html in source field is not safe

2016-09-01 22:55:04 +02:00 · 2016-09-01 22:55:04 +02:00 · 632d5f1136
commit 632d5f1136
parent e83d89e99d
1 changed files with 3 additions and 0 deletions
--- a/QvitterPlugin.php
+++ b/QvitterPlugin.php
@ -522,6 +522,9 @@ class QvitterPlugin extends Plugin {
    function onNoticeSimpleStatusArray($notice, &$twitter_status, $scoped)
    {

+        // strip tags from source, we can't trust html here, because of gs bug
+        $twitter_status['source'] = htmlspecialchars(strip_tags($twitter_status['source']));
+
    	// groups
 		$notice_groups = $notice->getGroups();
 		$group_addressees = false;