diff --git a/includes/common.inc b/includes/common.inc
index 0aa3a2c6e4070a7ca2e54924a173a6b82d67c48c..5ffaa444477a9841b30c3d59984d2dddbc82c3e4 100644
--- a/includes/common.inc
+++ b/includes/common.inc
@@ -244,8 +244,8 @@ function drupal_goto($path = '', $query = NULL, $fragment = NULL) {
function drupal_site_offline() {
drupal_set_header('HTTP/1.0 503 Service unavailable');
drupal_set_title(t('Site off-line'));
- print theme('maintenance_page', variable_get('site_offline_message',
- t('%site is currently under maintenance. We should be back shortly. Thank you for your patience.', array('%site' => variable_get('site_name', t('This Drupal site'))))));
+ print theme('maintenance_page', filter_xss_admin(variable_get('site_offline_message',
+ t('%site is currently under maintenance. We should be back shortly. Thank you for your patience.', array('%site' => variable_get('site_name', t('This Drupal site')))))));
}
/**
diff --git a/modules/contact.module b/modules/contact.module
index 076d284b0ec3582af5e2b13cf9157237847995ab..c9ddcca14f07ffdf68250d6a1a0ae15a4664d2f7 100644
--- a/modules/contact.module
+++ b/modules/contact.module
@@ -430,7 +430,7 @@ function contact_mail_page() {
if (count($categories) > 0) {
$form['#token'] = $user->name . $user->mail;
- $form['contact_information'] = array('#value' => variable_get('contact_form_information', t('You can leave us a message using the contact form below.')));
+ $form['contact_information'] = array('#value' => filter_xss_admin(variable_get('contact_form_information', t('You can leave us a message using the contact form below.'))));
$form['name'] = array('#type' => 'textfield',
'#title' => t('Your name'),
'#maxlength' => 255,
diff --git a/modules/contact/contact.module b/modules/contact/contact.module
index 076d284b0ec3582af5e2b13cf9157237847995ab..c9ddcca14f07ffdf68250d6a1a0ae15a4664d2f7 100644
--- a/modules/contact/contact.module
+++ b/modules/contact/contact.module
@@ -430,7 +430,7 @@ function contact_mail_page() {
if (count($categories) > 0) {
$form['#token'] = $user->name . $user->mail;
- $form['contact_information'] = array('#value' => variable_get('contact_form_information', t('You can leave us a message using the contact form below.')));
+ $form['contact_information'] = array('#value' => filter_xss_admin(variable_get('contact_form_information', t('You can leave us a message using the contact form below.'))));
$form['name'] = array('#type' => 'textfield',
'#title' => t('Your name'),
'#maxlength' => 255,
diff --git a/modules/filter.module b/modules/filter.module
index 2a4dc3cd38152e3d73b66e20a52c9fa8f94e4714..fe2e77e420a727688993d68810989b805cb994a0 100644
--- a/modules/filter.module
+++ b/modules/filter.module
@@ -1097,6 +1097,20 @@ function _filter_autop($text) {
return $output;
}
+/**
+ * Very permissive XSS/HTML filter for admin-only use.
+ *
+ * Use only for fields where it is impractical to use the
+ * whole filter system, but where some (mainly inline) mark-up
+ * is desired (so check_plain() is not acceptable).
+ *
+ * Allows all tags that can be used inside an HTML body, save
+ * for scripts and styles.
+ */
+function filter_xss_admin($string) {
+ return filter_xss($string, array('a', 'abbr', 'acronym', 'address', 'b', 'bdo', 'big', 'blockquote', 'br', 'caption', 'cite', 'code', 'col', 'colgroup', 'dd', 'del', 'dfn', 'div', 'dl', 'dt', 'em', 'h', 'h', 'h', 'h', 'h', 'h', 'hr', 'i', 'img', 'ins', 'kbd', 'li', 'object', 'ol', 'p', 'param', 'pre', 'q', 'samp', 'small', 'span', 'strong', 'sub', 'sup', 'table', 'tbody', 'td', 'tfoot', 'th', 'thead', 'tr', 'tt', 'ul', 'var'));
+}
+
/**
* Filters XSS. Based on kses by Ulf Harnhammar, see
* http://sourceforge.net/projects/kses
diff --git a/modules/filter/filter.module b/modules/filter/filter.module
index 2a4dc3cd38152e3d73b66e20a52c9fa8f94e4714..fe2e77e420a727688993d68810989b805cb994a0 100644
--- a/modules/filter/filter.module
+++ b/modules/filter/filter.module
@@ -1097,6 +1097,20 @@ function _filter_autop($text) {
return $output;
}
+/**
+ * Very permissive XSS/HTML filter for admin-only use.
+ *
+ * Use only for fields where it is impractical to use the
+ * whole filter system, but where some (mainly inline) mark-up
+ * is desired (so check_plain() is not acceptable).
+ *
+ * Allows all tags that can be used inside an HTML body, save
+ * for scripts and styles.
+ */
+function filter_xss_admin($string) {
+ return filter_xss($string, array('a', 'abbr', 'acronym', 'address', 'b', 'bdo', 'big', 'blockquote', 'br', 'caption', 'cite', 'code', 'col', 'colgroup', 'dd', 'del', 'dfn', 'div', 'dl', 'dt', 'em', 'h', 'h', 'h', 'h', 'h', 'h', 'hr', 'i', 'img', 'ins', 'kbd', 'li', 'object', 'ol', 'p', 'param', 'pre', 'q', 'samp', 'small', 'span', 'strong', 'sub', 'sup', 'table', 'tbody', 'td', 'tfoot', 'th', 'thead', 'tr', 'tt', 'ul', 'var'));
+}
+
/**
* Filters XSS. Based on kses by Ulf Harnhammar, see
* http://sourceforge.net/projects/kses
diff --git a/modules/forum.module b/modules/forum.module
index e3fcb0216c0f89bef3fe84de962089d4f86a911d..756b52e351b0b85b8dd201fe9ce7acc4bc114fde 100644
--- a/modules/forum.module
+++ b/modules/forum.module
@@ -935,7 +935,7 @@ function theme_forum_list($forums, $parents, $tid) {
$description .= ' <div class="name">'. l($forum->name, "forum/$forum->tid") ."</div>\n";
if ($forum->description) {
- $description .= ' <div class="description">'. check_plain($forum->description) ."</div>\n";
+ $description .= ' <div class="description">'. filter_xss_admin($forum->description) ."</div>\n";
}
$description .= "</div>\n";
@@ -952,7 +952,7 @@ function theme_forum_list($forums, $parents, $tid) {
$description .= ' <div class="name">'. l($forum->name, "forum/$forum->tid") ."</div>\n";
if ($forum->description) {
- $description .= ' <div class="description">'. check_plain($forum->description) ."</div>\n";
+ $description .= ' <div class="description">'. filter_xss_admin($forum->description) ."</div>\n";
}
$description .= "</div>\n";
diff --git a/modules/forum/forum.module b/modules/forum/forum.module
index e3fcb0216c0f89bef3fe84de962089d4f86a911d..756b52e351b0b85b8dd201fe9ce7acc4bc114fde 100644
--- a/modules/forum/forum.module
+++ b/modules/forum/forum.module
@@ -935,7 +935,7 @@ function theme_forum_list($forums, $parents, $tid) {
$description .= ' <div class="name">'. l($forum->name, "forum/$forum->tid") ."</div>\n";
if ($forum->description) {
- $description .= ' <div class="description">'. check_plain($forum->description) ."</div>\n";
+ $description .= ' <div class="description">'. filter_xss_admin($forum->description) ."</div>\n";
}
$description .= "</div>\n";
@@ -952,7 +952,7 @@ function theme_forum_list($forums, $parents, $tid) {
$description .= ' <div class="name">'. l($forum->name, "forum/$forum->tid") ."</div>\n";
if ($forum->description) {
- $description .= ' <div class="description">'. check_plain($forum->description) ."</div>\n";
+ $description .= ' <div class="description">'. filter_xss_admin($forum->description) ."</div>\n";
}
$description .= "</div>\n";
diff --git a/modules/node.module b/modules/node.module
index 32083046cf722cc6e4b8a1889bd92bcf2d080520..a48598fcc95cfb7c6226467571c98c6e849be811 100644
--- a/modules/node.module
+++ b/modules/node.module
@@ -48,7 +48,7 @@ function node_help($section) {
}
if (arg(0) == 'node' && arg(1) == 'add' && $type = arg(2)) {
- return variable_get($type .'_help', '');
+ return filter_xss_admin(variable_get($type .'_help', ''));
}
}
diff --git a/modules/node/node.module b/modules/node/node.module
index 32083046cf722cc6e4b8a1889bd92bcf2d080520..a48598fcc95cfb7c6226467571c98c6e849be811 100644
--- a/modules/node/node.module
+++ b/modules/node/node.module
@@ -48,7 +48,7 @@ function node_help($section) {
}
if (arg(0) == 'node' && arg(1) == 'add' && $type = arg(2)) {
- return variable_get($type .'_help', '');
+ return filter_xss_admin(variable_get($type .'_help', ''));
}
}
diff --git a/modules/taxonomy.module b/modules/taxonomy.module
index 69fe701abbc9382aade71132bff5ff2583b4db37..35bd0e613337039e80f58c0651ad76bed8e857bf 100644
--- a/modules/taxonomy.module
+++ b/modules/taxonomy.module
@@ -29,7 +29,7 @@ function taxonomy_link($type, $node = NULL) {
$links = array();
if (array_key_exists('taxonomy', $node)) {
foreach ($node->taxonomy as $term) {
- $links[] = l($term->name, taxonomy_term_path($term), array('rel' => 'tag', 'title' => $term->description));
+ $links[] = l($term->name, taxonomy_term_path($term), array('rel' => 'tag', 'title' => strip_tags($term->description)));
}
}
return $links;
diff --git a/modules/taxonomy/taxonomy.module b/modules/taxonomy/taxonomy.module
index 69fe701abbc9382aade71132bff5ff2583b4db37..35bd0e613337039e80f58c0651ad76bed8e857bf 100644
--- a/modules/taxonomy/taxonomy.module
+++ b/modules/taxonomy/taxonomy.module
@@ -29,7 +29,7 @@ function taxonomy_link($type, $node = NULL) {
$links = array();
if (array_key_exists('taxonomy', $node)) {
foreach ($node->taxonomy as $term) {
- $links[] = l($term->name, taxonomy_term_path($term), array('rel' => 'tag', 'title' => $term->description));
+ $links[] = l($term->name, taxonomy_term_path($term), array('rel' => 'tag', 'title' => strip_tags($term->description)));
}
}
return $links;
diff --git a/themes/engines/phptemplate/phptemplate.engine b/themes/engines/phptemplate/phptemplate.engine
index 97c95adc9600e789df72705693a79b5c29dfc61a..0a136a3ac4280decf2e0a57f42bbbb94eba63d92 100644
--- a/themes/engines/phptemplate/phptemplate.engine
+++ b/themes/engines/phptemplate/phptemplate.engine
@@ -143,7 +143,7 @@ function phptemplate_page($content) {
/* Set title and breadcrumb to declared values */
if (drupal_get_path_alias($_GET['q']) == variable_get('site_frontpage', 'node')) {
- $mission = filter_xss(theme_get_setting('mission'));
+ $mission = filter_xss_admin(theme_get_setting('mission'));
}
/* Add favicon */
@@ -188,7 +188,7 @@ function phptemplate_page($content) {
'breadcrumb' => theme('breadcrumb', drupal_get_breadcrumb()),
'closure' => theme('closure'),
'content' => '<!-- begin content -->' . $content . '<!-- end content -->',
- 'footer_message' => variable_get('site_footer', FALSE) . "\n" . theme('blocks', 'footer'),
+ 'footer_message' => filter_xss_admin(variable_get('site_footer', FALSE)) . "\n" . theme('blocks', 'footer'),
'head' => drupal_get_html_head(),
'head_title' => implode(' | ', $head_title),
'help' => theme('help'),