strip all html tags from author and title, fix #287

1 files changed, 12 insertions, 1 deletions

diff --git a/db/item.php b/db/item.php
index 6a627d8ff..332fd630e 100644
--- a/db/item.php
+++ b/db/item.php
@@ -74,7 +74,7 @@ class Item extends Entity implements IAPI {
 		$this->markFieldUpdated('status');
 		$this->status |= StatusFlag::STARRED;
 	}
-	
+
 	public function isStarred() {
 		return ($this->status & StatusFlag::STARRED) === StatusFlag::STARRED;
 	}
@@ -108,5 +108,16 @@ class Item extends Entity implements IAPI {
 		);
 	}
 
+
+	public function setAuthor($name) {
+		parent::setAuthor(strip_tags($name));
+	}
+
+
+	public function setTitle($title) {
+		parent::setTitle(strip_tags($title));
+	}
+
+
 }