diff options
author | Steven Wittens <steven@10.no-reply.drupal.org> | 2006-04-07 15:32:17 +0000 |
---|---|---|
committer | Steven Wittens <steven@10.no-reply.drupal.org> | 2006-04-07 15:32:17 +0000 |
commit | 9794b5538e2baee159d360c9f7125f178591659a (patch) | |
tree | c73a591ff817a3466ddea66391c664768022aa29 /modules | |
parent | 77dc67ec9218b9eb6dd8a88f8d81d15312ce3d3c (diff) | |
download | brdo-9794b5538e2baee159d360c9f7125f178591659a.tar.gz brdo-9794b5538e2baee159d360c9f7125f178591659a.tar.bz2 |
- #55898: Generic, permissive admin XSS/HTML filtering for mission/footer/...
- Clean up some raw output
Diffstat (limited to 'modules')
-rw-r--r-- | modules/contact.module | 2 | ||||
-rw-r--r-- | modules/contact/contact.module | 2 | ||||
-rw-r--r-- | modules/filter.module | 14 | ||||
-rw-r--r-- | modules/filter/filter.module | 14 | ||||
-rw-r--r-- | modules/forum.module | 4 | ||||
-rw-r--r-- | modules/forum/forum.module | 4 | ||||
-rw-r--r-- | modules/node.module | 2 | ||||
-rw-r--r-- | modules/node/node.module | 2 | ||||
-rw-r--r-- | modules/taxonomy.module | 2 | ||||
-rw-r--r-- | modules/taxonomy/taxonomy.module | 2 |
10 files changed, 38 insertions, 10 deletions
diff --git a/modules/contact.module b/modules/contact.module index 076d284b0..c9ddcca14 100644 --- a/modules/contact.module +++ b/modules/contact.module @@ -430,7 +430,7 @@ function contact_mail_page() { if (count($categories) > 0) { $form['#token'] = $user->name . $user->mail; - $form['contact_information'] = array('#value' => variable_get('contact_form_information', t('You can leave us a message using the contact form below.'))); + $form['contact_information'] = array('#value' => filter_xss_admin(variable_get('contact_form_information', t('You can leave us a message using the contact form below.')))); $form['name'] = array('#type' => 'textfield', '#title' => t('Your name'), '#maxlength' => 255, diff --git a/modules/contact/contact.module b/modules/contact/contact.module index 076d284b0..c9ddcca14 100644 --- a/modules/contact/contact.module +++ b/modules/contact/contact.module @@ -430,7 +430,7 @@ function contact_mail_page() { if (count($categories) > 0) { $form['#token'] = $user->name . $user->mail; - $form['contact_information'] = array('#value' => variable_get('contact_form_information', t('You can leave us a message using the contact form below.'))); + $form['contact_information'] = array('#value' => filter_xss_admin(variable_get('contact_form_information', t('You can leave us a message using the contact form below.')))); $form['name'] = array('#type' => 'textfield', '#title' => t('Your name'), '#maxlength' => 255, diff --git a/modules/filter.module b/modules/filter.module index 2a4dc3cd3..fe2e77e42 100644 --- a/modules/filter.module +++ b/modules/filter.module @@ -1098,6 +1098,20 @@ function _filter_autop($text) { } /** + * Very permissive XSS/HTML filter for admin-only use. + * + * Use only for fields where it is impractical to use the + * whole filter system, but where some (mainly inline) mark-up + * is desired (so check_plain() is not acceptable). + * + * Allows all tags that can be used inside an HTML body, save + * for scripts and styles. + */ +function filter_xss_admin($string) { + return filter_xss($string, array('a', 'abbr', 'acronym', 'address', 'b', 'bdo', 'big', 'blockquote', 'br', 'caption', 'cite', 'code', 'col', 'colgroup', 'dd', 'del', 'dfn', 'div', 'dl', 'dt', 'em', 'h', 'h', 'h', 'h', 'h', 'h', 'hr', 'i', 'img', 'ins', 'kbd', 'li', 'object', 'ol', 'p', 'param', 'pre', 'q', 'samp', 'small', 'span', 'strong', 'sub', 'sup', 'table', 'tbody', 'td', 'tfoot', 'th', 'thead', 'tr', 'tt', 'ul', 'var')); +} + +/** * Filters XSS. Based on kses by Ulf Harnhammar, see * http://sourceforge.net/projects/kses * diff --git a/modules/filter/filter.module b/modules/filter/filter.module index 2a4dc3cd3..fe2e77e42 100644 --- a/modules/filter/filter.module +++ b/modules/filter/filter.module @@ -1098,6 +1098,20 @@ function _filter_autop($text) { } /** + * Very permissive XSS/HTML filter for admin-only use. + * + * Use only for fields where it is impractical to use the + * whole filter system, but where some (mainly inline) mark-up + * is desired (so check_plain() is not acceptable). + * + * Allows all tags that can be used inside an HTML body, save + * for scripts and styles. + */ +function filter_xss_admin($string) { + return filter_xss($string, array('a', 'abbr', 'acronym', 'address', 'b', 'bdo', 'big', 'blockquote', 'br', 'caption', 'cite', 'code', 'col', 'colgroup', 'dd', 'del', 'dfn', 'div', 'dl', 'dt', 'em', 'h', 'h', 'h', 'h', 'h', 'h', 'hr', 'i', 'img', 'ins', 'kbd', 'li', 'object', 'ol', 'p', 'param', 'pre', 'q', 'samp', 'small', 'span', 'strong', 'sub', 'sup', 'table', 'tbody', 'td', 'tfoot', 'th', 'thead', 'tr', 'tt', 'ul', 'var')); +} + +/** * Filters XSS. Based on kses by Ulf Harnhammar, see * http://sourceforge.net/projects/kses * diff --git a/modules/forum.module b/modules/forum.module index e3fcb0216..756b52e35 100644 --- a/modules/forum.module +++ b/modules/forum.module @@ -935,7 +935,7 @@ function theme_forum_list($forums, $parents, $tid) { $description .= ' <div class="name">'. l($forum->name, "forum/$forum->tid") ."</div>\n"; if ($forum->description) { - $description .= ' <div class="description">'. check_plain($forum->description) ."</div>\n"; + $description .= ' <div class="description">'. filter_xss_admin($forum->description) ."</div>\n"; } $description .= "</div>\n"; @@ -952,7 +952,7 @@ function theme_forum_list($forums, $parents, $tid) { $description .= ' <div class="name">'. l($forum->name, "forum/$forum->tid") ."</div>\n"; if ($forum->description) { - $description .= ' <div class="description">'. check_plain($forum->description) ."</div>\n"; + $description .= ' <div class="description">'. filter_xss_admin($forum->description) ."</div>\n"; } $description .= "</div>\n"; diff --git a/modules/forum/forum.module b/modules/forum/forum.module index e3fcb0216..756b52e35 100644 --- a/modules/forum/forum.module +++ b/modules/forum/forum.module @@ -935,7 +935,7 @@ function theme_forum_list($forums, $parents, $tid) { $description .= ' <div class="name">'. l($forum->name, "forum/$forum->tid") ."</div>\n"; if ($forum->description) { - $description .= ' <div class="description">'. check_plain($forum->description) ."</div>\n"; + $description .= ' <div class="description">'. filter_xss_admin($forum->description) ."</div>\n"; } $description .= "</div>\n"; @@ -952,7 +952,7 @@ function theme_forum_list($forums, $parents, $tid) { $description .= ' <div class="name">'. l($forum->name, "forum/$forum->tid") ."</div>\n"; if ($forum->description) { - $description .= ' <div class="description">'. check_plain($forum->description) ."</div>\n"; + $description .= ' <div class="description">'. filter_xss_admin($forum->description) ."</div>\n"; } $description .= "</div>\n"; diff --git a/modules/node.module b/modules/node.module index 32083046c..a48598fcc 100644 --- a/modules/node.module +++ b/modules/node.module @@ -48,7 +48,7 @@ function node_help($section) { } if (arg(0) == 'node' && arg(1) == 'add' && $type = arg(2)) { - return variable_get($type .'_help', ''); + return filter_xss_admin(variable_get($type .'_help', '')); } } diff --git a/modules/node/node.module b/modules/node/node.module index 32083046c..a48598fcc 100644 --- a/modules/node/node.module +++ b/modules/node/node.module @@ -48,7 +48,7 @@ function node_help($section) { } if (arg(0) == 'node' && arg(1) == 'add' && $type = arg(2)) { - return variable_get($type .'_help', ''); + return filter_xss_admin(variable_get($type .'_help', '')); } } diff --git a/modules/taxonomy.module b/modules/taxonomy.module index 69fe701ab..35bd0e613 100644 --- a/modules/taxonomy.module +++ b/modules/taxonomy.module @@ -29,7 +29,7 @@ function taxonomy_link($type, $node = NULL) { $links = array(); if (array_key_exists('taxonomy', $node)) { foreach ($node->taxonomy as $term) { - $links[] = l($term->name, taxonomy_term_path($term), array('rel' => 'tag', 'title' => $term->description)); + $links[] = l($term->name, taxonomy_term_path($term), array('rel' => 'tag', 'title' => strip_tags($term->description))); } } return $links; diff --git a/modules/taxonomy/taxonomy.module b/modules/taxonomy/taxonomy.module index 69fe701ab..35bd0e613 100644 --- a/modules/taxonomy/taxonomy.module +++ b/modules/taxonomy/taxonomy.module @@ -29,7 +29,7 @@ function taxonomy_link($type, $node = NULL) { $links = array(); if (array_key_exists('taxonomy', $node)) { foreach ($node->taxonomy as $term) { - $links[] = l($term->name, taxonomy_term_path($term), array('rel' => 'tag', 'title' => $term->description)); + $links[] = l($term->name, taxonomy_term_path($term), array('rel' => 'tag', 'title' => strip_tags($term->description))); } } return $links; |