name)) ? Strings::removeTags(trim($_POST[$name])) : '';
+ return (x($_POST, $name)) ? Strings::escapeTags(trim($_POST[$name])) : '';
}
function pubsubhubbub_init(App $a) {
$using_invites = Config::get('system', 'invitation_only');
$num_invites = Config::get('system', 'number_invites');
- $invite_id = ((x($_POST, 'invite_id')) ? Strings::removeTags(trim($_POST['invite_id'])) : '');
+ $invite_id = ((x($_POST, 'invite_id')) ? Strings::escapeTags(trim($_POST['invite_id'])) : '');
if (intval(Config::get('config', 'register_policy')) === REGISTER_OPEN) {
if ($using_invites && $invite_id) {
Logger::log('new salmon ' . $xml, Logger::DATA);
- $nick = (($a->argc > 1) ? Strings::removeTags(trim($a->argv[1])) : '');
+ $nick = (($a->argc > 1) ? Strings::escapeTags(trim($a->argv[1])) : '');
$mentions = (($a->argc > 2 && $a->argv[2] === 'mention') ? true : false);
$r = q("SELECT * FROM `user` WHERE `nickname` = '%s' AND `account_expired` = 0 AND `account_removed` = 0 LIMIT 1",
function search_saved_searches() {
$o = '';
- $search = ((x($_GET,'search')) ? Strings::removeTags(trim(rawurldecode($_GET['search']))) : '');
+ $search = ((x($_GET,'search')) ? Strings::escapeTags(trim(rawurldecode($_GET['search']))) : '');
if (!Feature::isEnabled(local_user(),'savedsearch'))
return $o;
function search_init(App $a) {
- $search = ((x($_GET,'search')) ? Strings::removeTags(trim(rawurldecode($_GET['search']))) : '');
+ $search = ((x($_GET,'search')) ? Strings::escapeTags(trim(rawurldecode($_GET['search']))) : '');
if (local_user()) {
if (x($_GET,'save') && $search) {
$search = '';
if (x($a->data,'search'))
- $search = Strings::removeTags(trim($a->data['search']));
+ $search = Strings::escapeTags(trim($a->data['search']));
else
- $search = ((x($_GET,'search')) ? Strings::removeTags(trim(rawurldecode($_GET['search']))) : '');
+ $search = ((x($_GET,'search')) ? Strings::escapeTags(trim(rawurldecode($_GET['search']))) : '');
$tag = false;
if (x($_GET,'tag')) {
$tag = true;
- $search = (x($_GET,'tag') ? '#' . Strings::removeTags(trim(rawurldecode($_GET['tag']))) : '');
+ $search = (x($_GET,'tag') ? '#' . Strings::escapeTags(trim(rawurldecode($_GET['tag']))) : '');
}
// contruct a wrapper for the search header
if (($a->argc > 1) && ($a->argv[1] === 'display')) {
BaseModule::checkFormSecurityTokenRedirectOnError('/settings/display', 'settings_display');
- $theme = x($_POST, 'theme') ? Strings::removeTags(trim($_POST['theme'])) : $a->user['theme'];
- $mobile_theme = x($_POST, 'mobile_theme') ? Strings::removeTags(trim($_POST['mobile_theme'])) : '';
+ $theme = x($_POST, 'theme') ? Strings::escapeTags(trim($_POST['theme'])) : $a->user['theme'];
+ $mobile_theme = x($_POST, 'mobile_theme') ? Strings::escapeTags(trim($_POST['mobile_theme'])) : '';
$nosmile = x($_POST, 'nosmile') ? intval($_POST['nosmile']) : 0;
$first_day_of_week = x($_POST, 'first_day_of_week') ? intval($_POST['first_day_of_week']) : 0;
$noinfo = x($_POST, 'noinfo') ? intval($_POST['noinfo']) : 0;
}
}
- $username = ((x($_POST, 'username')) ? Strings::removeTags(trim($_POST['username'])) : '');
- $email = ((x($_POST, 'email')) ? Strings::removeTags(trim($_POST['email'])) : '');
- $timezone = ((x($_POST, 'timezone')) ? Strings::removeTags(trim($_POST['timezone'])) : '');
- $language = ((x($_POST, 'language')) ? Strings::removeTags(trim($_POST['language'])) : '');
+ $username = ((x($_POST, 'username')) ? Strings::escapeTags(trim($_POST['username'])) : '');
+ $email = ((x($_POST, 'email')) ? Strings::escapeTags(trim($_POST['email'])) : '');
+ $timezone = ((x($_POST, 'timezone')) ? Strings::escapeTags(trim($_POST['timezone'])) : '');
+ $language = ((x($_POST, 'language')) ? Strings::escapeTags(trim($_POST['language'])) : '');
- $defloc = ((x($_POST, 'defloc')) ? Strings::removeTags(trim($_POST['defloc'])) : '');
- $openid = ((x($_POST, 'openid_url')) ? Strings::removeTags(trim($_POST['openid_url'])) : '');
+ $defloc = ((x($_POST, 'defloc')) ? Strings::escapeTags(trim($_POST['defloc'])) : '');
+ $openid = ((x($_POST, 'openid_url')) ? Strings::escapeTags(trim($_POST['openid_url'])) : '');
$maxreq = ((x($_POST, 'maxreq')) ? intval($_POST['maxreq']) : 0);
$expire = ((x($_POST, 'expire')) ? intval($_POST['expire']) : 0);
$def_gid = ((x($_POST, 'group-selection')) ? intval($_POST['group-selection']) : 0);
$activity = ACTIVITY_FOLLOW;
- $item_id = (($a->argc > 1) ? Strings::removeTags(trim($a->argv[1])) : 0);
+ $item_id = (($a->argc > 1) ? Strings::escapeTags(trim($a->argv[1])) : 0);
$condition = ["`parent` = ? OR `parent-uri` = ? AND `parent` = `id`", $item_id, $item_id];
$item = Item::selectFirst([], $condition);
return;
}
- $term = Strings::removeTags(trim($_GET['term']));
+ $term = Strings::escapeTags(trim($_GET['term']));
// no commas allowed
$term = str_replace([',',' '],['','_'],$term);
return;
}
- $item_id = (($a->argc > 1) ? Strings::removeTags(trim($a->argv[1])) : 0);
+ $item_id = (($a->argc > 1) ? Strings::escapeTags(trim($a->argv[1])) : 0);
Logger::log('tagger: tag ' . $term . ' item ' . $item_id);
$tags = [];
foreach (defaults($_POST, 'tag', []) as $tag) {
- $tags[] = hex2bin(Strings::removeTags(trim($tag)));
+ $tags[] = hex2bin(Strings::escapeTags(trim($tag)));
}
$item_id = defaults($_POST,'item', 0);
}
if ($a->argc == 3) {
- update_tags($a->argv[1], [Strings::removeTags(trim(hex2bin($a->argv[2])))]);
+ update_tags($a->argv[1], [Strings::escapeTags(trim(hex2bin($a->argv[2])))]);
$a->internalRedirect($_SESSION['photo_return']);
}
}
$uid = local_user();
- $url = Strings::removeTags(trim(defaults($_REQUEST, 'url', '')));
+ $url = Strings::escapeTags(trim(defaults($_REQUEST, 'url', '')));
$condition = ["`uid` = ? AND (`rel` = ? OR `rel` = ?) AND (`nurl` = ? OR `alias` = ? OR `alias` = ?)",
$uid, Contact::SHARING, Contact::FRIEND, Strings::normaliseLink($url),
}
$uid = local_user();
- $url = Strings::removeTags(trim($_REQUEST['url']));
+ $url = Strings::escapeTags(trim($_REQUEST['url']));
$condition = ["`uid` = ? AND (`rel` = ? OR `rel` = ?) AND (`nurl` = ? OR `alias` = ? OR `alias` = ?)",
local_user(), Contact::SHARING, Contact::FRIEND, Strings::normaliseLink($url),
Logger::log("wall upload: starting new upload", Logger::DEBUG);
$r_json = (x($_GET, 'response') && $_GET['response'] == 'json');
- $album = (x($_GET, 'album') ? Strings::removeTags(trim($_GET['album'])) : '');
+ $album = (x($_GET, 'album') ? Strings::escapeTags(trim($_GET['album'])) : '');
if ($a->argc > 1) {
if (!x($_FILES, 'media')) {
return;
}
- $subject = ((x($_REQUEST,'subject')) ? Strings::removeTags(trim($_REQUEST['subject'])) : '');
+ $subject = ((x($_REQUEST,'subject')) ? Strings::escapeTags(trim($_REQUEST['subject'])) : '');
$body = ((x($_REQUEST,'body')) ? Strings::escapeHtml(trim($_REQUEST['body'])) : '');
- $recipient = (($a->argc > 1) ? Strings::removeTags($a->argv[1]) : '');
+ $recipient = (($a->argc > 1) ? Strings::escapeTags($a->argv[1]) : '');
if ((! $recipient) || (! $body)) {
return;
}
System::httpExit(404);
}
- $uri = urldecode(Strings::removeTags(trim($_GET['uri'])));
+ $uri = urldecode(Strings::escapeTags(trim($_GET['uri'])));
if (defaults($_SERVER, 'HTTP_ACCEPT', '') == 'application/jrd+json') {
$mode = 'json';
} else {
System::httpExit(404);
}
- $uri = urldecode(Strings::removeTags(trim($_GET['resource'])));
+ $uri = urldecode(Strings::escapeTags(trim($_GET['resource'])));
if (defaults($_SERVER, 'HTTP_ACCEPT', '') == 'application/xrd+xml') {
$mode = 'xml';
} else {
private static function guid($item, $notify)
{
if (!empty($item['guid'])) {
- return Strings::removeTags(trim($item['guid']));
+ return Strings::escapeTags(trim($item['guid']));
}
if ($notify) {
}
$item['guid'] = self::guid($item, $notify);
- $item['uri'] = Strings::removeTags(trim(defaults($item, 'uri', self::newURI($item['uid'], $item['guid']))));
+ $item['uri'] = Strings::escapeTags(trim(defaults($item, 'uri', self::newURI($item['uid'], $item['guid']))));
// Store URI data
$item['uri-id'] = ItemURI::insert(['uri' => $item['uri'], 'guid' => $item['guid']]);
$tab = false;
if (x($_GET, 'tab')) {
- $tab = Strings::removeTags(trim($_GET['tab']));
+ $tab = Strings::escapeTags(trim($_GET['tab']));
}
$url = System::baseUrl() . '/profile/' . $nickname;
$using_invites = Config::get('system', 'invitation_only');
$num_invites = Config::get('system', 'number_invites');
- $invite_id = !empty($data['invite_id']) ? Strings::removeTags(trim($data['invite_id'])) : '';
- $username = !empty($data['username']) ? Strings::removeTags(trim($data['username'])) : '';
- $nickname = !empty($data['nickname']) ? Strings::removeTags(trim($data['nickname'])) : '';
- $email = !empty($data['email']) ? Strings::removeTags(trim($data['email'])) : '';
- $openid_url = !empty($data['openid_url']) ? Strings::removeTags(trim($data['openid_url'])) : '';
- $photo = !empty($data['photo']) ? Strings::removeTags(trim($data['photo'])) : '';
+ $invite_id = !empty($data['invite_id']) ? Strings::escapeTags(trim($data['invite_id'])) : '';
+ $username = !empty($data['username']) ? Strings::escapeTags(trim($data['username'])) : '';
+ $nickname = !empty($data['nickname']) ? Strings::escapeTags(trim($data['nickname'])) : '';
+ $email = !empty($data['email']) ? Strings::escapeTags(trim($data['email'])) : '';
+ $openid_url = !empty($data['openid_url']) ? Strings::escapeTags(trim($data['openid_url'])) : '';
+ $photo = !empty($data['photo']) ? Strings::escapeTags(trim($data['photo'])) : '';
$password = !empty($data['password']) ? trim($data['password']) : '';
$password1 = !empty($data['password1']) ? trim($data['password1']) : '';
$confirm = !empty($data['confirm']) ? trim($data['confirm']) : '';
$blocked = !empty($data['blocked']) ? intval($data['blocked']) : 0;
$verified = !empty($data['verified']) ? intval($data['verified']) : 0;
- $language = !empty($data['language']) ? Strings::removeTags(trim($data['language'])) : 'en';
+ $language = !empty($data['language']) ? Strings::escapeTags(trim($data['language'])) : 'en';
$publish = !empty($data['profile_publish_reg']) && intval($data['profile_publish_reg']) ? 1 : 0;
$netpublish = strlen(Config::get('system', 'directory')) ? $publish : 0;
'$lbl_vis2' => L10n::t('Please choose the profile you would like to display to %s when viewing your profile securely.', $contact['name']),
'$lbl_info1' => $lbl_info1,
'$lbl_info2' => L10n::t('Their personal note'),
- '$reason' => trim(Strings::removeTags($contact['reason'])),
+ '$reason' => trim(Strings::escapeTags($contact['reason'])),
'$infedit' => L10n::t('Edit contact notes'),
'$common_link' => 'common/loc/' . local_user() . '/' . $contact['id'],
'$relation_text' => $relation_text,
$sql_extra .= sprintf(" AND `network` != '%s' ", Protocol::PHANTOM);
- $search = Strings::removeTags(trim(defaults($_GET, 'search', '')));
- $nets = Strings::removeTags(trim(defaults($_GET, 'nets' , '')));
+ $search = Strings::escapeTags(trim(defaults($_GET, 'search', '')));
+ $nets = Strings::escapeTags(trim(defaults($_GET, 'nets' , '')));
$tabs = [
[
break;
case self::SITE_SETTINGS:
- $dbhost = Strings::removeTags(trim(defaults($_POST, 'dbhost', Core\Installer::DEFAULT_HOST)));
- $dbuser = Strings::removeTags(trim(defaults($_POST, 'dbuser', '')));
- $dbpass = Strings::removeTags(trim(defaults($_POST, 'dbpass', '')));
- $dbdata = Strings::removeTags(trim(defaults($_POST, 'dbdata', '')));
+ $dbhost = Strings::escapeTags(trim(defaults($_POST, 'dbhost', Core\Installer::DEFAULT_HOST)));
+ $dbuser = Strings::escapeTags(trim(defaults($_POST, 'dbuser', '')));
+ $dbpass = Strings::escapeTags(trim(defaults($_POST, 'dbpass', '')));
+ $dbdata = Strings::escapeTags(trim(defaults($_POST, 'dbdata', '')));
// If we cannot connect to the database, return to the previous step
if (!self::$installer->checkDB($dbhost, $dbuser, $dbpass, $dbdata)) {
case self::FINISHED:
$urlpath = $a->getURLPath();
- $dbhost = Strings::removeTags(trim(defaults($_POST, 'dbhost', Core\Installer::DEFAULT_HOST)));
- $dbuser = Strings::removeTags(trim(defaults($_POST, 'dbuser', '')));
- $dbpass = Strings::removeTags(trim(defaults($_POST, 'dbpass', '')));
- $dbdata = Strings::removeTags(trim(defaults($_POST, 'dbdata', '')));
- $timezone = Strings::removeTags(trim(defaults($_POST, 'timezone', Core\Installer::DEFAULT_TZ)));
- $language = Strings::removeTags(trim(defaults($_POST, 'language', Core\Installer::DEFAULT_LANG)));
- $adminmail = Strings::removeTags(trim(defaults($_POST, 'adminmail', '')));
+ $dbhost = Strings::escapeTags(trim(defaults($_POST, 'dbhost', Core\Installer::DEFAULT_HOST)));
+ $dbuser = Strings::escapeTags(trim(defaults($_POST, 'dbuser', '')));
+ $dbpass = Strings::escapeTags(trim(defaults($_POST, 'dbpass', '')));
+ $dbdata = Strings::escapeTags(trim(defaults($_POST, 'dbdata', '')));
+ $timezone = Strings::escapeTags(trim(defaults($_POST, 'timezone', Core\Installer::DEFAULT_TZ)));
+ $language = Strings::escapeTags(trim(defaults($_POST, 'language', Core\Installer::DEFAULT_LANG)));
+ $adminmail = Strings::escapeTags(trim(defaults($_POST, 'adminmail', '')));
// If we cannot connect to the database, return to the Database config wizard
if (!self::$installer->checkDB($dbhost, $dbuser, $dbpass, $dbdata)) {
break;
case self::DATABASE_CONFIG:
- $dbhost = Strings::removeTags(trim(defaults($_POST, 'dbhost' , Core\Installer::DEFAULT_HOST)));
- $dbuser = Strings::removeTags(trim(defaults($_POST, 'dbuser' , '' )));
- $dbpass = Strings::removeTags(trim(defaults($_POST, 'dbpass' , '' )));
- $dbdata = Strings::removeTags(trim(defaults($_POST, 'dbdata' , '' )));
- $phpath = Strings::removeTags(trim(defaults($_POST, 'phpath' , '' )));
- $adminmail = Strings::removeTags(trim(defaults($_POST, 'adminmail', '' )));
+ $dbhost = Strings::escapeTags(trim(defaults($_POST, 'dbhost' , Core\Installer::DEFAULT_HOST)));
+ $dbuser = Strings::escapeTags(trim(defaults($_POST, 'dbuser' , '' )));
+ $dbpass = Strings::escapeTags(trim(defaults($_POST, 'dbpass' , '' )));
+ $dbdata = Strings::escapeTags(trim(defaults($_POST, 'dbdata' , '' )));
+ $phpath = Strings::escapeTags(trim(defaults($_POST, 'phpath' , '' )));
+ $adminmail = Strings::escapeTags(trim(defaults($_POST, 'adminmail', '' )));
$tpl = Renderer::getMarkupTemplate('install_db.tpl');
$output .= Renderer::replaceMacros($tpl, [
break;
case self::SITE_SETTINGS:
- $dbhost = Strings::removeTags(trim(defaults($_POST, 'dbhost', Core\Installer::DEFAULT_HOST)));
- $dbuser = Strings::removeTags(trim(defaults($_POST, 'dbuser', '' )));
- $dbpass = Strings::removeTags(trim(defaults($_POST, 'dbpass', '' )));
- $dbdata = Strings::removeTags(trim(defaults($_POST, 'dbdata', '' )));
- $phpath = Strings::removeTags(trim(defaults($_POST, 'phpath', '' )));
+ $dbhost = Strings::escapeTags(trim(defaults($_POST, 'dbhost', Core\Installer::DEFAULT_HOST)));
+ $dbuser = Strings::escapeTags(trim(defaults($_POST, 'dbuser', '' )));
+ $dbpass = Strings::escapeTags(trim(defaults($_POST, 'dbpass', '' )));
+ $dbdata = Strings::escapeTags(trim(defaults($_POST, 'dbdata', '' )));
+ $phpath = Strings::escapeTags(trim(defaults($_POST, 'phpath', '' )));
- $adminmail = Strings::removeTags(trim(defaults($_POST, 'adminmail', '')));
+ $adminmail = Strings::escapeTags(trim(defaults($_POST, 'adminmail', '')));
$timezone = defaults($_POST, 'timezone', Core\Installer::DEFAULT_TZ);
/* Installed langs */
);
}
} catch (Exception $e) {
- Logger::log('authenticate: failed login attempt: ' . Strings::removeTags($username) . ' from IP ' . $_SERVER['REMOTE_ADDR']);
+ Logger::log('authenticate: failed login attempt: ' . Strings::escapeTags($username) . ' from IP ' . $_SERVER['REMOTE_ADDR']);
info('Login failed. Please check your credentials.' . EOL);
$a->internalRedirect();
}
}
}
- $data["name"] = Strings::removeTags($data["name"]);
+ $data["name"] = Strings::escapeTags($data["name"]);
}
}
}
$item["body"] = XML::getFirstNodeValue($xpath, "dfrn:env/text()", $entry);
$item["body"] = str_replace([' ',"\t","\r","\n"], ['','','',''], $item["body"]);
// make sure nobody is trying to sneak some html tags by us
- $item["body"] = Strings::removeTags(Strings::base64UrlDecode($item["body"]));
+ $item["body"] = Strings::escapeTags(Strings::base64UrlDecode($item["body"]));
$item["body"] = BBCode::limitBodySize($item["body"]);
*/
private static function receiveAccountMigration(array $importer, $data)
{
- $old_handle = Strings::removeTags(XML::unescape($data->author));
- $new_handle = Strings::removeTags(XML::unescape($data->profile->author));
- $signature = Strings::removeTags(XML::unescape($data->signature));
+ $old_handle = Strings::escapeTags(XML::unescape($data->author));
+ $new_handle = Strings::escapeTags(XML::unescape($data->profile->author));
+ $signature = Strings::escapeTags(XML::unescape($data->signature));
$contact = self::contactByHandle($importer["uid"], $old_handle);
if (!$contact) {
*/
private static function receiveAccountDeletion($data)
{
- $author = Strings::removeTags(XML::unescape($data->author));
+ $author = Strings::escapeTags(XML::unescape($data->author));
$contacts = DBA::select('contact', ['id'], ['addr' => $author]);
while ($contact = DBA::fetch($contacts)) {
*/
private static function receiveComment(array $importer, $sender, $data, $xml)
{
- $author = Strings::removeTags(XML::unescape($data->author));
- $guid = Strings::removeTags(XML::unescape($data->guid));
- $parent_guid = Strings::removeTags(XML::unescape($data->parent_guid));
+ $author = Strings::escapeTags(XML::unescape($data->author));
+ $guid = Strings::escapeTags(XML::unescape($data->guid));
+ $parent_guid = Strings::escapeTags(XML::unescape($data->parent_guid));
$text = XML::unescape($data->text);
if (isset($data->created_at)) {
- $created_at = DateTimeFormat::utc(Strings::removeTags(XML::unescape($data->created_at)));
+ $created_at = DateTimeFormat::utc(Strings::escapeTags(XML::unescape($data->created_at)));
} else {
$created_at = DateTimeFormat::utcNow();
}
if (isset($data->thread_parent_guid)) {
- $thread_parent_guid = Strings::removeTags(XML::unescape($data->thread_parent_guid));
+ $thread_parent_guid = Strings::escapeTags(XML::unescape($data->thread_parent_guid));
$thr_uri = self::getUriFromGuid("", $thread_parent_guid, true);
} else {
$thr_uri = "";
*/
private static function receiveConversationMessage(array $importer, array $contact, $data, $msg, $mesg, $conversation)
{
- $author = Strings::removeTags(XML::unescape($data->author));
- $guid = Strings::removeTags(XML::unescape($data->guid));
- $subject = Strings::removeTags(XML::unescape($data->subject));
+ $author = Strings::escapeTags(XML::unescape($data->author));
+ $guid = Strings::escapeTags(XML::unescape($data->guid));
+ $subject = Strings::escapeTags(XML::unescape($data->subject));
// "diaspora_handle" is the element name from the old version
// "author" is the element name from the new version
if ($mesg->author) {
- $msg_author = Strings::removeTags(XML::unescape($mesg->author));
+ $msg_author = Strings::escapeTags(XML::unescape($mesg->author));
} elseif ($mesg->diaspora_handle) {
- $msg_author = Strings::removeTags(XML::unescape($mesg->diaspora_handle));
+ $msg_author = Strings::escapeTags(XML::unescape($mesg->diaspora_handle));
} else {
return false;
}
- $msg_guid = Strings::removeTags(XML::unescape($mesg->guid));
- $msg_conversation_guid = Strings::removeTags(XML::unescape($mesg->conversation_guid));
+ $msg_guid = Strings::escapeTags(XML::unescape($mesg->guid));
+ $msg_conversation_guid = Strings::escapeTags(XML::unescape($mesg->conversation_guid));
$msg_text = XML::unescape($mesg->text);
- $msg_created_at = DateTimeFormat::utc(Strings::removeTags(XML::unescape($mesg->created_at)));
+ $msg_created_at = DateTimeFormat::utc(Strings::escapeTags(XML::unescape($mesg->created_at)));
if ($msg_conversation_guid != $guid) {
Logger::log("message conversation guid does not belong to the current conversation.");
*/
private static function receiveConversation(array $importer, $msg, $data)
{
- $author = Strings::removeTags(XML::unescape($data->author));
- $guid = Strings::removeTags(XML::unescape($data->guid));
- $subject = Strings::removeTags(XML::unescape($data->subject));
- $created_at = DateTimeFormat::utc(Strings::removeTags(XML::unescape($data->created_at)));
- $participants = Strings::removeTags(XML::unescape($data->participants));
+ $author = Strings::escapeTags(XML::unescape($data->author));
+ $guid = Strings::escapeTags(XML::unescape($data->guid));
+ $subject = Strings::escapeTags(XML::unescape($data->subject));
+ $created_at = DateTimeFormat::utc(Strings::escapeTags(XML::unescape($data->created_at)));
+ $participants = Strings::escapeTags(XML::unescape($data->participants));
$messages = $data->message;
*/
private static function receiveLike(array $importer, $sender, $data)
{
- $author = Strings::removeTags(XML::unescape($data->author));
- $guid = Strings::removeTags(XML::unescape($data->guid));
- $parent_guid = Strings::removeTags(XML::unescape($data->parent_guid));
- $parent_type = Strings::removeTags(XML::unescape($data->parent_type));
- $positive = Strings::removeTags(XML::unescape($data->positive));
+ $author = Strings::escapeTags(XML::unescape($data->author));
+ $guid = Strings::escapeTags(XML::unescape($data->guid));
+ $parent_guid = Strings::escapeTags(XML::unescape($data->parent_guid));
+ $parent_type = Strings::escapeTags(XML::unescape($data->parent_type));
+ $positive = Strings::escapeTags(XML::unescape($data->positive));
// likes on comments aren't supported by Diaspora - only on posts
// But maybe this will be supported in the future, so we will accept it.
*/
private static function receiveMessage(array $importer, $data)
{
- $author = Strings::removeTags(XML::unescape($data->author));
- $guid = Strings::removeTags(XML::unescape($data->guid));
- $conversation_guid = Strings::removeTags(XML::unescape($data->conversation_guid));
+ $author = Strings::escapeTags(XML::unescape($data->author));
+ $guid = Strings::escapeTags(XML::unescape($data->guid));
+ $conversation_guid = Strings::escapeTags(XML::unescape($data->conversation_guid));
$text = XML::unescape($data->text);
- $created_at = DateTimeFormat::utc(Strings::removeTags(XML::unescape($data->created_at)));
+ $created_at = DateTimeFormat::utc(Strings::escapeTags(XML::unescape($data->created_at)));
$contact = self::allowedContactByHandle($importer, $author, true);
if (!$contact) {
*/
private static function receiveParticipation(array $importer, $data)
{
- $author = strtolower(Strings::removeTags(XML::unescape($data->author)));
- $parent_guid = Strings::removeTags(XML::unescape($data->parent_guid));
+ $author = strtolower(Strings::escapeTags(XML::unescape($data->author)));
+ $parent_guid = Strings::escapeTags(XML::unescape($data->parent_guid));
$contact_id = Contact::getIdForURL($author);
if (!$contact_id) {
*/
private static function receiveProfile(array $importer, $data)
{
- $author = strtolower(Strings::removeTags(XML::unescape($data->author)));
+ $author = strtolower(Strings::escapeTags(XML::unescape($data->author)));
$contact = self::contactByHandle($importer["uid"], $author);
if (!$contact) {
*/
private static function receiveReshare(array $importer, $data, $xml)
{
- $author = Strings::removeTags(XML::unescape($data->author));
- $guid = Strings::removeTags(XML::unescape($data->guid));
- $created_at = DateTimeFormat::utc(Strings::removeTags(XML::unescape($data->created_at)));
- $root_author = Strings::removeTags(XML::unescape($data->root_author));
- $root_guid = Strings::removeTags(XML::unescape($data->root_guid));
+ $author = Strings::escapeTags(XML::unescape($data->author));
+ $guid = Strings::escapeTags(XML::unescape($data->guid));
+ $created_at = DateTimeFormat::utc(Strings::escapeTags(XML::unescape($data->created_at)));
+ $root_author = Strings::escapeTags(XML::unescape($data->root_author));
+ $root_guid = Strings::escapeTags(XML::unescape($data->root_guid));
/// @todo handle unprocessed property "provider_display_name"
- $public = Strings::removeTags(XML::unescape($data->public));
+ $public = Strings::escapeTags(XML::unescape($data->public));
$contact = self::allowedContactByHandle($importer, $author, false);
if (!$contact) {
*/
private static function itemRetraction(array $importer, array $contact, $data)
{
- $author = Strings::removeTags(XML::unescape($data->author));
- $target_guid = Strings::removeTags(XML::unescape($data->target_guid));
- $target_type = Strings::removeTags(XML::unescape($data->target_type));
+ $author = Strings::escapeTags(XML::unescape($data->author));
+ $target_guid = Strings::escapeTags(XML::unescape($data->target_guid));
+ $target_type = Strings::escapeTags(XML::unescape($data->target_type));
$person = self::personByHandle($author);
if (!is_array($person)) {
*/
private static function receiveRetraction(array $importer, $sender, $data)
{
- $target_type = Strings::removeTags(XML::unescape($data->target_type));
+ $target_type = Strings::escapeTags(XML::unescape($data->target_type));
$contact = self::contactByHandle($importer["uid"], $sender);
if (!$contact && (in_array($target_type, ["Contact", "Person"]))) {
*/
private static function receiveStatusMessage(array $importer, SimpleXMLElement $data, $xml)
{
- $author = Strings::removeTags(XML::unescape($data->author));
- $guid = Strings::removeTags(XML::unescape($data->guid));
- $created_at = DateTimeFormat::utc(Strings::removeTags(XML::unescape($data->created_at)));
- $public = Strings::removeTags(XML::unescape($data->public));
+ $author = Strings::escapeTags(XML::unescape($data->author));
+ $guid = Strings::escapeTags(XML::unescape($data->guid));
+ $created_at = DateTimeFormat::utc(Strings::escapeTags(XML::unescape($data->created_at)));
+ $public = Strings::escapeTags(XML::unescape($data->public));
$text = XML::unescape($data->text);
- $provider_display_name = Strings::removeTags(XML::unescape($data->provider_display_name));
+ $provider_display_name = Strings::escapeTags(XML::unescape($data->provider_display_name));
$contact = self::allowedContactByHandle($importer, $author, false);
if (!$contact) {
$address = [];
if ($data->location) {
foreach ($data->location->children() as $fieldname => $data) {
- $address[$fieldname] = Strings::removeTags(XML::unescape($data));
+ $address[$fieldname] = Strings::escapeTags(XML::unescape($data));
}
}
}
/**
- * This is our primary input filter.
- *
- * The high bit hack only involved some old IE browser, forget which (IE5/Mac?)
- * that had an XSS attack vector due to stripping the high-bit on an 8-bit character
- * after cleansing, and angle chars with the high bit set could get through as markup.
- *
- * This is now disabled because it was interfering with some legitimate unicode sequences
- * and hopefully there aren't a lot of those browsers left.
+ * @brief This is our primary input filter.
*
* Use this on any text input where angle chars are not valid or permitted
* They will be replaced with safer brackets. This may be filtered further
* @param string $string Input string
* @return string Filtered string
*/
- public static function removeTags($string)
+ public static function escapeTags($string)
{
return str_replace(["<", ">"], ['[', ']'], $string);
}
$datarray['title'] .= $subpart->text;
}
}
- $datarray['title'] = Strings::removeTags(trim($datarray['title']));
+ $datarray['title'] = Strings::escapeTags(trim($datarray['title']));
- //$datarray['title'] = Strings::removeTags(trim($meta->subject));
+ //$datarray['title'] = Strings::escapeTags(trim($meta->subject));
$datarray['created'] = DateTimeFormat::utc($meta->date);
// Is it a reply?
{
$invalidstring='<submit type="button" onclick="alert(\'failed!\');" />';
- $validstring = Strings::removeTags($invalidstring);
+ $validstring = Strings::escapeTags($invalidstring);
$escapedString = Strings::escapeHtml($invalidstring);
$this->assertEquals('[submit type="button" onclick="alert(\'failed!\');" /]', $validstring);
*/
function frio_acl_lookup(App $a, &$results)
{
- $nets = x($_GET, 'nets') ? Strings::removeTags(trim($_GET['nets'])) : '';
+ $nets = x($_GET, 'nets') ? Strings::escapeTags(trim($_GET['nets'])) : '';
// we introduce a new search type, r should do the same query like it's
// done in /src/Module/Contact.php for connections
projects / friendica.git / commitdiff