sanitize: allow <description>

[tt-rss.git] / include / functions2.php

diff --git a/include/functions2.php b/include/functions2.php
index 0386b52ed30443ac95f4278dffd51fb9756632c5..fb2fff286ff610d533023b9ee5262ed58ada7537 100755 (executable)
--- a/include/functions2.php
+++ b/include/functions2.php
@@ -892,6 +892,8 @@
 
                $entries = $xpath->query('(//a[@href]|//img[@src])');
 
+               $ttrss_uses_https = parse_url(get_self_url_prefix(), PHP_URL_SCHEME) === 'https';
+
                foreach ($entries as $entry) {
 
                        if ($site_url) {
@@ -916,6 +918,21 @@
                                }
 
                                if ($entry->nodeName == 'img') {
+                                       if ($entry->hasAttribute('src')) {
+                                               $is_https_url = parse_url($entry->getAttribute('src'), PHP_URL_SCHEME) === 'https';
+
+                                               if ($ttrss_uses_https && !$is_https_url) {
+
+                                                       if ($entry->hasAttribute('srcset')) {
+                                                               $entry->removeAttribute('srcset');
+                                                       }
+
+                                                       if ($entry->hasAttribute('sizes')) {
+                                                               $entry->removeAttribute('sizes');
+                                                       }
+                                               }
+                                       }
+
                                        if (($owner && get_pref("STRIP_IMAGES", $owner)) ||
                                                        $force_remove_images || $_SESSION["bw_limit"]) {
 
@@ -955,7 +972,7 @@
                $allowed_elements = array('a', 'address', 'audio', 'article', 'aside',
                        'b', 'bdi', 'bdo', 'big', 'blockquote', 'body', 'br',
                        'caption', 'cite', 'center', 'code', 'col', 'colgroup',
-                       'data', 'dd', 'del', 'details', 'div', 'dl', 'font',
+                       'data', 'dd', 'del', 'details', 'description', 'div', 'dl', 'font',
                        'dt', 'em', 'footer', 'figure', 'figcaption',
                        'h1', 'h2', 'h3', 'h4', 'h5', 'h6', 'header', 'html', 'i',
                        'img', 'ins', 'kbd', 'li', 'main', 'mark', 'nav', 'noscript',
@@ -1104,7 +1121,8 @@
                        $result = db_query("SELECT tag_cache FROM ttrss_user_entries
                                WHERE ref_id = '$id' AND owner_uid = $owner_uid");
 
-                       $tag_cache = db_fetch_result($result, 0, "tag_cache");
+                       if (db_num_rows($result) != 0)
+                               $tag_cache = db_fetch_result($result, 0, "tag_cache");
                }
 
                if ($tag_cache) {
@@ -1139,7 +1157,7 @@
 
        function tag_is_valid($tag) {
                if ($tag == '') return false;
-               if (preg_match("/^[0-9]*$/", $tag)) return false;
+               if (is_numeric($tag)) return false;
                if (mb_strlen($tag) > 250) return false;
 
                if (!$tag) return false;