| @@ -439,13 +439,32 @@ | ||
| 439 | 439 | } |
| 440 | 440 | } |
| 441 | 441 | } |
| 442 | 442 | |
| 443 | - | |
| 443 | + /** | |
| 444 | + * Create a task with field-specific sanitization for its request data. | |
| 445 | + * | |
| 446 | + * @param Request $request | |
| 447 | + * @param int $board_id | |
| 448 | + * @return mixed | |
| 449 | + */ | |
| 444 | 450 | public function create(Request $request, $board_id) |
| 445 | 451 | { |
| 446 | 452 | $board_id = absint($board_id); |
| 447 | - $taskData = $this->taskSanitizeAndValidate($request->getSafe('task'), [ | |
| 453 | + $safeTaskData = $request->getSafe('task'); | |
| 454 | + $rawTaskData = $request->get('task', []); | |
| 455 | + | |
| 456 | + // Milkdown serializes pasted URLs as <https://...>, which generic text | |
| 457 | + // sanitization removes as a tag. | |
| 458 | + if ( | |
| 459 | + is_array($safeTaskData) && | |
| 460 | + is_array($rawTaskData) && | |
| 461 | + array_key_exists('description', $rawTaskData) | |
| 462 | + ) { | |
| 463 | + $safeTaskData['description'] = fluent_boards_sanitize_description($rawTaskData['description']); | |
| 464 | + } | |
| 465 | + | |
| 466 | + $taskData = $this->taskSanitizeAndValidate($safeTaskData, [ | |
| 448 | 467 | 'title' => 'required|string', |
| 449 | 468 | 'board_id' => 'required|numeric', |
| 450 | 469 | 'stage_id' => 'required|numeric', |
| 451 | 470 | 'priority' => 'nullable|string', |
