[markdown] Escape mentions which username can contain Markdown-like syntax

[friendica-addons.git/.git] / markdown / markdown.php

diff --git a/markdown/markdown.php b/markdown/markdown.php
index bd0e022..4f12e71 100644 (file)
--- a/markdown/markdown.php
+++ b/markdown/markdown.php
@@ -7,11 +7,9 @@
  */
 use Friendica\App;
 use Friendica\Core\Hook;
-use Friendica\Core\Logger;
 use Friendica\Content\Text\Markdown;
 use Friendica\Core\Renderer;
-use Friendica\Core\PConfig;
-use Friendica\Core\L10n;
+use Friendica\DI;
 
 function markdown_install() {
        Hook::register('post_local_start',      __FILE__, 'markdown_post_local_start');
@@ -25,13 +23,13 @@ function markdown_addon_settings(App $a, &$s)
                return;
        }
 
-       $enabled = intval(PConfig::get(local_user(), 'markdown', 'enabled'));
+       $enabled = intval(DI::pConfig()->get(local_user(), 'markdown', 'enabled'));
 
        $t = Renderer::getMarkupTemplate('settings.tpl', 'addon/markdown/');
        $s .= Renderer::replaceMacros($t, [
-               '$title'   => L10n::t('Markdown'),
-               '$enabled' => ['enabled', L10n::t('Enable Markdown parsing'), $enabled, L10n::t('If enabled, self created items will additionally be parsed via Markdown.')],
-               '$submit'  => L10n::t('Save Settings'),
+               '$title'   => DI::l10n()->t('Markdown'),
+               '$enabled' => ['enabled', DI::l10n()->t('Enable Markdown parsing'), $enabled, DI::l10n()->t('If enabled, self created items will additionally be parsed via Markdown.')],
+               '$submit'  => DI::l10n()->t('Save Settings'),
        ]);
 }
 
@@ -41,33 +39,25 @@ function markdown_addon_settings_post(App $a, &$b)
                return;
        }
 
-       PConfig::set(local_user(), 'markdown', 'enabled', intval($_POST['enabled']));
+       DI::pConfig()->set(local_user(), 'markdown', 'enabled', intval($_POST['enabled']));
 }
 
 function markdown_post_local_start(App $a, &$request) {
-       if (empty($request['body']) || !PConfig::get(local_user(), 'markdown', 'enabled')) {
+       if (empty($request['body']) || !DI::pConfig()->get(local_user(), 'markdown', 'enabled')) {
                return;
        }
 
-       // Elements that shouldn't be parsed
-       $elements = ['code', 'noparse', 'nobb', 'pre'];
-       foreach ($elements as $element) {
-               $request['body'] = preg_replace_callback("/\[" . $element . "\](.*?)\[\/" . $element . "\]/ism",
-                       function ($match)  use ($element) {
-                               return '[base64' . $element . ']' . base64_encode($match[1]) . '[/base64' . $element . ']';
-                       },
-                       $request['body']
-               );
-       }
-
-       $request['body'] = Markdown::toBBCode($request['body']);
-
-       foreach (array_reverse($elements) as $element) {
-               $request['body'] = preg_replace_callback("/\[base64" . $element . "\](.*?)\[\/base64" . $element . "\]/ism",
-                       function ($match)  use ($element) {
-                               return '[' . $element . ']' . base64_decode($match[1]) . '[/' . $element . ']';
-                       },
-                       $request['body']
-               );
-       }
+       // Escape elements that shouldn't be parsed
+       $request['body'] = \Friendica\Content\Text\BBCode::performWithEscapedTags(
+               $request['body'],
+               ['code', 'noparse', 'nobb', 'pre', 'share', 'url', 'img', 'bookmark',
+                       'audio', 'video', 'youtube', 'vimeo', 'attachment', 'iframe', 'map', 'mail'],
+               function ($body) {
+                       // Escape mentions which username can contain Markdown-like characters
+                       // See https://github.com/friendica/friendica/issues/9486
+                       return \Friendica\Util\Strings::performWithEscapedBlocks($body, '/[@!][^@\s]+@[^\s]+\w/', function ($text) {
+                               return Markdown::toBBCode($text);
+                       });
+               }
+       );
 }