https://photosmilephotos.com/wp-content/plugins/nextgen-gallery/st…nextgen_simple_lightbox_init.js?ver=3.59.12

1jQuery(function ($) {
2  var selector = null;
3  var lightbox = null;
4
5  // Whitelist of allowed HTML elements and their allowed attributes.
6  var allowedTags = {
7    a: ["href", "title", "target", "rel"],
8    b: [],
9    i: [],
10    u: [],
11    em: [],
12    strong: [],
13    p: [],
14    br: [],
15    span: ["class", "id", "style"],
16    img: ["src", "alt", "title"],
17    h1: [],
18    h2: [],
19    h4: [],
20    h4: [],
21    h5: [],
22    h6: [],
23    ul: [],
24    ol: [],
25    li: [],
26  };
27
28  // Function to sanitize HTML, allowing only certain tags and attributes.
29  var sanitizeHTML = function (str) {
30    // Create a temporary DOM element to parse the HTML string.
31    var tempDiv = document.createElement("div");
32    tempDiv.innerHTML = str;
33
34    // Iterate through all elements.
35    var elements = tempDiv.querySelectorAll("*");
36    elements.forEach(function (el) {
37      var tagName = el.tagName.toLowerCase();
38
39      // If the tag is not allowed, replace the element with its content.
40      if (!allowedTags.hasOwnProperty(tagName)) {
41        el.replaceWith(el.innerHTML);
42        return;
43      }
44
45      // If the tag is allowed, check attributes.
46      var allowedAttributes = allowedTags[tagName];
47
48      // Loop through each attribute of the element.
49      for (var i = el.attributes.length - 1; i >= 0; i--) {
50        var attrName = el.attributes[i].name;
51        var attrValue = el.attributes[i].value;
52
53        // Remove attributes that are not allowed for this tag.
54        if (!allowedAttributes.includes(attrName)) {
55          el.removeAttribute(attrName);
56        }
57
58        // Additional checks to sanitize certain attributes like href, src.
59        if (
60          ["href", "src"].includes(attrName) &&
61          attrValue.startsWith("javascript:")
62        ) {
63          el.removeAttribute(attrName); // Remove dangerous URLs.
64        }
65
66        // Sanitize the title attribute (if allowed).
67        if (attrName === "title") {
68          el.setAttribute("title", sanitizeTitle(attrValue)); // Sanitize the title value.
69        }
70      }
71    });
72
73    // Return the sanitized HTML as a string.
74    var sanitizedText = tempDiv.innerHTML;
75    return sanitizedText.replace(/\\/g, "");
76  };
77
78  // Helper function to sanitize the content of the title attribute.
79  var sanitizeTitle = function (title) {
80    // Replace potential XSS characters in the title.
81    return title
82      .replace(/</g, "&lt;")
83      .replace(/>/g, "&gt;")
84      .replace(/"/g, "&quot;");
85  };
86
87  // Function to sanitize captions in the DOM elements.
88  var sanitizeCaptions = function () {
89    $(".ngg-simplelightbox").each(function () {
90      var caption = $(this).attr("title");
91      if (caption) {
92        // Sanitize the caption and update the element attribute.
93        var sanitizedCaption = sanitizeHTML(caption);
94        $(this).attr("title", sanitizedCaption);
95      }
96    });
97  };
98
99  var nextgen_simplebox_options = {
100    history: false,
101    animationSlide: false,
102    animationSpeed: 100,
103    captionSelector: "self",
104  };
105
106  var nextgen_simplelightbox_init = function () {
107    // Sanitize all captions before initializing the lightbox.
108    sanitizeCaptions();
109
110    // Initialize SimpleLightbox.
111    selector = nextgen_lightbox_filter_selector($, $(".ngg-simplelightbox"));
112    if (selector.length > 0) {
113      lightbox = selector.simpleLightbox(nextgen_simplebox_options);
114    }
115  };
116
117  nextgen_simplelightbox_init();
118
119  $(window).on("refreshed", function () {
120    if (lightbox) {
121      lightbox.destroy();
122    }
123
124    // Sanitize captions again after refresh.
125    sanitizeCaptions();
126
127    // Re-initialize SimpleLightbox.
128    selector = nextgen_lightbox_filter_selector($, $(".ngg-simplelightbox"));
129    if (selector.length > 0) {
130      lightbox = selector.simpleLightbox(nextgen_simplebox_options);
131    }
132  });
133});