From e268a1e22ac09b3757ff8e5152d0d3f95706ccbd Mon Sep 17 00:00:00 2001 From: pecesama Date: Sun, 26 Oct 2008 17:39:38 +0000 Subject: [PATCH] Removed all textile references and correct sanitation of comments --- admin/bm.php | 12 +- admin/comments.php | 11 +- admin/index.php | 2 +- classes/comments.class.php | 6 +- classes/functions.php | 2 +- entry.php | 1 - themes/tumblr/index.htm | 347 +++++++++++++++++++------------------ 7 files changed, 198 insertions(+), 183 deletions(-) diff --git a/admin/bm.php b/admin/bm.php index 6d52467..6c8ae50 100644 --- a/admin/bm.php +++ b/admin/bm.php @@ -208,7 +208,17 @@ if ($user->isAdmin()) { } ?>

- Textile + + :
+      + + <strong> <em> <del> <ul> <ol> <li> <a> +
+     <blockquote> + <code> <pre> <img> + +

+

diff --git a/admin/comments.php b/admin/comments.php index 8e12f83..ae43344 100644 --- a/admin/comments.php +++ b/admin/comments.php @@ -22,13 +22,12 @@ $isEdition = isset($_GET["edit"]); $commentId = ($isEdition) ? $_GET["edit"] : NULL; if(isset($_POST["btnAdd"])) { - unset($_POST["btnAdd"]); + unset($_POST["btnAdd"]); - $textile = new Textile(); - - $_POST["username"] = $textile->TextileThis(removeBadTags($_POST["username"])); - $_POST["email"] = $textile->TextileThis(removeBadTags($_POST["email"])); - $_POST["web"] = $textile->TextileThis(removeBadTags($_POST["web"])); + $_POST["username"] = strip_tags($_POST["username"]); + $_POST["email"] = strip_tags($_POST["email"]); + $_POST["web"] = strip_tags($_POST["web"]); + $_POST["content"] = removeBadTags($_POST["content"], true); if (isset($_POST["id_comment"])) { if ($isAdmin) { diff --git a/admin/index.php b/admin/index.php index ee2f832..df72262 100644 --- a/admin/index.php +++ b/admin/index.php @@ -318,7 +318,7 @@ if ($user->isAuthenticated()) {
    <blockquote> <code> <pre> <img> - +

Bookmarklet - " href="javascript:var w; setTimeout('w.focus()',100);w=window.open('urlGelato; ?>/admin/bm.php?url='+encodeURIComponent(location.href)+'&sel='+encodeURIComponent(window.getSelection()),'bookmarklet','toolbar=0,resizable=0,status=1,width=650,height=540,dependent=yes' ); w.focus();">

diff --git a/classes/comments.class.php b/classes/comments.class.php index 3b11279..750f230 100644 --- a/classes/comments.class.php +++ b/classes/comments.class.php @@ -28,9 +28,9 @@ class comments extends Conexion_Mysql { } function generateCookie($fieldsArray) { - setcookie("cookie_gel_user", $fieldsArray["username"], time() + 30000000); - setcookie("cookie_gel_email", $fieldsArray["email"], time() + 30000000); - setcookie("cookie_gel_web", $fieldsArray["web"], time() + 30000000); + setcookie("cookie_gel_user", $fieldsArray["username"], time() + 30000000, "/"); + setcookie("cookie_gel_email", $fieldsArray["email"], time() + 30000000, "/"); + setcookie("cookie_gel_web", $fieldsArray["web"], time() + 30000000, "/"); } function isSpam($fieldsArray) { diff --git a/classes/functions.php b/classes/functions.php index 60de16f..ae655a6 100644 --- a/classes/functions.php +++ b/classes/functions.php @@ -401,7 +401,7 @@ if(!defined('entry') || !entry) die('Not a valid page'); function removeBadTags($source,$secure=false) { if($secure){ - $validTags =''; + $validTags ='

'; } else { $validTags ='