Changeset 22660 for branches/2.5/include/config_default.inc.php

Timestamp:

May 14, 2013, 10:04:33 AM (11 years ago)

Author:

plg

Message:

feature 2899: ability to allow HTML in EXIF/IPTC (disabled by default)

File:

• branches/2.5/include/config_default.inc.php (modified) (1 diff)

branches/2.5/include/config_default.inc.php

@@ -374 +374 @@
   'date_creation' => 'DateTimeOriginal'
   );
+
+// allow_html_in_metadata: in case the origin of the photo is unsecure (user
+// upload), we remove HTML tags to avoid XSS (malicious execution of
+// javascript)
+$conf['allow_html_in_metadata'] = false;
 
 // +-----------------------------------------------------------------------+