Changeset 893

Timestamp:

03/16/09 14:03:46 (14 years ago)

Author:

Moe

Message:

Contribute 1.0-alpha9 :

• added HTML filter to excerpt and content (thanks to Thomas Bouron and Vincent Garnier)
• escaped host display in admin

Location:

plugins/contribute

Files:

• _admin.php (modified) (1 diff)
• _define.php (modified) (1 diff)
• _public.php (modified) (2 diffs)

plugins/contribute/_admin.php

@@ -143 +143 @@
                     if (!empty($host))
                     {
-                         $link = '<br />'.
-                              '<a href="'.html::escapeHTML($site).'">'.$host.'</a>';
+                         $link = '<br />'.'<a href="'.html::escapeHTML($site).'">'.
+                              html::escapeHTML($host).'</a>';
                     }
                }

plugins/contribute/_define.php

@@ -28 +28 @@
      /* Description*/                "Allow visitors to contribute to your blog",
      /* Author */                    "Moe (http://gniark.net/)",
-     /* Version */                   '1.0-alpha8',
+     /* Version */                   '1.0-alpha9',
      /* Permissions */               'admin'
 );

plugins/contribute/_public.php

@@ -200 +200 @@
                               {
                                    $post->post_format = $_POST['post_format'];
-                                   // fixme : security :limit to wiki without XHTML ?
-                                   // $core->wiki2xhtml->setOpt('parse_pre',0);
                               }
                          }
@@ -236 +234 @@
                     }
                     
+                    # HTML filter
+                    $filter = new htmlFilter;
                     # excerpt
-                    if (($core->blog->settings->contribute_allow_category === true)
+                    if (($core->blog->settings->contribute_allow_excerpt === true)
                          && (isset($_POST['post_excerpt'])))
                     {
-                         $post->post_excerpt = $_POST['post_excerpt'];
+                         $post->post_excerpt = trim($filter->apply($_POST['post_excerpt']));
                     }
                     # content
                     if (isset($_POST['post_content']))
                     {
-                         $post->post_content = $_POST['post_content'];
-                    }
+                         $post->post_content = trim($filter->apply($_POST['post_content']));
+                    }
+                    unset($filter);
                     
                     # avoid Notice: Indirect modification of overloaded property