html: allow inline images by default (because of custom emoji)

diff --git a/config/config.exs b/config/config.exs
index b3889ba12bc16c9f5dffe7941ba9561d18e110f6..d5c5b7902e1534c0e0a29979462c9fbf67f930b8 100644 (file)
--- a/config/config.exs
+++ b/config/config.exs
@@ -77,7 +77,9 @@ config :pleroma, :instance,
   managed_config: true
 
 config :pleroma, :markup,
-  allow_inline_images: false,
+  # XXX - unfortunately, inline images must be enabled by default right now, because
+  # of custom emoji.  Issue #275 discusses defanging that somehow.
+  allow_inline_images: true,
   allow_headings: false,
   allow_tables: false,
   allow_fonts: false,

diff --git a/lib/pleroma/html.ex b/lib/pleroma/html.ex
index 1c62f2ccc2e9617636c134141d741b1c85147b56..107784e70496219156c616e17561e0285a94fd3d 100644 (file)
--- a/lib/pleroma/html.ex
+++ b/lib/pleroma/html.ex
@@ -37,6 +37,21 @@ defmodule Pleroma.HTML.Scrubber.TwitterText do
 
   # microformats
   Meta.allow_tag_with_these_attributes("span", [])
+
+  # allow inline images for custom emoji
+  @markup Application.get_env(:pleroma, :markup)
+  @allow_inline_images Keyword.get(@markup, :allow_inline_images)
+
+  if @allow_inline_images do
+    Meta.allow_tag_with_uri_attributes("img", ["src"], @valid_schemes)
+
+    Meta.allow_tag_with_these_attributes("img", [
+      "width",
+      "height",
+      "title",
+      "alt"
+    ])
+  end
 end
 
 defmodule Pleroma.HTML.Scrubber.Default do