From ff906e49a23d46ab45c17436283aac911536b638 Mon Sep 17 00:00:00 2001 From: Travis Carden Date: Tue, 21 Feb 2012 16:50:06 -0600 Subject: [PATCH] Issue #1449332: Accept HTML Purifier as alternative to HTML Filter. --- security_review.inc | 6 +++--- 1 files changed, 3 insertions(+), 3 deletions(-) diff --git a/security_review.inc b/security_review.inc index 65c56d6..ce150d5 100644 --- a/security_review.inc +++ b/security_review.inc @@ -300,9 +300,9 @@ function security_review_check_input_formats() { if (!empty($intersect)) { // Untrusted users can use this format. $filters = filter_list_format($format->format); - // Check format for HTML filter. - if (in_array('filter/0', array_keys($filters))) { - // Using HTML Filter, good! Now check allowed tags if the filter is stripping instead of escaping. + // Check format for an HTML filter. + if (count(array_intersect(array('filter/0', 'htmlpurifier/0', 'htmlpurifier/1'), array_keys($filters)))) { + // Using an HTML filter, good! Now check allowed tags if the filter is stripping instead of escaping. $setting = variable_get("filter_html_" . $format->format, FILTER_HTML_STRIP); if ($setting == FILTER_HTML_STRIP) { // Check for unsafe tags in allowed tags. -- 1.7.4.1