Sanitizer Plugin for Kirby

Handle untrusted user input, e.g. in comments or any other user-submitted form with confidence. The Sanitizer plugin escaped all unsafe HTML tags, corrects illegally nested HTML tags and syntax errors, while keeping a small, well-formed subset of all the HTML tags in existance. Optionally, Markdown can also be enabled.

Installation

Download

Download and copy this repository to /site/plugins/kirby-sanitizer.

Git submodule

git submodule add https://github.com/avoskitchen/kirby-sanitizer.git site/plugins/kirby-sanitizer

Composer

composer require avoskitchen/kirby-sanitizer

Setup

Use the provided helper function sanitize(string $html, array $options = []) in your templates or anywhere else, where you need for sanitize untrusted HTML input. You can also use the corresponding field method $field->sanitize(array $options = []).

Options

Key	Default value	Description
dir	null	Sets the text direction of the input HTML. If null, the current locale setting of Kirby is used.
markdown	false	Parse Markdown commands before sanitization.
smartypants	null	If not specified, Kirby’s default setting is used.
allowlinks	true	Allow links in output HTML.
autolinks	true	Automatically convert all URLs to links. If allowlinks is set to false, this option has no effect.
headingClass	{{ tag }}-sanitized	Class to apply to replaced headlines. Available playeholders: {{ tag }} = The full tag name of the replaced (<h[1-6]>) element / {{ level }} = The level ([1-6]) of the replaced element.

You can set global defaults, by prepending any of the options above with the plugin namespace (avoskitchen.sanitizer):

# site/config/config.php

return [
  'avoskitchen.sanitizer.allowlinks' => false,
];

Development

I created this plugin for my own purposes. I will try my best if you report a bug, but if you need any new features, please be aware that I don’t really have time to develop them for your needs. But you are welcome to support the development of this plugin by contributing code. I’m happy to help you with that, if I can.

License

LPGL

Credits

• Fabian Michael

Third-party Libraries

• HTML Purifier, released under the LGPL
• html5-php, released under the HTML5-PHP license