diff --git a/system/blueprints/config/security.yaml b/system/blueprints/config/security.yaml index e0296be28..4e93e9b21 100644 --- a/system/blueprints/config/security.yaml +++ b/system/blueprints/config/security.yaml @@ -105,3 +105,15 @@ form: validate: type: commalist + + sanitize_svg: + type: toggle + label: PLUGIN_ADMIN.SANITIZE_SVG + help: PLUGIN_ADMIN.SANITIZE_SVG_HELP + highlight: 1 + options: + 1: PLUGIN_ADMIN.YES + 0: PLUGIN_ADMIN.NO + default: true + validate: + type: bool diff --git a/system/config/security.yaml b/system/config/security.yaml index 964e6821e..2cc815fb5 100644 --- a/system/config/security.yaml +++ b/system/config/security.yaml @@ -36,3 +36,4 @@ uploads_dangerous_extensions: - htm - js - exe +sanitize_svg: true diff --git a/system/src/Grav/Common/Security.php b/system/src/Grav/Common/Security.php index a58d5a1b5..4a14169a8 100644 --- a/system/src/Grav/Common/Security.php +++ b/system/src/Grav/Common/Security.php @@ -22,10 +22,12 @@ class Security */ public static function sanitizeSVG($file) { - $sanitizer = new Sanitizer(); - $original_svg = file_get_contents($file); - $clean_svg = $sanitizer->sanitize($original_svg); - file_put_contents($file, $clean_svg); + if (Grav::instance()['config']->get('security.sanitize_svg')) { + $sanitizer = new Sanitizer(); + $original_svg = file_get_contents($file); + $clean_svg = $sanitizer->sanitize($original_svg); + file_put_contents($file, $clean_svg); + } } /**