pierre/wallabag
1
0
Fork 0
forked from wallabag/wallabag
Code Issues Pull Requests Packages Projects Releases 1 Wiki Activity

[fix] content is now cleaned by HTML purifier from prevent XSS attack

Browse Source
This commit is contained in:
Nicolas Lœuillet
2014-02-21 15:44:13 +01:00
parent d4949327ef
commit 1570a65381
2 changed files with 8 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
inc/poche/Poche.class.php
View File

@ -427,6 +427,12 @@ class Poche
$title = ($content['rss']['channel']['item']['title'] != '') ? $content['rss']['channel']['item']['title'] : _('Untitled');
$body = $content['rss']['channel']['item']['description'];
// clean content from prevent xss attack
$config = HTMLPurifier_Config::createDefault();
$purifier = new HTMLPurifier($config);
$title = $purifier->purify($title);
$body = $purifier->purify($body);
//search for possible duplicate if not in import mode
if (!$import) {
$duplicate = $this->store->retrieveOneByURL($url->getUrl(), $this->user->getId());