Wavyzz/dolibarr
2
0
Fork 1
mirror of https://github.com/Dolibarr/dolibarr.git synced 2025-12-07 18:18:18 +01:00
Code Issues Packages Projects Releases Wiki Activity

Add restricthtmlallowlinkjstag in GETPOST

Browse Source
This commit is contained in:
Laurent Destailleur
2024-08-21 02:42:13 +02:00
parent a83fb60074
commit 3c78580471
1 changed files with 17 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

21
htdocs/core/lib/functions.lib.php
View File

@@ -1272,6 +1272,7 @@ function sanitizeVal($out = '', $check = 'alphanohtml', $filter = null, $options
case 'restricthtmlnolink':
case 'restricthtml': // Recommended for most html textarea
case 'restricthtmlallowclass':
case 'restricthtmlallowlinkjstag': // Allow link and js tag for head section.
case 'restricthtmlallowunvalid':
$out = dol_htmlwithnojs($out, 1, $check);
break;
@@ -7965,12 +7966,13 @@ function dol_string_nohtmltag($stringtoclean, $removelinefeed = 1, $pagecodeto =
* @param int $cleanalsojavascript Remove also occurrence of 'javascript:'.
* @param int $allowiframe Allow iframe tags.
* @param string[] $allowed_tags List of allowed tags to replace the default list
* @param int $allowlink Allow "link" tags.
* @param int $allowlink Allow "link" tags (for head html section)
* @param int $allowscript Allow "script" tags (for head html section)
* @return string String cleaned
*
* @see dol_htmlwithnojs() dol_escape_htmltag() strip_tags() dol_string_nohtmltag() dol_string_neverthesehtmltags()
*/
function dol_string_onlythesehtmltags($stringtoclean, $cleanalsosomestyles = 1, $removeclassattribute = 1, $cleanalsojavascript = 0, $allowiframe = 0, $allowed_tags = array(), $allowlink = 0)
function dol_string_onlythesehtmltags($stringtoclean, $cleanalsosomestyles = 1, $removeclassattribute = 1, $cleanalsojavascript = 0, $allowiframe = 0, $allowed_tags = array(), $allowlink = 0, $allowscript = 0)
{
if (empty($allowed_tags)) {
$allowed_tags = array(
@@ -7990,6 +7992,11 @@ function dol_string_onlythesehtmltags($stringtoclean, $cleanalsosomestyles = 1,
$allowed_tags[] = "link";
}
}
if ($allowscript) {
if (!in_array('script', $allowed_tags)) {
$allowed_tags[] = "script";
}
}
$allowed_tags_string = implode("><", $allowed_tags);
$allowed_tags_string = '<'.$allowed_tags_string.'>';
@@ -8246,7 +8253,7 @@ function dol_nl2br($stringtoencode, $nl2brmode = 0, $forxml = false)
*
* @param string $stringtoencode String to encode
* @param int $nouseofiframesandbox 0=Default, 1=Allow use of option MAIN_SECURITY_USE_SANDBOX_FOR_HTMLWITHNOJS for html sanitizing (not yet working)
* @param string $check 'restricthtmlnolink' or 'restricthtml' or 'restricthtmlallowclass' or 'restricthtmlallowunvalid'
* @param string $check 'restricthtmlnolink' or 'restricthtml' or 'restricthtmlallowclass' or 'restricthtmlallowlinkjstag' or 'restricthtmlallowunvalid'
* @return string HTML sanitized
*/
function dol_htmlwithnojs($stringtoencode, $nouseofiframesandbox = 0, $check = 'restricthtml')
@@ -8363,7 +8370,13 @@ function dol_htmlwithnojs($stringtoencode, $nouseofiframesandbox = 0, $check = '
$out = preg_replace('/&#x?[0-9]+/i', '', $out); // For example if we have j&#x61vascript with an entities without the ; to hide the 'a' of 'javascript'.
// Keep only some html tags and remove also some 'javascript:' strings
$out = dol_string_onlythesehtmltags($out, 0, ($check == 'restricthtmlallowclass' ? 0 : 1), 1);
if ($check == 'restricthtmlallowlinkjstag') {
$out = dol_string_onlythesehtmltags($out, 0, 1, 0, 0, array(), 1);
} elseif ($check == 'restricthtmlallowclass') {
$out = dol_string_onlythesehtmltags($out, 0, 0, 1);
} else {
$out = dol_string_onlythesehtmltags($out, 0, 1, 1);
}
// Keep only some html attributes and exclude non expected HTML attributes and clean content of some attributes (keep only alt=, title=...).
if (getDolGlobalString('MAIN_RESTRICTHTML_REMOVE_ALSO_BAD_ATTRIBUTES')) {