search

ushahidi / Ushahidi_Web

Ushahidi v2. A platform that allows information collection, visualization and interactive mapping, allowing anyone to submit information through text messaging using a mobile phone, email or web form.
http://www.ushahidi.com
Other
899 stars 624 forks source link

Sanitize HTML Output #536

Open brianherbert opened 12 years ago

brianherbert commented 12 years ago

All output of reports, site messages and any other area that allows for HTML output need to be sanitized while still allowing presentation HTML tags. Additionally, the WYSIWYG editor should be restricted to only use approved tags.

PoPoutdoor commented 12 years ago

Re: Longer term: We need to look at including a proper html sanitization library and using it through out the code

strip_tags() only strip-off html tags, the url inside <a|img> tags will not be stripped off.

rjmackay commented 12 years ago

From #648 (closed as dupe): Don't trust strip_tags() - make sure we escape chars too. strip_tags is probably only good on well formed html - so we should run its output through specialchars() or similar too

rjmackay commented 12 years ago

Implement an HTML whitelist using -> http://htmlpurifier.org/

maxxzaxx commented 11 years ago

Hi Guys, I wanted to use Ushahidi for a special purpose - 360 Spherical panorama photography - reporting from our reporters. The incident_description after saving strips the html. I want to embed html codes like this in the pic request The the output would be like this: output The embed code is here: script Can Anyone help me to enable the full html content support in the description output? I know the security risks but all the reports will be moderated. Thanks.