introducing a sanitize HTML function for the internal and the public API. This

allows to easily convert strings to HTML before displaying them on the web page
to reduce the risk of xss vulnerabilities.

diff --git a/lib/public/util.php b/lib/public/util.php
index d79d3f26b1e85dc6e1ee859df69860d26b047317..7c0cb6660779a987bdd38b1f63547e2818d68d96 100644 (file)
--- a/lib/public/util.php
+++ b/lib/public/util.php
@@ -264,6 +264,18 @@ class Util {
        public static function callCheck(){
                return(\OC_Util::callCheck());
        }
+       
+       /**\r
+        * @brief Used to sanitize HTML\r
+        *\r
+        * This function is used to sanitize HTML and should be applied on any string or array of strings before displaying it on a web page.\r
+        *\r
+        * @param string or array of strings\r
+        * @return array with sanitized strings or a single sinitized string, depends on the input parameter.\r
+        */\r
+       public static function sanitizeHTML( $value ){\r
+               return(\OC_Util::sanitizeHTML($value)); //Specify encoding for PHP<5.4\r
+       }
 }
 
 ?>

diff --git a/lib/util.php b/lib/util.php
index 0266a8ecc5f5f90da89c990feeaa3c15e52f67e9..bcfeb417c1dd104b080559d65e2a4dc465ecceee 100755 (executable)
--- a/lib/util.php
+++ b/lib/util.php
@@ -370,7 +370,7 @@ class OC_Util {
                $_SESSION['requesttoken-'.$token]=time();
 
                // cleanup old tokens garbage collector
-               // only run every 20th time so we don´t waste cpu cycles
+               // only run every 20th time so we don't waste cpu cycles
                if(rand(0,20)==0) {  
                        foreach($_SESSION as $key=>$value) {
                                // search all tokens in the session
@@ -426,4 +426,19 @@ class OC_Util {
                        exit;
                }
        }
+       
+       /**\r
+        * @brief Public function to sanitize HTML\r
+        *\r
+        * This function is used to sanitize HTML and should be applied on any string or array of strings before displaying it on a web page.
+        * 
+        * @param string or array of strings
+        * @return array with sanitized strings or a single sinitized string, depends on the input parameter.\r
+        */
+       public static function sanitizeHTML( &$value ){\r
+               if (is_array($value) || is_object($value)) array_walk_recursive($value,'OC_Util::sanitizeHTML');\r
+               else $value = htmlentities($value, ENT_QUOTES, 'UTF-8'); //Specify encoding for PHP<5.4\r
+               return $value;
+       }
+
 }