Merge pull request #491 from ArthurHoaro/markdown-escape2

Markdown: don't escape content + sanitize sensible tags

diff --combined application/Utils.php
index 91e28a68fba38de7e7992c63b989bbc9bac2c1ff,868946df756d98c1a726350cd524556e48b4a667..3d819716316e78f1a884cb662723668a1529560d
--- 1/application/Utils.php
--- 2/application/Utils.php
+++ b/application/Utils.php
@@@ -62,13 -62,29 +62,29 @@@ function endsWith($haystack, $needle, $
  }
  
  /**
-  * htmlspecialchars wrapper
+  * Htmlspecialchars wrapper
+  *
+  * @param string $str the string to escape.
+  *
+  * @return string escaped.
   */
  function escape($str)
  {
      return htmlspecialchars($str, ENT_COMPAT, 'UTF-8', false);
  }
  
+ /**
+  * Reverse the escape function.
+  *
+  * @param string $str the string to unescape.
+  *
+  * @return string unescaped string.
+  */
+ function unescape($str)
+ {
+     return htmlspecialchars_decode($str);
+ }
+ 
  /**
   * Link sanitization before templating
   */
@@@ -213,28 -229,3 +229,28 @@@ function space2nbsp($text
  function format_description($description, $redirector) {
      return nl2br(space2nbsp(text2clickable($description, $redirector)));
  }
 +
 +/**
 + * Sniff browser language to set the locale automatically.
 + * Note that is may not work on your server if the corresponding locale is not installed.
 + *
 + * @param string $headerLocale Locale send in HTTP headers (e.g. "fr,fr-fr;q=0.8,en;q=0.5,en-us;q=0.3").
 + **/
 +function autoLocale($headerLocale)
 +{
 +    // Default if browser does not send HTTP_ACCEPT_LANGUAGE
 +    $attempts = array('en_US');
 +    if (isset($headerLocale)) {
 +        // (It's a bit crude, but it works very well. Preferred language is always presented first.)
 +        if (preg_match('/([a-z]{2})-?([a-z]{2})?/i', $headerLocale, $matches)) {
 +            $loc = $matches[1] . (!empty($matches[2]) ? '_' . strtoupper($matches[2]) : '');
 +            $attempts = array(
 +                $loc.'.UTF-8', $loc, str_replace('_', '-', $loc).'.UTF-8', str_replace('_', '-', $loc),
 +                $loc . '_' . strtoupper($loc).'.UTF-8', $loc . '_' . strtoupper($loc),
 +                $loc . '_' . $loc.'.UTF-8', $loc . '_' . $loc, $loc . '-' . strtoupper($loc).'.UTF-8',
 +                $loc . '-' . strtoupper($loc), $loc . '-' . $loc.'.UTF-8', $loc . '-' . $loc
 +            );
 +        }
 +    }
 +    setlocale(LC_ALL, $attempts);
 +}