[fix] content is now cleaned by HTML purifier from prevent XSS attack

diff --git a/inc/poche/Poche.class.php b/inc/poche/Poche.class.php
index e852c7e9f8de58565849c78360e7e6b98fc47344..34f2ff5ae9c139c6390c2ccb2eb8b1814a5c935f 100755 (executable)
--- a/inc/poche/Poche.class.php
+++ b/inc/poche/Poche.class.php
@@ -427,6 +427,12 @@ class Poche
                 $title = ($content['rss']['channel']['item']['title'] != '') ? $content['rss']['channel']['item']['title'] : _('Untitled');
                 $body = $content['rss']['channel']['item']['description'];
 
+                // clean content from prevent xss attack
+                $config = HTMLPurifier_Config::createDefault();
+                $purifier = new HTMLPurifier($config);
+                $title = $purifier->purify($title);
+                $body = $purifier->purify($body);
+
                 //search for possible duplicate if not in import mode
                 if (!$import) {
                     $duplicate = $this->store->retrieveOneByURL($url->getUrl(), $this->user->getId());

diff --git a/inc/poche/global.inc.php b/inc/poche/global.inc.php
index e2beade1f2c3904c35daef0fba3f18d5c3a53055..d22b05887e8ea85f86017a763d4ecaeef2a7d940 100644 (file)
--- a/inc/poche/global.inc.php
+++ b/inc/poche/global.inc.php
@@ -29,6 +29,8 @@ require_once INCLUDES . '/3rdparty/libraries/feedwriter/FeedItem.php';
 require_once INCLUDES . '/3rdparty/libraries/feedwriter/FeedWriter.php';
 require_once INCLUDES . '/3rdparty/FlattrItem.class.php';
 
+require_once INCLUDES . '/3rdparty/htmlpurifier/HTMLPurifier.auto.php';
+
 # Composer its autoloader for automatically loading Twig
 if (! file_exists(ROOT . '/vendor/autoload.php')) {
     Poche::$canRenderTemplates = false;