From d210ae50ad14ded6cf204242bc072c82b9e8e70c Mon Sep 17 00:00:00 2001
From: Andrew Dolgov <noreply@fakecake.org>
Date: Sun, 5 Mar 2023 08:07:55 +0300
Subject: [PATCH] API:  - sharedToPublished: add optional sanitize parameter
 (defaults to true)    if disabled, allows inserting HTML into shared article
 content;  - clean() already invokes strip_tags() so it's pointless to do
 both;

---
 classes/api.php | 13 +++++++++----
 1 file changed, 9 insertions(+), 4 deletions(-)

diff --git a/classes/api.php b/classes/api.php
index 09f190451..b282a39ce 100755
--- a/classes/api.php
+++ b/classes/api.php
@@ -1,7 +1,7 @@
 <?php
 class API extends Handler {
 
-	const API_LEVEL  = 19;
+	const API_LEVEL  = 20;
 
 	const STATUS_OK  = 0;
 	const STATUS_ERR = 1;
@@ -504,9 +504,14 @@ class API extends Handler {
 	}
 
 	function shareToPublished(): bool {
-		$title = strip_tags(clean($_REQUEST["title"]));
-		$url = strip_tags(clean($_REQUEST["url"]));
-		$content = strip_tags(clean($_REQUEST["content"]));
+		$title = clean($_REQUEST["title"]);
+		$url = clean($_REQUEST["url"]);
+		$sanitize_content = self::_param_to_bool($_REQUEST["sanitize"] ?? true);
+
+		if ($sanitize_content)
+			$content = clean($_REQUEST["content"]);
+		else
+			$content = $_REQUEST["content"];
 
 		if (Article::_create_published_article($title, $url, $content, "", $_SESSION["uid"])) {
 			return $this->_wrap(self::STATUS_OK, array("status" => 'OK'));