MDL-15810 whitelist _blank target in htmlpurifier cleaning; merged from MOODLE_19_STABLE

diff --git a/lib/weblib.php b/lib/weblib.php
index 656a382c98902a1667e840b99651e8482389e85e..33083fbd52f7f927d80b71adeefdc8ad7ffbb494 100644 (file)
--- a/lib/weblib.php
+++ b/lib/weblib.php
@@ -1886,6 +1886,7 @@ function purify_html($text) {
         $config->set('HTML', 'Doctype', 'XHTML 1.0 Transitional');
         $config->set('Cache', 'SerializerPath', $cachedir);
         $config->set('URI', 'AllowedSchemes', array('http'=>1, 'https'=>1, 'ftp'=>1, 'irc'=>1, 'nntp'=>1, 'news'=>1, 'rtsp'=>1, 'teamspeak'=>1, 'gopher'=>1, 'mms'=>1));
+        $config->set('Attr', 'AllowedFrameTargets', array('_blank'));
         $purifier = new HTMLPurifier($config);
     }
     return $purifier->purify($text);