diff --git a/htdocs/core/lib/functions.lib.php b/htdocs/core/lib/functions.lib.php index 19380ee10bd..127f048cf5f 100644 --- a/htdocs/core/lib/functions.lib.php +++ b/htdocs/core/lib/functions.lib.php @@ -8793,6 +8793,12 @@ function dol_htmlwithnojs($stringtoencode, $nouseofiframesandbox = 0, $check = ' do { $oldstringtoclean = $out; + $outishtml = 0; + if (dol_textishtml($out)) { + $outishtml = 1; + } + + // HTML sanitizer by DOMDocument if (!empty($out) && getDolGlobalString('MAIN_RESTRICTHTML_ONLY_VALID_HTML') && $check != 'restricthtmlallowunvalid') { try { libxml_use_internal_errors(false); // Avoid to fill memory with xml errors @@ -8809,7 +8815,7 @@ function dol_htmlwithnojs($stringtoencode, $nouseofiframesandbox = 0, $check = ' // like 'abc' that wrongly ends up, without the trick, with '

abc

' // Add also a trick to solve utf8 lost. // I don't know what the xml encoding is the trick for - if (dol_textishtml($out)) { + if ($outishtml) { //$out = '
'.$out.'
'; $out = '
'.$out.'
'; //$out = '
'.$out.'
'; @@ -8832,6 +8838,10 @@ function dol_htmlwithnojs($stringtoencode, $nouseofiframesandbox = 0, $check = ' // $out = preg_replace('/^<\?xml encoding="UTF-8">
/', '', $out); // $out = preg_replace('/<\/div>$/', '', $out); // var_dump('rrrrrrrrrrrrrrrrrrrrrrrrrrrrr'.$out); + + if (!$outishtml) { // If $out was not HTML content we made before a dol_nl2br so we must do the opposite operation now + $out = str_replace('
', '', $out); + } } catch (Exception $e) { // If error, invalid HTML string with no way to clean it //print $e->getMessage(); @@ -8839,8 +8849,10 @@ function dol_htmlwithnojs($stringtoencode, $nouseofiframesandbox = 0, $check = ' } } - if (!empty($out) && getDolGlobalString('MAIN_RESTRICTHTML_ONLY_VALID_HTML_TIDY') && !in_array($check, array('restricthtmlallowunvalid', 'restricthtmlallowlinkscript'))) { - // Tidy can't be used for restricthtmlallowunvalid and restricthtmlallowlinkscript + // HTML sanitizer by Tidy + // Tidy can't be used for restricthtmlallowunvalid and restricthtmlallowlinkscript + // Tidy can't be used for non html text content as it is corrupting the new lines fields. + if (!empty($out) && getDolGlobalString('MAIN_RESTRICTHTML_ONLY_VALID_HTML_TIDY') && !in_array($check, array('restricthtmlallowunvalid', 'restricthtmlallowlinkscript')) && $outishtml) { // TODO Try to implement a hack for restricthtmlallowlinkscript by renaming tag and