From c6ae883ad274915be89890cbb96c53497fc3f698 Mon Sep 17 00:00:00 2001
From: Mikael Nordfeldth <mmn@hethane.se>
Date: Sat, 30 Jan 2016 00:00:37 +0100
Subject: [PATCH] Don't trust local HTML either

If we reallyreally want to include <img> or <script> or whatever then we
have to do that after Notice::saveActivity sets ->rendered.
---
 classes/Notice.php | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/classes/Notice.php b/classes/Notice.php
index bbf543e5a6..ccd398003d 100644
--- a/classes/Notice.php
+++ b/classes/Notice.php
@@ -848,13 +848,12 @@ class Notice extends Managed_DataObject
         $stored->url = $url;
         $stored->verb = $act->verb;
 
-        // Notice content. We trust local users to provide HTML we like, but of course not remote users.
-        // FIXME: What about local users importing feeds? Mirror functions must filter out bad HTML first...
         $content = $act->content ?: $act->summary;
         if (is_null($content) && !is_null($actobj)) {
             $content = $actobj->content ?: $actobj->summary;
         }
-        $stored->rendered = $actor->isLocal() ? $content : common_purify($content);
+        // Strip out any bad HTML
+        $stored->rendered = common_purify($content);
         // yeah, just don't use getRendered() here since it's not inserted yet ;)
         $stored->content = common_strip_html($stored->rendered);
         if (trim($stored->content) === '') {
-- 
2.39.5