How do I clean a discussion forum post from XSS attacks in EE?
A bit of background, I'm using the EE discussion module and I've dropped in ckeditor so the user can easily embed youtube/vimeo videos and images. I set "HTML Formatting in posts" to "Allow all HTML" so it will accept the iframed videos. However this leaves it open to XSS attacks as users can then put in any scripts they like. I'd like to whitelist just iframes to youtube & vimeo, links, images and a few tags like p and strong.
I thought of adjusting the settings in the discussion module but they seem very much hardcoded. I thought of using http://htmlpurifier.org/ to whitelist tags but the forum_submit_post_start hook doesn't contain the post content and I guess by the time the forum_submit_post_end hook is called it's too late.
Any ideas?
iframe
is one of many blacklisted tags that are never accepted on front end input.iframe
from the$naughty
list insystem\codeigniter\system\core\Security.php
so it would accept iframes. But I only want it to accept iframes where the src is using the youtube or vimeo domain.