From a58897441e7c5cc3eccce9628ac96fc579090f8f Mon Sep 17 00:00:00 2001
From: "Eloy Lafuente (stronk7)" <stronk7@moodle.org>
Date: Mon, 8 Jul 2019 16:09:40 +0200
Subject: [PATCH] MDL-66104 output: HTMLPurifier to allow <nolink> tags
 everywhere

Before the patch, HTMLPurifier was instructed to handle <nolink>
tags in block mode. That implies that any block tag enclosing it
had to be closed for HTML compliance.

But <noscript> tags are not part of the final output (they are
removed) but just internally used to skip filtering certain areas.

So they can be virtually everywhere, HTMLPurifier just should allow
them without any change, both to parent or children tags.
---
 lib/tests/htmlpurifier_test.php | 5 +++++
 lib/weblib.php                  | 2 +-
 2 files changed, 6 insertions(+), 1 deletion(-)

diff --git a/lib/tests/htmlpurifier_test.php b/lib/tests/htmlpurifier_test.php
index e14b3191fdf87..f1ae916c93af6 100644
--- a/lib/tests/htmlpurifier_test.php
+++ b/lib/tests/htmlpurifier_test.php
@@ -64,6 +64,11 @@ public function test_nolink() {
         $text = '<nolink>xxx<em>xx</em><div>xxx</div></nolink>';
         $result = purify_html($text, array());
         $this->assertSame($text, $result);
+
+        // Ensure nolink doesn't force open tags to be closed, so can be virtually everywhere.
+        $text = '<p><nolink><div>no filters</div></nolink></p>';
+        $result = purify_html($text, array());
+        $this->assertSame($text, $result);
     }
 
     /**
diff --git a/lib/weblib.php b/lib/weblib.php
index 6b6c00a4be81d..a643e59814df8 100644
--- a/lib/weblib.php
+++ b/lib/weblib.php
@@ -1856,7 +1856,7 @@ function purify_html($text, $options = array()) {
         }
 
         if ($def = $config->maybeGetRawHTMLDefinition()) {
-            $def->addElement('nolink', 'Block', 'Flow', array());                       // Skip our filters inside.
+            $def->addElement('nolink', 'Inline', 'Flow', array());                      // Skip our filters inside.
             $def->addElement('tex', 'Inline', 'Inline', array());                       // Tex syntax, equivalent to $$xx$$.
             $def->addElement('algebra', 'Inline', 'Inline', array());                   // Algebra syntax, equivalent to @@xx@@.
             $def->addElement('lang', 'Block', 'Flow', array(), array('lang'=>'CDATA')); // Original multilang style - only our hacked lang attribute.