From: Bram Matthys <redacted>
Date: Wed, 26 Apr 2023 17:52:25 +0000 (+0200)
Subject: Channel list: Run StripControlCharacters() on the topic
X-Git-Tag: 0.9~64
X-Git-Url: https://jfr.im/git/irc/unrealircd/unrealircd-webpanel.git/commitdiff_plain/064843a8e47d8d7c7c5d3c6d110c869053da1c84

Channel list: Run StripControlCharacters() on the topic

The alternative would be irc2html() from
https://github.com/unrealircd/unrealircd-webpanel/pull/24
but not so sure about that... it makes colors and other markup
done by random users show quite prominently on an admin panel.
---

diff --git a/api/channels.php b/api/channels.php
index cebe6b9..13c932a 100644
--- a/api/channels.php
+++ b/api/channels.php
@@ -19,7 +19,7 @@ foreach($channels as $channel)
 	$modes = (isset($channel->modes)) ? "+" . explode(" ",$channel->modes)[0] : "<none>";
 	$topic = '';
 	if (isset($channel->topic))
-		$topic = htmlentities($channel->topic, ENT_QUOTES | ENT_SUBSTITUTE | ENT_HTML401 | ENT_DISALLOWED);
+		$topic = htmlentities(StripControlCharacters($channel->topic), ENT_QUOTES | ENT_SUBSTITUTE | ENT_HTML401 | ENT_DISALLOWED);
 	$date = explode("T", $channel->creation_time)[0];
 	$out[] = [
 		"Name" => htmlspecialchars($channel->name),
diff --git a/misc/strings.php b/misc/strings.php
index 25cbdba..f5d5767 100644
--- a/misc/strings.php
+++ b/misc/strings.php
@@ -192,4 +192,19 @@ function rparv($string)
 	if ($string)
 		return $string;
 	return false;
-}
\ No newline at end of file
+}
+
+/* Taken from https://www.aviran.org/stripremove-irc-client-control-characters/
+ * We may want to re-base it off our UnrealIRCd's one though.
+ */
+function StripControlCharacters($text)
+{
+    $controlCodes = array(
+        '/(\x03(?:\d{1,2}(?:,\d{1,2})?)?)/',    // Color code
+        '/\x02/',                               // Bold
+        '/\x0F/',                               // Escaped
+        '/\x16/',                               // Italic
+        '/\x1F/'                                // Underline
+    );
+    return preg_replace($controlCodes,'',$text);
+}