Remove href attribute if it executes JavaScript.

[tt-rss.git] / include / functions2.php
diff --git a/include/functions2.php b/include/functions2.php

index 1c2ffb9369329532ad8c0571fd98e039f9f6f5f4..dceea507ee882ccbc6f15935c1a959ad7795ad26 100644 (file)
--- a/include/functions2.php
+++ b/include/functions2.php
@@ -89,6 +89,7 @@
                                 "feed_edit" => __("Edit feed"),
                                 "feed_catchup" => __("Mark as read"),
                                 "feed_reverse" => __("Reverse headlines"),
+                               "feed_toggle_vgroup" => __("Toggle headline grouping"),
                                 "feed_debug_update" => __("Debug feed update"),
                                 "feed_debug_viewfeed" => __("Debug viewfeed()"),
                                 "catchup_all" => __("Mark all feeds as read"),
@@ -158,6 +159,7 @@
                                 "f e" => "feed_edit",
                                 "f q" => "feed_catchup",
                                 "f x" => "feed_reverse",
+                               "f g" => "feed_toggle_vgroup",
                                 "f *d" => "feed_debug_update",
                                 "f *g" => "feed_debug_viewfeed",
                                 "f *c" => "toggle_combined_mode",
@@ -1034,7 +1036,14 @@
  
                 $res = $doc->saveHTML();
  
-               return $res;
+               /* strip everything outside of <body>...</body> */
+
+               $res_frag = array();
+               if (preg_match('/<body>(.*)<\/body>/is', $res, $res_frag)) {
+                       return $res_frag[1];
+               } else {
+                       return $res;
+               }
         }
  
         function strip_harmful_tags($doc, $allowed_elements, $disallowed_attributes) {
@@ -1055,6 +1064,10 @@
                                                 array_push($attrs_to_remove, $attr);
                                         }
  
+                                       if ($attr->nodeName == 'href' && stripos($attr->value, 'javascript:') === 0) {
+                                               array_push($attrs_to_remove, $attr);
+                                       }
+
                                         if (in_array($attr->nodeName, $disallowed_attributes)) {
                                                 array_push($attrs_to_remove, $attr);
                                         }