Wavyzz/dolibarr-fork
2
0
Fork 0
forked from Wavyzz/dolibarr
Code Pull Requests Activity

Merge branch '21.0' of git@github.com:Dolibarr/dolibarr.git into develop

Browse Source
This commit is contained in:
Laurent Destailleur (aka Eldy)
2025-01-19 15:02:20 +01:00
parent 9c5e0747c6 e239e2f29f
commit f11d701486
23 changed files with 132 additions and 97 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
htdocs/core/lib/functions.lib.php
View File

@@ -1317,6 +1317,7 @@ function sanitizeVal($out = '', $check = 'alphanohtml', $filter = null, $options
case 'restricthtmlnolink':
case 'restricthtml': // Recommended for most html textarea
case 'restricthtmlallowclass':
case 'restricthtmlallowiframe':
case 'restricthtmlallowlinkscript': // Allow link and script tag for head section.
case 'restricthtmlallowunvalid':
$out = dol_htmlwithnojs($out, 1, $check);
@@ -8482,7 +8483,7 @@ function dol_nl2br($stringtoencode, $nl2brmode = 0, $forxml = false)
*
* @param string $stringtoencode String to encode
* @param int $nouseofiframesandbox 0=Default, 1=Allow use of option MAIN_SECURITY_USE_SANDBOX_FOR_HTMLWITHNOJS for html sanitizing (not yet working)
* @param string $check 'restricthtmlnolink' or 'restricthtml' or 'restricthtmlallowclass' or 'restricthtmlallowlinkscript' or 'restricthtmlallowunvalid'
* @param string $check 'restricthtmlnolink' or 'restricthtml' or 'restricthtmlallowclass' or 'restricthtmlallowiframe' or 'restricthtmlallowlinkscript' or 'restricthtmlallowunvalid'
* @return string HTML sanitized
*/
function dol_htmlwithnojs($stringtoencode, $nouseofiframesandbox = 0, $check = 'restricthtml')
@@ -8608,6 +8609,8 @@ function dol_htmlwithnojs($stringtoencode, $nouseofiframesandbox = 0, $check = '
$out = dol_string_onlythesehtmltags($out, 0, 1, 0, 0, array(), 1, 1, 1, getDolGlobalInt("UNSECURED_restricthtmlallowlinkscript_ALLOW_PHP"));
} elseif ($check == 'restricthtmlallowclass' || $check == 'restricthtmlallowunvalid') {
$out = dol_string_onlythesehtmltags($out, 0, 0, 1);
} elseif ($check == 'restricthtmlallowiframe') {
$out = dol_string_onlythesehtmltags($out, 0, 0, 1, 1);
} else {
$out = dol_string_onlythesehtmltags($out, 0, 1, 1);
}