<blockquote>Foo</blockquote> '.
- 'would become <blockquote><p>Foo</p></blockquote>. The '.
- '<p> tags can be replaced '.
- 'with whatever you desire, as long as it is a block level element. '.
- 'This directive has been available since 1.3.0.'
-);
+ 'HTML', 'BlockWrapper', 'p', 'string', '
++ String name of element to wrap inline elements that are inside a block + context. This only occurs in the children of blockquote in strict mode. +
+
+ Example: by default value,
+ <blockquote>Foo</blockquote> would become
+ <blockquote><p>Foo</p></blockquote>.
+ The <p> tags can be replaced with whatever you desire,
+ as long as it is a block level element. This directive has been available
+ since 1.3.0.
+
+ String name of element that HTML fragment passed to library will be + inserted in. An interesting variation would be using span as the + parent element, meaning that only inline tags would be allowed. + This directive has been available since 1.3.0. +
+'); HTMLPurifier_ConfigSchema::define( - 'HTML', 'AllowedElements', null, 'lookup/null', - 'If HTML Purifier\'s tag set is unsatisfactory for your needs, you '. - 'can overload it with your own list of tags to allow. Note that this '. - 'method is subtractive: it does its job by taking away from HTML Purifier '. - 'usual feature set, so you cannot add a tag that HTML Purifier never '. - 'supported in the first place (like embed, form or head). If you change this, you '. - 'probably also want to change %HTML.AllowedAttributes. '. - 'Warning: If another directive conflicts with the '. - 'elements here, that directive will win and override. '. - 'This directive has been available since 1.3.0.' -); + 'HTML', 'AllowedElements', null, 'lookup/null', ' ++ If HTML Purifier\'s tag set is unsatisfactory for your needs, you + can overload it with your own list of tags to allow. Note that this + method is subtractive: it does its job by taking away from HTML Purifier + usual feature set, so you cannot add a tag that HTML Purifier never + supported in the first place (like embed, form or head). If you + change this, you probably also want to change %HTML.AllowedAttributes. +
++ Warning: If another directive conflicts with the + elements here, that directive will win and override. + This directive has been available since 1.3.0. +
+'); HTMLPurifier_ConfigSchema::define( - 'HTML', 'AllowedAttributes', null, 'lookup/null', - 'IF HTML Purifier\'s attribute set is unsatisfactory, overload it! '. - 'The syntax is \'tag.attr\' or \'*.attr\' for the global attributes '. - '(style, id, class, dir, lang, xml:lang).'. - 'Warning: If another directive conflicts with the '. - 'elements here, that directive will win and override. For '. - 'example, %HTML.EnableAttrID will take precedence over *.id in this '. - 'directive. You must set that directive to true before you can use '. - 'IDs at all. This directive has been available since 1.3.0.' -); + 'HTML', 'AllowedAttributes', null, 'lookup/null', ' ++ If HTML Purifier\'s attribute set is unsatisfactory, overload it! + The syntax is "tag.attr" or "*.attr" for the global attributes + (style, id, class, dir, lang, xml:lang). +
++ Warning: If another directive conflicts with the + elements here, that directive will win and override. For + example, %HTML.EnableAttrID will take precedence over *.id in this + directive. You must set that directive to true before you can use + IDs at all. This directive has been available since 1.3.0. +
+'); /** * Definition of the purified HTML that describes allowed children, diff --git a/library/HTMLPurifier/HTMLModuleManager.php b/library/HTMLPurifier/HTMLModuleManager.php index bfce9c7c..cad46136 100644 --- a/library/HTMLPurifier/HTMLModuleManager.php +++ b/library/HTMLPurifier/HTMLModuleManager.php @@ -53,6 +53,43 @@ HTMLPurifier_ConfigSchema::define( 'will be used. This directive has been available since 1.7.0.' ); +HTMLPurifier_ConfigSchema::define( + 'HTML', 'AllowedModules', null, 'lookup/null', ' ++ A doctype comes with a set of usual modules to use. Without having + to mucking about with the doctypes, you can quickly activate or + disable these modules by specifying which modules you wish to allow + with this directive. This is most useful for unit testing specific + modules, although end users may find it useful for their own ends. +
++ If you specify a module that does not exist, the manager will silently + fail to use it, so be careful! User-defined modules are not affected + by this directive. Modules defined in %HTML.CoreModules are not + affected by this directive. This directive has been available since 1.7.0. +
+'); + +HTMLPurifier_ConfigSchema::define( + 'HTML', 'CoreModules', array( + 'Structure' => true, + 'Text' => true, + 'Hypertext' => true, + 'List' => true, + 'NonXMLCommonAttributes' => true, + 'XMLCommonAttributes' => true, + 'CommonAttributes' => true + ), 'lookup', ' ++ Certain modularized doctypes (XHTML, namely), have certain modules + that must be included for the doctype to be an conforming document + type: put those modules here. By default, XHTML\'s core modules + are used. You can set this to a blank array to disable core module + protection, but this is not recommended. This directive has been + available since 1.7.0. +
+'); + class HTMLPurifier_HTMLModuleManager { @@ -254,6 +291,17 @@ class HTMLPurifier_HTMLModuleManager $doctype = $this->doctypes->make($config); $modules = $doctype->modules; + // take out the default modules that aren't allowed + $lookup = $config->get('HTML', 'AllowedModules'); + $special_cases = $config->get('HTML', 'CoreModules'); + + if (is_array($lookup)) { + foreach ($modules as $k => $m) { + if (isset($special_cases[$m])) continue; + if (!isset($lookup[$m])) unset($modules[$k]); + } + } + // merge in custom modules $modules = array_merge($modules, $this->userModules); @@ -291,7 +339,6 @@ class HTMLPurifier_HTMLModuleManager // the module in your custom doctype should be sufficient $this->modules ); - } /** diff --git a/tests/HTMLPurifier/AttrCollectionsTest.php b/tests/HTMLPurifier/AttrCollectionsTest.php index f43ee90e..c121fd50 100644 --- a/tests/HTMLPurifier/AttrCollectionsTest.php +++ b/tests/HTMLPurifier/AttrCollectionsTest.php @@ -70,7 +70,7 @@ class HTMLPurifier_AttrCollectionsTest extends UnitTestCase $types = new HTMLPurifier_AttrTypesMock($this); $collections = new HTMLPurifier_AttrCollections($types, array()); $collections->info = array( - 'Core' => array(0 => array('Inclusion'), 'attr-original' => 'Type'), + 'Core' => array(0 => array('Inclusion', 'Undefined'), 'attr-original' => 'Type'), 'Inclusion' => array(0 => array('SubInclusion'), 'attr' => 'Type'), 'SubInclusion' => array('attr2' => 'Type') ); diff --git a/tests/HTMLPurifier/HTMLModule/BdoTest.php b/tests/HTMLPurifier/HTMLModule/BdoTest.php index b2fcc1c8..51a74b3e 100644 --- a/tests/HTMLPurifier/HTMLModule/BdoTest.php +++ b/tests/HTMLPurifier/HTMLModule/BdoTest.php @@ -7,21 +7,15 @@ class HTMLPurifier_HTMLModule_BdoTest extends HTMLPurifier_HTMLModuleHarness function test() { + $this->setupScaffold('Bdo'); + // max $this->assertResult( ' - + #PCDATA Inline - ', true, array('Attr.EnableID' => true) + ' ); // min diff --git a/tests/HTMLPurifier/HTMLModule/EditTest.php b/tests/HTMLPurifier/HTMLModule/EditTest.php index 3acf7917..e6fe8c44 100644 --- a/tests/HTMLPurifier/HTMLModule/EditTest.php +++ b/tests/HTMLPurifier/HTMLModule/EditTest.php @@ -7,21 +7,23 @@ class HTMLPurifier_HTMLModule_EditTest extends HTMLPurifier_HTMLModuleHarness function test() { + $this->setupScaffold('Edit'); + // max $this->assertResult( ' - + #PCDATA -