From: Nicolas Lœuillet <nicolas.loeuillet@gmail.com>
Date: Fri, 21 Feb 2014 14:44:13 +0000 (+0100)
Subject: [fix] content is now cleaned by HTML purifier from prevent XSS attack
X-Git-Tag: 1.5.2^2~1
X-Git-Url: https://git.immae.eu/?a=commitdiff_plain;h=1570a65381372fca86f5a16f1ec94d59af4babfa;p=github%2Fwallabag%2Fwallabag.git

[fix] content is now cleaned by HTML purifier from prevent XSS attack
---

diff --git a/inc/poche/Poche.class.php b/inc/poche/Poche.class.php
index e852c7e9..34f2ff5a 100755
--- a/inc/poche/Poche.class.php
+++ b/inc/poche/Poche.class.php
@@ -427,6 +427,12 @@ class Poche
                 $title = ($content['rss']['channel']['item']['title'] != '') ? $content['rss']['channel']['item']['title'] : _('Untitled');
                 $body = $content['rss']['channel']['item']['description'];
 
+                // clean content from prevent xss attack
+                $config = HTMLPurifier_Config::createDefault();
+                $purifier = new HTMLPurifier($config);
+                $title = $purifier->purify($title);
+                $body = $purifier->purify($body);
+
                 //search for possible duplicate if not in import mode
                 if (!$import) {
                     $duplicate = $this->store->retrieveOneByURL($url->getUrl(), $this->user->getId());
diff --git a/inc/poche/global.inc.php b/inc/poche/global.inc.php
index e2beade1..d22b0588 100644
--- a/inc/poche/global.inc.php
+++ b/inc/poche/global.inc.php
@@ -29,6 +29,8 @@ require_once INCLUDES . '/3rdparty/libraries/feedwriter/FeedItem.php';
 require_once INCLUDES . '/3rdparty/libraries/feedwriter/FeedWriter.php';
 require_once INCLUDES . '/3rdparty/FlattrItem.class.php';
 
+require_once INCLUDES . '/3rdparty/htmlpurifier/HTMLPurifier.auto.php';
+
 # Composer its autoloader for automatically loading Twig
 if (! file_exists(ROOT . '/vendor/autoload.php')) {
     Poche::$canRenderTemplates = false;