upload: common function to parse user text input

Move duplicate code from issue and reply pages.

diff --git a/issue/index.php b/issue/index.php
index bb556f2019d6e259d70ca8a943cdc40757b75c50..82fa39e024287b442086c82dd824e8010a24d8b5 100644 (file)
--- a/issue/index.php
+++ b/issue/index.php
@@ -37,12 +37,11 @@ if ($id and ctype_digit($id)) {
 }
 
 if ($_POST) {
-               $html = nl2br(htmlspecialchars($_POST['body']));
-               $html = empty($html) ? NULL : "<p>$html</p>";
+               require_once 'upload.inc.php';
                $query = $Db->set('issues', [
                        'page'    => $Page,
                        'subject' => $_POST['subject'],
-                       'body'    => $html,
+                       'body'    => messagehtml($_POST['body']),
                        'author'  => $User->login,
                ]);
                if (!$query->rowCount()) {

diff --git a/upload.inc.php b/upload.inc.php
index c578a2dc66ab36c0d36c772ff00ea1ab7868aad4..ed9ee772eccf99f8595f69efd67ee16d57432b1d 100644 (file)
--- a/upload.inc.php
+++ b/upload.inc.php
@@ -37,3 +37,14 @@ function userupload($input, $target = NULL, $filename = NULL)
        }
        return $target;
 }
+
+function messagehtml($input)
+{
+       # convert user textarea post to formatted html
+       if (empty($input)) {
+               return;
+       }
+       $html = htmlspecialchars($input);
+       $html = nl2br($html);
+       return "<p>$html</p>";
+}

diff --git a/widget/reply.php b/widget/reply.php
index 43b773bead82752eef7f727a9afb5708b7645430..94018c4e2492606caaa4845a58d78f23bf1b5b1e 100644 (file)
--- a/widget/reply.php
+++ b/widget/reply.php
@@ -7,12 +7,11 @@ $journalcol = [
 ];
 
 if ($_POST) {
+       require_once 'upload.inc.php';
        try {
-               $html = nl2br(htmlspecialchars($_POST['reply']));
-               $html = empty($html) ? NULL : "<p>$html</p>";
                $query = $Db->set('comments', [
                        'page'    => $Page,
-                       'message' => $html,
+                       'message' => messagehtml($_POST['reply']),
                        'author'  => $User->login,
                ]);
                if (!$query->rowCount()) {