From faf0d7e528a06575d47b7180686b81cee5a79238 Mon Sep 17 00:00:00 2001
From: Angel Fernando Quiroz Campos <angelfqc.18@gmail.com>
Date: Sat, 30 Dec 2017 02:14:43 -0500
Subject: [PATCH] Allow audio tag works with htmlpurifier

Fix #2265
---
 .../lib/formvalidator/Rule/allowed_tags.inc.php |  9 +++++++++
 main/inc/lib/security.lib.php                   | 17 ++++++++++++++++-
 2 files changed, 25 insertions(+), 1 deletion(-)

diff --git a/main/inc/lib/formvalidator/Rule/allowed_tags.inc.php b/main/inc/lib/formvalidator/Rule/allowed_tags.inc.php
index 2c5ff4d7f4..48ebb9d309 100755
--- a/main/inc/lib/formvalidator/Rule/allowed_tags.inc.php
+++ b/main/inc/lib/formvalidator/Rule/allowed_tags.inc.php
@@ -316,6 +316,15 @@ $allowed_tags_student['video']['src'] = array();
 $allowed_tags_student['video']['controls'] = array();
 $allowed_tags_student['video']['id'] = array();
 
+$allowed_tags_student['audio'] = array();
+$allowed_tags_student['audio']['autoplay'] = array();
+$allowed_tags_student['audio']['src'] = array();
+$allowed_tags_student['audio']['loop'] = array();
+$allowed_tags_student['audio']['preload'] = array();
+$allowed_tags_student['audio']['controls'] = array();
+$allowed_tags_student['audio']['muted'] = array();
+$allowed_tags_student['audio']['id'] = array();
+
 $allowed_tags_student['source'] = array();
 $allowed_tags_student['source']['type'] = array();
 $allowed_tags_student['source']['src'] = array();
diff --git a/main/inc/lib/security.lib.php b/main/inc/lib/security.lib.php
index 5a94dfaf50..e56189a18d 100755
--- a/main/inc/lib/security.lib.php
+++ b/main/inc/lib/security.lib.php
@@ -364,7 +364,7 @@ class Security
             $config->set('HTML.DefinitionID', 'html5-definitions'); // unqiue id
             $config->set('HTML.DefinitionRev', 1);
             if ($def = $config->maybeGetRawHTMLDefinition()) {
-                // http://developers.whatwg.org/the-video-element.html#the-video-element
+                // https://html.spec.whatwg.org/dev/media.html#the-video-element
                 $def->addElement(
                     'video',
                     'Block',
@@ -380,6 +380,21 @@ class Security
                         'controls' => 'Bool',
                     )
                 );
+                // https://html.spec.whatwg.org/dev/media.html#the-audio-element
+                $def->addElement(
+                    'audio',
+                    'Block',
+                    'Optional: (source, Flow) | (Flow, source) | Flow',
+                    'Common',
+                    array(
+                        'autoplay' => 'Bool',
+                        'src'      => 'URI',
+                        'loop'     => 'Bool',
+                        'preload'  => 'Enum#auto,metadata,none',
+                        'controls' => 'Bool',
+                        'muted'    => 'Bool',
+                    )
+                );
                 $def->addElement(
                     'source',
                     'Block',