9 Commits

Author SHA1 Message Date
Tim Almdal
7ea13b3869 Normalize capitalization ticket #596 2009-10-28 12:15:52 -07:00
Bharat Mediratta
2aad580f53 Move specialized (pretty) url generation back into Item_Model so that
we're not relying on overriding url::site() to do tricks around item
urls.  This means that you won't get item urls by doing
url::site("albums/37"), for example, but it also means that we won't
get pretty urls where we don't expect them (like in the action of a
<form> element).

Incidentally, this will help us move over to using the slug format
because if you've got a bad character in a url, the edit forms will
now work on it since they'll be id based.
2009-09-08 13:44:52 -07:00
Andy Staudacher
b9bd1681a3 Update all code to use helper method html::clean(), html::purify(), ... instead of SafeString directly. 2009-08-29 22:54:20 -07:00
Andy Staudacher
c01ac42c46 Refactor all calls of p::clean() to SafeString::of() and p::purify() to SafeString::purify().
Removing any p::clean() calls for arguments to t() and t2() since their args are wrapped in a SafeString anyway.
2009-08-29 12:48:40 -07:00
Tim Almdal
d6648c0aff Fix for ticket #477. Use nl2br method when rendering comment::text and
item::description.  In addition add p::clean or p::purify to places that
xss cleaning had missed (i.e. rss feeds)
2009-07-04 08:17:12 -07:00
Tim Almdal
54ffea2419 Split the clean method into two clean and purify. clean is a light weight
approach using html::specialchars and purify uses HTMLPurifier to intelligently
cleanse the output fields. Use purifier for text and title fields where it is
likely that a user would enter html to format their data.
2009-07-03 21:44:10 -07:00
Bharat Mediratta
708f27f483 Run p::clean() on any variables that contain data entered by users. 2009-05-31 00:11:48 -07:00
Bharat Mediratta
b493a534f2 A variety of cleanups:
* Allow for the "movie" type in all of our text
* Try to follow the pattern of mainly only passing ORM objects
  to the view and let it generate its own text (this becomes
  even more important when 3rd parties want to customize notification
  messages)
* Rename _send_message to be _notify_subscribers to be more acccurate
  and have it explicitly take a subject in the API
* Use Item_Model::url() in the views instead of hand crafting URLs
* Reformat HTML in views
* Use $comment->author_xxx() functions instead of replicating that code
* Fix several places where we were encoding data by doing ucfirst($item->type)
  with conditionals where we form the text properly.  We should *never*
  be showing data types to the end user!  This is not localizable!

Note that this probably breaks the existing batch processing code.  I
am going to redo that in a subsequent pass.
2009-03-04 06:25:55 +00:00
Tim Almdal
ef58ac91e8 Notifications now send emails when a comment is published. It won't
send the email if the comment status is not published.  This gives the
administrator to moderate the comments prior to being published.
2009-02-02 15:41:47 +00:00