From a262b161f99cdc5cadb6571941c324f53bb3543e Mon Sep 17 00:00:00 2001
From: Andrew Dolgov <fox@madoka.spb.ru>
Date: Thu, 21 Sep 2006 04:55:02 +0100
Subject: [PATCH] disable html objects in article content, breaks layout

---
 backend.php   |  6 ++++--
 functions.php | 11 +++++++++++
 tt-rss.css    |  6 ++++++
 3 files changed, 21 insertions(+), 2 deletions(-)

diff --git a/backend.php b/backend.php
index e4329a26c..ebbf33a68 100644
--- a/backend.php
+++ b/backend.php
@@ -650,6 +650,8 @@
 				$line["content"] = preg_replace("/href=/i", "target=\"_new\" href=", $line["content"]);
 			}
 
+			$line["content"] = sanitize_rss($line["content"]);
+
 			print $line["content"] . "</div>";
 			
 			print "</div>";
@@ -1335,13 +1337,13 @@
 			
 			print "</td>";
 
-			$auth_login = db_fetch_result($result, 0, "auth_login");
+			$auth_login = escape_for_form(db_fetch_result($result, 0, "auth_login"));
 
 			print "<tr><td>Login:</td>";
 			print "<td><input class=\"iedit\" onkeypress=\"return filterCR(event)\"
 				name=\"auth_login\" value=\"$auth_login\"></td></tr>";
 
-			$auth_pass = db_fetch_result($result, 0, "auth_pass");
+			$auth_pass = escape_for_form(db_fetch_result($result, 0, "auth_pass"));
 
 			print "<tr><td>Password:</td>";
 			print "<td><input class=\"iedit\" type=\"password\" name=\"auth_pass\" 
diff --git a/functions.php b/functions.php
index 600a776c6..e5f06da37 100644
--- a/functions.php
+++ b/functions.php
@@ -2449,6 +2449,13 @@
 		$res = preg_replace('/<\/script>/i', 
 			"</p>", $res);
 
+		$res = preg_replace('/<object.*?>.*?<\/object>/i', 
+			"<p class=\"objectWarn\">(Disabled html object 
+			- flash or other embedded content)</p>", $str);
+
+		$res = preg_replace('/<\/object>/i', 
+			"</p>", $res);
+
 		return $res;
 	}
 
@@ -2637,4 +2644,8 @@
 		}
 	}
 
+	function escape_for_form($s) {
+		return htmlspecialchars(db_unescape_string($s));
+	}
+
 ?>
diff --git a/tt-rss.css b/tt-rss.css
index 5f771fe6e..ec4b51320 100644
--- a/tt-rss.css
+++ b/tt-rss.css
@@ -1172,6 +1172,12 @@ span.debugTS {
 	font-weight : bold;
 }
 
+.objectWarn {
+	color : gray;
+	padding : 3px;
+	font-style: italic;
+}
+
 table.loginForm2 {
 	padding : 1em;
 }