From 764167136fd21eaa3386f61cf2cc7fa7cb4538c5 Mon Sep 17 00:00:00 2001
From: "Eloy Lafuente (stronk7)" <stronk7@moodle.org>
Date: Mon, 8 Jul 2019 16:09:40 +0200
Subject: [PATCH] MDL-66104 output: HTMLPurifier to allow <nolink> tags
 everywhere

Before the patch, HTMLPurifier was instructed to handle <nolink>
tags in block mode. That implies that any block tag enclosing it
had to be closed for HTML compliance.

But <noscript> tags are not part of the final output (they are
removed) but just internally used to skip filtering certain areas.

So they can be virtually everywhere, HTMLPurifier just should allow
them without any change, both to parent or children tags.
---
 lib/tests/htmlpurifier_test.php | 5 +++++
 lib/weblib.php                  | 2 +-
 2 files changed, 6 insertions(+), 1 deletion(-)

diff --git a/lib/tests/htmlpurifier_test.php b/lib/tests/htmlpurifier_test.php
index e14b3191fdf..f1ae916c93a 100644
--- a/lib/tests/htmlpurifier_test.php
+++ b/lib/tests/htmlpurifier_test.php
@@ -64,6 +64,11 @@ class core_htmlpurifier_testcase extends basic_testcase {
         $text = '<nolink>xxx<em>xx</em><div>xxx</div></nolink>';
         $result = purify_html($text, array());
         $this->assertSame($text, $result);
+
+        // Ensure nolink doesn't force open tags to be closed, so can be virtually everywhere.
+        $text = '<p><nolink><div>no filters</div></nolink></p>';
+        $result = purify_html($text, array());
+        $this->assertSame($text, $result);
     }
 
     /**
diff --git a/lib/weblib.php b/lib/weblib.php
index 73fbcf94a2a..6e66c484a7c 100644
--- a/lib/weblib.php
+++ b/lib/weblib.php
@@ -1856,7 +1856,7 @@ function purify_html($text, $options = array()) {
         }
 
         if ($def = $config->maybeGetRawHTMLDefinition()) {
-            $def->addElement('nolink', 'Block', 'Flow', array());                       // Skip our filters inside.
+            $def->addElement('nolink', 'Inline', 'Flow', array());                      // Skip our filters inside.
             $def->addElement('tex', 'Inline', 'Inline', array());                       // Tex syntax, equivalent to $$xx$$.
             $def->addElement('algebra', 'Inline', 'Inline', array());                   // Algebra syntax, equivalent to @@xx@@.
             $def->addElement('lang', 'Block', 'Flow', array(), array('lang'=>'CDATA')); // Original multilang style - only our hacked lang attribute.
-- 
2.11.4.GIT