Safer HTML for PHPNuke

Posted: Mon Aug 16, 2004 10:10 pm

I've been messing with a WYSIWYG editor and I found that if I add img to the allowed html array in config.php that style= can be inserted into it. Which though cool for somethings is just bad on a public place because we can put any sort of nasty java into that we want for one thing. So I had to think about what could I do to make html safer globally. I came up with 2 choices

1) Hack the check_html function and try to improve it to filter out attributes better.
2) Replace the code in check_html with a proven better solution.

I went with 2) and replaced the code in function check_html with KSES. It will still check for the "nohtml" flag and strip everything if it exists. So if you have the need for more html and want to be safer give this a try.

Simply add any edits to the mainfile.php that you need to run your site. (Like Sentinel's include line. Upload this new mainfile.php and your done. Here's the best part though now you can add img to the the allowed array and not have to be concerned about script kiddies adding java to your site.

Install:
Upload the included mainfile.php. (PHPNUke 7.4 ChatServ Patched 2.5 downloaded 8-16-04)
Or replace the entire check_html function in your mainfile.php with the code in the code
file included in this archive.

Please test this and report any issues. I have only briefly tested it but it seems to do its job. Usuage should be just as check_html is intended
$var = check_html($var, "nohtml"); // Strips html
$var = check_html($var, "html"); // Would allow approved html
$var = check_html$var); might work too but I didn't try that.
There have been someplaces I've seen $var = (check_html, $strip); this would return the allowed html too. The only way to strip html with it is to use the nohtml method.
Get it here: [ Only registered users can see links on this board! Get registered or login! ]

Posted: Mon Aug 16, 2004 10:17 pm

Note: It will conflict with the Journal2 so I think within a day or so I'll get a copy converted over to use check_html as it uses kses Embarassed

Posted: Tue Aug 17, 2004 7:43 am

Here is Journal 2.0.b which is only recomended for use with this mainfile hack. [ Only registered users can see links on this board! Get registered or login! ]