1
0
mirror of https://github.com/ezyang/htmlpurifier.git synced 2025-08-05 05:37:49 +02:00

Compare commits

..

105 Commits

Author SHA1 Message Date
Edward Z. Yang
350d8301dd Release 2.1.0.
git-svn-id: http://htmlpurifier.org/svnroot/htmlpurifier/trunk@1351 48356398-32a2-884e-a903-53898d9a118a
2007-08-03 03:04:40 +00:00
Edward Z. Yang
a40e16dd2e [2.1.0] Allow i18n font names
- Minor typos fixed; we're release ready!

git-svn-id: http://htmlpurifier.org/svnroot/htmlpurifier/trunk@1350 48356398-32a2-884e-a903-53898d9a118a
2007-08-03 02:48:52 +00:00
Edward Z. Yang
ee388e86c0 Fix code typo in URI Filter documentation.
git-svn-id: http://htmlpurifier.org/svnroot/htmlpurifier/trunk@1349 48356398-32a2-884e-a903-53898d9a118a
2007-08-03 00:08:45 +00:00
Edward Z. Yang
79df79b2fd [2.1.0] Add tutorial for creating URI Filters
- Update NEWS

git-svn-id: http://htmlpurifier.org/svnroot/htmlpurifier/trunk@1348 48356398-32a2-884e-a903-53898d9a118a
2007-08-02 23:34:30 +00:00
Edward Z. Yang
f5b72c623c [2.1.0] Implement Ruby.
- Destroy some zombie context variables
- Reorganize some TODO items

git-svn-id: http://htmlpurifier.org/svnroot/htmlpurifier/trunk@1347 48356398-32a2-884e-a903-53898d9a118a
2007-08-02 22:44:42 +00:00
Edward Z. Yang
7bccc24977 [2.1.0] Implement MakeAbsolute URI filter
- Move some directives with complex dependencies to URIDefinition
- Fix a missing extends
- Add hierarchical information to URI schemes
- Fix bug in URIHarness.

git-svn-id: http://htmlpurifier.org/svnroot/htmlpurifier/trunk@1346 48356398-32a2-884e-a903-53898d9a118a
2007-08-02 21:47:24 +00:00
Edward Z. Yang
25fe416ab2 Add test-case for blank TinyMCE allowed list.
git-svn-id: http://htmlpurifier.org/svnroot/htmlpurifier/trunk@1345 48356398-32a2-884e-a903-53898d9a118a
2007-08-02 15:13:12 +00:00
Edward Z. Yang
a9012f4387 Guard merge-library against non-cli execution.
git-svn-id: http://htmlpurifier.org/svnroot/htmlpurifier/trunk@1344 48356398-32a2-884e-a903-53898d9a118a
2007-08-02 12:51:52 +00:00
Edward Z. Yang
82f8561123 Factor out cli execution guard to common.php
git-svn-id: http://htmlpurifier.org/svnroot/htmlpurifier/trunk@1343 48356398-32a2-884e-a903-53898d9a118a
2007-08-02 12:45:15 +00:00
Edward Z. Yang
0b743fb2db Update maintenance files with cgi-fcgi compiled PHP executable workaround.
git-svn-id: http://htmlpurifier.org/svnroot/htmlpurifier/trunk@1342 48356398-32a2-884e-a903-53898d9a118a
2007-08-02 12:40:54 +00:00
Edward Z. Yang
08e32597df Fix flush-definition-cache to clear everything, and make it accept a parameter specifying which cache to flush. Also, set svn:executable to CLI scripts.
git-svn-id: http://htmlpurifier.org/svnroot/htmlpurifier/trunk@1340 48356398-32a2-884e-a903-53898d9a118a
2007-08-02 12:24:50 +00:00
Edward Z. Yang
2b82fbacad Minor re-prioritization of TODO.
git-svn-id: http://htmlpurifier.org/svnroot/htmlpurifier/trunk@1339 48356398-32a2-884e-a903-53898d9a118a
2007-08-02 01:53:46 +00:00
Edward Z. Yang
710820cbe9 [2.1.0] Repair minor PHP4 regression due to undefined configuration directive
git-svn-id: http://htmlpurifier.org/svnroot/htmlpurifier/trunk@1338 48356398-32a2-884e-a903-53898d9a118a
2007-08-02 01:48:43 +00:00
Edward Z. Yang
22ef52a7f6 [2.1.0] Migrate host blacklist functionality to URIFilter.
git-svn-id: http://htmlpurifier.org/svnroot/htmlpurifier/trunk@1336 48356398-32a2-884e-a903-53898d9a118a
2007-08-02 01:41:37 +00:00
Edward Z. Yang
4919187fc6 [2.1.0] Further refactoring of AttrDef_URI, creation of new URIFilter and URIDefinition subsystems.
git-svn-id: http://htmlpurifier.org/svnroot/htmlpurifier/trunk@1335 48356398-32a2-884e-a903-53898d9a118a
2007-08-02 01:12:27 +00:00
Edward Z. Yang
797b899305 [2.1.0] Create new URI object and migrate URI validation systems to use it. URIScheme interface changed.
git-svn-id: http://htmlpurifier.org/svnroot/htmlpurifier/trunk@1334 48356398-32a2-884e-a903-53898d9a118a
2007-08-01 18:34:46 +00:00
Edward Z. Yang
8c9dbe142d [2.1.0] Refactor AttrDef_URI: removed URIParser functionality
- Genericized flush-definition-cache script

git-svn-id: http://htmlpurifier.org/svnroot/htmlpurifier/trunk@1333 48356398-32a2-884e-a903-53898d9a118a
2007-08-01 14:55:09 +00:00
Edward Z. Yang
2a002857ce [2.1.0] All unit tests inherit from HTMLPurifier_Harness, not UnitTestCase. prepareCommon() refactored to global test-case.
git-svn-id: http://htmlpurifier.org/svnroot/htmlpurifier/trunk@1332 48356398-32a2-884e-a903-53898d9a118a
2007-08-01 14:06:59 +00:00
Edward Z. Yang
9d98b45dea Fix typo in news file.
git-svn-id: http://htmlpurifier.org/svnroot/htmlpurifier/trunk@1331 48356398-32a2-884e-a903-53898d9a118a
2007-08-01 13:16:49 +00:00
Edward Z. Yang
b0f3116b9e [2.1.0] URI scheme is munged off if there is no authority and the scheme is the default one
git-svn-id: http://htmlpurifier.org/svnroot/htmlpurifier/trunk@1330 48356398-32a2-884e-a903-53898d9a118a
2007-08-01 13:15:33 +00:00
Edward Z. Yang
b03a44abff Remove expectations from assertOutput in URITest.
git-svn-id: http://htmlpurifier.org/svnroot/htmlpurifier/trunk@1329 48356398-32a2-884e-a903-53898d9a118a
2007-08-01 02:19:43 +00:00
Edward Z. Yang
cf257cabde [2.1.0]
- AttrDef_URI unit tests refactored
- Block access to benchmarks: they should be called via command line

git-svn-id: http://htmlpurifier.org/svnroot/htmlpurifier/trunk@1328 48356398-32a2-884e-a903-53898d9a118a
2007-08-01 01:48:51 +00:00
Edward Z. Yang
ab950a1909 [2.1.0] Fix fairly major bug introduced when logic was reorganized.
git-svn-id: http://htmlpurifier.org/svnroot/htmlpurifier/trunk@1324 48356398-32a2-884e-a903-53898d9a118a
2007-07-31 02:39:49 +00:00
Edward Z. Yang
a12ea4bb3b [2.1.0] Fix bug in mkdir_deep that would prevent absolute paths in Unix systems from being created properly
git-svn-id: http://htmlpurifier.org/svnroot/htmlpurifier/trunk@1321 48356398-32a2-884e-a903-53898d9a118a
2007-07-31 02:04:32 +00:00
Edward Z. Yang
f80de908bd [2.1.0] Optimize ConfigSchema to only perform safety checks when HTMLPURIFIER_SCHEMA_STRICT is true
- Remove useless ->revision check in Config.php
- Add simple trace file to benchmarks folder

git-svn-id: http://htmlpurifier.org/svnroot/htmlpurifier/trunk@1319 48356398-32a2-884e-a903-53898d9a118a
2007-07-31 01:04:38 +00:00
Edward Z. Yang
349c4de75b [2.1.0] Standalone file now can be generated using maintenance/merge-library.php. Also:
- HTMLPURIFIER_PREFIX constant added, and relevant files transitioned over
- Custom ChildDef added to default include list
- Tester accepts ?standalone parameter

git-svn-id: http://htmlpurifier.org/svnroot/htmlpurifier/trunk@1316 48356398-32a2-884e-a903-53898d9a118a
2007-07-30 16:56:50 +00:00
Edward Z. Yang
89622c964e [2.1.0] Genericize element contents removal. This is done in a slightly hacky way since ElementDef is not available, but should be sufficient.
git-svn-id: http://htmlpurifier.org/svnroot/htmlpurifier/trunk@1313 48356398-32a2-884e-a903-53898d9a118a
2007-07-11 20:42:58 +00:00
Edward Z. Yang
732fe5cad7 [2.1.0] Two tiny bugfixes:
- Remove contents of <style> tags
- Use XHTMLStrict Tidy routines for XHTML 1.1

git-svn-id: http://htmlpurifier.org/svnroot/htmlpurifier/trunk@1311 48356398-32a2-884e-a903-53898d9a118a
2007-07-11 20:06:15 +00:00
Edward Z. Yang
e7e81c0a5b [2.1.0] Fix some minor DirectLex bugs that may lead to PHP errors
git-svn-id: http://htmlpurifier.org/svnroot/htmlpurifier/trunk@1310 48356398-32a2-884e-a903-53898d9a118a
2007-07-05 21:29:07 +00:00
Edward Z. Yang
626b2a13c8 Typographical and linkrot fixes for UTF-8 doc.
git-svn-id: http://htmlpurifier.org/svnroot/htmlpurifier/trunk@1308 48356398-32a2-884e-a903-53898d9a118a
2007-07-05 16:50:48 +00:00
Edward Z. Yang
35487c02ae Update test settings template.
git-svn-id: http://htmlpurifier.org/svnroot/htmlpurifier/trunk@1303 48356398-32a2-884e-a903-53898d9a118a
2007-06-30 16:13:10 +00:00
Edward Z. Yang
4bc1761b12 Update test settings file with more options.
git-svn-id: http://htmlpurifier.org/svnroot/htmlpurifier/trunk@1302 48356398-32a2-884e-a903-53898d9a118a
2007-06-30 05:02:27 +00:00
Edward Z. Yang
63f5414f2e [Phorum] Refactor settings.php into different files.
git-svn-id: http://htmlpurifier.org/svnroot/htmlpurifier/trunk@1298 48356398-32a2-884e-a903-53898d9a118a
2007-06-29 20:34:19 +00:00
Edward Z. Yang
88d014706b [Phorum] Double-reverse control.php's double-escaping
- Implement signature migration

git-svn-id: http://htmlpurifier.org/svnroot/htmlpurifier/trunk@1297 48356398-32a2-884e-a903-53898d9a118a
2007-06-29 20:00:38 +00:00
Edward Z. Yang
f6de73d7e7 [Phorum] Deal more gracefully with signatures and edit messages. More improvements.
git-svn-id: http://htmlpurifier.org/svnroot/htmlpurifier/trunk@1296 48356398-32a2-884e-a903-53898d9a118a
2007-06-29 18:25:13 +00:00
Edward Z. Yang
733868a76d [2.1.0] Fix another AutoParagraph edge-case.
git-svn-id: http://htmlpurifier.org/svnroot/htmlpurifier/trunk@1295 48356398-32a2-884e-a903-53898d9a118a
2007-06-29 17:48:56 +00:00
Edward Z. Yang
fab6a212c8 Turn off WYSIWYG.
git-svn-id: http://htmlpurifier.org/svnroot/htmlpurifier/trunk@1286 48356398-32a2-884e-a903-53898d9a118a
2007-06-29 17:03:55 +00:00
Edward Z. Yang
ea1362ce5c [Phorum] Minor enhancements: add cache purge support and give a friendly HTML is on message above editor.
git-svn-id: http://htmlpurifier.org/svnroot/htmlpurifier/trunk@1281 48356398-32a2-884e-a903-53898d9a118a
2007-06-29 15:43:23 +00:00
Edward Z. Yang
cff498ef67 [2.1.0] Refine autoparagraphing algorithm.
git-svn-id: http://htmlpurifier.org/svnroot/htmlpurifier/trunk@1278 48356398-32a2-884e-a903-53898d9a118a
2007-06-29 03:57:14 +00:00
Edward Z. Yang
1765a7537a [Phorum] Fix cross-platform mutilation of cache data, remove excess newlines.
git-svn-id: http://htmlpurifier.org/svnroot/htmlpurifier/trunk@1277 48356398-32a2-884e-a903-53898d9a118a
2007-06-29 03:41:21 +00:00
Edward Z. Yang
d7157d0ccd Tweak to make more conducive to our new textareas.
git-svn-id: http://htmlpurifier.org/svnroot/htmlpurifier/trunk@1274 48356398-32a2-884e-a903-53898d9a118a
2007-06-29 02:17:17 +00:00
Edward Z. Yang
ed44b5c5ba [2.1.0] ConfigForm generates textareas instead of text inputs for lists, hashes, lookups, text and itext fields
git-svn-id: http://htmlpurifier.org/svnroot/htmlpurifier/trunk@1273 48356398-32a2-884e-a903-53898d9a118a
2007-06-29 02:16:47 +00:00
Edward Z. Yang
5e5c0f3aa4 [2.1.0]
. Introduce new text/itext configuration directive values: these represent longer strings that would be more appropriately edited with a textarea
. Allow newlines to act as separators for lists, hashes, lookups and %HTML.Allowed

git-svn-id: http://htmlpurifier.org/svnroot/htmlpurifier/trunk@1272 48356398-32a2-884e-a903-53898d9a118a
2007-06-29 01:54:48 +00:00
Edward Z. Yang
b2ed0aff01 [Phorum] Final polishing: Have default config auto-detect character encoding; add WYSIWYG hook; update error message to be more friendly
git-svn-id: http://htmlpurifier.org/svnroot/htmlpurifier/trunk@1271 48356398-32a2-884e-a903-53898d9a118a
2007-06-29 00:48:55 +00:00
Edward Z. Yang
148681d1b0 Tidy up Phorum extension. Add svn:ignore, add img to the default list of allowed tags (for smileys), improve naming convention, move loading code out of main namespace, and add reset. Probably the last thing to do before this is feature complete is to have a WYSIWYG flag that turns on escaping for edit posts.
git-svn-id: http://htmlpurifier.org/svnroot/htmlpurifier/trunk@1270 48356398-32a2-884e-a903-53898d9a118a
2007-06-29 00:28:07 +00:00
Edward Z. Yang
2e7e411491 [2.1.0] Fix bug in auto-paragraphing: empty tags should be treated like start tags too.
git-svn-id: http://htmlpurifier.org/svnroot/htmlpurifier/trunk@1269 48356398-32a2-884e-a903-53898d9a118a
2007-06-29 00:24:59 +00:00
Edward Z. Yang
02051e465c [2.1.0] Phorum mod implemented for HTML Purifier. Some other code adjustments were made, they need to be cleaned up.
git-svn-id: http://htmlpurifier.org/svnroot/htmlpurifier/trunk@1267 48356398-32a2-884e-a903-53898d9a118a
2007-06-28 23:01:27 +00:00
Edward Z. Yang
a96b5bf612 [2.1.0] Friendly error messages for when injector needs a tag that's not allowed added
git-svn-id: http://htmlpurifier.org/svnroot/htmlpurifier/trunk@1265 48356398-32a2-884e-a903-53898d9a118a
2007-06-28 13:06:15 +00:00
Edward Z. Yang
9dd7c8c7dd Add reference document on CSS lengths.
git-svn-id: http://htmlpurifier.org/svnroot/htmlpurifier/trunk@1264 48356398-32a2-884e-a903-53898d9a118a
2007-06-27 23:49:50 +00:00
Edward Z. Yang
0c59db1da3 Bring Null's flush() interface inline with parent.
git-svn-id: http://htmlpurifier.org/svnroot/htmlpurifier/trunk@1263 48356398-32a2-884e-a903-53898d9a118a
2007-06-27 21:03:07 +00:00
Edward Z. Yang
584a1abd15 [2.1.0] Standardize interface for Injector (we actually got it wrong in the 2.0.1-strict version, but this'll fix it)
git-svn-id: http://htmlpurifier.org/svnroot/htmlpurifier/trunk@1262 48356398-32a2-884e-a903-53898d9a118a
2007-06-27 19:01:09 +00:00
Edward Z. Yang
a6ede3804e [2.1.0] True emoticon < fix.
git-svn-id: http://htmlpurifier.org/svnroot/htmlpurifier/trunk@1260 48356398-32a2-884e-a903-53898d9a118a
2007-06-27 16:40:18 +00:00
Edward Z. Yang
4476745003 Add new entries for 2.1.0 and 2.0.2
git-svn-id: http://htmlpurifier.org/svnroot/htmlpurifier/trunk@1258 48356398-32a2-884e-a903-53898d9a118a
2007-06-27 15:16:27 +00:00
Edward Z. Yang
45748500ec Release 2.0.1.
git-svn-id: http://htmlpurifier.org/svnroot/htmlpurifier/trunk@1254 48356398-32a2-884e-a903-53898d9a118a
2007-06-27 14:10:43 +00:00
Edward Z. Yang
e99520ab96 Remove trailing ?> in PHP library files, add trailing newlines to all other files.
git-svn-id: http://htmlpurifier.org/svnroot/htmlpurifier/trunk@1253 48356398-32a2-884e-a903-53898d9a118a
2007-06-27 13:58:32 +00:00
Edward Z. Yang
1e2abb7f8f Fix little PHP 4.4.0 bug involving return by reference.
git-svn-id: http://htmlpurifier.org/svnroot/htmlpurifier/trunk@1252 48356398-32a2-884e-a903-53898d9a118a
2007-06-27 13:29:01 +00:00
Edward Z. Yang
362c802191 Since we're passing a temporary variable by reference, it needs to be committed back onto to the main array. To be honest, I'm not terribly happy with this behavior, but it doesn't seem to break anything.
git-svn-id: http://htmlpurifier.org/svnroot/htmlpurifier/trunk@1251 48356398-32a2-884e-a903-53898d9a118a
2007-06-27 13:20:02 +00:00
Edward Z. Yang
3a1d505b3d [2.0.1] Implement haphazard error collection for AttrValidator.
- Error collector / Language can take arrays and listify them
- AttrValidator takes token by reference
- Formatted errors now have their severity <strong>
- 100 test-cases! W00t!

git-svn-id: http://htmlpurifier.org/svnroot/htmlpurifier/trunk@1250 48356398-32a2-884e-a903-53898d9a118a
2007-06-27 02:03:15 +00:00
Edward Z. Yang
a005da8a4c [2.0.1] Add error messages for FixNesting
git-svn-id: http://htmlpurifier.org/svnroot/htmlpurifier/trunk@1249 48356398-32a2-884e-a903-53898d9a118a
2007-06-26 23:43:28 +00:00
Edward Z. Yang
9a66394abb Add warning on how error reporting is incomplete to "No Errors" message.
git-svn-id: http://htmlpurifier.org/svnroot/htmlpurifier/trunk@1247 48356398-32a2-884e-a903-53898d9a118a
2007-06-26 19:54:33 +00:00
Edward Z. Yang
62c0575468 [2.0.1] Fix minor regression where ins/del broadcasted most restrictive set when they should have been more lenient.
git-svn-id: http://htmlpurifier.org/svnroot/htmlpurifier/trunk@1246 48356398-32a2-884e-a903-53898d9a118a
2007-06-26 19:38:26 +00:00
Edward Z. Yang
6a95d91a1a [2.0.1] Revamp error collector scheme: we now have custom mocks and an exchange of responsibilities
- Fix oversight in AutoParagraph dealing with armor.
- Order errors with no line number last
- Language object now needs $config and $context objects to do parameterized objects
- Auto-close notice added
- Token constructors accept line numbers

git-svn-id: http://htmlpurifier.org/svnroot/htmlpurifier/trunk@1245 48356398-32a2-884e-a903-53898d9a118a
2007-06-26 19:33:37 +00:00
Edward Z. Yang
275932ec05 [2.0.1] Fix DirectLex's incomprehension of un-armored script contents as CDATA using custom preg_replace_callback
git-svn-id: http://htmlpurifier.org/svnroot/htmlpurifier/trunk@1244 48356398-32a2-884e-a903-53898d9a118a
2007-06-26 16:08:42 +00:00
Edward Z. Yang
ae90bb919d Remove unnecessary $this parameters from mock instantiation; SimpleTest doesn't use it!
git-svn-id: http://htmlpurifier.org/svnroot/htmlpurifier/trunk@1243 48356398-32a2-884e-a903-53898d9a118a
2007-06-26 15:40:04 +00:00
Edward Z. Yang
3c734b4c72 [2.0.1] Implement error messages for MakeWellFormed. Armor AutoParagraph generated p start tags from these tag closing errors. Fix another auto-paragraphing edge-case. Create common Strategy error harness.
git-svn-id: http://htmlpurifier.org/svnroot/htmlpurifier/trunk@1242 48356398-32a2-884e-a903-53898d9a118a
2007-06-26 15:07:07 +00:00
Edward Z. Yang
3d02a2a7d4 Remove magic quotes test: it fails in systems that have magic quotes disabled.
git-svn-id: http://htmlpurifier.org/svnroot/htmlpurifier/trunk@1241 48356398-32a2-884e-a903-53898d9a118a
2007-06-26 03:34:29 +00:00
Edward Z. Yang
0bfa42f9b7 Downgrade comment removal error to E_NOTICE.
git-svn-id: http://htmlpurifier.org/svnroot/htmlpurifier/trunk@1240 48356398-32a2-884e-a903-53898d9a118a
2007-06-26 03:22:07 +00:00
Edward Z. Yang
7a8edc88f9 [2.0.1] Implement error collection for RemoveForeignElements.
- Register Generator context variable.
- Implement special substitutions for error collector.
- Also sort by order the errors came in.
- Fix line number determination bug in Lexer::create().
- Remove vestigial variables.
- Force all tag transforms to use copy(), implement serialize, unserialize algorithm for copy() in tokens.

git-svn-id: http://htmlpurifier.org/svnroot/htmlpurifier/trunk@1238 48356398-32a2-884e-a903-53898d9a118a
2007-06-26 02:49:21 +00:00
Edward Z. Yang
98b4e70a93 [2.0.1] Rewire line numbering so that if it's null it's autodetected based on error collection. also, update TODO.
git-svn-id: http://htmlpurifier.org/svnroot/htmlpurifier/trunk@1237 48356398-32a2-884e-a903-53898d9a118a
2007-06-25 23:22:35 +00:00
Edward Z. Yang
6f5592ae60 [2.0.1] Normalize newlines to \n for internal processing.
git-svn-id: http://htmlpurifier.org/svnroot/htmlpurifier/trunk@1235 48356398-32a2-884e-a903-53898d9a118a
2007-06-25 19:18:55 +00:00
Edward Z. Yang
9f996b125a [2.0.1]
- Printer adheres to configuration's directives on output format
- Fix improperly named form field in ConfigForm printer
. HTMLPurifier_Config::getAllowedDirectivesForForm implemented, allows much easier selective embedding of configuration values
. Doctype objects now accept public and system DTD identifiers
. %HTML.Doctype is now constrained by specific values, to specify a custom doctype use new %HTML.CustomDoctype
. ConfigForm truncates long directives to keep the form small, and does not re-output namespaces

git-svn-id: http://htmlpurifier.org/svnroot/htmlpurifier/trunk@1232 48356398-32a2-884e-a903-53898d9a118a
2007-06-25 18:38:39 +00:00
Edward Z. Yang
96b571d236 [2.0.1] Fix unescaped print_r that handles user input
git-svn-id: http://htmlpurifier.org/svnroot/htmlpurifier/trunk@1231 48356398-32a2-884e-a903-53898d9a118a
2007-06-25 15:20:45 +00:00
Edward Z. Yang
0e9904a9ba Factor out DirectLex error testing to its own class.
git-svn-id: http://htmlpurifier.org/svnroot/htmlpurifier/trunk@1230 48356398-32a2-884e-a903-53898d9a118a
2007-06-25 01:56:00 +00:00
Edward Z. Yang
e66a98c396 [2.0.1] Convert test language messages to use new format.
git-svn-id: http://htmlpurifier.org/svnroot/htmlpurifier/trunk@1229 48356398-32a2-884e-a903-53898d9a118a
2007-06-25 01:11:56 +00:00
Edward Z. Yang
728088f2ba [2.0.1] Rather than pass line number by parameter, have it be retrieved via Context. Add $ignore_error boolean to get().
git-svn-id: http://htmlpurifier.org/svnroot/htmlpurifier/trunk@1228 48356398-32a2-884e-a903-53898d9a118a
2007-06-25 01:08:57 +00:00
Edward Z. Yang
8ae2604440 [2.0.1] Start making more moves towards full error reporting. Revise message naming conventions. Fix variable assignment for error collecting. Revise Language interface to be as readable as possible (NOT compact). Add error reporting to DirectLex. Rewrite ErrorCollector.
git-svn-id: http://htmlpurifier.org/svnroot/htmlpurifier/trunk@1227 48356398-32a2-884e-a903-53898d9a118a
2007-06-25 00:48:26 +00:00
Edward Z. Yang
7b087c7bbe [2.0.1] Add severity to error collector
git-svn-id: http://htmlpurifier.org/svnroot/htmlpurifier/trunk@1226 48356398-32a2-884e-a903-53898d9a118a
2007-06-24 23:20:35 +00:00
Edward Z. Yang
58064592ff [2.0.1]
- Stray xmlns attributes removed from configuration documentation
. Interlinking in configuration documentation added using Injector_PurifierLinkify
. Directives now keep track of aliases to themselves

git-svn-id: http://htmlpurifier.org/svnroot/htmlpurifier/trunk@1225 48356398-32a2-884e-a903-53898d9a118a
2007-06-24 22:22:00 +00:00
Edward Z. Yang
b19fc32a5a Genericize Injector loading code, create new AutoFormatParam namespace, move out unit tests.
git-svn-id: http://htmlpurifier.org/svnroot/htmlpurifier/trunk@1224 48356398-32a2-884e-a903-53898d9a118a
2007-06-24 21:35:34 +00:00
Edward Z. Yang
b15cbbb42a [2.0.1] Officially add experimental auto-paragraphing and linkification functionality. Rename %Core.DefinitionCache to %Cache.DefinitionImpl. Have AutoParagraph handle even more edge cases. Fix MakeWellFormed bug.
git-svn-id: http://htmlpurifier.org/svnroot/htmlpurifier/trunk@1223 48356398-32a2-884e-a903-53898d9a118a
2007-06-24 20:29:50 +00:00
Edward Z. Yang
5f0663cad7 Refactor MakeWellFormed/Injector for performance and as little code duplication as possible. Also, make AutoParagraph smarter about root nodes that don't like p tags.
git-svn-id: http://htmlpurifier.org/svnroot/htmlpurifier/trunk@1221 48356398-32a2-884e-a903-53898d9a118a
2007-06-24 17:44:27 +00:00
Edward Z. Yang
75e52a12a6 Make context errors more friendly; factor out disabled; fix broken test cases; update TODO.
git-svn-id: http://htmlpurifier.org/svnroot/htmlpurifier/trunk@1220 48356398-32a2-884e-a903-53898d9a118a
2007-06-24 04:22:28 +00:00
Edward Z. Yang
269268b843 Fix possible infinite loop by incrementing everybody's offsets. Add printTokens debugger function. Refine Linkify parent node checks (also check excludes, although technically later steps will catch it!)
git-svn-id: http://htmlpurifier.org/svnroot/htmlpurifier/trunk@1218 48356398-32a2-884e-a903-53898d9a118a
2007-06-24 03:34:33 +00:00
Edward Z. Yang
62c6d93b6d Add more unit tests; everything seems to be good, but I'm suspicious.
git-svn-id: http://htmlpurifier.org/svnroot/htmlpurifier/trunk@1217 48356398-32a2-884e-a903-53898d9a118a
2007-06-24 02:59:06 +00:00
Edward Z. Yang
31704c92f6 Implement working linkification, now, the real challenge is to get it to play nice with auto-paragraphing.
git-svn-id: http://htmlpurifier.org/svnroot/htmlpurifier/trunk@1216 48356398-32a2-884e-a903-53898d9a118a
2007-06-24 02:45:38 +00:00
Edward Z. Yang
291fa4cb29 Convert to numerically indexed array.
git-svn-id: http://htmlpurifier.org/svnroot/htmlpurifier/trunk@1215 48356398-32a2-884e-a903-53898d9a118a
2007-06-24 02:27:57 +00:00
Edward Z. Yang
389fcc9a5d Convert injector to use arrays.
git-svn-id: http://htmlpurifier.org/svnroot/htmlpurifier/trunk@1214 48356398-32a2-884e-a903-53898d9a118a
2007-06-24 02:17:34 +00:00
Edward Z. Yang
e5191b3ada [2.0.1] Scrap auto_close in favor of ChildDef->elements heuristic.
git-svn-id: http://htmlpurifier.org/svnroot/htmlpurifier/trunk@1213 48356398-32a2-884e-a903-53898d9a118a
2007-06-23 20:52:57 +00:00
Edward Z. Yang
5d0a992579 Refactor Injector not to edit $result directly.
git-svn-id: http://htmlpurifier.org/svnroot/htmlpurifier/trunk@1212 48356398-32a2-884e-a903-53898d9a118a
2007-06-23 19:39:03 +00:00
Edward Z. Yang
ae83bebc98 Convert handleStart to the new format.
git-svn-id: http://htmlpurifier.org/svnroot/htmlpurifier/trunk@1211 48356398-32a2-884e-a903-53898d9a118a
2007-06-23 18:58:51 +00:00
Edward Z. Yang
9191877740 Factor out auto-paragraph to injector class.
git-svn-id: http://htmlpurifier.org/svnroot/htmlpurifier/trunk@1210 48356398-32a2-884e-a903-53898d9a118a
2007-06-23 18:50:41 +00:00
Edward Z. Yang
3066ca357a Further refactoring in preparation for logic change.
git-svn-id: http://htmlpurifier.org/svnroot/htmlpurifier/trunk@1209 48356398-32a2-884e-a903-53898d9a118a
2007-06-23 17:44:28 +00:00
Edward Z. Yang
53fd096641 Refactor auto-paragraph code in preparation for fundamental logic change.
git-svn-id: http://htmlpurifier.org/svnroot/htmlpurifier/trunk@1208 48356398-32a2-884e-a903-53898d9a118a
2007-06-23 17:11:05 +00:00
Edward Z. Yang
2166246b7e Fix quick bug: it's 2 dashes, not 3.
git-svn-id: http://htmlpurifier.org/svnroot/htmlpurifier/trunk@1207 48356398-32a2-884e-a903-53898d9a118a
2007-06-23 14:48:08 +00:00
Edward Z. Yang
49bb6ec35d [2.0.1] DefinitionCache no longer throws errors when it encounters old serial files that do not conform to the current style
git-svn-id: http://htmlpurifier.org/svnroot/htmlpurifier/trunk@1206 48356398-32a2-884e-a903-53898d9a118a
2007-06-23 14:45:13 +00:00
Edward Z. Yang
401612dc3a [2.0.1] Improve directory permissions checks. UNTESTED!!!
git-svn-id: http://htmlpurifier.org/svnroot/htmlpurifier/trunk@1205 48356398-32a2-884e-a903-53898d9a118a
2007-06-23 14:38:16 +00:00
Edward Z. Yang
dc0fb7d2b4 [2.0.1] DefinitionCache related bug-fixes
- Fixed bug where manually modified definitions were not saved via cache (mostly harmless, except for the fact that it would be a little slower)
- Configuration objects with different serials do not clobber each others when revision numbers are unequal
. DefinitionCache keys reordered to reflect precedence: version number, hash, then revision number

git-svn-id: http://htmlpurifier.org/svnroot/htmlpurifier/trunk@1204 48356398-32a2-884e-a903-53898d9a118a
2007-06-23 14:05:09 +00:00
Edward Z. Yang
eee45fed37 [2.0.1] Add preliminary auto-paragraph implementation. It needs to be aggressively refactored and generalized.
git-svn-id: http://htmlpurifier.org/svnroot/htmlpurifier/trunk@1202 48356398-32a2-884e-a903-53898d9a118a
2007-06-22 21:32:56 +00:00
Edward Z. Yang
03657ad51a Update NEWS.
git-svn-id: http://htmlpurifier.org/svnroot/htmlpurifier/trunk@1197 48356398-32a2-884e-a903-53898d9a118a
2007-06-22 00:09:20 +00:00
Edward Z. Yang
dda4038446 [2.0.1] Reorder definition cache includes
- Update some comments, rename some variables

git-svn-id: http://htmlpurifier.org/svnroot/htmlpurifier/trunk@1196 48356398-32a2-884e-a903-53898d9a118a
2007-06-21 23:56:19 +00:00
Edward Z. Yang
996ccdbdda [1.7.0] Update HTMLDefinition printer with some of the new attributes.
git-svn-id: http://htmlpurifier.org/svnroot/htmlpurifier/trunk@1192 48356398-32a2-884e-a903-53898d9a118a
2007-06-21 16:02:06 +00:00
Edward Z. Yang
008348db21 Update TODO.
git-svn-id: http://htmlpurifier.org/svnroot/htmlpurifier/trunk@1191 48356398-32a2-884e-a903-53898d9a118a
2007-06-21 15:28:50 +00:00
Edward Z. Yang
b10a380ff4 [2.0.1] Rewire test-cases to swallow errors, not expect them
git-svn-id: http://htmlpurifier.org/svnroot/htmlpurifier/trunk@1190 48356398-32a2-884e-a903-53898d9a118a
2007-06-21 15:15:02 +00:00
Edward Z. Yang
bf0d659c47 [2.0.1] Improve special case handling for <script>
- DirectLex now honors comments with greater than or less than signs in them
- Comments are transformed into script elements, ending comments are scrapped
- Buggy generator code rewritten to be more error-proof
- AttrValidator checks if token has attributes before processing
- Remove invalid documentation from Scripting
- "Commenting" of script elements switched to the more advanced version

git-svn-id: http://htmlpurifier.org/svnroot/htmlpurifier/trunk@1189 48356398-32a2-884e-a903-53898d9a118a
2007-06-21 14:44:26 +00:00
Edward Z. Yang
e55551ecdd Remove SVN checkout warnings from these two docs: they are no longer applicable.
git-svn-id: http://htmlpurifier.org/svnroot/htmlpurifier/trunk@1185 48356398-32a2-884e-a903-53898d9a118a
2007-06-21 02:14:47 +00:00
372 changed files with 7145 additions and 1883 deletions

View File

@@ -4,7 +4,7 @@
# Project related configuration options
#---------------------------------------------------------------------------
PROJECT_NAME = HTML Purifier
PROJECT_NUMBER = 2.0.0
PROJECT_NUMBER = 2.1.0
OUTPUT_DIRECTORY = "C:/Documents and Settings/Edward/My Documents/My Webs/htmlpurifier/docs/doxygen"
CREATE_SUBDIRS = NO
OUTPUT_LANGUAGE = English

54
INSTALL
View File

@@ -48,7 +48,7 @@ be standards compliant. HTML Purifier can deal with these doctypes:
* XHTML 1.0 Strict
* HTML 4.01 Transitional
* HTML 4.01 Strict
* XHTML 1.1 sans Ruby
* XHTML 1.1 (sans Ruby)
...and these character encodings:
@@ -112,8 +112,9 @@ websites):
Note that HTML Purifier's support for non-Unicode encodings is crippled by the
fact that any character not supported by that encoding will be silently
dropped, EVEN if it is ampersand escaped. If you want to work around
this, you are welcome to read docs/enduser-utf8.html for a workaround,
but please be cognizant of the issues the "solution" creates.
this, you are welcome to read docs/enduser-utf8.html for a fix,
but please be cognizant of the issues the "solution" creates (for this
reason, I do not include the solution in this document).
@@ -139,7 +140,9 @@ Other supported doctypes include:
There are more configuration directives which can be read about
here: <http://htmlpurifier.org/live/configdoc/plain.html> They're a bit boring,
but they can help out for those of you who like to exert maximum control over
your code.
your code. Some of the more interesting ones are configurable at the
demo <http://htmlpurifier.org/demo.php> and are well worth looking into
for your own system.
@@ -156,13 +159,15 @@ The interface is mind-numbingly simple:
$clean_html = $purifier->purify( $dirty_html );
That's it! For more examples, check out docs/examples/ (they aren't very
different though). Also, SLOW gives advice on what to do if HTML Purifier
is slowing down your application.
different though). Also, docs/enduser-slow.html gives advice on what to
do if HTML Purifier is slowing down your application.
6. Quick install
First, make sure library/HTMLPurifier/DefinitionCache/Serializer is
writable by the webserver (see Section 7: Caching below for details).
If your website is in UTF-8 and XHTML Transitional, use this code:
<?php
@@ -189,6 +194,37 @@ If your website is in a different encoding or doctype, use this code:
7. Caching
HTML Purifier generates some cache files to speed up its execution. For
maximum performance, make sure that library/HTMLPurifier/DefinitionCache/Serializer
is writeable by the webserver.
HTML Purifier generates some cache files (generally one or two) to speed up
its execution. For maximum performance, make sure that
library/HTMLPurifier/DefinitionCache/Serializer is writeable by the webserver.
If you are in the library/ folder of HTML Purifier, you can set the
appropriate permissions using:
chmod -R 0755 HTMLPurifier/DefinitionCache/Serializer
If the above command doesn't work, you may need to assign write permissions
to all. This may be necessary if your webserver runs as nobody, but is
not recommended since it means any other user can write files in the
directory. Use:
chmod -R 0777 HTMLPurifier/DefinitionCache/Serializer
You can also chmod files via your FTP client; this option
is usually accessible by right clicking the corresponding directory and
then selecting "chmod" or "file permissions".
Starting with 2.0.1, HTML Purifier will generate friendly error messages
that will tell you exactly what you have to chmod the directory to, if in doubt,
follow its advice.
If you are unable or unwilling to give write permissions to the cache
directory, you can either disable the cache (and suffer a performance
hit):
$config->set('Core', 'DefinitionCache', null);
Or move the cache directory somewhere else (no trailing slash):
$config->set('Cache', 'SerializerPath', '/home/user/absolute/path');

99
NEWS
View File

@@ -9,6 +9,105 @@ NEWS ( CHANGELOG and HISTORY ) HTMLPurifier
. Internal change
==========================
2.1.0, released 2007-08-02
# flush-htmldefinition-cache.php superseded in favor of a generic
flush-definition-cache.php script, you can clear a specific cache
by passing its name as a parameter to the script
! Phorum mod implemented for HTML Purifier
! With %Core.AggressivelyFixLt, <3 and similar emoticons no longer
trigger HTML removal in PHP5 (DOMLex). This directive is not necessary
for PHP4 (DirectLex).
! Standalone file now available, which greatly reduces the amount of
includes (although there are still a few files that reside in the
standalone folder)
! Relative URIs can now be transformed into their absolute equivalents
using %URI.Base and %URI.MakeAbsolute
! Ruby implemented for XHTML 1.1
! You can now define custom URI filtering behavior, see enduser-uri-filter.html
for more details
! UTF-8 font names now supported in CSS
- AutoFormatters emit friendly error messages if tags or attributes they
need are not allowed
- ConfigForm's compactification of directive names is now configurable
- AutoParagraph autoformatter algorithm refined after field-testing
- XHTML 1.1 now applies XHTML 1.0 Strict cleanup routines, namely
blockquote wrapping
- Contents of <style> tags removed by default when tags are removed
. HTMLPurifier_Config->getSerial() implemented, this is extremely useful
for output cache invalidation
. ConfigForm printer now can retrieve CSS and JS files as strings, in
case HTML Purifier's directory is not publically accessible
. Introduce new text/itext configuration directive values: these represent
longer strings that would be more appropriately edited with a textarea
. Allow newlines to act as separators for lists, hashes, lookups and
%HTML.Allowed
. ConfigForm generates textareas instead of text inputs for lists, hashes,
lookups, text and itext fields
. Hidden element content removal genericized: %Core.HiddenElements can
be used to customize this behavior, by default <script> and <style> are
hidden
. Added HTMLPURIFIER_PREFIX constant, should be used instead of dirname(__FILE__)
. Custom ChildDef added to default include list
. URIScheme reflection improved: will not attempt to include file if class
already exists. May clobber autoload, so I need to keep an eye on it
. ConfigSchema heavily optimized, will only collect information and validate
definitions when HTMLPURIFIER_SCHEMA_STRICT is true.
. AttrDef_URI unit tests and implementation refactored
. benchmarks/ directory now protected from public view with .htaccess file;
run the tests via command line
. URI scheme is munged off if there is no authority and the scheme is the
default one
. All unit tests inherit from HTMLPurifier_Harness, not UnitTestCase
. Interface for URIScheme changed
. Generic URI object to hold components of URI added, most systems involved
in URI validation have been migrated to use it
. Custom filtering for URIs factored out to URIDefinition interface for
maximum extensibility
2.0.1, released 2007-06-27
! Tag auto-closing now based on a ChildDef heuristic rather than a
manually set auto_close array; some behavior may change
! Experimental AutoFormat functionality added: auto-paragraph and
linkify your HTML input by setting %AutoFormat.AutoParagraph and
%AutoFormat.Linkify to true
! Newlines normalized internally, and then converted back to the
value of PHP_EOL. If this is not desired, set your newline format
using %Output.Newline.
! Beta error collection, messages are implemented for the most generic
cases involving Lexing or Strategies
- Clean up special case code for <script> tags
- Reorder includes for DefinitionCache decorators, fixes a possible
missing class error
- Fixed bug where manually modified definitions were not saved via cache
(mostly harmless, except for the fact that it would be a little slower)
- Configuration objects with different serials do not clobber each
others when revision numbers are unequal
- Improve Serializer DefinitionCache directory permissions checks
- DefinitionCache no longer throws errors when it encounters old
serial files that do not conform to the current style
- Stray xmlns attributes removed from configuration documentation
- configForm.php smoketest no longer has XSS vulnerability due to
unescaped print_r output
- Printer adheres to configuration's directives on output format
- Fix improperly named form field in ConfigForm printer
. Rewire some test-cases to swallow errors rather than expect them
. HTMLDefinition printer updated with some of the new attributes
. DefinitionCache keys reordered to reflect precedence: version number,
hash, then revision number
. %Core.DefinitionCache renamed to %Cache.DefinitionImpl
. Interlinking in configuration documentation added using
Injector_PurifierLinkify
. Directives now keep track of aliases to themselves
. Error collector now requires a severity to be passed, use PHP's internal
error constants for this
. HTMLPurifier_Config::getAllowedDirectivesForForm implemented, allows
much easier selective embedding of configuration values
. Doctype objects now accept public and system DTD identifiers
. %HTML.Doctype is now constrained by specific values, to specify a custom
doctype use new %HTML.CustomDoctype
. ConfigForm truncates long directives to keep the form small, and does
not re-output namespaces
2.0.0, released 2007-06-20
# Completely refactored HTMLModuleManager, decentralizing safety
information

39
TODO
View File

@@ -7,20 +7,13 @@ TODO List
? Maybe I'll Do It
==========================
2.1 release [Refactor, refactor!]
# URI validation routines tighter (see docs/dev-code-quality.html) (COMPLEX)
# Advanced URI filtering schemes (see docs/proposal-new-directives.txt)
- Configuration profiles: predefined directives set with one func call
- Implement IDREF support (harder than it seems, since you cannot have
IDREFs to non-existent IDs)
- Allow non-ASCII characters in font names
- Genericize special cases in RemoveForeignElements
If no interest is expressed for a feature that may required a considerable
amount of effort to implement, it may get endlessly delayed. Do not be
afraid to cast your vote for the next feature to be implemented!
2.2 release [Error'ed]
# Error logging for filtering/cleanup procedures
- Requires I18N facilities to be created first (COMPLEX)
- XSS-attempt detection
- More fine-grained control over escaping behavior
2.3 release [Do What I Mean, Not What I Say]
# Additional support for poorly written HTML
@@ -39,20 +32,17 @@ TODO List
2.4 release [It's All About Trust] (floating)
# Implement untrusted, dangerous elements/attributes
# Implement IDREF support (harder than it seems, since you cannot have
IDREFs to non-existent IDs)
3.0 release [Beyond HTML]
# Legit token based CSS parsing (will require revamping almost every
AttrDef class)
# More control over allowed CSS properties (maybe modularize it in the
same fashion!)
# Formatters for plaintext (COMPLEX)
- Auto-paragraphing (be sure to leverage fact that we know when things
shouldn't be paragraphed, such as lists and tables).
- Linkify URLs
# Formatters for plaintext
- Smileys
- Linkification for HTML Purifier docs: notably configuration and classes
- Allow tags to be "armored", an internal flag that protects them
from validation and passes them out unharmed
- Standardize token armor for all areas of processing
- Fixes for Firefox's inability to handle COL alignment props (Bug 915)
- Automatically add non-breaking spaces to empty table cells when
empty-cells:show is applied to have compatibility with Internet Explorer
@@ -64,12 +54,11 @@ TODO List
- Hooks for adding custom processors to custom namespaced tags and
attributes, offer default implementation
- Lots of documentation and samples
- XHTML 1.1 support
Ongoing
- Lots of profiling, make it faster!
- Plugins for major CMSes (COMPLEX)
- WordPress (mostly written, needs beta-testing)
- phpBB
- eFiction
- more! (look for ones that use WYSIWYGs)
- Complete basic smoketests
@@ -78,18 +67,22 @@ Unknown release (on a scratch-an-itch basis)
? Semi-lossy dumb alternate character encoding transfor
? Have 'lang' attribute be checked against official lists, achieved by
encoding all characters that have string entity equivalents
- Explain how to use HTML Purifier in non-PHP languages
- Abstract ChildDef_BlockQuote to work with all elements that only
allow blocks in them, required or optional
- Reorganize Unit Tests
- Refactor loop tests (esp. AttrDef_URI)
- Refactor loop tests: Lexer
- Reorganize configuration directives (Create more namespaces! Get messy!)
- Advanced URI filtering schemes (see docs/proposal-new-directives.txt)
- Implement lenient <ruby> child validation
- Explain how to use HTML Purifier in non-PHP languages / create
a simple command line stub (or complicated?)
Requested
? Native content compression, whitespace stripping (don't rely on Tidy, make
sure we don't remove from <pre> or related tags)
Wontfix
- Non-lossy smart alternate character encoding transformations (unless
patch provided)
- Pretty-printing HTML, users can use Tidy on the output on entire page
- Native content compression, whitespace stripping (don't rely on Tidy, make
sure we don't remove from <pre> or related tags): use gzip if this is
really important

View File

@@ -1 +1 @@
2.0.0
2.1.0

View File

@@ -1,7 +1,8 @@
HTML Purifier 2.0 is the culmination of two major architectural changes.
The first is Tidy, which enables HTML Purifier to both natively support
deprecated elements and also convert them to standards-compliant
alternatives. The second is the Advanced API, which enables users to
create new elements and attributes with ease. Keeping in line with a
commitment to high quality, there are also five esoteric bug-fixes and a
plethora of subtle improvements that enhance the library.
In version 2.1, HTML Purifier's URI validation and filtering handling
system has been revamped with a new, extensible URIFilter system. Also
notable features include preservation of emoticons in PHP5 with
%Core.AggressivelyFixLt, standalone and lite download versions,
transforming relative URIs to absolute URIs, Ruby in XHTML 1.1, a Phorum
mod, and UTF-8 font names. Notable bug-fixes include refinement of
the auto-paragraphing algorithm (no longer experimental), better XHTML
1.1 support and the removal of the contents of <style> elements.

BIN
art/100cases.png Normal file

Binary file not shown.

After

Width:  |  Height:  |  Size: 2.7 KiB

1
benchmarks/.htaccess Normal file
View File

@@ -0,0 +1 @@
Deny from all

View File

@@ -165,4 +165,4 @@ echo '<div>Random input was: ' .
?>
</body></html>
</body></html>

View File

@@ -15,5 +15,3 @@ $context = new HTMLPurifier_Context();
for ($i = 0; $i < 10; $i++) {
$tokens = $lexer->tokenizeHTML($input, $config, $context);
}
?>

12
benchmarks/Trace.php Normal file
View File

@@ -0,0 +1,12 @@
<?php
ini_set('xdebug.trace_format', 1);
ini_set('xdebug.show_mem_delta', true);
xdebug_start_trace(dirname(__FILE__) . '/Trace');
require_once '../library/HTMLPurifier.auto.php';
$purifier = new HTMLPurifier();
$data = $purifier->purify(file_get_contents('samples/Lexer/4.html'));
xdebug_stop_trace();

View File

@@ -18,10 +18,16 @@ TODO:
if (version_compare('5', PHP_VERSION, '>')) exit('Requires PHP 5 or higher.');
error_reporting(E_ALL); // probably not possible to use E_STRICT
define('HTMLPURIFIER_SCHEMA_STRICT', true); // description data needs to be collected
// load dual-libraries
require_once '../library/HTMLPurifier.auto.php';
require_once 'library/ConfigDoc.auto.php';
$purifier = HTMLPurifier::getInstance(array(
'AutoFormat.PurifierLinkify' => true
));
$schema = HTMLPurifier_ConfigSchema::instance();
$style = 'plain'; // use $_GET in the future
$configdoc = new ConfigDoc();
@@ -37,4 +43,3 @@ if (php_sapi_name() != 'cli') {
echo 'Files generated successfully.';
}
?>

View File

@@ -7,4 +7,3 @@
set_include_path(dirname(__FILE__) . PATH_SEPARATOR . get_include_path() );
require_once 'ConfigDoc.php';
?>

View File

@@ -36,4 +36,3 @@ class ConfigDoc
}
?>

View File

@@ -36,6 +36,7 @@ class ConfigDoc_HTMLXSLTProcessor
// fudges for HTML backwards compatibility
$out = str_replace('/>', ' />', $out); // <br /> not <br/>
$out = str_replace(' xmlns=""', '', $out); // rm unnecessary xmlns
$out = str_replace(' xmlns="http://www.w3.org/1999/xhtml"', '', $out); // rm unnecessary xmlns
if (class_exists('Tidy')) {
// cleanup output
$config = array(
@@ -59,4 +60,3 @@ class ConfigDoc_HTMLXSLTProcessor
}
?>

View File

@@ -23,4 +23,3 @@ class ConfigDoc_XMLSerializer
}
?>

View File

@@ -50,6 +50,12 @@ class ConfigDoc_XMLSerializer_ConfigSchema extends ConfigDoc_XMLSerializer
$dom_document->createElement('name', $name)
);
$dom_aliases = $dom_document->createElement('aliases');
$dom_directive->appendChild($dom_aliases);
foreach ($info->directiveAliases as $alias) {
$dom_aliases->appendChild($dom_document->createElement('alias', $alias));
}
$dom_constraints = $dom_document->createElement('constraints');
$dom_directive->appendChild($dom_constraints);
@@ -115,4 +121,3 @@ class ConfigDoc_XMLSerializer_ConfigSchema extends ConfigDoc_XMLSerializer
}
?>

View File

@@ -24,4 +24,3 @@ class ConfigDoc_XMLSerializer_Types extends ConfigDoc_XMLSerializer
}
?>

View File

@@ -72,8 +72,16 @@
<xsl:apply-templates />
</xsl:template>
<xsl:template match="directive/name">
<xsl:apply-templates select="../aliases/alias" mode="anchor" />
<h3 id="{../@id}"><xsl:value-of select="../@id" /></h3>
</xsl:template>
<xsl:template match="alias" mode="anchor">
<a id="{.}"></a>
</xsl:template>
<!-- Do not pass through -->
<xsl:template match="alias"></xsl:template>
<xsl:template match="directive/constraints">
<table class="constraints">
<xsl:apply-templates />
@@ -89,8 +97,20 @@
</td>
</tr>
</xsl:if>
<xsl:if test="../aliases/alias">
<xsl:apply-templates select="../aliases" mode="constraints" />
</xsl:if>
</table>
</xsl:template>
<xsl:template match="directive/aliases" mode="constraints">
<th>Aliases:</th>
<td>
<xsl:for-each select="alias">
<xsl:if test="position()&gt;1">, </xsl:if>
<xsl:value-of select="." />
</xsl:for-each>
</td>
</xsl:template>
<xsl:template match="directive//description">
<div class="description">
<xsl:copy-of select="div/node()" />
@@ -128,4 +148,4 @@
</tr>
</xsl:template>
</xsl:stylesheet>
</xsl:stylesheet>

View File

@@ -210,4 +210,4 @@ the usual things required are:</p>
<div id="version">$Id$</div>
</body></html>
</body></html>

View File

@@ -11,8 +11,7 @@ docs/examples/demo.php - ad hoc HTML/PHP soup to the extreme
AttrDef - a lot of duplication, more generic classes need to be created;
a lot of strtolower() calls, no legit casing
Class - doesn't support Unicode characters (fringe); uses regular
expressions
Class - doesn't support Unicode characters (fringe); uses regular expressions
Lang - code duplication; premature optimization
Length - easily mistaken for CSSLength
URI - multiple regular expressions; missing validation for parts (?)
@@ -22,9 +21,6 @@ ConfigSchema - redefinition is a mess
Strategy
FixNesting - cannot bubble nodes out of structures, duplicated checks
for special-case parent node
MakeWellFormed - insufficient automatic closing definitions (check HTML
spec for optional end tags, also, closing based on type (block/inline)
might be efficient).
RemoveForeignElements - should be run in parallel with MakeWellFormed
URIScheme - needs to have callable generic checks
mailto - doesn't validate emails, doesn't validate querystring

View File

@@ -79,4 +79,4 @@ help you find the correct functionality more quickly. Here they are:</p>
<div id="version">$Id$</div>
</body></html>
</body></html>

View File

@@ -30,4 +30,4 @@ that itch, put it here!</p>
<div id="version">$Id$</div>
</body></html>
</body></html>

View File

@@ -299,4 +299,4 @@ Mozilla on inside and needs -moz-outline, no IE support.</td></tr>
<div id="version">$Id$</div>
</body></html>
</body></html>

View File

@@ -17,11 +17,6 @@
<div id="index">Return to the <a href="index.html">index</a>.</div>
<div id="home"><a href="http://htmlpurifier.org/">HTML Purifier</a> End-User Documentation</div>
<div id="applicability">
This document covers currently unreleased functionality and
only applies to recent SVN checkouts.
</div>
<p>
You may have heard of the <a href="dev-advanced-api.html">Advanced API</a>.
If you're interested in reading dry prose and boring functional
@@ -788,4 +783,4 @@ $form->excludes = array('form' => true);</strong></pre>
<div id="version">$Id: enduser-tidy.html 1158 2007-06-18 19:26:29Z Edward $</div>
</body></html>
</body></html>

View File

@@ -144,4 +144,4 @@ anchors is beyond me.</p>
<div id="version">$Id$</div>
</body>
</html>
</html>

View File

@@ -10,9 +10,7 @@ to be effective. Things to remember:
2. IDs: see enduser-id.html for more info
3. Links: document pending feature completion
Rudimentary blacklisting, we should also allow only relative URIs. We
need a doc to explain the stuff.
3. URIs: see enduser-uri-filter.html
4. CSS: document pending
Explain which CSS styles we blocked and why.

View File

@@ -114,4 +114,4 @@ if you decide to do that! Especially if you port HTML Purifier to C++.
<tt>;-)</tt></p>
</body>
</html>
</html>

View File

@@ -16,11 +16,6 @@
<div id="index">Return to the <a href="index.html">index</a>.</div>
<div id="home"><a href="http://htmlpurifier.org/">HTML Purifier</a> End-User Documentation</div>
<div id="applicability">
This document covers currently unreleased functionality and
only applies to recent SVN checkouts.
</div>
<p>You've probably heard of HTML Tidy, Dave Raggett's little piece
of software that cleans up poorly written HTML. Let me say it straight
out:</p>
@@ -232,4 +227,4 @@ effectively in the background.</p>
<div id="version">$Id$</div>
</body></html>
</body></html>

View File

@@ -0,0 +1,201 @@
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"><head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />
<meta name="description" content="Tutorial for creating custom URI filters." />
<link rel="stylesheet" type="text/css" href="style.css" />
<title>URI Filters - HTML Purifier</title>
</head><body>
<h1>URI Filters</h1>
<div id="filing">Filed under End-User</div>
<div id="index">Return to the <a href="index.html">index</a>.</div>
<div id="home"><a href="http://htmlpurifier.org/">HTML Purifier</a> End-User Documentation</div>
<p>
This is a quick and dirty document to get you on your way to writing
custom URI filters for your own URL filtering needs. Why would you
want to write a URI filter? If you need URIs your users put into
HTML to magically change into a different URI, this is
exactly what you need!
</p>
<h2>Creating the class</h2>
<p>
Any URI filter you make will be a subclass of <code>HTMLPurifier_URIFilter</code>.
The scaffolding is thus:
</p>
<pre>class HTMLPurifier_URIFilter_<strong>NameOfFilter</strong> extends HTMLPurifier_URIFilter
{
var $name = '<strong>NameOfFilter</strong>';
function prepare($config) {}
function filter(&$uri, $config, &$context) {}
}</pre>
<p>
Fill in the variable <code>$name</code> with the name of your filter, and
take a look at the two methods. <code>prepare()</code> is an initialization
method that is called only once, before any filtering has been done of the
HTML. Use it to perform any costly setup work that only needs to be done
once. <code>filter()</code> is the guts and innards of our filter:
it takes the URI and does whatever needs to be done to it.
</p>
<p>
If you've worked with HTML Purifier, you'll recognize the <code>$config</code>
and <code>$context</code> parameters. On the other hand, <code>$uri</code>
is something unique to this section of the application: it's a
<code>HTMLPurifier_URI</code> object. The interface is thus:
</p>
<pre>class HTMLPurifier_URI
{
var $scheme, $userinfo, $host, $port, $path, $query, $fragment;
function HTMLPurifier_URI($scheme, $userinfo, $host, $port, $path, $query, $fragment);
function toString();
function copy();
function getSchemeObj($config, &$context);
function validate($config, &$context);
}</pre>
<p>
The first three methods are fairly self-explanatory: you have a constructor,
a serializer, and a cloner. Generally, you won't be using them when
you are manipulating the URI objects themselves.
<code>getSchemeObj()</code> is a special purpose method that returns
a <code>HTMLPurifier_URIScheme</code> object corresponding to the specific
URI at hand. <code>validate()</code> performs general-purpose validation
on the internal components of a URI. Once again, you don't need to
worry about these: they've already been handled for you.
</p>
<h2>URI format</h2>
<p>
As a URIFilter, we're interested in the member variables of the URI object.
</p>
<table class="quick"><tbody>
<tr><th>Scheme</th> <td>The protocol for identifying (and possibly locating) a resource (http, ftp, https)</td></tr>
<tr><th>Userinfo</th> <td>User information such as a username (bob)</td></tr>
<tr><th>Host</th> <td>Domain name or IP address of the server (example.com, 127.0.0.1)</td></tr>
<tr><th>Port</th> <td>Network port number for the server (80, 12345)</td></tr>
<tr><th>Path</th> <td>Data that identifies the resource, possibly hierarchical (/path/to, ed@example.com)</td></tr>
<tr><th>Query</th> <td>String of information to be interpreted by the resource (?q=search-term)</td></tr>
<tr><th>Fragment</th> <td>Additional information for the resource after retrieval (#bookmark)</td></tr>
</tbody></table>
<p>
Because the URI is presented to us in this form, and not
<code>http://bob@example.com:8080/foo.php?q=string#hash</code>, it saves us
a lot of trouble in having to parse the URI every time we want to filter
it. For the record, the above URI has the following components:
</p>
<table class="quick"><tbody>
<tr><th>Scheme</th> <td>http</td></tr>
<tr><th>Userinfo</th> <td>bob</td></tr>
<tr><th>Host</th> <td>example.com</td></tr>
<tr><th>Port</th> <td>8080</td></tr>
<tr><th>Path</th> <td>/foo.php</td></tr>
<tr><th>Query</th> <td>q=string</td></tr>
<tr><th>Fragment</th> <td>hash</td></tr>
</tbody></table>
<p>
Note that there is no question mark or octothorpe in the query or
fragment: these get removed during parsing.
</p>
<p>
With this information, you can get straight to implementing your
<code>filter()</code> method. But one more thing...
</p>
<h2>Return value: Boolean, not URI</h2>
<p>
You may have noticed that the URI is being passed in by reference.
This means that whatever changes you make to it, those changes will
be reflected in the URI object the callee had. <strong>Do not
return the URI object: it is unnecessary and will cause bugs.</strong>
Instead, return a boolean value, true if the filtering was successful,
or false if the URI is beyond repair and needs to be axed.
</p>
<p>
Let's suppose I wanted to write a filter that de-internationalized domain
names by converting them to <a href="http://en.wikipedia.org/wiki/Punycode">Punycode</a>.
Assuming that <code>punycode_encode($input)</code> converts <code>$input</code> to
Punycode and returns <code>false</code> on failure:
</p>
<pre>class HTMLPurifier_URIFilter_ConvertIDNToPunycode extends HTMLPurifier_URIFilter
{
var $name = 'ConvertIDNToPunycode';
function filter(&$uri, $config, &$context) {
if (is_null($uri->host)) return true;
if ($uri->host == utf8_decode($uri->host)) {
// is ASCII, abort
return true;
}
$host = punycode_encode($uri->host);
if ($host === false) return false;
$uri->host = $host;
return true;
}
}</pre>
<p>
Notice I did not <code>return $uri;</code>.
</p>
<h2>Activating your filter</h2>
<p>
Having a filter is all well and good, but you need to tell HTML Purifier
to use it. Fortunately, this part's simple:
</p>
<pre>$uri =& $config->getDefinition('URI');
$uri->addFilter(new HTMLPurifier_URIFilter_<strong>NameOfFilter</strong>());</pre>
<p>
If you want to be really fancy, you can define a configuration directive
for your filter and have HTML Purifier automatically manage whether or
not your filter gets loaded or not (this is how internal filters manage
things):
</p>
<pre>HTMLPurifier_ConfigSchema::define(
'URI', '<strong>NameOfFilter</strong>', false, 'bool',
'<strong>What your filter does.</strong>'
);
$uri =& $config->getDefinition('URI', true);
$uri->registerFilter(new HTMLPurifier_URIFilter_<strong>NameOfFilter</strong>());
</pre>
<p>
Now, your filter will only be called when %URI.<strong>NameOfFilter</strong>
is set to true.
</p>
<h2>Examples</h2>
<p>
Check the
<a href="http://htmlpurifier.org/svnroot/htmlpurifier/trunk/library/HTMLPurifier/URIFilter/">URIFilter</a>
directory for more implementation examples, and see <a href="http://htmlpurifier.org/svnroot/htmlpurifier/trunk/docs/proposal-new-directives.txt">the
new directives proposal document</a> for ideas on what could be implemented
as a filter.
</p>
<div id="version">$Id$</div>
</body></html>

View File

@@ -231,7 +231,7 @@ of your real encoding.</p>
why the character encoding should be explicitly stated. When the
browser isn't told what the character encoding of a text is, it
has to guess: and sometimes the guess is wrong. Hackers can manipulate
this guess in order to slip XSS pass filters and then fool the
this guess in order to slip XSS past filters and then fool the
browser into executing it as active code. A great example of this
is the <a href="http://shiflett.org/archive/177">Google UTF-7
exploit</a>.</p>
@@ -567,10 +567,11 @@ which may be used by POST, and is required when you want to upload
files.</p>
<p>The following is a summarization of notes from
<a href="http://ppewww.physics.gla.ac.uk/~flavell/charset/form-i18n.html">
<a href="http://web.archive.org/web/20060427015200/ppewww.ph.gla.ac.uk/~flavell/charset/form-i18n.html">
<code>FORM</code> submission and i18n</a>. That document contains lots
of useful information, but is written in a rambly manner, so
here I try to get right to the point.</p>
here I try to get right to the point. (Note: the original has
disappeared off the web, so I am linking to the Web Archive copy.)</p>
<h4 id="whyutf8-forms-urlencoded"><code>application/x-www-form-urlencoded</code></h4>
@@ -1043,4 +1044,4 @@ a more in-depth look into character sets and encodings.</p>
</ul>
</body>
</html>
</html>

View File

@@ -149,4 +149,4 @@ like that, for that matter), send it over and it might get included
with the core!</p>
</body>
</html>
</html>

View File

@@ -20,4 +20,3 @@ $pure_html = $purifier->purify($html);
echo '<pre>' . htmlspecialchars($pure_html) . '</pre>';
?>

View File

@@ -40,6 +40,9 @@ information for casual developers using HTML Purifier.</p>
<dt><a href="enduser-customize.html">Customize</a></dt>
<dd>Tutorial for customizing HTML Purifier's tag and attribute sets.</dd>
<dt><a href="enduser-uri-filter.html">URI Filters</a></dt>
<dd>Tutorial for creating custom URI filters.</dd>
</dl>
<h2>Development</h2>
@@ -162,4 +165,4 @@ the code. They may be upgraded to HTML files or stay as TXT scratchpads.</p>
<div id="version">$Id$</div>
</body>
</html>
</html>

View File

@@ -32,7 +32,7 @@ Here are some fuzzy levels you could set:
One final note: when you start axing tags that are more commonly used, you
run the risk of accidentally destroying user data, especially if the data
is incoming from a WYSIWYG eidtor that hasn't been synced accordingly. This may
is incoming from a WYSIWYG editor that hasn't been synced accordingly. This may
make forbidden element to text transformations desirable (for example, images).

View File

@@ -2,7 +2,8 @@
Configuration Ideas
Here are some theoretical configuration ideas that we could implement some
time. Note the naming convention: %Namespace.Directive
time. Note the naming convention: %Namespace.Directive. If you want one
implemented, give us a ring, and we'll move it up the priority chain.
%Attr.RewriteFragments - if there's %Attr.IDPrefix we may want to transparently
rewrite the URLs we parse too. However, we can only do it when it's a pure
@@ -22,8 +23,6 @@ time. Note the naming convention: %Namespace.Directive
%URI.AddRelNofollow - will add rel="nofollow" to all links, preventing the
spread of ill-gotten pagerank
%URI.RelativeToAbsolute - transforms all relative URIs to absolute form
%URI.HostBlacklistRegex - regexes that if matching the host are disallowed
%URI.HostWhitelist - domain names that are excluded from the host blacklist
%URI.HostPolicy - determines whether or not its reject all and then whitelist

28
docs/ref-css-length.txt Normal file
View File

@@ -0,0 +1,28 @@
CSS Length Reference
To bound, or not to bound, that is the question
It's quite a reasonable request, really, and it's already been implemented
for HTML. That is, length bounding. It makes little sense to let users
define text blocks that have a font-size of 63,360 inches (that's a mile,
by the way) or a width of forty-fold the parent container.
But it's a little more complicated then that. There are multiple units
one can use, and we have to a little unit conversion to get things working.
Here's what we have:
Absolute:
1 in ~= 2.54 cm
1 cm = 10 mm
1 pt = 1/72 in
1 pc = 12 pt
Relative:
1 em ~= 10.0667 px
1 ex ~= 0.5 em, though Mozilla Firefox says 1 ex = 6px
1 px ~= 1 pt
Watch out: font-sizes can also be nested to get successively larger
(although I do not relish having to keep track of context font-sizes,
this may be necessary, especially for some of the more advanced features
for preventing things like white on white).

View File

@@ -42,4 +42,4 @@ the development of this library in these forum threads:</p>
<div id="version">$Id$</div>
</body>
</html>
</html>

View File

@@ -21,4 +21,4 @@ HTML Purifier context.
<xmp>, monospace, replace with pre
These should be put into their own Tidy module, not loaded by default(?). These
all qualify as "lenient" transforms.
all qualify as "lenient" transforms.

View File

@@ -33,6 +33,9 @@ blockquote .label {font-weight:bold; font-size:1em; margin:0 0 .1em;
.table thead th:first-child {-moz-border-radius-topleft:1em;}
.table tbody td {border-bottom:1px solid #CCC; padding-right:0.6em;padding-left:0.6em;}
/* A quick table*/
table.quick tbody th {text-align:right; padding-right:1em;}
/* Category of the file */
#filing {font-weight:bold; font-size:smaller; }

View File

@@ -7,4 +7,3 @@
set_include_path(dirname(__FILE__) . PATH_SEPARATOR . get_include_path() );
require_once 'HTMLPurifier.php';
?>

View File

@@ -18,4 +18,3 @@ function HTMLPurifier($html, $config = null) {
return $purifier->purify($html, $config);
}
?>

View File

@@ -22,7 +22,7 @@
*/
/*
HTML Purifier 2.0.0 - Standards Compliant HTML Filtering
HTML Purifier 2.1.0 - Standards Compliant HTML Filtering
Copyright (C) 2006 Edward Z. Yang
This library is free software; you can redistribute it and/or
@@ -40,6 +40,9 @@
Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
*/
// constants are slow, but we'll make one exception
define('HTMLPURIFIER_PREFIX', dirname(__FILE__));
// almost every class has an undocumented dependency to these, so make sure
// they get included
require_once 'HTMLPurifier/ConfigSchema.php'; // important
@@ -51,16 +54,9 @@ require_once 'HTMLPurifier/Generator.php';
require_once 'HTMLPurifier/Strategy/Core.php';
require_once 'HTMLPurifier/Encoder.php';
require_once 'HTMLPurifier/ErrorCollector.php';
require_once 'HTMLPurifier/LanguageFactory.php';
HTMLPurifier_ConfigSchema::define(
'Core', 'Language', 'en', 'string', '
ISO 639 language code for localizable things in HTML Purifier to use,
which is mainly error reporting. There is currently only an English (en)
translation, so this directive is currently useless.
This directive has been available since 2.0.0.
');
HTMLPurifier_ConfigSchema::define(
'Core', 'CollectErrors', false, 'bool', '
Whether or not to collect errors found while filtering the document. This
@@ -81,7 +77,7 @@ This directive has been available since 2.0.0.
class HTMLPurifier
{
var $version = '2.0.0';
var $version = '2.1.0';
var $config;
var $filters;
@@ -139,15 +135,19 @@ class HTMLPurifier
$context = new HTMLPurifier_Context();
// our friendly neighborhood generator, all primed with configuration too!
$this->generator->generateFromTokens(array(), $config, $context);
$context->register('Generator', $this->generator);
// set up global context variables
if ($config->get('Core', 'CollectErrors')) {
// may get moved out if other facilities use it
$language_factory = HTMLPurifier_LanguageFactory::instance();
$language = $language_factory->create($config->get('Core', 'Language'));
$language = $language_factory->create($config, $context);
$context->register('Locale', $language);
$error_collector = new HTMLPurifier_ErrorCollector();
$context->register('ErrorCollector', $language);
$error_collector = new HTMLPurifier_ErrorCollector($context);
$context->register('ErrorCollector', $error_collector);
}
$html = HTMLPurifier_Encoder::convertToUTF8($html, $config, $context);
@@ -216,4 +216,3 @@ class HTMLPurifier
}
?>

View File

@@ -127,4 +127,3 @@ class HTMLPurifier_AttrCollections
}
?>

View File

@@ -84,4 +84,3 @@ class HTMLPurifier_AttrDef
}
?>

View File

@@ -66,4 +66,3 @@ class HTMLPurifier_AttrDef_CSS extends HTMLPurifier_AttrDef
}
?>

View File

@@ -84,4 +84,3 @@ class HTMLPurifier_AttrDef_CSS_Background extends HTMLPurifier_AttrDef
}
?>

View File

@@ -127,4 +127,3 @@ class HTMLPurifier_AttrDef_CSS_BackgroundPosition extends HTMLPurifier_AttrDef
}
?>

View File

@@ -42,4 +42,3 @@ class HTMLPurifier_AttrDef_CSS_Border extends HTMLPurifier_AttrDef
}
?>

View File

@@ -98,4 +98,3 @@ class HTMLPurifier_AttrDef_CSS_Color extends HTMLPurifier_AttrDef
}
?>

View File

@@ -35,4 +35,3 @@ class HTMLPurifier_AttrDef_CSS_Composite extends HTMLPurifier_AttrDef
}
?>

View File

@@ -148,4 +148,3 @@ class HTMLPurifier_AttrDef_CSS_Font extends HTMLPurifier_AttrDef
}
?>

View File

@@ -38,19 +38,24 @@ class HTMLPurifier_AttrDef_CSS_FontFamily extends HTMLPurifier_AttrDef
$quote = $font[0];
if ($font[$length - 1] !== $quote) continue;
$font = substr($font, 1, $length - 2);
// double-backslash processing is buggy
$font = str_replace("\\$quote", $quote, $font); // de-escape quote
$font = str_replace("\\\n", "\n", $font); // de-escape newlines
}
// process font
// $font is a pure representation of the font name
if (ctype_alnum($font)) {
// very simple font, allow it in unharmed
$final .= $font . ', ';
continue;
}
$nospace = str_replace(array(' ', '.', '!'), '', $font);
if (ctype_alnum($nospace)) {
// font with spaces in it
$final .= "'$font', ";
continue;
}
// complicated font, requires quoting
// armor single quotes and new lines
$font = str_replace("'", "\\'", $font);
$font = str_replace("\n", "\\\n", $font);
$final .= "'$font', ";
}
$final = rtrim($final, ', ');
if ($final === '') return false;
@@ -59,4 +64,3 @@ class HTMLPurifier_AttrDef_CSS_FontFamily extends HTMLPurifier_AttrDef
}
?>

View File

@@ -53,4 +53,3 @@ class HTMLPurifier_AttrDef_CSS_Length extends HTMLPurifier_AttrDef
}
?>

View File

@@ -77,4 +77,3 @@ class HTMLPurifier_AttrDef_CSS_ListStyle extends HTMLPurifier_AttrDef
}
?>

View File

@@ -55,4 +55,3 @@ class HTMLPurifier_AttrDef_CSS_Multiple extends HTMLPurifier_AttrDef
}
?>

View File

@@ -58,4 +58,3 @@ class HTMLPurifier_AttrDef_CSS_Number extends HTMLPurifier_AttrDef
}
?>

View File

@@ -40,4 +40,3 @@ class HTMLPurifier_AttrDef_CSS_Percentage extends HTMLPurifier_AttrDef
}
?>

View File

@@ -34,4 +34,3 @@ class HTMLPurifier_AttrDef_CSS_TextDecoration extends HTMLPurifier_AttrDef
}
?>

View File

@@ -15,7 +15,7 @@ class HTMLPurifier_AttrDef_CSS_URI extends HTMLPurifier_AttrDef_URI
{
function HTMLPurifier_AttrDef_CSS_URI() {
$this->HTMLPurifier_AttrDef_URI(true); // always embedded
parent::HTMLPurifier_AttrDef_URI(true); // always embedded
}
function validate($uri_string, $config, &$context) {
@@ -55,4 +55,3 @@ class HTMLPurifier_AttrDef_CSS_URI extends HTMLPurifier_AttrDef_URI
}
?>

View File

@@ -63,4 +63,3 @@ class HTMLPurifier_AttrDef_Enum extends HTMLPurifier_AttrDef
}
?>

View File

@@ -27,4 +27,3 @@ class HTMLPurifier_AttrDef_HTML_Bool extends HTMLPurifier_AttrDef
}
?>

View File

@@ -32,4 +32,3 @@ class HTMLPurifier_AttrDef_HTML_Color extends HTMLPurifier_AttrDef
}
?>

View File

@@ -31,4 +31,3 @@ class HTMLPurifier_AttrDef_HTML_FrameTarget extends HTMLPurifier_AttrDef_Enum
}
?>

View File

@@ -118,4 +118,3 @@ class HTMLPurifier_AttrDef_HTML_ID extends HTMLPurifier_AttrDef
}
?>

View File

@@ -41,4 +41,3 @@ class HTMLPurifier_AttrDef_HTML_Length extends HTMLPurifier_AttrDef_HTML_Pixels
}
?>

View File

@@ -70,4 +70,3 @@ class HTMLPurifier_AttrDef_HTML_LinkTypes extends HTMLPurifier_AttrDef
}
?>

View File

@@ -41,4 +41,3 @@ class HTMLPurifier_AttrDef_HTML_MultiLength extends HTMLPurifier_AttrDef_HTML_Le
}
?>

View File

@@ -48,4 +48,3 @@ class HTMLPurifier_AttrDef_HTML_Nmtokens extends HTMLPurifier_AttrDef
}
?>

View File

@@ -34,4 +34,3 @@ class HTMLPurifier_AttrDef_HTML_Pixels extends HTMLPurifier_AttrDef
}
?>

View File

@@ -72,4 +72,3 @@ class HTMLPurifier_AttrDef_Integer extends HTMLPurifier_AttrDef
}
?>

View File

@@ -72,4 +72,3 @@ class HTMLPurifier_AttrDef_Lang extends HTMLPurifier_AttrDef
}
?>

View File

@@ -14,4 +14,3 @@ class HTMLPurifier_AttrDef_Text extends HTMLPurifier_AttrDef
}
?>

View File

@@ -1,90 +1,65 @@
<?php
require_once 'HTMLPurifier/AttrDef.php';
require_once 'HTMLPurifier/URIParser.php';
require_once 'HTMLPurifier/URIScheme.php';
require_once 'HTMLPurifier/URISchemeRegistry.php';
require_once 'HTMLPurifier/AttrDef/URI/Host.php';
require_once 'HTMLPurifier/PercentEncoder.php';
HTMLPurifier_ConfigSchema::define(
'URI', 'DefaultScheme', 'http', 'string',
'Defines through what scheme the output will be served, in order to '.
'select the proper object validator when no scheme information is present.'
);
// special case filtering directives
HTMLPurifier_ConfigSchema::define(
'URI', 'Host', null, 'string/null',
'Defines the domain name of the server, so we can determine whether or '.
'an absolute URI is from your website or not. Not strictly necessary, '.
'as users should be using relative URIs to reference resources on your '.
'website. It will, however, let you use absolute URIs to link to '.
'subdomains of the domain you post here: i.e. example.com will allow '.
'sub.example.com. However, higher up domains will still be excluded: '.
'if you set %URI.Host to sub.example.com, example.com will be blocked. '.
'This directive has been available since 1.2.0.'
);
'URI', 'Munge', null, 'string/null', '
<p>
Munges all browsable (usually http, https and ftp)
absolute URI\'s into another URI, usually a URI redirection service.
This directive accepts a URI, formatted with a <code>%s</code> where
the url-encoded original URI should be inserted (sample:
<code>http://www.google.com/url?q=%s</code>).
</p>
<p>
Uses for this directive:
</p>
<ul>
<li>
Prevent PageRank leaks, while being fairly transparent
to users (you may also want to add some client side JavaScript to
override the text in the statusbar). <strong>Notice</strong>:
Many security experts believe that this form of protection does not deter spam-bots.
</li>
<li>
Redirect users to a splash page telling them they are leaving your
website. While this is poor usability practice, it is often mandated
in corporate environments.
</li>
</ul>
<p>
This directive has been available since 1.3.0.
</p>
');
// disabling directives
HTMLPurifier_ConfigSchema::define(
'URI', 'DisableExternal', false, 'bool',
'Disables links to external websites. This is a highly effective '.
'anti-spam and anti-pagerank-leech measure, but comes at a hefty price: no'.
'links or images outside of your domain will be allowed. Non-linkified '.
'URIs will still be preserved. If you want to be able to link to '.
'subdomains or use absolute URIs, specify %URI.Host for your website. '.
'This directive has been available since 1.2.0.'
);
HTMLPurifier_ConfigSchema::define(
'URI', 'DisableExternalResources', false, 'bool',
'Disables the embedding of external resources, preventing users from '.
'embedding things like images from other hosts. This prevents '.
'access tracking (good for email viewers), bandwidth leeching, '.
'cross-site request forging, goatse.cx posting, and '.
'other nasties, but also results in '.
'a loss of end-user functionality (they can\'t directly post a pic '.
'they posted from Flickr anymore). Use it if you don\'t have a '.
'robust user-content moderation team. This directive has been '.
'available since 1.3.0.'
);
HTMLPurifier_ConfigSchema::define(
'URI', 'DisableResources', false, 'bool',
'Disables embedding resources, essentially meaning no pictures. You can '.
'still link to them though. See %URI.DisableExternalResources for why '.
'this might be a good idea. This directive has been available since 1.3.0.'
);
HTMLPurifier_ConfigSchema::define(
'URI', 'Munge', null, 'string/null',
'Munges all browsable (usually http, https and ftp) URI\'s into some URL '.
'redirection service. Pass this directive a URI, with %s inserted where '.
'the url-encoded original URI should be inserted (sample: '.
'<code>http://www.google.com/url?q=%s</code>). '.
'This prevents PageRank leaks, while being as transparent as possible '.
'to users (you may also want to add some client side JavaScript to '.
'override the text in the statusbar). Warning: many security experts '.
'believe that this form of protection does not deter spam-bots. '.
'You can also use this directive to redirect users to a splash page '.
'telling them they are leaving your website. '.
'This directive has been available since 1.3.0.'
);
HTMLPurifier_ConfigSchema::define(
'URI', 'HostBlacklist', array(), 'list',
'List of strings that are forbidden in the host of any URI. Use it to '.
'kill domain names of spam, etc. Note that it will catch anything in '.
'the domain, so <tt>moo.com</tt> will catch <tt>moo.com.example.com</tt>. '.
'This directive has been available since 1.3.0.'
);
HTMLPurifier_ConfigSchema::define(
'URI', 'Disable', false, 'bool',
'Disables all URIs in all forms. Not sure why you\'d want to do that '.
'(after all, the Internet\'s founded on the notion of a hyperlink). '.
'This directive has been available since 1.3.0.'
);
'URI', 'Disable', false, 'bool', '
<p>
Disables all URIs in all forms. Not sure why you\'d want to do that
(after all, the Internet\'s founded on the notion of a hyperlink).
This directive has been available since 1.3.0.
</p>
');
HTMLPurifier_ConfigSchema::defineAlias('Attr', 'DisableURI', 'URI', 'Disable');
HTMLPurifier_ConfigSchema::define(
'URI', 'DisableResources', false, 'bool', '
<p>
Disables embedding resources, essentially meaning no pictures. You can
still link to them though. See %URI.DisableExternalResources for why
this might be a good idea. This directive has been available since 1.3.0.
</p>
');
/**
* Validates a URI as defined by RFC 3986.
* @note Scheme-specific mechanics deferred to HTMLPurifier_URIScheme
@@ -92,214 +67,83 @@ HTMLPurifier_ConfigSchema::defineAlias('Attr', 'DisableURI', 'URI', 'Disable');
class HTMLPurifier_AttrDef_URI extends HTMLPurifier_AttrDef
{
var $host;
var $embeds_resource;
var $parser, $percentEncoder;
var $embedsResource;
/**
* @param $embeds_resource_resource Does the URI here result in an extra HTTP request?
*/
function HTMLPurifier_AttrDef_URI($embeds_resource = false) {
$this->host = new HTMLPurifier_AttrDef_URI_Host();
$this->embeds_resource = (bool) $embeds_resource;
$this->parser = new HTMLPurifier_URIParser();
$this->percentEncoder = new HTMLPurifier_PercentEncoder();
$this->embedsResource = (bool) $embeds_resource;
}
function validate($uri, $config, &$context) {
static $PercentEncoder = null;
if ($PercentEncoder === null) $PercentEncoder = new HTMLPurifier_PercentEncoder();
// We'll write stack-based parsers later, for now, use regexps to
// get things working as fast as possible (irony)
if ($config->get('URI', 'Disable')) return false;
// parse as CDATA
// initial operations
$uri = $this->parseCDATA($uri);
$uri = $this->percentEncoder->normalize($uri);
// fix up percent-encoding
$uri = $PercentEncoder->normalize($uri);
// parse the URI
$uri = $this->parser->parse($uri);
if ($uri === false) return false;
// while it would be nice to use parse_url(), that's specifically
// for HTTP and thus won't work for our generic URI parsing
// add embedded flag to context for validators
$context->register('EmbeddedURI', $this->embedsResource);
// according to the RFC... (but this cuts corners, i.e. non-validating)
$r_URI = '!'.
'(([^:/?#<>\'"]+):)?'. // 2. Scheme
'(//([^/?#<>\'"]*))?'. // 4. Authority
'([^?#<>\'"]*)'. // 5. Path
'(\?([^#<>\'"]*))?'. // 7. Query
'(#([^<>\'"]*))?'. // 8. Fragment
'!';
$matches = array();
$result = preg_match($r_URI, $uri, $matches);
if (!$result) return false; // invalid URI
// seperate out parts
$scheme = !empty($matches[1]) ? $matches[2] : null;
$authority = !empty($matches[3]) ? $matches[4] : null;
$path = $matches[5]; // always present, can be empty
$query = !empty($matches[6]) ? $matches[7] : null;
$fragment = !empty($matches[8]) ? $matches[9] : null;
$registry =& HTMLPurifier_URISchemeRegistry::instance();
if ($scheme !== null) {
// no need to validate the scheme's fmt since we do that when we
// retrieve the specific scheme object from the registry
$scheme = ctype_lower($scheme) ? $scheme : strtolower($scheme);
$scheme_obj = $registry->getScheme($scheme, $config, $context);
if (!$scheme_obj) return false; // invalid scheme, clean it out
} else {
$scheme_obj = $registry->getScheme(
$config->get('URI', 'DefaultScheme'), $config, $context
);
}
// something funky weird happened in the registry, abort!
if (!$scheme_obj) {
trigger_error(
'Default scheme object "' . $config->get('URI', 'DefaultScheme') . '" was not readable',
E_USER_WARNING
);
return false;
}
// the URI we're processing embeds_resource a resource in the page, but the URI
// it references cannot be located
if ($this->embeds_resource && !$scheme_obj->browsable) {
return false;
}
if ($authority !== null) {
$ok = false;
do {
// remove URI if it's absolute and we disabled externals or
// if it's absolute and embedded and we disabled external resources
unset($our_host);
if (
$config->get('URI', 'DisableExternal') ||
(
$config->get('URI', 'DisableExternalResources') &&
$this->embeds_resource
)
) {
$our_host = $config->get('URI', 'Host');
if ($our_host === null) return false;
// generic validation
$result = $uri->validate($config, $context);
if (!$result) break;
// chained validation
$uri_def =& $config->getDefinition('URI');
$result = $uri_def->filter($uri, $config, $context);
if (!$result) break;
// scheme-specific validation
$scheme_obj = $uri->getSchemeObj($config, $context);
if (!$scheme_obj) break;
if ($this->embedsResource && !$scheme_obj->browsable) break;
$result = $scheme_obj->validate($uri, $config, $context);
if (!$result) break;
// survived gauntlet
$ok = true;
} while (false);
$context->destroy('EmbeddedURI');
if (!$ok) return false;
// munge scheme off if necessary (this must be last)
if (!is_null($uri->scheme) && is_null($uri->host)) {
if ($uri_def->defaultScheme == $uri->scheme) {
$uri->scheme = null;
}
$HEXDIG = '[A-Fa-f0-9]';
$unreserved = 'A-Za-z0-9-._~'; // make sure you wrap with []
$sub_delims = '!$&\'()'; // needs []
$pct_encoded = "%$HEXDIG$HEXDIG";
$r_userinfo = "(?:[$unreserved$sub_delims:]|$pct_encoded)*";
$r_authority = "/^(($r_userinfo)@)?(\[[^\]]+\]|[^:]*)(:(\d*))?/";
$matches = array();
preg_match($r_authority, $authority, $matches);
// overloads regexp!
$userinfo = !empty($matches[1]) ? $matches[2] : null;
$host = !empty($matches[3]) ? $matches[3] : null;
$port = !empty($matches[4]) ? $matches[5] : null;
// validate port
if ($port !== null) {
$port = (int) $port;
if ($port < 1 || $port > 65535) $port = null;
}
$host = $this->host->validate($host, $config, $context);
if ($host === false) $host = null;
if ($this->checkBlacklist($host, $config, $context)) return false;
// more lenient absolute checking
if (isset($our_host)) {
$host_parts = array_reverse(explode('.', $host));
// could be cached
$our_host_parts = array_reverse(explode('.', $our_host));
foreach ($our_host_parts as $i => $discard) {
if (!isset($host_parts[$i])) return false;
if ($host_parts[$i] != $our_host_parts[$i]) return false;
}
}
// userinfo and host are validated within the regexp
} else {
$port = $host = $userinfo = null;
}
// back to string
$result = $uri->toString();
// query and fragment are quite simple in terms of definition:
// *( pchar / "/" / "?" ), so define their validation routines
// when we start fixing percent encoding
// path gets to be validated against a hodge-podge of rules depending
// on the status of authority and scheme, but it's not that important,
// esp. since it won't be applicable to everyone
// okay, now we defer execution to the subobject for more processing
// note that $fragment is omitted
list($userinfo, $host, $port, $path, $query) =
$scheme_obj->validateComponents(
$userinfo, $host, $port, $path, $query, $config, $context
);
// reconstruct authority
$authority = null;
if (!is_null($userinfo) || !is_null($host) || !is_null($port)) {
$authority = '';
if($userinfo !== null) $authority .= $userinfo . '@';
$authority .= $host;
if($port !== null) $authority .= ':' . $port;
}
// reconstruct the result
$result = '';
if ($scheme !== null) $result .= "$scheme:";
if ($authority !== null) $result .= "//$authority";
$result .= $path;
if ($query !== null) $result .= "?$query";
if ($fragment !== null) $result .= "#$fragment";
// munge if necessary
$munge = $config->get('URI', 'Munge');
if (!empty($scheme_obj->browsable) && $munge !== null) {
if ($authority !== null) {
$result = str_replace('%s', rawurlencode($result), $munge);
}
// munge entire URI if necessary
if (
!is_null($uri->host) && // indicator for authority
!empty($scheme_obj->browsable) &&
!is_null($munge = $config->get('URI', 'Munge'))
) {
$result = str_replace('%s', rawurlencode($result), $munge);
}
return $result;
}
/**
* Checks a host against an array blacklist
* @param $host Host to check
* @param $config HTMLPurifier_Config instance
* @param $context HTMLPurifier_Context instance
* @return bool Is spam?
*/
function checkBlacklist($host, &$config, &$context) {
$blacklist = $config->get('URI', 'HostBlacklist');
if (!empty($blacklist)) {
foreach($blacklist as $blacklisted_host_fragment) {
if (strpos($host, $blacklisted_host_fragment) !== false) {
return true;
}
}
}
return false;
}
}
?>

View File

@@ -14,4 +14,3 @@ class HTMLPurifier_AttrDef_URI_Email extends HTMLPurifier_AttrDef
}
?>

View File

@@ -20,4 +20,3 @@ class HTMLPurifier_AttrDef_URI_Email_SimpleCheck extends HTMLPurifier_AttrDef_UR
}
?>

View File

@@ -51,4 +51,3 @@ class HTMLPurifier_AttrDef_URI_Host extends HTMLPurifier_AttrDef
}
?>

View File

@@ -39,4 +39,3 @@ class HTMLPurifier_AttrDef_URI_IPv4 extends HTMLPurifier_AttrDef
}
?>

View File

@@ -98,4 +98,3 @@ class HTMLPurifier_AttrDef_URI_IPv6 extends HTMLPurifier_AttrDef_URI_IPv4
}
?>

View File

@@ -55,4 +55,3 @@ class HTMLPurifier_AttrTransform
}
?>

View File

@@ -28,4 +28,3 @@ class HTMLPurifier_AttrTransform_BdoDir extends HTMLPurifier_AttrTransform
}
?>

View File

@@ -23,4 +23,3 @@ extends HTMLPurifier_AttrTransform {
}
?>

View File

@@ -36,4 +36,3 @@ extends HTMLPurifier_AttrTransform {
}
?>

View File

@@ -17,4 +17,3 @@ class HTMLPurifier_AttrTransform_Border extends HTMLPurifier_AttrTransform {
}
?>

View File

@@ -57,4 +57,3 @@ class HTMLPurifier_AttrTransform_EnumToCSS extends HTMLPurifier_AttrTransform {
}
?>

View File

@@ -51,4 +51,3 @@ class HTMLPurifier_AttrTransform_ImgRequired extends HTMLPurifier_AttrTransform
}
?>

View File

@@ -44,4 +44,3 @@ extends HTMLPurifier_AttrTransform {
}
?>

View File

@@ -27,4 +27,3 @@ class HTMLPurifier_AttrTransform_Lang extends HTMLPurifier_AttrTransform
}
?>

View File

@@ -26,4 +26,3 @@ class HTMLPurifier_AttrTransform_Length extends HTMLPurifier_AttrTransform
}
?>

View File

@@ -18,4 +18,3 @@ class HTMLPurifier_AttrTransform_Name extends HTMLPurifier_AttrTransform
}
?>

View File

@@ -79,4 +79,4 @@ class HTMLPurifier_AttrTypes
}
}
?>

View File

@@ -1,32 +1,53 @@
<?php
/**
* Validates the attributes of a token. Doesn't manage required attributes
* very well. The only reason we factored this out was because RemoveForeignElements
* also needed it besides ValidateAttributes.
*/
class HTMLPurifier_AttrValidator
{
function validateToken($token, &$config, &$context) {
/**
* Validates the attributes of a token, returning a modified token
* that has valid tokens
* @param $token Reference to token to validate. We require a reference
* because the operation this class performs on the token are
* not atomic, so the context CurrentToken to be updated
* throughout
* @param $config Instance of HTMLPurifier_Config
* @param $context Instance of HTMLPurifier_Context
*/
function validateToken(&$token, &$config, &$context) {
$definition = $config->getHTMLDefinition();
$e =& $context->get('ErrorCollector', true);
// initialize CurrentToken if necessary
$current_token =& $context->get('CurrentToken', true);
if (!$current_token) $context->register('CurrentToken', $token);
if ($token->type !== 'start' && $token->type !== 'empty') return $token;
// create alias to global definition array, see also $defs
// DEFINITION CALL
$d_defs = $definition->info_global_attr;
// copy out attributes for easy manipulation
$attr = $token->attr;
// reference attributes for easy manipulation
$attr =& $token->attr;
// do global transformations (pre)
// nothing currently utilizes this
foreach ($definition->info_attr_transform_pre as $transform) {
$attr = $transform->transform($attr, $config, $context);
$attr = $transform->transform($o = $attr, $config, $context);
if ($e && ($attr != $o)) $e->send(E_NOTICE, 'AttrValidator: Attributes transformed', $o, $attr);
}
// do local transformations only applicable to this element (pre)
// ex. <p align="right"> to <p style="text-align:right;">
foreach ($definition->info[$token->name]->attr_transform_pre
as $transform
) {
$attr = $transform->transform($attr, $config, $context);
foreach ($definition->info[$token->name]->attr_transform_pre as $transform) {
$attr = $transform->transform($o = $attr, $config, $context);
if ($e && ($attr != $o)) $e->send(E_NOTICE, 'AttrValidator: Attributes transformed', $o, $attr);
}
// create alias to this element's attribute definition array, see
@@ -34,6 +55,9 @@ class HTMLPurifier_AttrValidator
// DEFINITION CALL
$defs = $definition->info[$token->name]->attr;
$attr_key = false;
$context->register('CurrentAttr', $attr_key);
// iterate through all the attribute keypairs
// Watch out for name collisions: $key has previously been used
foreach ($attr as $attr_key => $value) {
@@ -67,9 +91,17 @@ class HTMLPurifier_AttrValidator
// put the results into effect
if ($result === false || $result === null) {
// this is a generic error message that should replaced
// with more specific ones when possible
if ($e) $e->send(E_ERROR, 'AttrValidator: Attribute removed');
// remove the attribute
unset($attr[$attr_key]);
} elseif (is_string($result)) {
// generally, if a substitution is happening, there
// was some sort of implicit correction going on. We'll
// delegate it to the attribute classes to say exactly what.
// simple substitution
$attr[$attr_key] = $result;
}
@@ -81,25 +113,27 @@ class HTMLPurifier_AttrValidator
// others would prepend themselves).
}
$context->destroy('CurrentAttr');
// post transforms
// ex. <x lang="fr"> to <x lang="fr" xml:lang="fr">
// global (error reporting untested)
foreach ($definition->info_attr_transform_post as $transform) {
$attr = $transform->transform($attr, $config, $context);
$attr = $transform->transform($o = $attr, $config, $context);
if ($e && ($attr != $o)) $e->send(E_NOTICE, 'AttrValidator: Attributes transformed', $o, $attr);
}
// ex. <bdo> to <bdo dir="ltr">
// local (error reporting untested)
foreach ($definition->info[$token->name]->attr_transform_post as $transform) {
$attr = $transform->transform($attr, $config, $context);
$attr = $transform->transform($o = $attr, $config, $context);
if ($e && ($attr != $o)) $e->send(E_NOTICE, 'AttrValidator: Attributes transformed', $o, $attr);
}
// commit changes
$token->attr = $attr;
return $token;
// destroy CurrentToken if we made it ourselves
if (!$current_token) $context->destroy('CurrentToken');
}
}
?>

View File

@@ -226,4 +226,3 @@ class HTMLPurifier_CSSDefinition extends HTMLPurifier_Definition
}
?>

View File

@@ -36,6 +36,11 @@ class HTMLPurifier_ChildDef
*/
var $allow_empty;
/**
* Lookup array of all elements that this definition could possibly allow
*/
var $elements = array();
/**
* Validates nodes according to definition and returns modification.
*
@@ -52,4 +57,4 @@ class HTMLPurifier_ChildDef
}
}
?>

View File

@@ -35,6 +35,7 @@ class HTMLPurifier_ChildDef_Chameleon extends HTMLPurifier_ChildDef
function HTMLPurifier_ChildDef_Chameleon($inline, $block) {
$this->inline = new HTMLPurifier_ChildDef_Optional($inline);
$this->block = new HTMLPurifier_ChildDef_Optional($block);
$this->elements = $this->block->elements;
}
function validateChildren($tokens_of_children, $config, &$context) {
@@ -48,4 +49,3 @@ class HTMLPurifier_ChildDef_Chameleon extends HTMLPurifier_ChildDef
}
}
?>

View File

@@ -44,6 +44,12 @@ class HTMLPurifier_ChildDef_Custom extends HTMLPurifier_ChildDef
// COMPLICATED! AND MIGHT BE BUGGY! I HAVE NO CLUE WHAT I'M
// DOING! Seriously: if there's problems, please report them.
// collect all elements into the $elements array
preg_match_all("/$el/", $reg, $matches);
foreach ($matches[0] as $match) {
$this->elements[$match] = true;
}
// setup all elements as parentheticals with leading commas
$reg = preg_replace("/$el/", '(,\\0)', $reg);
@@ -85,4 +91,3 @@ class HTMLPurifier_ChildDef_Custom extends HTMLPurifier_ChildDef
}
}
?>

View File

@@ -19,4 +19,3 @@ class HTMLPurifier_ChildDef_Empty extends HTMLPurifier_ChildDef
}
}
?>

View File

@@ -20,4 +20,3 @@ class HTMLPurifier_ChildDef_Optional extends HTMLPurifier_ChildDef_Required
}
}
?>

View File

@@ -25,7 +25,7 @@ class HTMLPurifier_ChildDef_Required extends HTMLPurifier_ChildDef
$elements = array_flip($elements);
foreach ($elements as $i => $x) {
$elements[$i] = true;
if (empty($i)) unset($elements[$i]);
if (empty($i)) unset($elements[$i]); // remove blank
}
}
$this->elements = $elements;
@@ -109,4 +109,3 @@ class HTMLPurifier_ChildDef_Required extends HTMLPurifier_ChildDef
}
}
?>

View File

@@ -73,4 +73,3 @@ extends HTMLPurifier_ChildDef_Required
}
}
?>

Some files were not shown because too many files have changed in this diff Show More