mirror/php-e107
1
0
Fork 0
mirror of https://github.com/e107inc/e107.git synced 2025-08-24 15:13:04 +02:00
Code Issues Releases Wiki Activity

Add HTML abuse blocker

Browse Source
This commit is contained in:
e107steved
2010-12-18 22:55:27 +00:00
parent 3240652607
commit 9d181bf566
4 changed files with 50 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

39
e107_handlers/e_parse_class.php
View File

@@ -492,6 +492,10 @@ class e_parse
{
$no_encode = TRUE;
}
if ($core_pref->get('html_abuse'))
{
if ($this->htmlAbuseFilter($data)) $no_encode = FALSE;
}
if (is_numeric($original_author) && !check_class($core_pref->get('post_html'), '', $original_author))
{
$no_encode = FALSE;
@@ -520,6 +524,41 @@ class e_parse
/**
* Check for HTML closing tag for input elements, without corresponding opening tag
*
* @param string $data
* @param string $tagList - if empty, uses default list of input tags. Otherwise a CSV list of tags to check (any type)
*
* @return boolean TRUE if an unopened closing tag found
* FALSE if nothing found
*/
function htmlAbuseFilter($data, $tagList = '')
{
if ($tagList == '')
{
$checkTags = array('textarea', 'input', 'td', 'tr', 'table');
}
else
{
$checkTags = explode(',', $tagList);
}
$data = preg_replace('#\[code\].*?\[\/code\]#i', '', $data); // Ignore code blocks
foreach ($checkTags as $tag)
{
if (($pos = stripos($data, '</'.$tag)) !== FALSE)
{
if ((($bPos = stripos($data, '<'.$tag )) === FALSE) || ($bPos > $pos))
{
return TRUE; // Potentially abusive HTML found
}
}
}
return FALSE; // Nothing detected
}
/**
* Checks a string for potentially dangerous HTML tags, including malformed tags