diff --git a/app/src/Controller/PagesController.php b/app/src/Controller/PagesController.php index 669a4100..240421c8 100644 --- a/app/src/Controller/PagesController.php +++ b/app/src/Controller/PagesController.php @@ -23,6 +23,8 @@ use Cake\ORM\TableRegistry; use Cake\View\Exception\MissingTemplateException; use \App\Lib\Enum\SuspendableStatusEnum; +use Symfony\Component\HtmlSanitizer\HtmlSanitizer; +use Symfony\Component\HtmlSanitizer\HtmlSanitizerConfig; /** * Static content controller @@ -130,7 +132,17 @@ public function show(string $coid, string $name) { $this->set('vv_bc_skip', true); // this doesn't do anything? $this->set('vv_title', $msp->title); - $this->set('vv_body', $msp->body); + + // Mostly Static Pages allow HTML input. Pass this through the Symfony HTML Sanitizer to + // disallow dom elements like