richard
/
sorbetcms
1
0
Fork 1
Code Issues Pull Requests Releases Wiki Activity

Removed all textile references and correct sanitation of comments

master
pecesama 2008-10-26 17:39:38 +00:00
parent 720d8a7644
commit e268a1e22a
7 changed files with 198 additions and 183 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
admin/bm.php
View File

@ -208,7 +208,17 @@ if ($user->isAdmin()) {
} }
?> ?>
<p> <p>
<span style="color: rgb(136, 136, 136); margin-bottom: 10px; font-size: 10px;"><a href="http://hobix.com/textile/">Textile</a> <?php echo __("syntax is supported.")?></span> <span style="color: rgb(136, 136, 136); margin-bottom: 10px; font-size: 10px;">
<?php echo __("Some HTML allowed")?>:<br />
&nbsp;&nbsp;&nbsp;&nbsp;
<code>
&lt;strong&gt; &lt;em&gt; &lt;del&gt; &lt;ul&gt; &lt;ol&gt; &lt;li&gt; &lt;a&gt;
<br />
&nbsp;&nbsp;&nbsp;&nbsp;&lt;blockquote&gt;
&lt;code&gt; &lt;pre&gt; &lt;img&gt;
</code>
<br /><br />
</span>
</p> </p>
<p> <p>
<input class="btn" type="submit" name="btnAdd" value="Create post" /> <input class="btn" type="submit" name="btnAdd" value="Create post" />

9
admin/comments.php
View File

@ -24,11 +24,10 @@ $commentId = ($isEdition) ? $_GET["edit"] : NULL;
if(isset($_POST["btnAdd"])) { if(isset($_POST["btnAdd"])) {
unset($_POST["btnAdd"]); unset($_POST["btnAdd"]);
$textile = new Textile(); $_POST["username"] = strip_tags($_POST["username"]);
$_POST["email"] = strip_tags($_POST["email"]);
$_POST["username"] = $textile->TextileThis(removeBadTags($_POST["username"])); $_POST["web"] = strip_tags($_POST["web"]);
$_POST["email"] = $textile->TextileThis(removeBadTags($_POST["email"])); $_POST["content"] = removeBadTags($_POST["content"], true);
$_POST["web"] = $textile->TextileThis(removeBadTags($_POST["web"]));
if (isset($_POST["id_comment"])) { if (isset($_POST["id_comment"])) {
if ($isAdmin) { if ($isAdmin) {

2
admin/index.php
View File

@ -318,7 +318,7 @@ if ($user->isAuthenticated()) {
<br /> <br />
&nbsp;&nbsp;&nbsp;&nbsp;&lt;blockquote&gt; &nbsp;&nbsp;&nbsp;&nbsp;&lt;blockquote&gt;
&lt;code&gt; &lt;pre&gt; &lt;img&gt; &lt;code&gt; &lt;pre&gt; &lt;img&gt;
<code> </code>
<br /><br /> <br /><br />
Bookmarklet - <a class="bookmarklet" title="<?php echo __("Drag to the Bookmarks Toolbar")?>" href="javascript:var w; setTimeout('w.focus()',100);w=window.open('<?php echo $conf->urlGelato; ?>/admin/bm.php?url='+encodeURIComponent(location.href)+'&sel='+encodeURIComponent(window.getSelection()),'bookmarklet','toolbar=0,resizable=0,status=1,width=650,height=540,dependent=yes' ); w.focus();"><?php echo __("add to gelato")?></a> Bookmarklet - <a class="bookmarklet" title="<?php echo __("Drag to the Bookmarks Toolbar")?>" href="javascript:var w; setTimeout('w.focus()',100);w=window.open('<?php echo $conf->urlGelato; ?>/admin/bm.php?url='+encodeURIComponent(location.href)+'&sel='+encodeURIComponent(window.getSelection()),'bookmarklet','toolbar=0,resizable=0,status=1,width=650,height=540,dependent=yes' ); w.focus();"><?php echo __("add to gelato")?></a>
<br /><br /> <br /><br />

6
classes/comments.class.php
View File

@ -28,9 +28,9 @@ class comments extends Conexion_Mysql {
} }
function generateCookie($fieldsArray) { function generateCookie($fieldsArray) {
setcookie("cookie_gel_user", $fieldsArray["username"], time() + 30000000); setcookie("cookie_gel_user", $fieldsArray["username"], time() + 30000000, "/");
setcookie("cookie_gel_email", $fieldsArray["email"], time() + 30000000); setcookie("cookie_gel_email", $fieldsArray["email"], time() + 30000000, "/");
setcookie("cookie_gel_web", $fieldsArray["web"], time() + 30000000); setcookie("cookie_gel_web", $fieldsArray["web"], time() + 30000000, "/");
} }
function isSpam($fieldsArray) { function isSpam($fieldsArray) {

2
classes/functions.php
View File

@ -401,7 +401,7 @@ if(!defined('entry') || !entry) die('Not a valid page');
function removeBadTags($source,$secure=false) { function removeBadTags($source,$secure=false) {
if($secure){ if($secure){
$validTags ='<abbr><acronym><em><i><strong><b><span>'; $validTags ='<blockquote><code><em><i><strong><b><a>';
} else { } else {
$validTags ='<p><ol><ul><li><a><abbr><acronym><blockquote><code><pre><em><i><strong><b><del><br><span><div><img>'; $validTags ='<p><ol><ul><li><a><abbr><acronym><blockquote><code><pre><em><i><strong><b><del><br><span><div><img>';
} }

1
entry.php
View File

@ -56,7 +56,6 @@ if($installed) {
} }
require_once(Absolute_Path.'classes'.DIRECTORY_SEPARATOR.'configuration.class.php'); require_once(Absolute_Path.'classes'.DIRECTORY_SEPARATOR.'configuration.class.php');
require_once(Absolute_Path.'classes'.DIRECTORY_SEPARATOR.'textile.class.php');
require_once(Absolute_Path.'classes'.DIRECTORY_SEPARATOR.'gelato.class.php'); require_once(Absolute_Path.'classes'.DIRECTORY_SEPARATOR.'gelato.class.php');
require_once(Absolute_Path.'classes'.DIRECTORY_SEPARATOR.'templates.class.php'); require_once(Absolute_Path.'classes'.DIRECTORY_SEPARATOR.'templates.class.php');
require_once(Absolute_Path.'classes'.DIRECTORY_SEPARATOR.'themes.class.php'); require_once(Absolute_Path.'classes'.DIRECTORY_SEPARATOR.'themes.class.php');

9
themes/tumblr/index.htm
View File

@ -148,7 +148,14 @@
<textarea name="content" id="content" cols="100" rows="10" tabindex="4"></textarea> <textarea name="content" id="content" cols="100" rows="10" tabindex="4"></textarea>
</p> </p>
<p> <p>
<span style="color: rgb(136, 136, 136); margin-bottom: 10px; font-size: 10px;"><a href="http://hobix.com/textile/">Textile</a> syntax is supported.</span> <span style="color: rgb(136, 136, 136); margin-bottom: 10px; font-size: 10px;">
Some HTML allowed:<br />
&nbsp;&nbsp;&nbsp;&nbsp;
<code>
&lt;blockquote&gt; &lt;code&gt; &lt;em&gt; &lt;strong&gt; &lt;a&gt;
</code>
</span>
</p>
<p> <p>
<input type="submit" value="Add comment" name="btnAdd" id="btnAdd" tabindex="5" /> <input type="submit" value="Add comment" name="btnAdd" id="btnAdd" tabindex="5" />
</p> </p>