From be9ec055965c72bab00645780d555abddaeb6d87 Mon Sep 17 00:00:00 2001
From: plegall <plg@piwigo.org>
Date: Mon, 3 Jul 2017 13:55:19 +0200
Subject: [PATCH] (cp 4d031c9) fixes #725, protect pwg.images.setInfo from HTML

---
 include/ws_functions/pwg.images.php | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/include/ws_functions/pwg.images.php b/include/ws_functions/pwg.images.php
index 393e42c13..1181f0516 100644
--- a/include/ws_functions/pwg.images.php
+++ b/include/ws_functions/pwg.images.php
@@ -1575,6 +1575,8 @@ SELECT path
  */
 function ws_images_setInfo($params, $service)
 {
+  global $conf;
+
   include_once(PHPWG_ROOT_PATH.'admin/include/functions.php');
 
   $query='
@@ -1606,6 +1608,11 @@ SELECT *
   {
     if (isset($params[$key]))
     {
+      if (!$conf['allow_html_descriptions'])
+      {
+        $params[$key] = strip_tags($params[$key], '<b><strong><em><i>');
+      }
+
       if ('fill_if_empty' == $params['single_value_mode'])
       {
         if (empty($image_row[$key]))