10 Commits

Author SHA1 Message Date
Johan Cwiklinski
6746792bdf Drop short_tags 2018-05-19 17:01:37 +02:00
Bharat Mediratta
882a6d9a5d Convert a couple of instances of Item_Model::url(array(), true) to Item_Model::abs_url() 2009-09-10 21:33:04 -07:00
Andy Staudacher
b9bd1681a3 Update all code to use helper method html::clean(), html::purify(), ... instead of SafeString directly. 2009-08-29 22:54:20 -07:00
Andy Staudacher
c01ac42c46 Refactor all calls of p::clean() to SafeString::of() and p::purify() to SafeString::purify().
Removing any p::clean() calls for arguments to t() and t2() since their args are wrapped in a SafeString anyway.
2009-08-29 12:48:40 -07:00
Bharat Mediratta
b1f93f358a Fix typo in p::purify() call. 2009-07-09 16:18:39 -07:00
Tim Almdal
d6648c0aff Fix for ticket #477. Use nl2br method when rendering comment::text and
item::description.  In addition add p::clean or p::purify to places that
xss cleaning had missed (i.e. rss feeds)
2009-07-04 08:17:12 -07:00
Tim Almdal
54ffea2419 Split the clean method into two clean and purify. clean is a light weight
approach using html::specialchars and purify uses HTMLPurifier to intelligently
cleanse the output fields. Use purifier for text and title fields where it is
likely that a user would enter html to format their data.
2009-07-03 21:44:10 -07:00
Bharat Mediratta
708f27f483 Run p::clean() on any variables that contain data entered by users. 2009-05-31 00:11:48 -07:00
Bharat Mediratta
b493a534f2 A variety of cleanups:
* Allow for the "movie" type in all of our text
* Try to follow the pattern of mainly only passing ORM objects
  to the view and let it generate its own text (this becomes
  even more important when 3rd parties want to customize notification
  messages)
* Rename _send_message to be _notify_subscribers to be more acccurate
  and have it explicitly take a subject in the API
* Use Item_Model::url() in the views instead of hand crafting URLs
* Reformat HTML in views
* Use $comment->author_xxx() functions instead of replicating that code
* Fix several places where we were encoding data by doing ucfirst($item->type)
  with conditionals where we form the text properly.  We should *never*
  be showing data types to the end user!  This is not localizable!

Note that this probably breaks the existing batch processing code.  I
am going to redo that in a subsequent pass.
2009-03-04 06:25:55 +00:00
Tim Almdal
69a7e238a4 As we stagger towards completing the notification module.
Item changes and Item additions email notifications with this change.
Still to come is item deleted, comment added and comment updated.
2009-02-02 03:09:17 +00:00