Fix commenting on news so that html is stripped

Author: carlbennett

src/libraries/Comment.php

@@ -153,7 +153,7 @@ public function getContent($prepare) {
       return $this->content;
     }
     $md = new Markdown();
-    return $md->text($this->content);
+    return $md->text(filter_var($this->content, FILTER_SANITIZE_FULL_SPECIAL_CHARS));
   }
 
   public function getCreatedDateTime() {

src/templates/News/View.phtml

@@ -76,7 +76,7 @@ require("./header.inc.phtml");
 <?php } ?>
         <section class="news"><img class="category" alt="<?php echo $object->getCategory()->getLabel(); ?>" title="<?php echo $object->getCategory()->getLabel(); ?>" src="<?php echo Common::relativeUrlToAbsolute("/a/news_categories/" . $object->getCategory()->getFilename()); ?>"/><?php echo $object->getContent(true); ?></section>
         <footer>
-          <span class="float-left"><a href="<?php echo $user_url; ?>"><img class="avatar" src="<?php echo $user_avatar; ?>"/> <?php echo htmlspecialchars($user_name, ENT_HTML5, "UTF-8"); ?></a></span>
+          <span class="float-left"><a href="<?php echo $user_url; ?>"><img class="avatar" src="<?php echo $user_avatar; ?>"/> <?php echo filter_var($user_name, FILTER_SANITIZE_STRING); ?></a></span>
 <?php if ($object->getEditedDateTime() !== null) { ?>
           <span class="float-right"><?php echo $object->getCreatedDateTime()->format("l, F j, Y"); ?> | Edited: <?php echo $object->getEditedDateTime()->format("l, F j, Y"); ?></span>
 <?php } else { ?>
@@ -98,25 +98,26 @@ require("./header.inc.phtml");
         $c_user_url    = $c_user->getURI();
         $c_user_avatar = $c_user->getAvatarURI(22);
 ?>
-            <tr><td><a href="<?php echo $c_user_url; ?>"><img class="avatar" src="<?php echo $c_user_avatar; ?>"/> <?php echo htmlspecialchars($c_user_name, ENT_HTML5, "UTF-8"); ?></a><br/><time class="comment_timestamp" datetime="<?php echo $c->getCreatedDateTime()->format("c"); ?>"><?php echo $c->getCreatedDateTime()->format("D M j, Y g:ia T"); ?></time></td><td><?php echo $c->getContent(true); ?></td></tr>
+            <tr><td><a href="<?php echo $c_user_url; ?>"><img class="avatar" src="<?php echo $c_user_avatar; ?>"/> <?php echo filter_var($c_user_name, FILTER_SANITIZE_STRING); ?></a><br/><time class="comment_timestamp" datetime="<?php echo $c->getCreatedDateTime()->format("c"); ?>"><?php echo $c->getCreatedDateTime()->format("D M j, Y g:ia T"); ?></time></td><td><?php echo $c->getContent(true); ?></td></tr>
 <?php } ?>
           </tbody></table>
 <?php } ?>
         </section>
 <?php if ($logged_in) { ?>
         <section>
+          <hr/>
           <form method="POST" action="<?php echo Common::relativeUrlToAbsolute("/comment/create"); ?>">
             <input type="hidden" name="parent_type" value="<?php echo Comment::PARENT_TYPE_NEWS_POST; ?>"/>
-            <input type="hidden" name="parent_id" value="<?php echo htmlspecialchars($object_id, ENT_HTML5, "UTF-8"); ?>"/>
+            <input type="hidden" name="parent_id" value="<?php echo $object_id; ?>"/>
             <p class="center"><label for="comment-content">Comment on this post:</label></p>
             <p class="center"><textarea id="comment-content" name="content" cols="80" rows="5"></textarea></p>
             <p class="center"><input type="submit" value="Comment"/></p>
           </form>
         </section>
 <?php } ?>
 <?php } else { ?>
-        <header class="red"><?php echo htmlspecialchars($title, ENT_HTML5, "UTF-8"); ?></header>
-        <section class="red"><?php echo htmlspecialchars($description, ENT_HTML5, "UTF-8"); ?></section>
+        <header class="red"><?php echo filter_var($title, FILTER_SANITIZE_STRING); ?></header>
+        <section class="red"><?php echo filter_var($description, FILTER_SANITIZE_STRING); ?></section>
 <?php } ?>
       </article>
 <?php require("./footer.inc.phtml"); ?>