provide core method for object titles to be optionally stripped of tags

[dave]

I think we should make it so that users can't insert imgs etc into the title fields of plugins. Anyone disagree or have a good reason why you would want users to be able to?

[dave]

Core commit [svn:3463] strips all tags on titles.

[cash]

1. I think it is reasonable to allow italics on blog titles.

2. I strongly disagree with the change to the entities class to handle this. Metadata and the ElggEntities class should be kept as general as possible. Adding special exceptions like this can cause problems in the future through odd behavior and this does not set a good precedent.

If you decide to strip all or most tags out of titles for blogs, pages, etc, I recommend doing it in the ElggObject class since that is where the title is stored anyway. It could be done as part of the sanitization of the title string in create_object_entity(). Another (better) possibility is to do it on output rather than input. Add a method getTitle() to the ElggObject class and strip tags in that method. You can use that method to get the title string in all of your plugins while allowing plugin authors decide whether they want a stripped title or not. This would then allow a plugin author to create a plugin that does use an image as a title (and I know of wordpress plugins that allow people to use images as titles - stylized text).

[cash]

This change broke the external pages plugin. See #1937

If you want to strip tags, I still believe the best way to do this is by adding a getTitle method to the Elgg Object class and strip tags in there. That way each plugin has the option to store html tags in the title.

[cash]

For 1.7.1, I think a good approach is to remove the stripping from ElggEntity and put it in the save action of each plugin. Then revisit for Elgg 1.8 by possibly adding a setTitle() method to ElggObject that will strip tags.

[cash]

(In [svn:5504]) Fixes #1937, refs #1781 - stripping tags moved into plugin actions until better solution

[brettp]

See also #2515 re "Complete the set of getter methods."

[ewinslow]

We shouldn't be stripping tags from titles at all. Instead, we should be escaping the output. That way I can title my blog post or page: "Dealing with <script> injection attacks" and not have it end up like "Dealing with injection attacks".