diff options
| author | polo <ordipolo@gmx.fr> | 2025-03-28 11:51:49 +0100 |
|---|---|---|
| committer | polo <ordipolo@gmx.fr> | 2025-03-28 11:51:49 +0100 |
| commit | fb69a844f1ce20fd6ba4bbbb352004bfc5d881af (patch) | |
| tree | 3fc771929f4e24af6a93a7e49816f0571d97ae5f /src | |
| parent | c9b69caa9201b8f05c7e4e413253392dac911537 (diff) | |
| download | cms-fb69a844f1ce20fd6ba4bbbb352004bfc5d881af.tar.gz cms-fb69a844f1ce20fd6ba4bbbb352004bfc5d881af.tar.bz2 cms-fb69a844f1ce20fd6ba4bbbb352004bfc5d881af.zip | |
Security autorise iframe pour les vidéos
Diffstat (limited to 'src')
| -rw-r--r-- | src/controller/Security.php | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/src/controller/Security.php b/src/controller/Security.php index ab59d07..818a2bd 100644 --- a/src/controller/Security.php +++ b/src/controller/Security.php | |||
| @@ -1,7 +1,7 @@ | |||
| 1 | <?php | 1 | <?php |
| 2 | // src/controller/Security.php | 2 | // src/controller/Security.php |
| 3 | // | 3 | // |
| 4 | // utilise htmlawed contre les faille XSS | 4 | // htmlawed nettoie les entrées de l'utilisateur, en particulier le html de l'éditeur |
| 5 | 5 | ||
| 6 | class Security | 6 | class Security |
| 7 | { | 7 | { |
| @@ -9,7 +9,7 @@ class Security | |||
| 9 | 'safe'=>1, // protection contre les élements et attributs dangereux | 9 | 'safe'=>1, // protection contre les élements et attributs dangereux |
| 10 | 10 | ||
| 11 | // liste blanche d'éléments HTML | 11 | // liste blanche d'éléments HTML |
| 12 | 'elements'=> 'h1, h2, h3, h4, h5, h6, p, s, em, span, strong, a, ul, ol, li, sup, sub, code, blockquote, div, pre, table, caption, colgroup, col, tbody, tr, th, td, figure, img, figcaption', | 12 | 'elements'=> 'h1, h2, h3, h4, h5, h6, p, s, em, span, strong, a, ul, ol, li, sup, sub, code, blockquote, div, pre, table, caption, colgroup, col, tbody, tr, th, td, figure, img, figcaption, iframe, small', |
| 13 | 13 | ||
| 14 | // liste noire d'attributs HTML | 14 | // liste noire d'attributs HTML |
| 15 | 'deny_attribute'=> 'id, class' // on garde 'style' | 15 | 'deny_attribute'=> 'id, class' // on garde 'style' |