Allow <IMG> tags in Moodle format text. Not having it can really mess

up smileys etc if the text has been edited at any stage using the
richtext editor.

I realise it's possible for students to really mess up forums display
etc if they wanted to include a huge picture ... I'm not sure if there
are any cross-site scripting attacks possible with images in there.

But there is also now the HTML format for most things, which is editable
using an ordinary form, so this problem is currently already exposed.

I think it's OK as long as can find a filter to strip all javascript
out of ANY format text in Moodle.

diff --git a/lib/languages.php b/lib/languages.php
index 812a03006b0200ab83a1c809a255c5cdd7db5445..4fa0f44518ecf8df17d6c1e9c149bd996bb9a561 100644 (file)
--- a/lib/languages.php
+++ b/lib/languages.php
@@ -115,6 +115,7 @@ $LANGUAGES = array (
 "pl" => "Polish",\r
 "ps" => "Pushto",\r
 "pt" => "Portuguese",\r
+"pt_br" => "Portuguese (Brazil)",\r
 "qu" => "Quechua",\r
 "rm" => "Raeto-Romance",\r
 "rn" => "Rundi",\r

diff --git a/lib/moodlelib.php b/lib/moodlelib.php
index 95b4c4b7a2c042d39d8d2e0f35cd55e3c2de750d..ccc10feaf27499def6f34b17d0da4eb3f36c4e11 100644 (file)
--- a/lib/moodlelib.php
+++ b/lib/moodlelib.php
@@ -116,7 +116,7 @@ function print_navigation ($navigation) {
 }
 
 function print_heading($text, $align="CENTER", $size=3) {
-    echo "<P ALIGN=\"$align\"><FONT SIZE=\"$size\"><B>$text</B></FONT></P>";
+    echo "<P ALIGN=\"$align\"><FONT SIZE=\"$size\"><B>".stripslashes($text)."</B></FONT></P>";
 }
 
 function print_continue($link) {

diff --git a/lib/weblib.php b/lib/weblib.php
index 8a32e13d74445c5a43f652ed80fd6a43874bc908..2aac5658a1fac1c2d637da9082af87336d01d109 100644 (file)
--- a/lib/weblib.php
+++ b/lib/weblib.php
@@ -351,7 +351,7 @@ function clean_text($text, $format) {
 
     switch ($format) {
         case FORMAT_MOODLE:
-            return strip_tags($text, '<b><i><u><font><ol><ul><dl><li><dt><dd><h1><h2><h3><hr>');
+            return strip_tags($text, '<b><i><u><font><ol><ul><dl><li><dt><dd><h1><h2><h3><hr><img>');
             break;
 
         case FORMAT_HTML: