Markdown: don't escape content + sanitize sensible tags

Instead of trying to fix broken content for Markdown parsing, parse it unescaped, then sanatize sensible tags such as scripts, etc.

1 files changed, 17 insertions, 1 deletions

diff --git a/application/Utils.php b/application/Utils.php
index 10d60698..868946df 100644
--- a/application/Utils.php
+++ b/application/Utils.php
@@ -62,7 +62,11 @@ function endsWith($haystack, $needle, $case=true)
 }
 
 /**
- * htmlspecialchars wrapper
+ * Htmlspecialchars wrapper
+ *
+ * @param string $str the string to escape.
+ *
+ * @return string escaped.
  */
 function escape($str)
 {
@@ -70,6 +74,18 @@ function escape($str)
 }
 
 /**
+ * Reverse the escape function.
+ *
+ * @param string $str the string to unescape.
+ *
+ * @return string unescaped string.
+ */
+function unescape($str)
+{
+    return htmlspecialchars_decode($str);
+}
+
+/**
  * Link sanitization before templating
  */
 function sanitizeLink(&$link)