oss/wallabag
oss/wallabag
1
0
Fork 0
mirror of https://github.com/wallabag/wallabag.git synced 2025-08-01 17:38:38 +00:00
Code Wiki Activity

[fix] content is now cleaned by HTML purifier from prevent XSS attack

Browse source
This commit is contained in:
Nicolas Lœuillet 2014-02-21 15:44:13 +01:00
parent d4949327ef
commit 1570a65381
2 changed files with 8 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

6
inc/poche/Poche.class.php
View file

@ -427,6 +427,12 @@ class Poche
$title = ($content['rss']['channel']['item']['title'] != '') ? $content['rss']['channel']['item']['title'] : _('Untitled');
$body = $content['rss']['channel']['item']['description'];
// clean content from prevent xss attack
$config = HTMLPurifier_Config::createDefault();
$purifier = new HTMLPurifier($config);
$title = $purifier->purify($title);
$body = $purifier->purify($body);
//search for possible duplicate if not in import mode
if (!$import) {
$duplicate = $this->store->retrieveOneByURL($url->getUrl(), $this->user->getId());