diff --git a/htdocs/admin/system/security.php b/htdocs/admin/system/security.php index 13f562900b7..2fca2654538 100644 --- a/htdocs/admin/system/security.php +++ b/htdocs/admin/system/security.php @@ -641,7 +641,7 @@ print '   ('.$langs->trans("Recommended").': 1) print '
'; print 'MAIN_RESTRICTHTML_REMOVE_ALSO_BAD_ATTRIBUTES = '.(getDolGlobalString('MAIN_RESTRICTHTML_REMOVE_ALSO_BAD_ATTRIBUTES') ? '1' : ''.$langs->trans("Undefined").''); -print '   ('.$langs->trans("Recommended").": 1)
"; +print '   ('.$langs->trans("Recommended").": 1 - does not work on HTML5 with some old libxml libs)
"; print '
'; print 'MAIN_DISALLOW_URL_INTO_DESCRIPTIONS = '.getDolGlobalString('MAIN_DISALLOW_URL_INTO_DESCRIPTIONS', ''.$langs->trans("Undefined").'   ('.$langs->trans("Recommended").': 1)')."
"; diff --git a/htdocs/core/lib/functions.lib.php b/htdocs/core/lib/functions.lib.php index c3cd667aef6..ecbaa361dab 100644 --- a/htdocs/core/lib/functions.lib.php +++ b/htdocs/core/lib/functions.lib.php @@ -7384,11 +7384,20 @@ function dol_string_onlythesehtmltags($stringtoclean, $cleanalsosomestyles = 1, * * @see dol_escape_htmltag() strip_tags() dol_string_nohtmltag() dol_string_onlythesehtmltags() dol_string_neverthesehtmltags() */ -function dol_string_onlythesehtmlattributes($stringtoclean, $allowed_attributes = array("allow", "allowfullscreen", "alt", "class", "contenteditable", "data-html", "frameborder", "height", "href", "id", "name", "src", "style", "target", "title", "width")) +function dol_string_onlythesehtmlattributes($stringtoclean, $allowed_attributes = null) { + if (is_null($allowed_attributes)) { + $allowed_attributes = array( + "allow", "allowfullscreen", "alt", "class", "contenteditable", "data-html", "frameborder", "height", "href", "id", "name", "src", "style", "target", "title", "width", + // HTML5 + "header", "footer", "nav", "section", "menu", "menuitem" + ); + } + if (class_exists('DOMDocument') && !empty($stringtoclean)) { $stringtoclean = ''.$stringtoclean.''; + // Warning: loadHTML does not support HTML5 on old libxml versions. $dom = new DOMDocument(null, 'UTF-8'); $dom->loadHTML($stringtoclean, LIBXML_ERR_NONE|LIBXML_HTML_NOIMPLIED|LIBXML_HTML_NODEFDTD|LIBXML_NONET|LIBXML_NOWARNING|LIBXML_NOXMLDECL); diff --git a/test/phpunit/SecurityTest.php b/test/phpunit/SecurityTest.php index d95d8da3454..45ca6fd0c0a 100644 --- a/test/phpunit/SecurityTest.php +++ b/test/phpunit/SecurityTest.php @@ -1152,12 +1152,12 @@ class SecurityTest extends PHPUnit\Framework\TestCase global $conf; // Set options for cleaning data - $conf->global->MAIN_RESTRICTHTML_ONLY_VALID_HTML = 0; // disabled, does not work on HTML5 + $conf->global->MAIN_RESTRICTHTML_ONLY_VALID_HTML = 0; // disabled, does not work on HTML5 and some libxml versions // Enabled option MAIN_RESTRICTHTML_ONLY_VALID_HTML_TIDY if possible if (extension_loaded('tidy') && class_exists("tidy")) { $conf->global->MAIN_RESTRICTHTML_ONLY_VALID_HTML_TIDY = 1; } - $conf->global->MAIN_RESTRICTHTML_REMOVE_ALSO_BAD_ATTRIBUTES = 1; + $conf->global->MAIN_RESTRICTHTML_REMOVE_ALSO_BAD_ATTRIBUTES = 0; // disabled, does not work on HTML5 and some libxml versions @@ -1176,7 +1176,7 @@ class SecurityTest extends PHPUnit\Framework\TestCase // For a string that is already HTML (contains HTML tags) with special tags but badly formated $stringtotest = "testA\n

hhhh

ddd
aaa
"; if (getDolGlobalString("MAIN_RESTRICTHTML_ONLY_VALID_HTML_TIDY")) { - $stringfixed = "testA\n

hhhh

\nddd\n
aaa
\n"; + $stringfixed = "testA\n

hhhh

\nddd\n
aaa
\n\n"; } else { $stringfixed = "testA\n

hhhh

ddd
aaa
"; } @@ -1186,19 +1186,19 @@ class SecurityTest extends PHPUnit\Framework\TestCase //$result = dol_escape_htmltag(dol_htmlwithnojs(dol_string_onlythesehtmltags(dol_htmlentitiesbr($stringtotest), 1, 1, 1, 0)), 1, 1, 'common', 0, 1); $result = dolPrintHTML($stringtotest); print __METHOD__." result=".$result."\n"; - $this->assertEquals($stringfixed, $result, 'Error'); // Expected '' because should failed because login 'auto' does not exists + $this->assertEquals($stringfixed, $result, 'Error'); // For a string that is already HTML (contains HTML tags) but badly formated $stringtotest = "testB\n

hhh

\ntd alone

iii

"; if (getDolGlobalString("MAIN_RESTRICTHTML_ONLY_VALID_HTML_TIDY")) { - $stringfixed = "testB\n

hhh

\n

iii

\n\n\n\n\n
td alone
"; + $stringfixed = "testB\n

hhh

\n

iii

\n\n\n\n\n
td alone
\n"; } else { $stringfixed = "testB\n

hhh

\ntd alone

iii

"; } $result = dolPrintHTML($stringtotest); print __METHOD__." result=".$result."\n"; - $this->assertEquals($stringfixed, $result, 'Error'); // Expected '' because should failed because login 'auto' does not exists + $this->assertEquals($stringfixed, $result, 'Error'); // For a string with no HTML tags @@ -1206,7 +1206,7 @@ class SecurityTest extends PHPUnit\Framework\TestCase $stringfixed = "testC
\ntest"; $result = dolPrintHTML($stringtotest); print __METHOD__." result=".$result."\n"; - $this->assertEquals($stringfixed, $result, 'Error'); // Expected '' because should failed because login 'auto' does not exists + $this->assertEquals($stringfixed, $result, 'Error'); return 0; }