// It isn't certain at this point whether our content is plaintext or html and we'd be foolish to trust
// the content type. Our own network only emits text normally, though it might have been converted to
- // html if we used a pubsubhubbub transport. But if we see even one html open tag in our text, we will
+ // html if we used a pubsubhubbub transport. But if we see even one html tag in our text, we will
// have to assume it is all html and needs to be purified.
// It doesn't matter all that much security wise - because before this content is used anywhere, we are
// html.
- if(strpos($res['body'],'<')) {
+ if((strpos($res['body'],'<')) || (strpos($res['body'],'>'))) {
$res['body'] = preg_replace('#<object[^>]+>.+?' . 'http://www.youtube.com/((?:v|cp)/[A-Za-z0-9\-_=]+).+?</object>#s',
'[youtube]$1[/youtube]', $res['body']);
$purifier = new HTMLPurifier($config);
$res['body'] = $purifier->purify($res['body']);
- }
+ $res['body'] = html2bbcode($res['body']);
+ }
+ else
+ $res['body'] = escape_tags($res['body']);
- $res['body'] = html2bbcode($res['body']);
-
$allow = $item->get_item_tags(NAMESPACE_DFRN,'comment-allow');
if($allow && $allow[0]['data'] == 1)
$body = $rawobj[0]['child'][SIMPLEPIE_NAMESPACE_ATOM_10]['summary'][0]['data'];
// preserve a copy of the original body content in case we later need to parse out any microformat information, e.g. events
$res['object'] .= '<orig>' . xmlify($body) . '</orig>' . "\n";
- if(strpos($body,'<')) {
+ if((strpos($body,'<')) || (strpos($body,'>'))) {
$body = preg_replace('#<object[^>]+>.+?' . 'http://www.youtube.com/((?:v|cp)/[A-Za-z0-9\-_=]+).+?</object>#s',
'[youtube]$1[/youtube]', $body);
$purifier = new HTMLPurifier($config);
$body = $purifier->purify($body);
+ $body = html2bbcode($body);
}
+ else
+ $body = escape_tags($body);
- $body = html2bbcode($body);
$res['object'] .= '<content>' . $body . '</content>' . "\n";
}
$body = $rawobj[0]['child'][SIMPLEPIE_NAMESPACE_ATOM_10]['summary'][0]['data'];
// preserve a copy of the original body content in case we later need to parse out any microformat information, e.g. events
$res['object'] .= '<orig>' . xmlify($body) . '</orig>' . "\n";
- if(strpos($body,'<')) {
+ if((strpos($body,'<')) || (strpos($body,'>'))) {
$body = preg_replace('#<object[^>]+>.+?' . 'http://www.youtube.com/((?:v|cp)/[A-Za-z0-9\-_=]+).+?</object>#s',
'[youtube]$1[/youtube]', $body);
$purifier = new HTMLPurifier($config);
$body = $purifier->purify($body);
+ $body = html2bbcode($body);
}
+ else
+ $body = escape_tags($body);
- $body = html2bbcode($body);
$res['target'] .= '<content>' . $body . '</content>' . "\n";
}