From: Ben Sherratt <redacted>
Date: Sun, 19 Nov 2023 16:41:33 +0000 (+0000)
Subject: allow html in body of posts
X-Git-Url: https://git.bts.cx/cx.git/commitdiff_plain/e1d26b122679e534e407a662457c3e054d1f20d8?ds=inline

allow html in body of posts
---

diff --git a/cx/cx.php b/cx/cx.php
index cbe7646..a47714b 100644
--- a/cx/cx.php
+++ b/cx/cx.php
@@ -125,7 +125,7 @@ function cx_route($path) {
 					$date = cx_form_input_sanitized_date_time('post_date');
 					if (isset($date) == false) $date = null;
 					$draft = cx_form_input_sanitized('post_is_draft') == 'draft';
-					$data = cx_form_input_sanitized('post_data');
+					$data = cx_form_input_sanitized_allowing_html('post_data');
 					
 					if (isset($_GET['id']) == false or $_GET['id'] == 0) {
 						cx_posts_add_post(1, $title, $slug, $date, $draft, $data);
diff --git a/cx/lib/form.php b/cx/lib/form.php
index d5e4e56..dd7b60c 100644
--- a/cx/lib/form.php
+++ b/cx/lib/form.php
@@ -1,10 +1,19 @@
 <?php
 
 function cx_form_input_sanitized($name) {
+	$input = cx_form_input_sanitized_allowing_html($name);
+
+	if ($input != null) {
+		$input = strip_tags($input);
+	}
+	
+	return $input;
+}
+
+function cx_form_input_sanitized_allowing_html($name) {
 	if (array_key_exists($name, $_POST)) {
 		$insecure_input = $_POST[$name];
-		$tagless_input = strip_tags($insecure_input);
-		return $tagless_input;
+		return $insecure_input;
 	} else {
 		return null;
 	}