=== June-Comments-Cleaner ===
Contributors: costintrifan, Nasty Web
Tags: comments, spam, security, javascript
Requires at least: 2.7.1
Tested up to: 2.7.1
Stable tag: 1.1

This plugin will strip out all html tags(except the allowed ones), css attributes and javascript code from comments.


== Description ==
For example, if your blog has a great number of visitors/commenters and you have selected the "Comment author must have a previously approved comment"
option in your admin panel (Settings > Discussion) or you allow comments to be published as they're posted then nothing will stop a previously approved
commenter in adding a hidden javascript code(could be ajax, redirects or very annoying popup windows) in his comments which will mess up your blog big time!

ex:
`
<p>What a great post! I've learned so much from it!</p>
<script type="text/javascript">document.writeln('Here is some hidden javascript code! I could use ajax and retrieve your cookies too!');</script>
<p>Thank you!</p>
`
or, another really annoying type of comment:
`
<script type="text/javascript">alert('Hi there!');</script>
`

Imagine when someone visits your page he will see that alert window. What if the page has 20 comments like that? That alert window will not even allow your visitors
to close their browser until they've gone through each and every one of them!

Now go to your admin panel to edit/delete this comment; you'll notice that when displaying the comments page the alert window(s) is/are displayed once again.

Imagine 200 of this alerts now....


Another type of 'attack' would be one that redirects your visitors to his blog:
ex:
`
<p>Thank you!</p>
<script type="text/javascript">window.location.href('http://malicious.website.url/');</script>
`

So this plugin will strip out all html, css, javascript tags from comments, except those you allow in the plugin's page, thus enhancing your blog security.


== Installation ==

1. Unzip the archive into the `/wp-content/plugins/` directory
2. Activate the plugin through the 'Plugins' menu in WordPress
3. Go to `Admin Panel > Settings > June Comment Cleaner` and add the tags you allow in your comments.



== Screenshots ==

1. The plugin's interface after installation
2. This is how your comment would look like after a user has added some 'hidden' javascript code into his comment
3. A javascript alert window in action

== ChangeLog ==

= 1.1 =
* The function that strips out the css attributes has been improved
* The html content displayed in code tags is now html escaped, this allowing you to post code snippets in your comments.

= 1.0 =
* Initial release