From 1619dd379d79482e58696eea6c4fea7a03f9e65f Mon Sep 17 00:00:00 2001 From: Rodrigo Aguilera Date: Sun, 12 Jul 2020 19:03:18 +0200 Subject: Allow data URI scheme inside the body of an item. Signed-off-by: Rodrigo Aguilera --- lib/AppInfo/Application.php | 14 ++++++++++++++ 1 file changed, 14 insertions(+) (limited to 'lib/AppInfo') diff --git a/lib/AppInfo/Application.php b/lib/AppInfo/Application.php index faafa471c..ef60c538e 100644 --- a/lib/AppInfo/Application.php +++ b/lib/AppInfo/Application.php @@ -153,6 +153,20 @@ class Application extends App 'player.vimeo.com/video/|' . 'vk.com/video_ext.php)%' ); //allow YouTube and Vimeo + + // Additionally to the defaults, allow the data URI scheme. + // See http://htmlpurifier.org/live/configdoc/plain.html#URI.AllowedSchemes + $config->set('URI.AllowedSchemes', [ + 'http' => true, + 'https' => true, + 'data' => true, + 'mailto' => true, + 'ftp' => true, + 'nntp' => true, + 'news' => true, + 'tel' => true, + ]); + $def = $config->getHTMLDefinition(true); $def->addAttribute('iframe', 'allowfullscreen', 'Bool'); return new HTMLPurifier($config); -- cgit v1.2.3