From: Moritz Bunkus <m.bunkus@linet.de>
Date: Wed, 10 Nov 2021 12:29:09 +0000 (+0100)
Subject: L/Presenter: Funktion zum Säubern von HTML von unerwünschten Tags
X-Git-Tag: kivitendo-mebil_0.1-0~10^2~2^2~269^2~11
X-Git-Url: http://wagnertech.de/git?a=commitdiff_plain;h=a30abed7783a6d000bb212562281f1ce50016ac2;p=kivitendo-erp.git

L/Presenter: Funktion zum Säubern von HTML von unerwünschten Tags
---

diff --git a/SL/Presenter/Text.pm b/SL/Presenter/Text.pm
index dd855fc09..2943a5aa2 100644
--- a/SL/Presenter/Text.pm
+++ b/SL/Presenter/Text.pm
@@ -3,13 +3,16 @@ package SL::Presenter::Text;
 use strict;
 
 use SL::Presenter::EscapedText qw(escape);
+use SL::HTML::Restrict;
 
 use Exporter qw(import);
-our @EXPORT_OK = qw(format_man_days simple_format truncate);
+our @EXPORT_OK = qw(format_man_days simple_format truncate restricted_html);
 our %EXPORT_TAGS = (ALL => \@EXPORT_OK);
 
 use Carp;
 
+my $html_cleaner;
+
 sub truncate {
   my ($text, %params) = @_;
 
@@ -43,6 +46,12 @@ sub format_man_days {
   escape($output);
 }
 
+sub restricted_html {
+  my ($value) = @_;
+  $html_cleaner //= SL::HTML::Restrict->create;
+  return $html_cleaner->process($value);
+}
+
 1;
 __END__
 
@@ -89,6 +98,11 @@ paragraph change: they close the current paragraph tag and start a new
 one. Single newlines are converted to line breaks. Carriage returns
 are removed.
 
+=item C<restricted_html $unsafe_html>
+
+Returns HTML code stripped from unwanted/unsupported content. This is
+done via the module L<SL::HTML::Restrict>.
+
 =back
 
 =head1 BUGS
diff --git a/SL/Template/Plugin/L.pm b/SL/Template/Plugin/L.pm
index 1beeb0477..451fba1cc 100644
--- a/SL/Template/Plugin/L.pm
+++ b/SL/Template/Plugin/L.pm
@@ -85,6 +85,7 @@ sub date_tag                 { return _call_presenter('date_tag',
 sub div_tag                  { return _call_presenter('div_tag',                  @_); }
 sub radio_button_tag         { return _call_presenter('radio_button_tag',         @_); }
 sub img_tag                  { return _call_presenter('img_tag',                  @_); }
+sub restricted_html          { return _call_presenter('restricted_html',          @_); }
 
 sub _set_id_attribute {
   my ($attributes, $name, $unique) = @_;