Release 3.1.0.

git-svn-id: http://htmlpurifier.org/svnroot/htmlpurifier/trunk@1728 48356398-32a2-884e-a903-53898d9a118a

Doxyfile

@@ -31,7 +31,7 @@ PROJECT_NAME           = HTMLPurifier
 # This could be handy for archiving the generated documentation or 
 # if some version control system is used.
 
-PROJECT_NUMBER         = 2.1.3
+PROJECT_NUMBER         = 3.1.0
 
 # The OUTPUT_DIRECTORY tag is used to specify the (relative or absolute) 
 # base path where the generated documentation will be put. 
@@ -539,7 +539,8 @@ EXCLUDE_PATTERNS       = */tests/* \
                          */maintenance/* \
                          */smoketests/* \
                          */library/standalone/* \
-                         */.svn*
+                         */.svn* \
+                         */conf/*
 
 # The EXCLUDE_SYMBOLS tag can be used to specify one or more symbol names 
 # (namespaces, classes, functions, etc.) that should be excluded from the output. 

INSTALL

@@ -7,18 +7,19 @@ library is extremely easy.  (Although... if you were looking for a
 step-by-step installation GUI, you've downloaded the wrong software!)
 
 While the impatient can get going immediately with some of the sample
-code at the bottom of this library, it's well worth performing some
-basic sanity checks to get the most out of this library.
+code at the bottom of this library, it's well worth reading this entire
+document--most of the other documentation assumes that you are familiar
+with these contents.
 
 
 ---------------------------------------------------------------------------
 1.  Compatibility
 
-HTML Purifier works in both PHP 4 and PHP 5, and is actively tested from 
-PHP 4.3.7 and up (see tests/multitest.php for specific versions). It has 
-no core dependencies with other libraries. PHP 4 support will be 
-deprecated on December 31, 2007, at which time only essential security 
-fixes will be issued for the PHP 4 version until August 8, 2008. 
+HTML Purifier is PHP 5 only, and is actively tested from PHP 5.0.5 and 
+up. It has no core dependencies with other libraries. PHP 
+4 support was deprecated on December 31, 2007 with HTML Purifier 3.0.0. 
+Essential security fixes will be issued for the 2.1.x branch until 
+August 8, 2008. 
 
 These optional extensions can enhance the capabilities of HTML Purifier:
 
@@ -47,7 +48,7 @@ HTML Purifier can process these doctypes:
 * UTF-8 (default)
 * Any encoding iconv supports (with crippled internationalization support)
 
-These defaults reflect what my choices where be if I were authoring an
+These defaults reflect what my choices would be if I were authoring an
 HTML document, however, what you choose depends on the nature of your
 codebase.  If you don't know what doctype you are using, you can determine
 the doctype from this identifier at the top of your source code:
@@ -62,8 +63,8 @@ the doctype from this identifier at the top of your source code:
 If the character encoding declaration is missing, STOP NOW, and
 read 'docs/enduser-utf8.html' (web accessible at
 http://htmlpurifier.org/docs/enduser-utf8.html).  In fact, even if it is
-present, read this document anyway, as most websites specify character
-encoding incorrectly.
+present, read this document anyway, as many websites specify their
+document's character encoding incorrectly.
 
 
 ---------------------------------------------------------------------------
@@ -73,25 +74,142 @@ The procedure is quite simple:
 
     require_once '/path/to/library/HTMLPurifier.auto.php';
 
-I recommend only including HTML Purifier when you need it, because that
-call represents the inclusion of a lot of PHP files which constitute
-the bulk of HTML Purifier's memory usage.
-
-If you don't like your include_path to be fiddled around with, simply set
-HTML Purifier's library/ directory to the include path yourself and then:
-
-    require_once 'HTMLPurifier.php';
+This will setup an autoloader, so the library's files are only included
+when you use them.
 
 Only the contents in the library/ folder are necessary, so you can remove
-everything else when using HTML Purifier in a production environment. 
+everything else when using HTML Purifier in a production environment.
+
+If you installed HTML Purifier via PEAR, all you need to do is:
+
+    require_once 'HTMLPurifier.auto.php';
+
+Please note that the usual PEAR practice of including just the classes you
+want will not work with HTML Purifier's autoloading scheme.
+
+Advanced users, read on; other users can skip to section 4.
+
+Autoload compatibility
+----------------------
+
+    HTML Purifier attempts to be as smart as possible when registering an
+    autoloader, but there are some cases where you will need to change
+    your own code to accomodate HTML Purifier. These are those cases:
+    
+    PHP VERSION IS LESS THAN 5.1.2, AND YOU'VE DEFINED __autoload
+        Because spl_autoload_register() doesn't exist in early versions
+        of PHP 5, HTML Purifier has no way of adding itself to the autoload
+        stack. Modify your __autoload function to test
+        HTMLPurifier_Bootstrap::autoload($class)
+        
+        For example, suppose your autoload function looks like this:
+        
+            function __autoload($class) {
+                require str_replace('_', '/', $class) . '.php';
+                return true;
+            }
+        
+        A modified version with HTML Purifier would look like this:
+        
+            function __autoload($class) {
+                if (HTMLPurifier_Bootstrap::autoload($class)) return true;
+                require str_replace('_', '/', $class) . '.php';
+                return true;
+            }
+        
+        Note that there *is* some custom behavior in our autoloader; the
+        original autoloader in our example would work for 99% of the time,
+        but would fail when including language files.
+    
+    AN __autoload FUNCTION IS DECLARED AFTER OUR AUTOLOADER IS REGISTERED
+        spl_autoload_register() has the curious behavior of disabling
+        the existing __autoload() handler. Users need to explicitly
+        spl_autoload_register('__autoload'). Because we use SPL when it
+        is available, __autoload() will ALWAYS be disabled. If __autoload()
+        is declared before HTML Purifier is loaded, this is not a problem:
+        HTML Purifier will register the function for you. But if it is
+        declared afterwards, it will mysteriously not work. This
+        snippet of code (after your autoloader is defined) will fix it:
+        
+            spl_autoload_register('__autoload')
+    
+    Users should also be on guard if they use a version of PHP previous
+    to 5.1.2 without an autoloader--HTML Purifier will define __autoload()
+    for you, which can collide with an autoloader that was added by *you*
+    later.
+    
+
+For better performance
+----------------------
+
+    Opcode caches, which greatly speed up PHP initialization for scripts
+    with large amounts of code (HTML Purifier included), don't like
+    autoloaders. We offer an include file that includes all of HTML Purifier's
+    files in one go in an opcode cache friendly manner:
+    
+        // If /path/to/library isn't already in your include path, uncomment
+        // the below line:
+        // require '/path/to/library/HTMLPurifier.path.php';
+        
+        require 'HTMLPurifier.includes.php';
+    
+    Optional components still need to be included--you'll know if you try to
+    use a feature and you get a class doesn't exists error! The autoloader
+    can be used in conjunction with this approach to catch classes that are
+    missing. Simply add this afterwards:
+    
+        require 'HTMLPurifier.autoload.php';
+
+Standalone version
+------------------
+
+    HTML Purifier has a standalone distribution; you can also generate
+    a standalone file from the full version by running the script
+    maintenance/generate-standalone.php . The standalone version has the
+    benefit of having most of its code in one file, so parsing is much
+    faster and the library is easier to manage.
+    
+    If HTMLPurifier.standalone.php exists in the library directory, you
+    can use it like this:
+    
+        require '/path/to/HTMLPurifier.standalone.php';
+    
+    This is equivalent to including HTMLPurifier.includes.php, except that
+    the contents of standalone/ will be added to your path. To override this
+    behavior, specify a new HTMLPURIFIER_PREFIX where standalone files can
+    be found (usually, this will be one directory up, the "true" library
+    directory in full distributions). Don't forget to set your path too!
+    
+    The autoloader can be added to the end to ensure the classes are
+    loaded when necessary; otherwise you can manually include them.
+    To use the autoloader, use this:
+    
+        require 'HTMLPurifier.autoload.php';
+
+For advanced users
+------------------
+
+    HTMLPurifier.auto.php performs a number of operations that can be done
+    individually. These are:
+    
+        HTMLPurifier.path.php
+            Puts /path/to/library in the include path. For high performance,
+            this should be done in php.ini.
+        
+        HTMLPurifier.autoload.php
+            Registers our autoload handler HTMLPurifier_Bootstrap::autoload($class).
+    
+    You can do these operations by yourself--in fact, you must modify your own
+    autoload handler if you are using a version of PHP earlier than PHP 5.1.2
+    (See "Autoload compatibility" above).
 
 
 ---------------------------------------------------------------------------
 4. Configuration
 
 HTML Purifier is designed to run out-of-the-box, but occasionally HTML
-Purifier needs to be told what to do.  If you answered no to any of these
-questions, read on, otherwise, you can skip to the next section (or, if you're
+Purifier needs to be told what to do.  If you answer no to any of these
+questions, read on; otherwise, you can skip to the next section (or, if you're
 into configuring things just for the heck of it, skip to 4.3).
 
 * Am I using UTF-8?

INSTALL.fr.utf8

@@ -17,7 +17,7 @@ ce document pour quelques choses.
 
 1.  Compatibilité
 
-HTML Purifier fonctionne dans PHP 4 et PHP 5. PHP 4.3.2 est le dernier
+HTML Purifier fonctionne dans PHP 5. PHP 5.0.5 est le dernier
 version que je le testais.  Il ne dépend de les autre librairies.
 
 Les extensions optionnel est iconv (en général déjà installer) et 
@@ -34,19 +34,15 @@ Utilisez:
 ...quand vous devez utiliser HTML Purifier (ne inclure pas quand vous
 ne devez pas, parce que HTML Purifier est trés grand.)
 
-Si vous n'aime pas que HTML Purifier change vos include_path, on peut
-change vos include_path, et:
+HTML Purifier utilise 'autoload'. Si vous avez définu la fonction
+__autoload, vous doivez ajoute cet programme:
 
-    require_once 'HTMLPurifier.php';
+    spl_autoload_register('__autoload')
 
-Seuleument les contents dans library/ est essentiel; vous peut enlever
-les autre fichiers quand vous est dans une atmosphère professionnel.
+Plus d'information est dans le document 'INSTALL'.
 
 
-[En cours de construction]
-
-
-6.   Installation vite
+3.   Installation vite
 
 Si votre site web est en UTF-8 et XHTML Transitional, utilisez:
 

NEWS

@@ -9,6 +9,178 @@ NEWS ( CHANGELOG and HISTORY )                                     HTMLPurifier
     . Internal change
 ==========================
 
+3.1.0, released 2008-05-18
+# Unnecessary references to objects (vestiges of PHP4) removed from method
+  signatures.  The following methods do not need references when assigning from
+  them and will result in E_STRICT errors if you try:
+    + HTMLPurifier_Config->get*Definition() [* = HTML, CSS]
+    + HTMLPurifier_ConfigSchema::instance()
+    + HTMLPurifier_DefinitionCacheFactory::instance()
+    + HTMLPurifier_DefinitionCacheFactory->create()
+    + HTMLPurifier_DoctypeRegistry->register()
+    + HTMLPurifier_DoctypeRegistry->get()
+    + HTMLPurifier_HTMLModule->addElement()
+    + HTMLPurifier_HTMLModule->addBlankElement()
+    + HTMLPurifier_LanguageFactory::instance()
+# Printer_ConfigForm's get*() functions were static-ified
+# %HTML.ForbiddenAttributes requires attribute declarations to be in the
+  form of tag@attr, NOT tag.attr (which will throw an error and won't do
+  anything). This is for forwards compatibility with XML; you'd do best
+  to migrate an %HTML.AllowedAttributes directives to this syntax too.
+! Allow index to be false for config from form creation
+! Added HTMLPurifier::VERSION constant
+! Commas, not dashes, used for serializer IDs. This change is forwards-compatible
+  and allows for version numbers like "3.1.0-dev".
+! %HTML.Allowed deals gracefully with whitespace anywhere, anytime!
+! HTML Purifier's URI handling is a lot more robust, with much stricter
+  validation checks and better percent encoding handling.
+! Bootstrap autoloader deals more robustly with classes that don't exist,
+  preventing class_exists($class, true) from barfing.
+- InterchangeBuilder now alphabetizes its lists
+- Validation error in configdoc output fixed
+- Iconv and other encoding errors muted even with custom error handlers that
+  do not honor error_reporting
+- Add protection against imagecrash attack with CSS height/width
+- HTMLPurifier::instance() created for consistency, is equivalent to getInstance()
+- Fixed and revamped broken ConfigForm smoketest
+- Bug with bool/null fields in Printer_ConfigForm fixed
+- Bug with global forbidden attributes fixed
+- Improved error messages for allowed and forbidden HTML elements and attributes
+- Missing (or null) in configdoc documentation restored
+- If DOM throws and exception during parsing with PH5P (occurs in newer versions
+  of DOM), HTML Purifier punts to DirectLex
+- Fatal error with unserialization of ScriptRequired
+- Created directories are now chmod'ed properly
+- Fixed bug with fallback languages in LanguageFactory
+- Standalone testing setup properly with autoload
+. Out-of-date documentation revised
+. UTF-8 encoding check optimization as suggested by Diego
+. HTMLPurifier_Error removed in favor of exceptions
+. More copy() function removed; should use clone instead
+. More extensive unit tests for HTMLDefinition
+. assertPurification moved to central harness
+. HTMLPurifier_Generator accepts $config and $context parameters during
+  instantiation, not runtime
+. Double-quotes outside of attribute values are now unescaped
+
+3.1.0rc1, released 2008-04-22
+# Autoload support added. Internal require_once's removed in favor of an
+  explicit require list or autoloading. To use HTML Purifier,
+  you must now either use HTMLPurifier.auto.php
+  or HTMLPurifier.includes.php; setting the include path and including
+  HTMLPurifier.php is insufficient--in such cases include HTMLPurifier.autoload.php
+  as well to register our autoload handler (or modify your autoload function
+  to check HTMLPurifier_Bootstrap::getPath($class)). You can also use
+  HTMLPurifier.safe-includes.php for a less performance friendly but more
+  user-friendly library load.
+# HTMLPurifier_ConfigSchema static functions are officially deprecated. Schema
+  information is stored in the ConfigSchema directory, and the
+  maintenance/generate-schema-cache.php generates the schema.ser file, which
+  is now instantiated. Support for userland schema changes coming soon!
+# HTMLPurifier_Config will now throw E_USER_NOTICE when you use a directive
+  alias; to get rid of these errors just modify your configuration to use
+  the new directive name.
+# HTMLPurifier->addFilter is deprecated; built-in filters can now be
+  enabled using %Filter.$filter_name or by setting your own filters using
+  %Filter.Custom
+# Directive-level safety properties superceded in favor of module-level
+  safety. Internal method HTMLModule->addElement() has changed, although 
+  the externally visible HTMLDefinition->addElement has *not* changed.
+! Extra utility classes for testing and non-library operations can
+  be found in extras/. Specifically, these are FSTools and ConfigDoc.
+  You may find a use for these in your own project, but right now they
+  are highly experimental and volatile.
+! Integration with PHPT allows for automated smoketests
+! Limited support for proprietary HTML elements, namely <marquee>, sponsored
+  by Chris. You can enable them with %HTML.Proprietary if your client
+  demands them.
+! Support for !important CSS cascade modifier. By default, this will be stripped
+  from CSS, but you can enable it using %CSS.AllowImportant
+! Support for display and visibility CSS properties added, set %CSS.AllowTricky
+  to true to use them.
+! HTML Purifier now has its own Exception hierarchy under HTMLPurifier_Exception.
+  Developer error (not enduser error) can cause these to be triggered.
+! Experimental kses() wrapper introduced with HTMLPurifier.kses.php
+! Finally %CSS.AllowedProperties for tweaking allowed CSS properties without
+  mucking around with HTMLPurifier_CSSDefinition
+! ConfigDoc output has been enhanced with version and deprecation info.
+! %HTML.ForbiddenAttributes and %HTML.ForbiddenElements implemented.
+- Autoclose now operates iteratively, i.e. <span><span><div> now has
+  both span tags closed.
+- Various HTMLPurifier_Config convenience functions now accept another parameter
+  $schema which defines what HTMLPurifier_ConfigSchema to use besides the
+  global default.
+- Fix bug with trusted script handling in libxml versions later than 2.6.28.
+- Fix bug in ExtractStyleBlocks with comments in style tags
+- Fix bug in comment parsing for DirectLex
+- Flush output now displayed when in command line mode for unit tester
+- Fix bug with rgb(0, 1, 2) color syntax with spaces inside shorthand syntax
+- HTMLPurifier_HTMLDefinition->addAttribute can now be called multiple times
+  on the same element without emitting errors.
+- Fixed fatal error in PH5P lexer with invalid tag names
+. Plugins now get their own changelogs according to project conventions.
+. Convert tokens to use instanceof, reducing memory footprint and
+  improving comparison speed.
+. Dry runs now supported in SimpleTest; testing facilities improved
+. Bootstrap class added for handling autoloading functionality
+. Implemented recursive glob at FSTools->globr
+. ConfigSchema now has instance methods for all corresponding define* 
+  static methods.
+. A couple of new historical maintenance scripts were added.
+. HTMLPurifier/HTMLModule/Tidy/XHTMLAndHTML4.php split into two files
+. tests/index.php can now be run from any directory.
+. HTMLPurifier_Token subclasses split into seperate files
+. HTMLPURIFIER_PREFIX now is defined in Bootstrap.php, NOT HTMLPurifier.php
+. HTMLPURIFIER_PREFIX can now be defined outside of HTML Purifier
+. New --php=php flag added, allows PHP executable to be specified (command
+  line only!)
+. htmlpurifier_add_test() preferred method to translate test files in to
+  classes, because it handles PHPT files too.
+. Debugger class is deprecated and will be removed soon.
+. Command line argument parsing for testing scripts revamped, now --opt value
+  format is supported.
+. Smoketests now cleanup after magic quotes
+. Generator now can output comments (however, comments are still stripped
+  from HTML Purifier output)
+. HTMLPurifier_ConfigSchema->validate() deprecated in favor of
+  HTMLPurifier_VarParser->parse()
+. Integers auto-cast into float type by VarParser.
+. HTMLPURIFIER_STRICT removed; no validation is performed on runtime, only 
+  during cache generation
+. Reordered script calls in maintenance/flush.php
+. Command line scripts now honor exit codes
+. When --flush fails in unit testers, abort tests and print message
+. Improved documentation in docs/dev-flush.html about the maintenance scripts
+. copy() methods removed in favor of clone keyword
+
+3.0.0, released 2008-01-06
+# HTML Purifier is PHP 5 only! The 2.1.x branch will be maintained
+  until PHP 4 is completely deprecated, but no new features will be added
+  to it.
+  + Visibility declarations added
+  + Constructor methods renamed to __construct()
+  + PHP4 reference cruft removed (in progress)
+! CSS properties are now case-insensitive
+! DefinitionCacheFactory now can register new implementations
+! New HTMLPurifier_Filter_ExtractStyleBlocks for extracting <style> from
+  documents and cleaning their contents up. Requires the CSSTidy library
+  <http://csstidy.sourceforge.net/>. You can access the blocks with the
+  'StyleBlocks' Context variable ($purifier->context->get('StyleBlocks')).
+  The output CSS can also be "scoped" for a specific element, use:
+  %Filter.ExtractStyleBlocksScope
+! Experimental support for some proprietary CSS attributes allowed:
+  opacity (and all of the browser-specific equivalents) and scrollbar colors.
+  Enable by setting %CSS.Proprietary to true.
+- Colors missing # but in hex form will be corrected
+- CSS Number algorithm improved
+- Unit testing and multi-testing now on steroids: command lines,
+  XML output, and other goodies now added.
+. Unit tests for Injector improved
+. New classes:
+  + HTMLPurifier_AttrDef_CSS_AlphaValue
+  + HTMLPurifier_AttrDef_CSS_Filter
+. Multitest now has a file docblock
+
 2.1.3, released 2007-11-05
 ! tests/multitest.php allows you to test multiple versions by running
   tests/index.php through multiple interpreters using `phpv` shell

TODO

@@ -7,19 +7,32 @@ TODO List
     ? Maybe I'll Do It
 ==========================
 
-If no interest is expressed for a feature that may required a considerable
+If no interest is expressed for a feature that may require a considerable
 amount of effort to implement, it may get endlessly delayed. Do not be
 afraid to cast your vote for the next feature to be implemented!
 
-2.2 release [Error'ed]
- # Error logging for filtering/cleanup procedures
- - XSS-attempt detection
+- Implement validation for query and for fragment
 
-2.3 release [Do What I Mean, Not What I Say]
+FUTURE VERSIONS
+---------------
+
+3.2 release [It's All About Trust] (floating)
+ # Implement untrusted, dangerous elements/attributes
+    - Objects and Forms are especially wanted
+ # Implement IDREF support (harder than it seems, since you cannot have
+   IDREFs to non-existent IDs)
+ # Frameset XHTML 1.0 and HTML 4.01 doctypes
+ - Research and implement a "safe" version of the Object module
+
+3.3 release [Error'ed]
+ # Error logging for filtering/cleanup procedures
+ - XSS-attempt detection--certain errors are flagged XSS-like
+
+3.4 release [Do What I Mean, Not What I Say]
  # Additional support for poorly written HTML
     - Microsoft Word HTML cleaning (i.e. MsoNormal, but research essential!)
     - Friendly strict handling of <address> (block -> <br>)
- - Remove redundant tags, ex. <u><u>Underlined</u></u>. Implementation notes:
+ ? Remove redundant tags, ex. <u><u>Underlined</u></u>. Implementation notes:
     1. Analyzing which tags to remove duplicants
     2. Ensure attributes are merged into the parent tag
     3. Extend the tag exclusion system to specify whether or not the
@@ -29,61 +42,85 @@ afraid to cast your vote for the next feature to be implemented!
  - Remove empty inline tags<i></i>
  - Append something to duplicate IDs so they're still usable (impl. note: the
    dupe detector would also need to detect the suffix as well)
- - Externalize inline CSS to promote clean HTML
+ - Externalize inline CSS to promote clean HTML, proposed by Sander Tekelenburg
 
-2.4 release [It's All About Trust] (floating)
- # Implement untrusted, dangerous elements/attributes
- # Implement IDREF support (harder than it seems, since you cannot have
-   IDREFs to non-existent IDs)
- # Frameset XHTML 1.0 and HTML 4.01 doctypes
-
-3.0 release [Beyond HTML]
+4.0 release [Beyond HTML]
  # Legit token based CSS parsing (will require revamping almost every
-   AttrDef class). Probably will use CSSTidy class
- # More control over allowed CSS properties (maybe modularize it in the
-   same fashion!)
- # Formatters for plaintext
-    - Smileys
+   AttrDef class). Probably will use CSSTidy class?
+ # More control over allowed CSS properties using a modularization
+ # HTML 5 support
+ # IRI support
  - Standardize token armor for all areas of processing
  - Convert RTL/LTR override characters to <bdo> tags, or vice versa on demand.
    Also, enable disabling of directionality
 
-4.0 release [To XML and Beyond]
+5.0 release [To XML and Beyond]
+ - AllowedAttributes and ForbiddenAttributes step on the toes of XML by
+   using periods; this needs to be changed.
  - Extended HTML capabilities based on namespacing and tag transforms (COMPLEX)
     - Hooks for adding custom processors to custom namespaced tags and
       attributes, offer default implementation
     - Lots of documentation and samples
 
 Ongoing
- - Lots of profiling, make it faster!
+ - More refactoring to take advantage of PHP5's facilities 
+ - Refactor unit tests into lots of test methods
  - Plugins for major CMSes (COMPLEX)
     - phpBB
-    - eFiction
+    - Drupal needs loving!
+    - Phorum need loving!
     - more! (look for ones that use WYSIWYGs)
- - Complete basic smoketests
+    - Also, maybe a FAQ for extension writers with HTML Purifier
 
-Unknown release (on a scratch-an-itch basis)
- # CHMOD install script for PEAR installs
- ? Have 'lang' attribute be checked against official lists, achieved by
-   encoding all characters that have string entity equivalents
- - Abstract ChildDef_BlockQuote to work with all elements that only
-   allow blocks in them, required or optional
- - Reorganize Unit Tests
- - Reorganize configuration directives (Create more namespaces! Get messy!)
+AutoFormat
+ - Smileys
+ - Syntax highlighting (with GeSHi) with <pre> and possibly <?php
+ - Look at http://drupal.org/project/Modules/category/63 for ideas
+
+Optimizations
+ - Reduce size of internal data-structures (esp. HTMLDefinition)
+ - Research memory usage of objects versus arrays
+ - Combine multiple strategies into a single, single-pass strategy
+ - Get PH5P working with the latest versions of DOM, which have much more
+   stringent error checking procedures. Maybe convert straight to tokens.
+ - Get rid of set_include_path(). Save this for another major release.
+
+Neat feature related
+ ! Factor demo.php into a set of Printer classes, and then create a stub
+   file for users here (inside the actual HTML Purifier library)
+ ! Support exporting configuration, so users can easily tweak settings
+   in the demo, and then copy-paste into their own setup
  - Advanced URI filtering schemes (see docs/proposal-new-directives.txt)
- - Implement lenient <ruby> child validation
+ - Allow scoped="scoped" attribute in <style> tags; may be troublesome
+   because regular CSS has no way of uniquely identifying nodes, so we'd
+   have to generate IDs
  - Explain how to use HTML Purifier in non-PHP languages / create
    a simple command line stub (or complicated?)
  - Fixes for Firefox's inability to handle COL alignment props (Bug 915)
  - Automatically add non-breaking spaces to empty table cells when
    empty-cells:show is applied to have compatibility with Internet Explorer
+ - Table of Contents generation (XHTML Compiler might be reusable). May also
+   be out-of-band information.
+ - Full set of color keywords. Also, a way to add onto them without
+   finalizing the configuration object.
+ - Write a var_export and memcached DefinitionCache - Denis
 
-Requested
+Maintenance related (slightly boring)
+ # CHMOD install script for PEAR installs
+ ! Factor out command line parser into its own class, and unit test it
+ ! Nested configuration namespaces
+ - Distinguish between default settings and explicitly set settings, so
+   configurations can be merged
+ - Time PHPT tests
+
+ChildDef related (very boring)
+ - Abstract ChildDef_BlockQuote to work with all elements that only
+   allow blocks in them, required or optional
+ - Implement lenient <ruby> child validation
 
 Wontfix
  - Non-lossy smart alternate character encoding transformations (unless
    patch provided)
  - Pretty-printing HTML: users can use Tidy on the output on entire page
- - Native content compression, whitespace stripping (don't rely on Tidy, make
-   sure we don't remove from <pre> or related tags): use gzip if this is
+ - Native content compression, whitespace stripping: use gzip if this is
    really important

VERSION

@@ -1 +1 @@
-2.1.3
+3.1.0

WHATSNEW

@@ -1,6 +1,10 @@
-Stability release 2.1.3 fixes a slew of minor bugs found in HTML Purifier,
-and also includes some internal code enhancements and refactorings.
-Notably, tests/multitest.php automates testing in multiple versions, 
-fatal AttrDef_URI_Email error fixed, blockquote contents are more lenient
-in HTML 4.01 Strict and fatal errors involving ID tags in img tags were
-fixed.
+HTML Purifier 3.1.0 is the second release series for HTML Purifier on PHP 5
+as well as a security update related to URIs. It shifts over to using
+autoload, and also includes support for the !important CSS modifier,
+display and visibility CSS properties with %CSS.AllowTricky, marquee with
+%HTML.Proprietary (had you scared for a moment, hmm?), a kses() wrapper,
+%CSS.AllowedProperties, %HTML.ForbiddenAttributes and
+%HTML.ForbiddenElements and a totally revamped ConfigDoc system. Since the
+release candidate, there have also been a number of stability fixes such as
+improved URI escaping, a change in serializer ID format, and a relaxed
+format for %HTML.Allowed. And as always, numerous bugfixes.

benchmarks/Lexer.php

@@ -1,13 +1,11 @@
 <?php
 
-// emulates inserting a dir called HTMLPurifier into your class dir
-set_include_path(get_include_path() . PATH_SEPARATOR . '../library/');
-
+require_once '../library/HTMLPurifier.auto.php';
 @include_once '../test-settings.php';
 
-require_once 'HTMLPurifier/ConfigSchema.php';
-require_once 'HTMLPurifier/Config.php';
-require_once 'HTMLPurifier/Context.php';
+// PEAR
+require_once 'Benchmark/Timer.php'; // to do the timing
+require_once 'Text/Password.php'; // for generating random input
 
 $LEXERS = array();
 $RUNS = isset($GLOBALS['HTMLPurifierTest']['Runs'])
@@ -16,22 +14,11 @@ $RUNS = isset($GLOBALS['HTMLPurifierTest']['Runs'])
 require_once 'HTMLPurifier/Lexer/DirectLex.php';
 $LEXERS['DirectLex'] = new HTMLPurifier_Lexer_DirectLex();
 
-if (!empty($GLOBALS['HTMLPurifierTest']['PEAR'])) {
-    require_once 'HTMLPurifier/Lexer/PEARSax3.php';
-    $LEXERS['PEARSax3'] = new HTMLPurifier_Lexer_PEARSax3();
-} else {
-    exit('PEAR required to perform benchmark.');
-}
-
 if (version_compare(PHP_VERSION, '5', '>=')) {
     require_once 'HTMLPurifier/Lexer/DOMLex.php';
     $LEXERS['DOMLex'] = new HTMLPurifier_Lexer_DOMLex();
 }
 
-// PEAR
-require_once 'Benchmark/Timer.php'; // to do the timing
-require_once 'Text/Password.php'; // for generating random input
-
 // custom class to aid unit testing
 class RowTimer extends Benchmark_Timer
 {

benchmarks/ProfileDirectLex.php

@@ -1,17 +0,0 @@
-<?php
-
-set_include_path(get_include_path() . PATH_SEPARATOR . '../library/');
-
-require_once 'HTMLPurifier/ConfigSchema.php';
-require_once 'HTMLPurifier/Config.php';
-require_once 'HTMLPurifier/Lexer/DirectLex.php';
-require_once 'HTMLPurifier/Context.php';
-
-$input = file_get_contents('samples/Lexer/4.html');
-$lexer = new HTMLPurifier_Lexer_DirectLex();
-$config = HTMLPurifier_Config::createDefault();
-$context = new HTMLPurifier_Context();
-
-for ($i = 0; $i < 10; $i++) {
-    $tokens = $lexer->tokenizeHTML($input, $config, $context);
-}

benchmarks/Trace.php

@@ -3,6 +3,11 @@
 ini_set('xdebug.trace_format', 1);
 ini_set('xdebug.show_mem_delta', true);
 
+if (file_exists('Trace.xt')) {
+    echo "Previous trace Trace.xt must be removed before this script can be run.";
+    exit;
+}
+
 xdebug_start_trace(dirname(__FILE__) . '/Trace');
 require_once '../library/HTMLPurifier.auto.php';
 
@@ -10,3 +15,5 @@ $purifier = new HTMLPurifier();
 
 $data = $purifier->purify(file_get_contents('samples/Lexer/4.html'));
 xdebug_stop_trace();
+
+echo "Trace finished.";

configdoc/generate.php

@@ -2,12 +2,12 @@
 
 /**
  * Generates XML and HTML documents describing configuration.
- * @note PHP 5 only!
+ * @note PHP 5.2+ only!
  */
 
 /*
 TODO:
-- make XML format richer (see XMLSerializer_ConfigSchema)
+- make XML format richer
 - extend XSLT transformation (see the corresponding XSLT file)
 - allow generation of packaged docs that can be easily moved
 - multipage documentation
@@ -15,29 +15,45 @@ TODO:
 - add blurbs to ToC
 */
 
-if (version_compare('5', PHP_VERSION, '>')) exit('Requires PHP 5 or higher.');
-error_reporting(E_ALL); // probably not possible to use E_STRICT
+if (version_compare(PHP_VERSION, '5.2', '<')) exit('PHP 5.2+ required.');
+error_reporting(E_ALL | E_STRICT);
 
-define('HTMLPURIFIER_SCHEMA_STRICT', true); // description data needs to be collected
+chdir(dirname(__FILE__));
 
 // load dual-libraries
+require_once '../extras/HTMLPurifierExtras.auto.php';
 require_once '../library/HTMLPurifier.auto.php';
-require_once 'library/ConfigDoc.auto.php';
 
-$purifier = HTMLPurifier::getInstance(array(
+// setup HTML Purifier singleton
+HTMLPurifier::getInstance(array(
     'AutoFormat.PurifierLinkify' => true
 ));
 
-$schema = HTMLPurifier_ConfigSchema::instance();
-$style = 'plain'; // use $_GET in the future
-$configdoc = new ConfigDoc();
-$output = $configdoc->generate($schema, $style);
+$interchange = HTMLPurifier_ConfigSchema_InterchangeBuilder::buildFromDirectory();
+$interchange->validate();
+
+$style = 'plain'; // use $_GET in the future, careful to validate!
+$configdoc_xml = 'configdoc.xml';
+
+$xml_builder = new HTMLPurifier_ConfigSchema_Builder_Xml();
+$xml_builder->openURI($configdoc_xml);
+$xml_builder->build($interchange);
+unset($xml_builder); // free handle
+
+$xslt = new ConfigDoc_HTMLXSLTProcessor();
+$xslt->importStylesheet(dirname(__FILE__) . "/styles/$style.xsl");
+$output = $xslt->transformToHTML($configdoc_xml);
+
+if (!$output) {
+    echo "Error in generating files\n";
+    exit(1);
+}
 
 // write out
 file_put_contents("$style.html", $output);
 
 if (php_sapi_name() != 'cli') {
-    // output = instant feedback
+    // output (instant feedback if it's a browser)
     echo $output;
 } else {
     echo 'Files generated successfully.';

configdoc/library/ConfigDoc.php

@@ -1,38 +0,0 @@
-<?php
-
-require_once 'ConfigDoc/HTMLXSLTProcessor.php';
-require_once 'ConfigDoc/XMLSerializer/Types.php';
-require_once 'ConfigDoc/XMLSerializer/ConfigSchema.php';
-
-class ConfigDoc
-{
-    
-    function generate($schema, $xsl_stylesheet_name = 'plain', $parameters = array()) {
-        // generate types document, describing type constraints
-        $types_serializer = new ConfigDoc_XMLSerializer_Types();
-        $types_document = $types_serializer->serialize($schema);
-        $types_document->save(dirname(__FILE__) . '/../types.xml'); // only ONE
-        
-        // generate configdoc.xml, documents configuration directives
-        $schema_serializer = new ConfigDoc_XMLSerializer_ConfigSchema();
-        $schema_document = $schema_serializer->serialize($schema);
-        $schema_document->save('configdoc.xml');
-        
-        // setup transformation
-        $xsl_stylesheet = dirname(__FILE__) . "/../styles/$xsl_stylesheet_name.xsl";
-        $xslt_processor = new ConfigDoc_HTMLXSLTProcessor();
-        $xslt_processor->setParameters($parameters);
-        $xslt_processor->importStylesheet($xsl_stylesheet);
-        
-        return $xslt_processor->transformToHTML($schema_document);
-    }
-    
-    /**
-     * Remove any generated files
-     */
-    function cleanup() {
-        unlink('configdoc.xml');
-    }
-    
-}
-

configdoc/library/ConfigDoc/XMLSerializer.php

@@ -1,25 +0,0 @@
-<?php
-
-/**
- * The XMLSerializer hierarchy of classes consist of classes that take
- * objects and serialize them into XML, specifically DOM, form; this
- * super-class contains convenience functions for those classes.
- */
-class ConfigDoc_XMLSerializer
-{
-    
-    protected function appendHTMLDiv($document, $node, $html) {
-        $purifier = HTMLPurifier::getInstance();
-        $html = $purifier->purify($html);
-        $dom_html = $document->createDocumentFragment();
-        $dom_html->appendXML($html);
-        
-        $dom_div = $document->createElement('div');
-        $dom_div->setAttribute('xmlns', 'http://www.w3.org/1999/xhtml');
-        $dom_div->appendChild($dom_html);
-        
-        $node->appendChild($dom_div);
-    }
-    
-}
-

configdoc/library/ConfigDoc/XMLSerializer/ConfigSchema.php

@@ -1,123 +0,0 @@
-<?php
-
-require_once 'ConfigDoc/XMLSerializer.php';
-
-class ConfigDoc_XMLSerializer_ConfigSchema extends ConfigDoc_XMLSerializer
-{
-    
-    /**
-     * Serializes a schema into DOM form
-     * @todo Split into sub-serializers
-     * @param $schema HTMLPurifier_ConfigSchema to serialize
-     */
-    public function serialize($schema) {
-        $dom_document = new DOMDocument('1.0', 'UTF-8');
-        $dom_root = $dom_document->createElement('configdoc');
-        $dom_document->appendChild($dom_root);
-        $dom_document->formatOutput = true;
-        
-        // add the name of the application
-        $dom_root->appendChild($dom_document->createElement('title', 'HTML Purifier'));
-        
-        /*
-        TODO for XML format:
-        - create a definition (DTD or other) once interface stabilizes
-        */
-        
-        foreach($schema->info as $namespace_name => $namespace_info) {
-            
-            $dom_namespace = $dom_document->createElement('namespace');
-            $dom_root->appendChild($dom_namespace);
-            
-            $dom_namespace->setAttribute('id', $namespace_name);
-            $dom_namespace->appendChild(
-                $dom_document->createElement('name', $namespace_name)
-            );
-            $dom_namespace_description = $dom_document->createElement('description');
-            $dom_namespace->appendChild($dom_namespace_description);
-            $this->appendHTMLDiv($dom_document, $dom_namespace_description,
-                $schema->info_namespace[$namespace_name]->description);
-            
-            foreach ($namespace_info as $name => $info) {
-                
-                if ($info->class == 'alias') continue;
-                
-                $dom_directive = $dom_document->createElement('directive');
-                $dom_namespace->appendChild($dom_directive);
-                
-                $dom_directive->setAttribute('id', $namespace_name . '.' . $name);
-                $dom_directive->appendChild(
-                    $dom_document->createElement('name', $name)
-                );
-                
-                $dom_aliases = $dom_document->createElement('aliases');
-                $dom_directive->appendChild($dom_aliases);
-                foreach ($info->directiveAliases as $alias) {
-                    $dom_aliases->appendChild($dom_document->createElement('alias', $alias));
-                }
-                
-                $dom_constraints = $dom_document->createElement('constraints');
-                $dom_directive->appendChild($dom_constraints);
-                
-                $dom_type = $dom_document->createElement('type', $info->type);
-                if ($info->allow_null) {
-                    $dom_type->setAttribute('allow-null', 'yes');
-                }
-                $dom_constraints->appendChild($dom_type);
-                
-                if ($info->allowed !== true) {
-                    $dom_allowed = $dom_document->createElement('allowed');
-                    $dom_constraints->appendChild($dom_allowed);
-                    foreach ($info->allowed as $allowed => $bool) {
-                        $dom_allowed->appendChild(
-                            $dom_document->createElement('value', $allowed)
-                        );
-                    }
-                }
-                
-                $raw_default = $schema->defaults[$namespace_name][$name];
-                if (is_bool($raw_default)) {
-                    $default = $raw_default ? 'true' : 'false';
-                } elseif (is_string($raw_default)) {
-                    $default = "\"$raw_default\"";
-                } elseif (is_null($raw_default)) {
-                    $default = 'null';
-                } else {
-                    $default = print_r(
-                            $schema->defaults[$namespace_name][$name], true
-                        );
-                }
-                
-                $dom_default = $dom_document->createElement('default', $default);
-                
-                // remove this once we get a DTD
-                $dom_default->setAttribute('xml:space', 'preserve');
-                
-                $dom_constraints->appendChild($dom_default);
-                
-                $dom_descriptions = $dom_document->createElement('descriptions');
-                $dom_directive->appendChild($dom_descriptions);
-                
-                foreach ($info->descriptions as $file => $file_descriptions) {
-                    foreach ($file_descriptions as $line => $description) {
-                        $dom_description = $dom_document->createElement('description');
-                        // refuse to write $file if it's a full path
-                        if (str_replace('\\', '/', realpath($file)) != $file) {
-                            $dom_description->setAttribute('file', $file);
-                            $dom_description->setAttribute('line', $line);
-                        }
-                        $this->appendHTMLDiv($dom_document, $dom_description, $description);
-                        $dom_descriptions->appendChild($dom_description);
-                    }
-                }
-                
-            }
-            
-        }
-        
-        return $dom_document;
-        
-    }
-    
-}
-

configdoc/library/ConfigDoc/XMLSerializer/Types.php

@@ -1,26 +0,0 @@
-<?php
-
-require_once 'ConfigDoc/XMLSerializer.php';
-
-class ConfigDoc_XMLSerializer_Types extends ConfigDoc_XMLSerializer
-{
-    
-    /**
-     * Serializes the types in a schema into DOM form
-     * @param $schema HTMLPurifier_ConfigSchema owner of types to serialize
-     */
-    public function serialize($schema) {
-        $types_document = new DOMDocument('1.0', 'UTF-8');
-        $types_root = $types_document->createElement('types');
-        $types_document->appendChild($types_root);
-        $types_document->formatOutput = true;
-        foreach ($schema->types as $name => $expanded_name) {
-            $types_type = $types_document->createElement('type', $expanded_name);
-            $types_type->setAttribute('id', $name);
-            $types_root->appendChild($types_type);
-        }
-        return $types_document;
-    }
-    
-}
-

configdoc/styles/plain.css

@@ -1,16 +1,30 @@
 
-body {margin:1em 4em;}
+body {margin:0;padding:0;}
+#content {
+  margin:1em auto;
+  max-width: 47em;
+  width: expression(document.body.clientWidth >
+    85 * parseInt(document.body.currentStyle.fontSize) ?
+    "54em": "auto");
+}
 
 table {border-collapse:collapse;}
 table td, table th {padding:0.2em;}
 
 table.constraints {margin:0 0 1em;}
-table.constraints th {text-align:left;padding-left:0.4em;}
-table.constraints td {padding-right:0.4em;}
+table.constraints th {
+  text-align:right;padding-left:0.4em;padding-right:0.4em;background:#EEE;
+  width:8em;vertical-align:top;}
+table.constraints td {padding-right:0.4em; padding-left: 1em;}
+table.constraints td ul {padding:0; margin:0; list-style:none;}
 table.constraints td pre {margin:0;}
 
-#toc {list-style-type:none; font-weight:bold;}
-#toc ul {list-style-type:disc; font-weight:normal;}
+#tocContainer {position:relative;}
+#toc {list-style-type:none; font-weight:bold; font-size:1em; margin-bottom:1em;}
+#toc li {position:relative; line-height: 1.2em;}
+#toc .col-2 {margin-left:50%;}
+#toc .col-l {float:left;}
+#toc ul {list-style-type:disc; font-weight:normal; padding-bottom:1.2em;}
 
 .description p {margin-top:0;margin-bottom:1em;}
 
@@ -19,6 +33,10 @@ table.constraints td pre {margin:0;}
 #library {font-size:1em;}
 h1 {margin-top:0;}
 h2 {border-bottom:1px solid #CCC; font-family:sans-serif; font-weight:normal;
-    font-size:1.3em;}
+    font-size:1.3em; clear:both;}
 h3 {font-family:sans-serif; font-size:1.1em; font-weight:bold; }
 h4 {font-family:sans-serif; font-size:0.9em; font-weight:bold; }
+
+.deprecated {color: #CCC;}
+.deprecated table.constraints th {background:#FFF;}
+.deprecated-notice {color: #000; text-align:center; margin-bottom: 1em;}

configdoc/styles/plain.xsl

@@ -15,7 +15,11 @@
     <xsl:param name="css" select="'styles/plain.css'"/>
     <xsl:param name="title" select="'Configuration Documentation'"/>
     
-    <xsl:variable name="typeLookup" select="document('../types.xml')" />
+    <xsl:variable name="typeLookup"  select="document('../types.xml')/types" />
+    <xsl:variable name="usageLookup" select="document('../usage.xml')/usage" />
+    
+    <!-- Twiddle this variable to get the columns as even as possible -->
+    <xsl:variable name="maxNumberAdjust" select="1" />
     
     <xsl:template match="/">
         <html lang="en" xml:lang="en">
@@ -25,55 +29,95 @@
                 <link rel="stylesheet" type="text/css" href="{$css}" />
             </head>
             <body>
-                <div id="library"><xsl:value-of select="/configdoc/title" /></div>
-                <h1><xsl:value-of select="$title" /></h1>
-                <h2>Table of Contents</h2>
-                <ul id="toc">
-                    <xsl:apply-templates mode="toc" />
-                </ul>
-                <xsl:apply-templates />
+                <div id="content">
+                    <div id="library"><xsl:value-of select="/configdoc/title" /></div>
+                    <h1><xsl:value-of select="$title" /></h1>
+                    <div id="tocContainer">
+                        <h2>Table of Contents</h2>
+                        <ul id="toc">
+                            <xsl:apply-templates mode="toc">
+                                <xsl:with-param name="overflowNumber" select="round(count(/configdoc/namespace) div 2) + $maxNumberAdjust" />
+                            </xsl:apply-templates>
+                        </ul>
+                    </div>
+                    <xsl:apply-templates />
+                </div>
             </body>
         </html>
     </xsl:template>
     
     <xsl:template match="title" mode="toc" />
     <xsl:template match="namespace" mode="toc">
+        <xsl:param name="overflowNumber" />
+        <xsl:variable name="number"><xsl:number level="single" /></xsl:variable>
+        <xsl:variable name="directiveNumber"><xsl:number level="any" count="directive" /></xsl:variable>
         <xsl:if test="count(directive)&gt;0">
             <li>
+                <!-- BEGIN multicolumn code -->
+                <xsl:if test="$number &gt;= $overflowNumber">
+                    <xsl:attribute name="class">col-2</xsl:attribute>
+                </xsl:if>
+                <xsl:if test="$number = $overflowNumber">
+                    <xsl:attribute name="style">margin-top:-<xsl:value-of select="($number * 2 + $directiveNumber - 3) * 1.2" />em</xsl:attribute>
+                </xsl:if>
+                <!-- END multicolumn code -->
                 <a href="#{@id}"><xsl:value-of select="name" /></a>
                 <ul>
-                    <xsl:apply-templates select="directive" mode="toc" />
+                    <xsl:apply-templates select="directive" mode="toc">
+                        <xsl:with-param name="overflowNumber" select="$overflowNumber" />
+                    </xsl:apply-templates>
                 </ul>
+                <xsl:if test="$number + 1 = $overflowNumber">
+                    <div class="col-l" />
+                </xsl:if>
             </li>
         </xsl:if>
     </xsl:template>
     <xsl:template match="directive" mode="toc">
-        <li><a href="#{@id}"><xsl:value-of select="name" /></a></li>
+        <xsl:variable name="number">
+            <xsl:number level="any" count="directive|namespace" />
+        </xsl:variable>
+        <xsl:if test="not(deprecated)">
+            <li>
+                <a href="#{@id}"><xsl:value-of select="name" /></a>
+            </li>
+        </xsl:if>
     </xsl:template>
     
     <xsl:template match="title" />
     
     <xsl:template match="namespace">
-        <xsl:apply-templates />
-        <xsl:if test="count(directive)=0">
-            <p>No configuration directives defined for this namespace.</p>
-        </xsl:if>
+        <div class="namespace">
+            <xsl:apply-templates />
+            <xsl:if test="count(directive)=0">
+                <p>No configuration directives defined for this namespace.</p>
+            </xsl:if>
+        </div>
     </xsl:template>
     <xsl:template match="namespace/name">
         <h2 id="{../@id}"><xsl:value-of select="." /></h2>
     </xsl:template>
     <xsl:template match="namespace/description">
         <div class="description">
-            <xsl:copy-of select="div/node()" />
+            <xsl:copy-of xmlns:xhtml="http://www.w3.org/1999/xhtml" select="xhtml:div/node()" />
         </div>
     </xsl:template>
     
     <xsl:template match="directive">
-        <xsl:apply-templates />
+        <div>
+            <xsl:attribute name="class"><!--
+                -->directive<!--
+                --><xsl:if test="deprecated"> deprecated</xsl:if><!--
+            --></xsl:attribute>
+            <xsl:apply-templates>
+                <xsl:with-param name="id" select="@id" />
+            </xsl:apply-templates>
+        </div>
     </xsl:template>
     <xsl:template match="directive/name">
+        <xsl:param name="id" />
         <xsl:apply-templates select="../aliases/alias" mode="anchor" />
-        <h3 id="{../@id}"><xsl:value-of select="../@id" /></h3>
+        <h3 id="{$id}"><xsl:value-of select="$id" /></h3>
     </xsl:template>
     <xsl:template match="alias" mode="anchor">
         <a id="{.}"></a>
@@ -83,47 +127,72 @@
     <xsl:template match="alias"></xsl:template>
     
     <xsl:template match="directive/constraints">
+        <xsl:param name="id" />
         <table class="constraints">
             <xsl:apply-templates />
-            <!-- Calculated other values -->
-            <xsl:if test="../descriptions/description[@file]">
-                <tr>
-                    <th>Used by:</th>
-                    <td>
-                        <xsl:for-each select="../descriptions/description">
-                            <xsl:if test="position()&gt;1">, </xsl:if>
-                            <xsl:value-of select="@file" />
-                        </xsl:for-each>
-                    </td>
-                </tr>
-            </xsl:if>
             <xsl:if test="../aliases/alias">
                 <xsl:apply-templates select="../aliases" mode="constraints" />
             </xsl:if>
+            <xsl:apply-templates select="$usageLookup/directive[@id=$id]" />
         </table>
     </xsl:template>
     <xsl:template match="directive/aliases" mode="constraints">
-        <th>Aliases:</th>
-        <td>
-            <xsl:for-each select="alias">
+        <tr>
+            <th>Aliases</th>
+            <td>
+                <xsl:for-each select="alias">
+                    <xsl:if test="position()&gt;1">, </xsl:if>
+                    <xsl:value-of select="." />
+                </xsl:for-each>
+            </td>
+        </tr>
+    </xsl:template>
+    <xsl:template match="directive/description">
+        <div class="description">
+            <xsl:copy-of xmlns:xhtml="http://www.w3.org/1999/xhtml" select="xhtml:div/node()" />
+        </div>
+    </xsl:template>
+    <xsl:template match="directive/deprecated">
+        <div class="deprecated-notice">
+            <strong>Warning:</strong>
+            This directive was deprecated in version <xsl:value-of select="version" />.
+            <a href="#{use}">%<xsl:value-of select="use" /></a> should be used instead.
+        </div>
+    </xsl:template>
+    <xsl:template match="usage/directive">
+        <tr>
+            <th>Used in</th>
+            <td>
+                <ul>
+                    <xsl:apply-templates />
+                </ul>
+            </td>
+        </tr>
+    </xsl:template>
+    <xsl:template match="usage/directive/file">
+        <li>
+            <em><xsl:value-of select="@name" /></em> on line<xsl:if test="count(line)&gt;1">s</xsl:if>
+            <xsl:text> </xsl:text>
+            <xsl:for-each select="line">
                 <xsl:if test="position()&gt;1">, </xsl:if>
                 <xsl:value-of select="." />
             </xsl:for-each>
-        </td>
-    </xsl:template>
-    <xsl:template match="directive//description">
-        <div class="description">
-            <xsl:copy-of select="div/node()" />
-        </div>
+        </li>
     </xsl:template>
     
+    <xsl:template match="constraints/version">
+        <tr>
+            <th>Version added</th>
+            <td><xsl:value-of select="." /></td>
+        </tr>
+    </xsl:template>
     <xsl:template match="constraints/type">
         <tr>
-            <th>Type:</th>
+            <th>Type</th>
             <td>
                 <xsl:variable name="type" select="text()" />
                 <xsl:attribute name="class">type type-<xsl:value-of select="$type" /></xsl:attribute>
-                <xsl:value-of select="$typeLookup/types/type[@id=$type]/text()" />
+                <xsl:value-of select="$typeLookup/type[@id=$type]/text()" />
                 <xsl:if test="@allow-null='yes'">
                     (or null)
                 </xsl:if>
@@ -132,7 +201,7 @@
     </xsl:template>
     <xsl:template match="constraints/allowed">
         <tr>
-            <th>Allowed values:</th>
+            <th>Allowed values</th>
             <td>
                 <xsl:for-each select="value"><!--
                  --><xsl:if test="position()&gt;1">, </xsl:if>
@@ -143,9 +212,22 @@
     </xsl:template>
     <xsl:template match="constraints/default">
         <tr>
-            <th>Default:</th>
+            <th>Default</th>
             <td><pre><xsl:value-of select="." xml:space="preserve" /></pre></td>
         </tr>
     </xsl:template>
+    <xsl:template match="constraints/external">
+        <tr>
+            <th>External deps</th>
+            <td>
+                <ul>
+                    <xsl:apply-templates />
+                </ul>
+            </td>
+        </tr>
+    </xsl:template>
+    <xsl:template match="constraints/external/project">
+        <li><xsl:value-of select="." /></li>
+    </xsl:template>
     
 </xsl:stylesheet>

configdoc/types.xml

@@ -0,0 +1,14 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<types>
+  <type id="string">String</type>
+  <type id="istring">Case-insensitive string</type>
+  <type id="text">Text</type>
+  <type id="itext">Case-insensitive text</type>
+  <type id="int">Integer</type>
+  <type id="float">Float</type>
+  <type id="bool">Boolean</type>
+  <type id="lookup">Lookup array</type>
+  <type id="list">Array list</type>
+  <type id="hash">Associative array</type>
+  <type id="mixed">Mixed</type>
+</types>

configdoc/usage.xml

@@ -0,0 +1,361 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<usage>
+ <directive id="Core.CollectErrors">
+  <file name="HTMLPurifier.php">
+   <line>131</line>
+  </file>
+  <file name="HTMLPurifier/Lexer.php">
+   <line>85</line>
+  </file>
+  <file name="HTMLPurifier/Lexer/DirectLex.php">
+   <line>50</line>
+   <line>62</line>
+   <line>327</line>
+  </file>
+  <file name="HTMLPurifier/Strategy/RemoveForeignElements.php">
+   <line>44</line>
+  </file>
+ </directive>
+ <directive id="CSS.Proprietary">
+  <file name="HTMLPurifier/CSSDefinition.php">
+   <line>202</line>
+  </file>
+ </directive>
+ <directive id="CSS.AllowTricky">
+  <file name="HTMLPurifier/CSSDefinition.php">
+   <line>206</line>
+  </file>
+ </directive>
+ <directive id="CSS.AllowImportant">
+  <file name="HTMLPurifier/CSSDefinition.php">
+   <line>210</line>
+  </file>
+ </directive>
+ <directive id="CSS.AllowedProperties">
+  <file name="HTMLPurifier/CSSDefinition.php">
+   <line>262</line>
+  </file>
+ </directive>
+ <directive id="Cache.DefinitionImpl">
+  <file name="HTMLPurifier/DefinitionCacheFactory.php">
+   <line>49</line>
+  </file>
+ </directive>
+ <directive id="HTML.Doctype">
+  <file name="HTMLPurifier/DoctypeRegistry.php">
+   <line>83</line>
+  </file>
+ </directive>
+ <directive id="HTML.CustomDoctype">
+  <file name="HTMLPurifier/DoctypeRegistry.php">
+   <line>85</line>
+  </file>
+ </directive>
+ <directive id="HTML.XHTML">
+  <file name="HTMLPurifier/DoctypeRegistry.php">
+   <line>88</line>
+  </file>
+ </directive>
+ <directive id="HTML.Strict">
+  <file name="HTMLPurifier/DoctypeRegistry.php">
+   <line>93</line>
+  </file>
+ </directive>
+ <directive id="Core.Encoding">
+  <file name="HTMLPurifier/Encoder.php">
+   <line>281</line>
+   <line>305</line>
+  </file>
+ </directive>
+ <directive id="Test.ForceNoIconv">
+  <file name="HTMLPurifier/Encoder.php">
+   <line>283</line>
+   <line>310</line>
+  </file>
+ </directive>
+ <directive id="Core.EscapeNonASCIICharacters">
+  <file name="HTMLPurifier/Encoder.php">
+   <line>307</line>
+  </file>
+ </directive>
+ <directive id="Core.MaintainLineNumbers">
+  <file name="HTMLPurifier/ErrorCollector.php">
+   <line>81</line>
+  </file>
+  <file name="HTMLPurifier/Lexer.php">
+   <line>82</line>
+  </file>
+  <file name="HTMLPurifier/Lexer/DirectLex.php">
+   <line>45</line>
+  </file>
+ </directive>
+ <directive id="Output.CommentScriptContents">
+  <file name="HTMLPurifier/Generator.php">
+   <line>41</line>
+  </file>
+ </directive>
+ <directive id="Output.TidyFormat">
+  <file name="HTMLPurifier/Generator.php">
+   <line>70</line>
+  </file>
+ </directive>
+ <directive id="Output.Newline">
+  <file name="HTMLPurifier/Generator.php">
+   <line>84</line>
+  </file>
+ </directive>
+ <directive id="HTML.BlockWrapper">
+  <file name="HTMLPurifier/HTMLDefinition.php">
+   <line>213</line>
+  </file>
+ </directive>
+ <directive id="HTML.Parent">
+  <file name="HTMLPurifier/HTMLDefinition.php">
+   <line>221</line>
+  </file>
+ </directive>
+ <directive id="HTML.AllowedElements">
+  <file name="HTMLPurifier/HTMLDefinition.php">
+   <line>238</line>
+  </file>
+ </directive>
+ <directive id="HTML.AllowedAttributes">
+  <file name="HTMLPurifier/HTMLDefinition.php">
+   <line>239</line>
+  </file>
+ </directive>
+ <directive id="HTML.Allowed">
+  <file name="HTMLPurifier/HTMLDefinition.php">
+   <line>242</line>
+  </file>
+ </directive>
+ <directive id="HTML.ForbiddenElements">
+  <file name="HTMLPurifier/HTMLDefinition.php">
+   <line>328</line>
+  </file>
+ </directive>
+ <directive id="HTML.ForbiddenAttributes">
+  <file name="HTMLPurifier/HTMLDefinition.php">
+   <line>329</line>
+  </file>
+ </directive>
+ <directive id="HTML.Trusted">
+  <file name="HTMLPurifier/HTMLModuleManager.php">
+   <line>198</line>
+  </file>
+  <file name="HTMLPurifier/Lexer.php">
+   <line>238</line>
+  </file>
+  <file name="HTMLPurifier/Lexer/DirectLex.php">
+   <line>34</line>
+  </file>
+ </directive>
+ <directive id="HTML.AllowedModules">
+  <file name="HTMLPurifier/HTMLModuleManager.php">
+   <line>205</line>
+  </file>
+ </directive>
+ <directive id="HTML.CoreModules">
+  <file name="HTMLPurifier/HTMLModuleManager.php">
+   <line>206</line>
+  </file>
+ </directive>
+ <directive id="HTML.Proprietary">
+  <file name="HTMLPurifier/HTMLModuleManager.php">
+   <line>220</line>
+  </file>
+ </directive>
+ <directive id="Attr.IDBlacklist">
+  <file name="HTMLPurifier/IDAccumulator.php">
+   <line>26</line>
+  </file>
+ </directive>
+ <directive id="Core.Language">
+  <file name="HTMLPurifier/LanguageFactory.php">
+   <line>88</line>
+  </file>
+ </directive>
+ <directive id="Core.LexerImpl">
+  <file name="HTMLPurifier/Lexer.php">
+   <line>70</line>
+  </file>
+ </directive>
+ <directive id="Core.ConvertDocumentToFragment">
+  <file name="HTMLPurifier/Lexer.php">
+   <line>230</line>
+  </file>
+ </directive>
+ <directive id="URI.Host">
+  <file name="HTMLPurifier/URIDefinition.php">
+   <line>57</line>
+  </file>
+  <file name="HTMLPurifier/URIFilter/DisableExternal.php">
+   <line>8</line>
+  </file>
+ </directive>
+ <directive id="URI.Base">
+  <file name="HTMLPurifier/URIDefinition.php">
+   <line>58</line>
+  </file>
+ </directive>
+ <directive id="URI.DefaultScheme">
+  <file name="HTMLPurifier/URIDefinition.php">
+   <line>65</line>
+  </file>
+ </directive>
+ <directive id="URI.AllowedSchemes">
+  <file name="HTMLPurifier/URISchemeRegistry.php">
+   <line>42</line>
+  </file>
+ </directive>
+ <directive id="URI.OverrideAllowedSchemes">
+  <file name="HTMLPurifier/URISchemeRegistry.php">
+   <line>43</line>
+  </file>
+ </directive>
+ <directive id="URI.Disable">
+  <file name="HTMLPurifier/AttrDef/URI.php">
+   <line>23</line>
+  </file>
+ </directive>
+ <directive id="URI.Munge">
+  <file name="HTMLPurifier/AttrDef/URI.php">
+   <line>68</line>
+  </file>
+ </directive>
+ <directive id="Core.ColorKeywords">
+  <file name="HTMLPurifier/AttrDef/CSS/Color.php">
+   <line>12</line>
+  </file>
+  <file name="HTMLPurifier/AttrDef/HTML/Color.php">
+   <line>12</line>
+  </file>
+ </directive>
+ <directive id="Attr.AllowedFrameTargets">
+  <file name="HTMLPurifier/AttrDef/HTML/FrameTarget.php">
+   <line>15</line>
+  </file>
+ </directive>
+ <directive id="Attr.EnableID">
+  <file name="HTMLPurifier/AttrDef/HTML/ID.php">
+   <line>20</line>
+  </file>
+ </directive>
+ <directive id="Attr.IDPrefix">
+  <file name="HTMLPurifier/AttrDef/HTML/ID.php">
+   <line>26</line>
+  </file>
+ </directive>
+ <directive id="Attr.IDPrefixLocal">
+  <file name="HTMLPurifier/AttrDef/HTML/ID.php">
+   <line>28</line>
+   <line>31</line>
+  </file>
+ </directive>
+ <directive id="Attr.IDBlacklistRegexp">
+  <file name="HTMLPurifier/AttrDef/HTML/ID.php">
+   <line>54</line>
+  </file>
+ </directive>
+ <directive id="Attr.DefaultTextDir">
+  <file name="HTMLPurifier/AttrTransform/BdoDir.php">
+   <line>13</line>
+  </file>
+ </directive>
+ <directive id="Core.RemoveInvalidImg">
+  <file name="HTMLPurifier/AttrTransform/ImgRequired.php">
+   <line>18</line>
+  </file>
+  <file name="HTMLPurifier/Strategy/RemoveForeignElements.php">
+   <line>20</line>
+  </file>
+ </directive>
+ <directive id="Attr.DefaultInvalidImage">
+  <file name="HTMLPurifier/AttrTransform/ImgRequired.php">
+   <line>19</line>
+  </file>
+ </directive>
+ <directive id="Attr.DefaultInvalidImageAlt">
+  <file name="HTMLPurifier/AttrTransform/ImgRequired.php">
+   <line>27</line>
+  </file>
+ </directive>
+ <directive id="Core.EscapeInvalidChildren">
+  <file name="HTMLPurifier/ChildDef/Required.php">
+   <line>55</line>
+  </file>
+ </directive>
+ <directive id="Cache.SerializerPath">
+  <file name="HTMLPurifier/DefinitionCache/Serializer.php">
+   <line>91</line>
+  </file>
+ </directive>
+ <directive id="FilterParam.ExtractStyleBlocksTidyImpl">
+  <file name="HTMLPurifier/Filter/ExtractStyleBlocks.php">
+   <line>41</line>
+  </file>
+ </directive>
+ <directive id="FilterParam.ExtractStyleBlocksScope">
+  <file name="HTMLPurifier/Filter/ExtractStyleBlocks.php">
+   <line>65</line>
+  </file>
+ </directive>
+ <directive id="FilterParam.ExtractStyleBlocksEscaping">
+  <file name="HTMLPurifier/Filter/ExtractStyleBlocks.php">
+   <line>123</line>
+  </file>
+ </directive>
+ <directive id="HTML.TidyLevel">
+  <file name="HTMLPurifier/HTMLModule/Tidy.php">
+   <line>45</line>
+  </file>
+ </directive>
+ <directive id="HTML.TidyAdd">
+  <file name="HTMLPurifier/HTMLModule/Tidy.php">
+   <line>49</line>
+  </file>
+ </directive>
+ <directive id="HTML.TidyRemove">
+  <file name="HTMLPurifier/HTMLModule/Tidy.php">
+   <line>50</line>
+  </file>
+ </directive>
+ <directive id="AutoFormatParam.PurifierLinkifyDocURL">
+  <file name="HTMLPurifier/Injector/PurifierLinkify.php">
+   <line>15</line>
+  </file>
+ </directive>
+ <directive id="Core.AggressivelyFixLt">
+  <file name="HTMLPurifier/Lexer/DOMLex.php">
+   <line>44</line>
+  </file>
+ </directive>
+ <directive id="Core.DirectLexLineNumberSyncInterval">
+  <file name="HTMLPurifier/Lexer/DirectLex.php">
+   <line>59</line>
+  </file>
+ </directive>
+ <directive id="Core.EscapeInvalidTags">
+  <file name="HTMLPurifier/Strategy/MakeWellFormed.php">
+   <line>22</line>
+  </file>
+  <file name="HTMLPurifier/Strategy/RemoveForeignElements.php">
+   <line>19</line>
+  </file>
+ </directive>
+ <directive id="Core.RemoveScriptContents">
+  <file name="HTMLPurifier/Strategy/RemoveForeignElements.php">
+   <line>22</line>
+  </file>
+ </directive>
+ <directive id="Core.HiddenElements">
+  <file name="HTMLPurifier/Strategy/RemoveForeignElements.php">
+   <line>23</line>
+  </file>
+ </directive>
+ <directive id="URI.HostBlacklist">
+  <file name="HTMLPurifier/URIFilter/HostBlacklist.php">
+   <line>8</line>
+  </file>
+ </directive>
+</usage>

docs/dev-advanced-api.html

@@ -3,7 +3,7 @@
     "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
 <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"><head>
 <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />
-<meta name="description" content="Functional specification for HTML Purifier's advanced API for defining custom filtering behavior." />
+<meta name="description" content="Specification for HTML Purifier's advanced API for defining custom filtering behavior." />
 <link rel="stylesheet" type="text/css" href="style.css" />
 
 <title>Advanced API - HTML Purifier</title>
@@ -16,6 +16,11 @@
 <div id="index">Return to the <a href="index.html">index</a>.</div>
 <div id="home"><a href="http://htmlpurifier.org/">HTML Purifier</a> End-User Documentation</div>
 
+<p>
+  <strong>Warning:</strong> This document may be out-of-date. When in doubt,
+  consult the source code documentation.
+</p>
+
 <p>HTML Purifier currently natively supports only a subset of HTML's
 allowed elements, attributes, and behavior; specifically, this subset
 is the set of elements that are safe for untrusted users to use.

docs/dev-code-quality.txt

@@ -17,7 +17,6 @@ a lot of strtolower() calls, no legit casing
     URI - multiple regular expressions; missing validation for parts (?)
     CSS - parser doesn't accept advanced CSS (fringe)
     Number - constructor interface inconsistent with Integer
-ConfigSchema - redefinition is a mess
 Strategy
     FixNesting - cannot bubble nodes out of structures, duplicated checks
         for special-case parent node

docs/dev-config-schema.html

@@ -0,0 +1,376 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
+  "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
+<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
+  <head>
+    <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />
+    <meta name="description" content="Describes config schema framework in HTML Purifier." />
+    <link rel="stylesheet" type="text/css" href="./style.css" />
+    <title>Config Schema - HTML Purifier</title>
+  </head>
+  <body>
+    
+    <h1>Config Schema</h1>
+    
+    <div id="filing">Filed under Development</div>
+    <div id="index">Return to the <a href="index.html">index</a>.</div>
+    <div id="home"><a href="http://htmlpurifier.org/">HTML Purifier</a> End-User Documentation</div>
+    
+    <p>
+      HTML Purifier has a fairly complex system for configuration. Users
+      interact with a <code>HTMLPurifier_Config</code> object to
+      set configuration directives. The values they set are validated according
+      to a configuration schema, <code>HTMLPurifier_ConfigSchema</code>.
+    </p>
+    
+    <p>
+      The schema is mostly transparent to end-users, but if you're doing development
+      work for HTML Purifier and need to define a new configuration directive,
+      you'll need to interact with it. We'll also talk about how to define
+      userspace configuration directives at the very end.
+    </p>
+    
+    <h2>Write a directive file</h2>
+    
+    <p>
+      Directive files define configuration directives to be used by
+      HTML Purifier. They are placed in <code>library/HTMLPurifier/ConfigSchema/schema/</code>
+      in the form <code><em>Namespace</em>.<em>Directive</em>.txt</code> (I
+      couldn't think of a more descriptive file extension.)
+      Directive files are actually what we call <code>StringHash</code>es,
+      i.e. associative arrays represented in a string form reminiscent of
+      <a href="http://qa.php.net/write-test.php">PHPT</a> tests. Here's a
+      sample directive file, <code>Test.Sample.txt</code>:
+    </p>
+    
+    <pre>Test.Sample
+TYPE: string/null
+DEFAULT: NULL
+ALLOWED: 'foo', 'bar'
+VALUE-ALIASES: 'baz' => 'bar'
+VERSION: 3.1.0
+--DESCRIPTION--
+This is a sample configuration directive for the purposes of the
+&lt;code&gt;dev-config-schema.html&lt;code&gt; documentation.
+--ALIASES--
+Test.Example</pre>
+    
+    <p>
+      Each of these segments has a specific meaning:
+    </p>
+    
+    <table class="table">
+      <thead>
+        <tr>
+          <th>Key</th>
+          <th>Example</th>
+          <th>Description</th>
+        </tr>
+      </thead>
+      <tbody>
+        <tr>
+          <td>ID</td>
+          <td>Test.Sample</td>
+          <td>The name of the directive, in the form Namespace.Directive
+          (implicitly the first line)</td>
+        </tr>
+        <tr>
+          <td>TYPE</td>
+          <td>string/null</td>
+          <td>The type of variable this directive accepts. See below for
+          details. You can also add <code>/null</code> to the end of
+          any basic type to allow null values too.</td>
+        </tr>
+        <tr>
+          <td>DEFAULT</td>
+          <td>NULL</td>
+          <td>A parseable PHP expression of the default value.</td>
+        </tr>
+        <tr>
+          <td>DESCRIPTION</td>
+          <td>This is a...</td>
+          <td>An HTML description of what this directive does.</td>
+        </tr>
+        <tr>
+          <td>VERSION</td>
+          <td>3.1.0</td>
+          <td><em>Recommended</em>. The version of HTML Purifier this directive was added.
+          Directives that have been around since 1.0.0 don't have this,
+          but any new ones should.</td>
+        </tr>
+        <tr>
+          <td>ALIASES</td>
+          <td>Test.Example</td>
+          <td><em>Optional</em>. A comma separated list of aliases for this directive.
+          This is most useful for backwards compatibility and should
+          not be used otherwise.</td>
+        </tr>
+        <tr>
+          <td>ALLOWED</td>
+          <td>'foo', 'bar'</td>
+          <td><em>Optional</em>. Set of allowed value for a directive,
+          a comma separated list of parseable PHP expressions. This
+          is only allowed string, istring, text and itext TYPEs.</td>
+        </tr>
+        <tr>
+          <td>VALUE-ALIASES</td>
+          <td>'baz' => 'bar'</td>
+          <td><em>Optional</em>. Mapping of one value to another, and
+          should be a comma separated list of keypair duples. This
+          is only allowed string, istring, text and itext TYPEs.</td>
+        </tr>
+        <tr>
+          <td>DEPRECATED-VERSION</td>
+          <td>3.1.0</td>
+          <td><em>Not shown</em>. Indicates that the directive was
+          deprecated this version.</td>
+        </tr>
+        <tr>
+          <td>DEPRECATED-USE</td>
+          <td>Test.NewDirective</td>
+          <td><em>Not shown</em>. Indicates what new directive should be
+          used instead. Note that the directives will functionally be
+          different, although they should offer the same functionality.
+          If they are identical, use an alias instead.</td>
+        </tr>
+        <tr>
+          <td>EXTERNAL</td>
+          <td>CSSTidy</td>
+          <td><em>Not shown</em>. Indicates if there is an external library
+          the user will need to download and install to use this configuration
+          directive. As of right now, this is merely a Google-able name; future
+          versions may also provide links and instructions.</td>
+        </tr>
+      </tbody>
+    </table>
+    
+    <p>
+      Some notes on format and style:
+    </p>
+    
+    <ul>
+      <li>
+        Each of these keys can be expressed in the short format
+        (<code>KEY: Value</code>) or the long format
+        (<code>--KEY--</code> with value beneath). You must use the
+        long format if multiple lines are needed, or if a long format
+        has been used already (that's why <code>ALIASES</code> in our
+        example is in the long format); otherwise, it's user preference.
+      </li>
+      <li>
+        The HTML descriptions should be wrapped at about 80 columns; do
+        not rely on editor word-wrapping.
+      </li>
+    </ul>
+    
+    <p>
+      Also, as promised, here is the set of possible types:
+    </p>
+    
+    <table class="table">
+      <thead>
+        <tr>
+          <th>Type</th>
+          <th>Example</th>
+          <th>Description</th>
+        </tr>
+      </thead>
+      <tbody>
+        <tr>
+          <td>string</td>
+          <td>'Foo'</td>
+          <td><a href="http://docs.php.net/manual/en/language.types.string.php">String</a> without newlines</td>
+        </tr>
+        <tr>
+          <td>istring</td>
+          <td>'foo'</td>
+          <td>Case insensitive ASCII string without newlines</td>
+        </tr>
+        <tr>
+          <td>text</td>
+          <td>"A<em>\n</em>b"</td>
+          <td>String with newlines</td>
+        </tr>
+        <tr>
+          <td>itext</td>
+          <td>"a<em>\n</em>b"</td>
+          <td>Case insensitive ASCII string without newlines</td>
+        </tr>
+        <tr>
+          <td>int</td>
+          <td>23</td>
+          <td>Integer</td>
+        </tr>
+        <tr>
+          <td>float</td>
+          <td>3.0</td>
+          <td>Floating point number</td>
+        </tr>
+        <tr>
+          <td>bool</td>
+          <td>true</td>
+          <td>Boolean</td>
+        </tr>
+        <tr>
+          <td>lookup</td>
+          <td>array('key' => true)</td>
+          <td>Lookup array, used with <code>isset($var[$key])</code></td>
+        </tr>
+        <tr>
+          <td>list</td>
+          <td>array('f', 'b')</td>
+          <td>List array, with ordered numerical indexes</td>
+        </tr>
+        <tr>
+          <td>hash</td>
+          <td>array('key' => 'val')</td>
+          <td>Associative array of keys to values</td>
+        </tr>
+        <tr>
+          <td>mixed</td>
+          <td>new stdclass</td>
+          <td>Any PHP variable is fine</td>
+        </tr>
+      </tbody>
+    </table>
+    
+    <p>
+      The examples represent what will be returned out of the configuration
+      object; users have a little bit of leeway when setting configuration
+      values (for example, a lookup value can be specified as a list;
+      HTML Purifier will flip it as necessary.) These types are defined
+      in <a href="http://htmlpurifier.org/svnroot/htmlpurifier/trunk/library/HTMLPurifier/VarParser.php">
+      library/HTMLPurifier/VarParser.php</a>.
+    </p>
+    
+    <p>
+      For more information on what values are allowed, and how they are parsed,
+      consult <a href="http://htmlpurifier.org/svnroot/htmlpurifier/trunk/library/HTMLPurifier/ConfigSchema/InterchangeBuilder.php">
+      library/HTMLPurifier/ConfigSchema/InterchangeBuilder.php</a>, as well
+      as <a href="http://htmlpurifier.org/svnroot/htmlpurifier/trunk/library/HTMLPurifier/ConfigSchema/Interchange/Directive.php">
+      library/HTMLPurifier/ConfigSchema/Interchange/Directive.php</a> for
+      the semantics of the parsed values.
+    </p>
+    
+    <h2>Refreshing the cache</h2>
+    
+    <p>
+      You may have noticed that your directive file isn't doing anything
+      yet. That's because it hasn't been added to the runtime
+      <code>HTMLPurifier_ConfigSchema</code> instance. Run
+      <code>maintenance/generate-schema-cache.php</code> to fix this.
+      If there were no errors, you're good to go! Don't forget to add
+      some unit tests for your functionality!
+    </p>
+    
+    <p>
+      If you ever make changes to your configuration directives, you
+      will need to run this script again.
+    </p>
+    
+    <h2>Errors</h2>
+    
+    <p>
+      All directive files go through a rigorous validation process
+      through <a href="http://htmlpurifier.org/svnroot/htmlpurifier/trunk/library/HTMLPurifier/ConfigSchema/">
+      library/HTMLPurifier/ConfigSchema/Validator.php</a>, as well
+      as some basic checks during building. While
+      listing every error out here is out-of-scope for this document, we
+      can give some general tips for interpreting error messages.
+      There are two types of errors: builder errors and validation errors.
+    </p>
+    
+    <h3>Builder errors</h3>
+    
+    <blockquote>
+      <p>
+        <strong>Exception:</strong> Expected type string, got
+        integer in DEFAULT in directive hash 'Ns.Dir'
+      </p>
+    </blockquote>
+    
+    <p>
+      You can identify a builder error by the keyword "directive hash."
+      These are the easiest to deal with, because they directly correspond
+      with your directive file. Find the offending directive file (which
+      is the directive hash plus the .txt extension), find the
+      offending index ("in DEFAULT" means the DEFAULT key) and fix the error.
+      This particular error would occur if your default value is not the same
+      type as TYPE.
+    </p>
+    
+    <h3>Validation errors</h3>
+    
+    <blockquote>
+      <p>
+        <strong>Exception:</strong> Alias 3 in valueAliases in directive
+        'Ns.Dir' must be a string
+      </p>
+    </blockquote>
+    
+    <p>
+      These are a little trickier, because we're not actually validating
+      your directive file, or even the direct string hash representation.
+      We're validating an Interchange object, and the error messages do
+      not mention any string hash keys.
+    </p>
+    
+    <p>
+      Nevertheless, it's not difficult to figure out what went wrong.
+      Read the "context" statements in reverse:
+    </p>
+    
+    <dl>
+      <dt>in directive 'Ns.Dir'</dt>
+        <dd>This means we need to look at the directive file <code>Ns.Dir.txt</code></dd>
+      <dt>in valueAliases</dt>
+        <dd>There's no key actually called this, but there's one that's close:
+          VALUE-ALIASES. Indeed, that's where to look.</dd>
+      <dt>Alias 3</dt>
+        <dd>The value alias that is equal to 3 is the culprit.</dd>
+    </dl>
+    
+    <p>
+      In this particular case, you're not allowed to alias integers values to
+      strings values.
+    </p>
+    
+    <p>
+      The most difficult part is translating the Interchange member variable (valueAliases)
+      into a directive file key (VALUE-ALIASES), but there's a one-to-one
+      correspondence currently. If the two formats diverge, any discrepancies
+      will be described in <a href="http://htmlpurifier.org/svnroot/htmlpurifier/trunk/library/HTMLPurifier/ConfigSchema/InterchangeBuilder.php">
+      library/HTMLPurifier/ConfigSchema/InterchangeBuilder.php</a>.
+    </p>
+    
+    <h2>Internals</h2>
+    
+    <p>
+      Much of the configuration schema framework's codebase deals with
+      shuffling data from one format to another, and doing validation on this
+      data.
+      The keystone of all of this is the <code>HTMLPurifier_ConfigSchema_Interchange</code>
+      class, which represents the purest, parsed representation of the schema.
+    </p>
+    
+    <p>
+      Hand-writing this data is unwieldy, however, so we write directive files.
+      These directive files are parsed by <code>HTMLPurifier_StringHashParser</code>
+      into <code>HTMLPurifier_StringHash</code>es, which then
+      are run through <code>HTMLPurifier_ConfigSchema_InterchangeBuilder</code>
+      to construct the interchange object.
+    </p>
+    
+    <p>
+      From the interchange object, the data can be siphoned into other forms
+      using <code>HTMLPurifier_ConfigSchema_Builder</code> subclasses.
+      For example, <code>HTMLPurifier_ConfigSchema_Builder_ConfigSchema</code>
+      generates a runtime <code>HTMLPurifier_ConfigSchema</code> object,
+      which <code>HTMLPurifier_Config</code> uses to validate its incoming
+      data. There is also an XML serializer, which is used to build documentation.
+    </p>
+    
+    <div id="version">$Id$</div>
+
+  </body>
+</html>

docs/dev-flush.html

@@ -0,0 +1,67 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
+    "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
+<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
+<head>
+    <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />
+    <meta name="description" content="Discusses when to flush HTML Purifier's various caches." />
+    <link rel="stylesheet" type="text/css" href="./style.css" />
+    <title>Flushing the Purifier - HTML Purifier</title>
+</head>
+<body>
+
+<h1>Flushing the Purifier</h1>
+
+<div id="filing">Filed under Development</div>
+<div id="index">Return to the <a href="index.html">index</a>.</div>
+<div id="home"><a href="http://htmlpurifier.org/">HTML Purifier</a> End-User Documentation</div>
+
+<p>
+    If you've been poking around the various folders in HTML Purifier,
+    you may have noticed the <code>maintenance</code> directory.  Almost
+    all of these scripts are devoted to flushing out the various caches
+    HTML Purifier uses.  Normal users don't have to worry about this:
+    regular library usage is transparent.  However, when doing development
+    work on HTML Purifier, you may find you have to flush one of the
+    caches.
+</p>
+
+<p>
+    As a general rule of thumb, run <code>flush.php</code> whenever you make
+    any <em>major</em> changes, or when tests start mysteriously failing.
+    In more detail, run this script if:
+</p>
+
+<ul>
+    <li>
+        You added new source files to HTML Purifier's main library.
+        (see <code>generate-includes.php</code>)
+    </li>
+    <li>
+        You modified the configuration schema (see
+        <code>generate-schema-cache.php</code>). This usually means
+        adding or modifying files in <code>HTMLPurifier/ConfigSchema/schema/</code>,
+        although in rare cases modifying <code>HTMLPurifier/ConfigSchema.php</code>
+        will also require this.
+    </li>
+    <li>
+        You modified a Definition, or its subsystems. The most usual candidate
+        is <code>HTMLPurifier/HTMLDefinition.php</code>, which also encompasses
+        the files in <code>HTMLPurifier/HTMLModule/</code> as well as if you've
+        <a href="enduser-customize.html">customizing definitions</a> without
+        the cache disabled. (see <code>flush-generation-cache.php</code>)
+    </li>
+    <li>
+        You modified source files, and have been using the standalone
+        version from the full installation. (see <code>generate-standalone.php</code>)
+    </li>
+</ul>
+
+<p>
+    You can check out the corresponding scripts for more information on what they
+    do.
+</p>
+
+<div id="version">$Id$</div>
+
+</body></html>

docs/dev-includes.txt

@@ -0,0 +1,279 @@
+
+INCLUDES, AUTOLOAD, BYTECODE CACHES and OPTIMIZATION
+
+The Problem
+-----------
+
+HTML Purifier contains a number of extra components that are not used all
+of the time, only if the user explicitly specifies that we should use
+them.
+
+Some of these optional components are optionally included (Filter,
+Language, Lexer, Printer), while others are included all the time
+(Injector, URIFilter, HTMLModule, URIScheme). We will stipulate that these
+are all developer specified: it is conceivable that certain Tokens are not
+used, but this is user-dependent and should not be trusted.
+
+We should come up with a consistent way to handle these things and ensure
+that we get the maximum performance when there is bytecode caches and
+when there are not. Unfortunately, these two goals seem contrary to each
+other.
+
+A peripheral issue is the performance of ConfigSchema, which has been
+shown take a large, constant amount of initialization time, and is
+intricately linked to the issue of includes due to its pervasive use
+in our plugin architecture.
+
+Pros and Cons
+-------------
+
+We will assume that user-based extensions will be included by them.
+
+Conditional includes:
+  Pros:
+    - User management is simplified; only a single directive needs to be set
+    - Only necessary code is included
+  Cons:
+    - Doesn't play nicely with opcode caches
+    - Adds complexity to standalone version
+    - Optional configuration directives are not exposed without a little
+      extra coaxing (not implemented yet)
+
+Include it all:
+  Pros:
+    - User management is still simple
+    - Plays nicely with opcode caches and standalone version
+    - All configuration directives are present
+  Cons:
+    - Lots of (how much?) extra code is included
+    - Classes that inherit from external libraries will cause compile
+      errors
+
+Build an include stub (Let's do this!):
+  Pros:
+    - Only necessary code is included
+    - Plays nicely with opcode caches and standalone version
+    - require (without once) can be used, see above
+    - Could further extend as a compilation to one file
+  Cons:
+    - Not implemented yet
+    - Requires user intervention and use of a command line script
+    - Standalone script must be chained to this
+    - More complex and compiled-language-like
+    - Requires a whole new class of system-wide configuration directives,
+      as configuration objects can be reused
+    - Determining what needs to be included can be complex (see above)
+    - No way of autodetecting dynamically instantiated classes
+    - Might be slow
+
+Include stubs
+-------------
+
+This solution may be "just right" for users who are heavily oriented
+towards performance. However, there are a number of picky implementation
+details to work out beforehand.
+
+The number one concern is how to make the HTML Purifier files "work
+out of the box", while still being able to easily get them into a form
+that works with this setup. As the codebase stands right now, it would
+be necessary to strip out all of the require_once calls. The only way
+we could get rid of the require_once calls is to use __autoload or
+use the stub for all cases (which might not be a bad idea).
+
+    Aside
+    -----
+    An important thing to remember, however, is that these require_once's
+    are valuable data about what classes a file needs. Unfortunately, there's
+    no distinction between whether or not the file is needed all the time,
+    or whether or not it is one of our "optional" files. Thus, it is
+    effectively useless.
+
+    Deprecated
+    ----------
+    One of the things I'd like to do is have the code search for any classes
+    that are explicitly mentioned in the code. If a class isn't mentioned, I 
+    get to assume that it is "optional," i.e. included via introspection.
+    The choice is either to use PHP's tokenizer or use regexps; regexps would
+    be faster but a tokenizer would be more correct. If this ends up being
+    unfeasible, adding dependency comments isn't a bad idea. (This could
+    even be done automatically by search/replacing require_once, although
+    we'd have to manually inspect the results for the optional requires.)
+    
+    NOTE: This ends up not being necessary, as we're going to make the user
+    figure out all the extra classes they need, and only include the core
+    which is predetermined.
+
+Using the autoload framework with include stubs works nicely with
+introspective classes: instead of having to have require_once inside
+the function, we can let autoload do the work; we simply need to
+new $class or accept the object straight from the caller. Handling filters
+becomes a simple matter of ticking off configuration directives, and
+if ConfigSchema spits out errors, adding the necessary includes. We could
+also use the autoload framework as a fallback, in case the user forgets
+to make the include, but doesn't really care about performance.
+
+    Insight
+    -------
+    All of this talk is merely a natural extension of what our current
+    standalone functionality does. However, instead of having our code
+    perform the includes, or attempting to inline everything that possibly
+    could be used, we boot the issue to the user, making them include
+    everything or setup the fallback autoload handler.
+
+Configuration Schema
+--------------------
+
+A common deficiency for all of the conditional include setups (including
+the dynamically built include PHP stub) is that if one of this
+conditionally included files includes a configuration directive, it
+is not accessible to configdoc. A stopgap solution for this problem is
+to have it piggy-back off of the data in the merge-library.php script
+to figure out what extra files it needs to include, but if the file also
+inherits classes that don't exist, we're in big trouble.
+
+I think it's high time we centralized the configuration documentation.
+However, the type checking has been a great boon for the library, and
+I'd like to keep that. The compromise is to use some other source, and
+then parse it into the ConfigSchema internal format (sans all of those
+nasty documentation strings which we really don't need at runtime) and
+serialize that for future use.
+
+The next question is that of format. XML is very verbose, and the prospect
+of setting defaults in it gives me willies. However, this may be necessary.
+Splitting up the file into manageable chunks may alleviate this trouble,
+and we may be even want to create our own format optimized for specifying
+configuration. It might look like (based off the PHPT format, which is
+nicely compact yet unambiguous and human-readable):
+
+Core.HiddenElements
+TYPE:    lookup
+DEFAULT: array('script', 'style') // auto-converted during processing
+--ALIASES--
+Core.InvisibleElements, Core.StupidElements
+--DESCRIPTION--
+<p>
+  Blah blah
+</p>
+
+The first line is the directive name, the lines after that prior to the
+first --HEADER-- block are single-line values, and then after that
+the multiline values are there. No value is restricted to a particular
+format: DEFAULT could very well be multiline if that would be easier.
+This would make it insanely easy, also, to add arbitrary extra parameters,
+like:
+
+VERSION:  3.0.0
+ALLOWED:  'none', 'light', 'medium', 'heavy' // this is wrapped in array()
+EXTERNAL: CSSTidy // this would be documented somewhere else with a URL
+
+The final loss would be that you wouldn't know what file the directive
+was used in; with some clever regexps it should be possible to
+figure out where $config->get($ns, $d); occurs. Reflective calls to
+the configuration object is mitigated by the fact that getBatch is
+used, so we can simply talk about that in the namespace definition page.
+This might be slow, but it would only happen when we are creating
+the documentation for consumption, and is sugar.
+
+We can put this in a schema/ directory, outside of HTML Purifier. The serialized
+data gets treated like entities.ser.
+
+The final thing that needs to be handled is user defined configurations.
+They can be added at runtime using ConfigSchema::registerDirectory()
+which globs the directory and grabs all of the directives to be incorporated
+in. Then, the result is saved. We may want to take advantage of the
+DefinitionCache framework, although it is not altogether certain what
+configuration directives would be used to generate our key (meta-directives!)
+
+    Further thoughts
+    ----------------
+    Our master configuration schema will only need to be updated once
+    every new version, so it's easily versionable. User specified
+    schema files are far more volatile, but it's far too expensive
+    to check the filemtimes of all the files, so a DefinitionRev style
+    mechanism works better. However, we can uniquely identify the
+    schema based on the directories they loaded, so there's no need
+    for a DefinitionId until we give them full programmatic control.
+    
+    These variables should be directly incorporated into ConfigSchema,
+    and ConfigSchema should handle serialization. Some refactoring will be
+    necessary for the DefinitionCache classes, as they are built with
+    Config in mind. If the user changes something, the cache file gets
+    rebuilt. If the version changes, the cache file gets rebuilt. Since
+    our unit tests flush the caches before we start, and the operation is
+    pretty fast, this will not negatively impact unit testing.
+
+One last thing: certain configuration directives require that files
+get added. They may even be specified dynamically. It is not a good idea
+for the HTMLPurifier_Config object to be used directly for such matters.
+Instead, the userland code should explicitly perform the includes. We may
+put in something like:
+
+REQUIRES: HTMLPurifier_Filter_ExtractStyleBlocks
+
+To indicate that if that class doesn't exist, and the user is attempting
+to use the directive, we should fatally error out. The stub includes the core files,
+and the user includes everything else. Any reflective things like new
+$class would be required to tie in with the configuration.
+
+It would work very well with rarely used configuration options, but it
+wouldn't be so good for "core" parts that can be disabled. In such cases
+the core include file would need to be modified, and the only way
+to properly do this is use the configuration object. Once again, our
+ability to create cache keys saves the day again: we can create arbitrary
+stub files for arbitrary configurations and include those. They could
+even be the single file affairs. The only thing we'd need to include,
+then, would be HTMLPurifier_Config! Then, the configuration object would
+load the library.
+
+    An aside...
+    -----------
+    One questions, however, the wisdom of letting PHP files write other PHP
+    files. It seems like a recipe for disaster, or at least lots of headaches
+    in highly secured setups, where PHP does not have the ability to write
+    to its root. In such cases, we could use sticky bits or tell the user
+    to manually generate the file.
+
+    The other troublesome bit is actually doing the calculations necessary.
+    For certain cases, it's simple (such as URIScheme), but for AttrDef
+    and HTMLModule the dependency trees are very complex in relation to
+    %HTML.Allowed and friends. I think that this idea should be shelved
+    and looked at a later, less insane date.
+
+An interesting dilemma presents itself when a configuration form is offered
+to the user. Normally, the configuration object is not accessible without
+editing PHP code; this facility changes thing. The sensible thing to do
+is stipulate that all classes required by the directives you allow must
+be included.
+
+Unit testing
+------------
+
+Setting up the parsing and translation into our existing format would not
+be difficult to do. It might represent a good time for us to rethink our
+tests for these facilities; as creative as they are, they are often hacky
+and require public visibility for things that ought to be protected.
+This is especially applicable for our DefinitionCache tests.
+
+Migration
+---------
+
+Because we are not *adding* anything essentially new, it should be trivial
+to write a script to take our existing data and dump it into the new format.
+Well, not trivial, but fairly easy to accomplish. Primary implementation
+difficulties would probably involve formatting the file nicely.
+
+Backwards-compatibility
+-----------------------
+
+I expect that the ConfigSchema methods should stick around for a little bit,
+but display E_USER_NOTICE warnings that they are deprecated. This will
+require documentation!
+
+New stuff
+---------
+
+VERSION: Version number directive was introduced
+DEPRECATED-VERSION: If the directive was deprecated, when was it deprecated?
+DEPRECATED-USE: If the directive was deprecated, what should the user use now?
+REQUIRES: What classes does this configuration directive require, but are
+    not part of the HTML Purifier core?

docs/dev-optimization.html

@@ -23,7 +23,6 @@ that itch, put it here!</p>
 <ul>
     <li>Make Tokens Flyweights (may prove problematic, probably not worth it)</li>
     <li>Rewrite regexps into PHP code</li>
-    <li>Serialize the Definition object</li>
     <li>Batch regexp validation (do as many per function call as possible)</li>
     <li>Parallelize strategies</li>
 </ul>

docs/dev-progress.html

@@ -34,6 +34,11 @@ thead th {text-align:left;padding:0.1em;background-color:#EEE;}
 <div id="index">Return to the <a href="index.html">index</a>.</div>
 <div id="home"><a href="http://htmlpurifier.org/">HTML Purifier</a> End-User Documentation</div>
 
+<p>
+  <strong>Warning:</strong> This table is kept for historical purposes and
+  is not being actively updated.
+</p>
+
 <h2>Key</h2>
 
 <table cellspacing="0"><tbody>
@@ -148,7 +153,7 @@ thead th {text-align:left;padding:0.1em;background-color:#EEE;}
     Depends on background-image</td></tr>
 <tr class="css1 impl-yes"><td>background-position</td><td>Depends on background-image</td></tr>
 <tr class="danger impl-no"><td>cursor</td><td>Dangerous but fluffy</td></tr>
-<tr class="danger css1"><td>display</td><td>ENUM(...), Dangerous but interesting;
+<tr class="danger impl-yes"><td>display</td><td>ENUM(...), Dangerous but interesting;
     will not implement list-item, run-in (Opera only) or table (no IE);
     inline-block has incomplete IE6 support and requires -moz-inline-box
     for Mozilla. Unknown target milestone.</td></tr>
@@ -167,7 +172,7 @@ thead th {text-align:left;padding:0.1em;background-color:#EEE;}
     Mostly supported. Unknown target milestone.</td></tr>
 <tr><td>page-break-inside</td><td>ENUM(avoid, auto), Opera only. Unknown target milestone.</td></tr>
 <tr class="impl-no"><td>quotes</td><td>May be dropped from CSS2, fairly useless for inline context</td></tr>
-<tr class="impl-no"><td>visibility</td><td>ENUM(visible, hidden, collapse),
+<tr class="danger impl-yes"><td>visibility</td><td>ENUM(visible, hidden, collapse),
     Dangerous</td></tr>
 <tr class="css1 feature impl-partial"><td>white-space</td><td>ENUM(normal, pre, nowrap, pre-wrap,
     pre-line), Spotty implementation:

docs/enduser-customize.html

@@ -158,7 +158,7 @@
 <pre>$config = HTMLPurifier_Config::createDefault();
 $config->set('HTML', 'DefinitionID', 'enduser-customize.html tutorial');
 $config->set('HTML', 'DefinitionRev', 1);
-$def =& $config->getHTMLDefinition(true);</pre>
+$def = $config->getHTMLDefinition(true);</pre>
 
 <p>
   Assuming that HTML Purifier has already been properly loaded (hint:
@@ -214,7 +214,7 @@ $def =& $config->getHTMLDefinition(true);</pre>
 $config->set('HTML', 'DefinitionID', 'enduser-customize.html tutorial');
 $config->set('HTML', 'DefinitionRev', 1);
 <strong>$config->set('Core', 'DefinitionCache', null); // remove this later!</strong>
-$def =& $config->getHTMLDefinition(true);</pre>
+$def = $config->getHTMLDefinition(true);</pre>
 
 <p>
   A few things should be mentioned about the caching mechanism before
@@ -270,7 +270,7 @@ $def =& $config->getHTMLDefinition(true);</pre>
 $config->set('HTML', 'DefinitionID', 'enduser-customize.html tutorial');
 $config->set('HTML', 'DefinitionRev', 1);
 $config->set('Core', 'DefinitionCache', null); // remove this later!
-$def =& $config->getHTMLDefinition(true);
+$def = $config->getHTMLDefinition(true);
 <strong>$def->addAttribute('a', 'target', 'Enum#_blank,_self,_target,_top');</strong></pre>
 
 <p>
@@ -388,7 +388,7 @@ $def =& $config->getHTMLDefinition(true);
 $config->set('HTML', 'DefinitionID', 'enduser-customize.html tutorial');
 $config->set('HTML', 'DefinitionRev', 1);
 $config->set('Core', 'DefinitionCache', null); // remove this later!
-$def =& $config->getHTMLDefinition(true);
+$def = $config->getHTMLDefinition(true);
 <strong>$def->addAttribute('a', 'target', new HTMLPurifier_AttrDef_Enum(
   array('_blank','_self','_target','_top')
 ));</strong></pre>
@@ -735,11 +735,11 @@ $def =& $config->getHTMLDefinition(true);
 $config->set('HTML', 'DefinitionID', 'enduser-customize.html tutorial');
 $config->set('HTML', 'DefinitionRev', 1);
 $config->set('Core', 'DefinitionCache', null); // remove this later!
-$def =& $config->getHTMLDefinition(true);
+$def = $config->getHTMLDefinition(true);
 $def->addAttribute('a', 'target', new HTMLPurifier_AttrDef_Enum(
   array('_blank','_self','_target','_top')
 ));
-<strong>$form =& $def->addElement(
+<strong>$form = $def->addElement(
   'form',   // name
   'Block',  // content set
   'Flow', // allowed children

docs/enduser-uri-filter.html

@@ -33,9 +33,9 @@
 
 <pre>class HTMLPurifier_URIFilter_<strong>NameOfFilter</strong> extends HTMLPurifier_URIFilter
 {
-    var $name = '<strong>NameOfFilter</strong>';
-    function prepare($config) {}
-    function filter(&$uri, $config, &$context) {}
+    public $name = '<strong>NameOfFilter</strong>';
+    public function prepare($config) {}
+    public function filter(&$uri, $config, $context) {}
 }</pre>
 
 <p>
@@ -56,12 +56,12 @@
 
 <pre>class HTMLPurifier_URI
 {
-    var $scheme, $userinfo, $host, $port, $path, $query, $fragment;
-    function HTMLPurifier_URI($scheme, $userinfo, $host, $port, $path, $query, $fragment);
-    function toString();
-    function copy();
-    function getSchemeObj($config, &$context);
-    function validate($config, &$context);
+    public $scheme, $userinfo, $host, $port, $path, $query, $fragment;
+    public function HTMLPurifier_URI($scheme, $userinfo, $host, $port, $path, $query, $fragment);
+    public function toString();
+    public function copy();
+    public function getSchemeObj($config, $context);
+    public function validate($config, $context);
 }</pre>
 
 <p>
@@ -138,8 +138,8 @@
 
 <pre>class HTMLPurifier_URIFilter_ConvertIDNToPunycode extends HTMLPurifier_URIFilter
 {
-    var $name = 'ConvertIDNToPunycode';
-    function filter(&$uri, $config, &$context) {
+    public $name = 'ConvertIDNToPunycode';
+    public function filter(&$uri, $config, $context) {
         if (is_null($uri->host)) return true;
         if ($uri->host == utf8_decode($uri->host)) {
             // is ASCII, abort
@@ -163,7 +163,7 @@
   to use it. Fortunately, this part's simple:
 </p>
 
-<pre>$uri =& $config->getDefinition('URI');
+<pre>$uri = $config->getDefinition('URI');
 $uri->addFilter(new HTMLPurifier_URIFilter_<strong>NameOfFilter</strong>());</pre>
 
 <p>
@@ -177,7 +177,7 @@ $uri->addFilter(new HTMLPurifier_URIFilter_<strong>NameOfFilter</strong>());</pr
     'URI', '<strong>NameOfFilter</strong>', false, 'bool',
     '<strong>What your filter does.</strong>'
 );
-$uri =& $config->getDefinition('URI', true);
+$uri = $config->getDefinition('URI', true);
 $uri->registerFilter(new HTMLPurifier_URIFilter_<strong>NameOfFilter</strong>());
 </pre>
 

docs/enduser-utf8.html

@@ -5,7 +5,6 @@
 <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />
 <meta name="description" content="Describes the rationale for using UTF-8, the ramifications otherwise, and how to make the switch." />
 <link rel="stylesheet" type="text/css" href="./style.css" />
-<script defer="defer" type="text/javascript" src="./toc-gen.js"></script>
 <style type="text/css">
     .minor td {font-style:italic;}
 </style>

docs/enduser-youtube.html

@@ -75,9 +75,7 @@ passes through HTML Purifier <em>unharmed</em>.
 <p>And the corresponding usage:</p>
 
 <pre>&lt;?php
-    // assuming $purifier is an instance of HTMLPurifier
-    require_once 'HTMLPurifier/Filter/YouTube.php';
-    $purifier-&gt;addFilter(new HTMLPurifier_Filter_YouTube());
+    $config->set('Filter', 'YouTube', true);
 ?&gt;</pre>
 
 <p>There is a bit going in the two code snippets, so let's explain.</p>

docs/index.html

@@ -60,10 +60,16 @@ conventions.</p>
 <dt><a href="dev-optimization.html">Optimization</a></dt>
 <dd>Discusses possible methods of optimizing HTML Purifier.</dd>
 
+<dt><a href="dev-flush.html">Flushing the Purifier</a></dt>
+<dd>Discusses when to flush HTML Purifier's various caches.</dd>
+
 <dt><a href="dev-advanced-api.html">Advanced API</a></dt>
-<dd>Functional specification for HTML Purifier's advanced API for defining
+<dd>Specification for HTML Purifier's advanced API for defining
 custom filtering behavior.</dd>
 
+<dt><a href="dev-config-schema.html">Config Schema</a></dt>
+<dd>Describes config schema framework in HTML Purifier.</dd>
+
 </dl>
 
 <h2>Proposals</h2>
@@ -113,7 +119,7 @@ the code. They may be upgraded to HTML files or stay as TXT scratchpads.</p>
 
 <tr>
     <td>Development</td>
-    <td><a href="enduser-code-quality.txt">Code Quality Issues</a></td>
+    <td><a href="dev-code-quality.txt">Code Quality Issues</a></td>
     <td>Enumerates code quality issues and places that need to be refactored.</td>
 </tr>
 
@@ -135,6 +141,12 @@ the code. They may be upgraded to HTML files or stay as TXT scratchpads.</p>
     <td>Assorted configuration options that could be implemented.</td>
 </tr>
 
+<tr>
+    <td>Proposal</td>
+    <td><a href="proposal-css-extraction.txt">CSS extraction</a></td>
+    <td>Taking the inline CSS out of documents and into <code>style</code>.</td>
+</tr>
+
 <tr>
     <td>Reference</td>
     <td><a href="ref-content-models.txt">Handling Content Model Changes</a></td>

docs/proposal-css-extraction.txt

@@ -0,0 +1,32 @@
+
+Extracting inline CSS from HTML Purifier
+    voodoofied: Assigning semantics to elements
+
+Sander Tekelenburg brought to my attention the poor programming style of
+inline CSS in HTML documents.  In an ideal world, we wouldn't be using inline
+CSS at all: everything would be assigned using semantic class attributes
+from an external stylesheet.
+
+With ExtractStyleBlocks and CSSTidy, this is now possible (when allowed, users
+can specify a style element which gets extracted from the user-submitted HTML, which
+the application can place in the head of the HTML document).  But there still
+is the issue of inline CSS that refuses to go away.
+
+The basic idea behind this feature is assign every element a unique identifier,
+and then move all of the CSS data to a style-sheet. This HTML:
+
+<div style="text-align:center">Big <span style="color:red;">things</span>!</div>
+
+into
+
+<div id="hp-12345">Big <span id="hp-12346">things</span>!</div>
+
+and a stylesheet that is:
+
+#hp-12345 {text-align:center;}
+#hp-12346 {color:red;}
+
+Beyond that, HTML Purifier can magically merge common CSS values together,
+and a whole manner of other heuristic things.  HTML Purifier should also
+make it easy for an admin to re-style the HTML semantically. Speed is not
+an issue. Also, better WYSIWYG editors are needed.

docs/ref-html-modularization.txt

@@ -1,8 +1,8 @@
 
 The Modularization of HTMLDefinition in HTML Purifier
 
-Todo for XHTML 1.1 support <http://www.w3.org/TR/xhtml11/changes.html>
-1. Support Ruby <http://www.w3.org/TR/2001/REC-ruby-20010531/>
+WARNING: This document was drafted before the implementation of this
+    system, and some implementation details may have evolved over time.
 
 HTML Purifier uses the modularization of XHTML
 <http://www.w3.org/TR/xhtml-modularization/> to organize the internals

extras/ConfigDoc/HTMLXSLTProcessor.php

@@ -1,21 +1,23 @@
 <?php
 
 /**
- * Special XSLTProcessor specifically for HTML documents. Loosely
- * based off of XSLTProcessor, but not really
+ * Decorator/extender XSLT processor specifically for HTML documents.
  */
 class ConfigDoc_HTMLXSLTProcessor
 {
     
+    /**
+     * Instance of XSLTProcessor
+     */
     protected $xsltProcessor;
     
-    public function __construct() {
-        $this->xsltProcessor = new XSLTProcessor();
+    public function __construct($proc = false) {
+        if ($proc === false) $proc = new XSLTProcessor();
+        $this->xsltProcessor = $proc;
     }
     
     /**
-     * Imports stylesheet for processor to use
-     * @param $xsl XSLT DOM tree, or filename of the XSL transformation
+     * @note Allows a string $xsl filename to be passed
      */
     public function importStylesheet($xsl) {
         if (is_string($xsl)) {
@@ -27,16 +29,25 @@ class ConfigDoc_HTMLXSLTProcessor
     }
     
     /**
-     * Transforms an XML file into HTML based on the stylesheet
-     * @param $xml XML DOM tree
+     * Transforms an XML file into compatible XHTML based on the stylesheet
+     * @param $xml XML DOM tree, or string filename
+     * @return string HTML output
+     * @todo Rename to transformToXHTML, as transformToHTML is misleading
      */
     public function transformToHTML($xml) {
-        $out = $this->xsltProcessor->transformToXML($xml);
+        if (is_string($xml)) {
+            $dom = new DOMDocument();
+            $dom->load($xml);
+        } else {
+            $dom = $xml;
+        }
+        $out = $this->xsltProcessor->transformToXML($dom);
         
         // fudges for HTML backwards compatibility
+        // assumes that document is XHTML
         $out = str_replace('/>', ' />', $out); // <br /> not <br/>
         $out = str_replace(' xmlns=""', '', $out); // rm unnecessary xmlns
-        $out = str_replace(' xmlns="http://www.w3.org/1999/xhtml"', '', $out); // rm unnecessary xmlns
+        
         if (class_exists('Tidy')) {
             // cleanup output
             $config = array(
@@ -49,14 +60,26 @@ class ConfigDoc_HTMLXSLTProcessor
             $tidy->cleanRepair();
             $out = (string) $tidy;
         }
+        
         return $out;
     }
     
+    /**
+     * Bulk sets parameters for the XSL stylesheet
+     * @param array $options Associative array of options to set
+     */
     public function setParameters($options) {
         foreach ($options as $name => $value) {
             $this->xsltProcessor->setParameter('', $name, $value);
         }
     }
     
+    /**
+     * Forward any other calls to the XSLT processor
+     */
+    public function __call($name, $arguments) {
+        call_user_func_array(array($this->xsltProcessor, $name), $arguments);
+    }
+    
 }
 

extras/FSTools.php

@@ -0,0 +1,155 @@
+<?php
+
+/**
+ * Filesystem tools not provided by default; can recursively create, copy
+ * and delete folders. Some template methods are provided for extensibility.
+ * 
+ * @note This class must be instantiated to be used, although it does
+ *       not maintain state.
+ */
+class FSTools
+{
+    
+    private static $singleton;
+    
+    /**
+     * Returns a global instance of FSTools
+     */
+    static public function singleton() {
+        if (empty(FSTools::$singleton)) FSTools::$singleton = new FSTools();
+        return FSTools::$singleton;
+    }
+    
+    /**
+     * Sets our global singleton to something else; useful for overloading
+     * functions.
+     */
+    static public function setSingleton($singleton) {
+        FSTools::$singleton = $singleton;
+    }
+    
+    /**
+     * Recursively creates a directory
+     * @param string $folder Name of folder to create
+     * @note Adapted from the PHP manual comment 76612
+     */
+    public function mkdirr($folder) {
+        $folders = preg_split("#[\\\\/]#", $folder);
+        $base = '';
+        for($i = 0, $c = count($folders); $i < $c; $i++) {
+            if(empty($folders[$i])) {
+                if (!$i) {
+                    // special case for root level
+                    $base .= DIRECTORY_SEPARATOR;
+                }
+                continue;
+            }
+            $base .= $folders[$i];
+            if(!is_dir($base)){
+                $this->mkdir($base);
+            }
+            $base .= DIRECTORY_SEPARATOR;
+        }
+    }
+    
+    /**
+     * Copy a file, or recursively copy a folder and its contents; modified
+     * so that copied files, if PHP, have includes removed
+     * @note Adapted from http://aidanlister.com/repos/v/function.copyr.php
+     */
+    public function copyr($source, $dest) {
+        // Simple copy for a file
+        if (is_file($source)) {
+            return $this->copy($source, $dest);
+        }
+        // Make destination directory
+        if (!is_dir($dest)) {
+            $this->mkdir($dest);
+        }
+        // Loop through the folder
+        $dir = $this->dir($source);
+        while ( false !== ($entry = $dir->read()) ) {
+            // Skip pointers
+            if ($entry == '.' || $entry == '..') {
+                continue;
+            }
+            if (!$this->copyable($entry)) {
+                continue;
+            }
+            // Deep copy directories
+            if ($dest !== "$source/$entry") {
+                $this->copyr("$source/$entry", "$dest/$entry");
+            }
+        }
+        // Clean up
+        $dir->close();
+        return true;
+    }
+    
+    /**
+     * Overloadable function that tests a filename for copyability. By
+     * default, everything should be copied; you can restrict things to
+     * ignore hidden files, unreadable files, etc. This function 
+     * applies to copyr().
+     */
+    public function copyable($file) {
+        return true;
+    }
+    
+    /**
+     * Delete a file, or a folder and its contents
+     * @note Adapted from http://aidanlister.com/repos/v/function.rmdirr.php
+     */
+    public function rmdirr($dirname)
+    {
+        // Sanity check
+        if (!$this->file_exists($dirname)) {
+            return false;
+        }
+     
+        // Simple delete for a file
+        if ($this->is_file($dirname) || $this->is_link($dirname)) {
+            return $this->unlink($dirname);
+        }
+     
+        // Loop through the folder
+        $dir = $this->dir($dirname);
+        while (false !== $entry = $dir->read()) {
+            // Skip pointers
+            if ($entry == '.' || $entry == '..') {
+                continue;
+            }
+            // Recurse
+            $this->rmdirr($dirname . DIRECTORY_SEPARATOR . $entry);
+        }
+     
+        // Clean up
+        $dir->close();
+        return $this->rmdir($dirname);
+    }
+    
+    /**
+     * Recursively globs a directory.
+     */
+    public function globr($dir, $pattern, $flags = NULL) {
+        $files = $this->glob("$dir/$pattern", $flags);
+        if ($files === false) $files = array();
+        $sub_dirs = $this->glob("$dir/*", GLOB_ONLYDIR);
+        if ($sub_dirs === false) $sub_dirs = array();
+        foreach ($sub_dirs as $sub_dir) {
+            $sub_files = $this->globr($sub_dir, $pattern, $flags);
+            $files = array_merge($files, $sub_files);
+        }
+        return $files; 
+    }
+    
+    /**
+     * Allows for PHP functions to be called and be stubbed.
+     * @warning This function will not work for functions that need
+     *      to pass references; manually define a stub function for those.
+     */
+    public function __call($name, $args) {
+        return call_user_func_array($name, $args);
+    }
+    
+}

extras/FSTools/File.php

@@ -0,0 +1,124 @@
+<?php
+
+/**
+ * Represents a file in the filesystem
+ *
+ * @warning Be sure to distinguish between get() and write() versus
+ *      read() and put(), the former operates on the entire file, while
+ *      the latter operates on a handle.
+ */
+class FSTools_File
+{
+    
+    /** Filename of file this object represents */
+    protected $name;
+    
+    /** Handle for the file */
+    protected $handle = false;
+    
+    /** Instance of FSTools for interfacing with filesystem */
+    protected $fs;
+    
+    /**
+     * Filename of file you wish to instantiate.
+     * @note This file need not exist
+     */
+    public function __construct($name, $fs = false) {
+        $this->name = $name;
+        $this->fs = $fs ? $fs : FSTools::singleton();
+    }
+    
+    /** Returns the filename of the file. */
+    public function getName() {return $this->name;}
+    
+    /** Returns directory of the file without trailing slash */
+    public function getDirectory() {return $this->fs->dirname($this->name);}
+    
+    /**
+     * Retrieves the contents of a file
+     * @todo Throw an exception if file doesn't exist
+     */
+    public function get() {
+        return $this->fs->file_get_contents($this->name);
+    }
+    
+    /** Writes contents to a file, creates new file if necessary */
+    public function write($contents) {
+        return $this->fs->file_put_contents($this->name, $contents);
+    }
+    
+    /** Deletes the file */
+    public function delete() {
+        return $this->fs->unlink($this->name);
+    }
+    
+    /** Returns true if file exists and is a file. */
+    public function exists() {
+        return $this->fs->is_file($this->name);
+    }
+    
+    /** Returns last file modification time */
+    public function getMTime() {
+        return $this->fs->filemtime($this->name);
+    }
+    
+    /**
+     * Chmod a file
+     * @note We ignore errors because of some weird owner trickery due
+     *       to SVN duality
+     */
+    public function chmod($octal_code) {
+        return @$this->fs->chmod($this->name, $octal_code);
+    }
+    
+    /** Opens file's handle */
+    public function open($mode) {
+        if ($this->handle) $this->close();
+        $this->handle = $this->fs->fopen($this->name, $mode);
+        return true;
+    }
+    
+    /** Closes file's handle */
+    public function close() {
+        if (!$this->handle) return false;
+        $status = $this->fs->fclose($this->handle);
+        $this->handle = false;
+        return $status;
+    }
+    
+    /** Retrieves a line from an open file, with optional max length $length */
+    public function getLine($length = null) {
+        if (!$this->handle) $this->open('r');
+        if ($length === null) return $this->fs->fgets($this->handle);
+        else return $this->fs->fgets($this->handle, $length);
+    }
+    
+    /** Retrieves a character from an open file */
+    public function getChar() {
+        if (!$this->handle) $this->open('r');
+        return $this->fs->fgetc($this->handle);
+    }
+    
+    /** Retrieves an $length bytes of data from an open data */
+    public function read($length) {
+        if (!$this->handle) $this->open('r');
+        return $this->fs->fread($this->handle, $length);
+    }
+    
+    /** Writes to an open file */
+    public function put($string) {
+        if (!$this->handle) $this->open('a');
+        return $this->fs->fwrite($this->handle, $string);
+    }
+    
+    /** Returns TRUE if the end of the file has been reached */
+    public function eof() {
+        if (!$this->handle) return true;
+        return $this->fs->feof($this->handle);
+    }
+    
+    public function __destruct() {
+        if ($this->handle) $this->close();
+    }
+    
+}

extras/HTMLPurifierExtras.auto.php

@@ -5,5 +5,5 @@
  */
 
 set_include_path(dirname(__FILE__) . PATH_SEPARATOR . get_include_path() );
-require_once 'ConfigDoc.php';
-
+require_once 'HTMLPurifierExtras.php';
+require_once 'HTMLPurifierExtras.autoload.php';

extras/HTMLPurifierExtras.autoload.php

@@ -0,0 +1,23 @@
+<?php
+
+/**
+ * @file
+ * Convenience file that registers autoload handler for HTML Purifier.
+ * 
+ * @warning
+ *      This autoloader does not contain the compatibility code seen in
+ *      HTMLPurifier_Bootstrap; the user is expected to make any necessary
+ *      changes to use this library.
+ */
+
+if (function_exists('spl_autoload_register')) {
+    spl_autoload_register(array('HTMLPurifierExtras', 'autoload'));
+    if (function_exists('__autoload')) {
+        // Be polite and ensure that userland autoload gets retained
+        spl_autoload_register('__autoload');
+    }
+} elseif (!function_exists('__autoload')) {
+    function __autoload($class) {
+        return HTMLPurifierExtras::autoload($class);
+    }
+}

extras/HTMLPurifierExtras.php

@@ -0,0 +1,27 @@
+<?php
+
+/**
+ * Meta-class for HTML Purifier's extra class hierarchies, similar to
+ * HTMLPurifier_Bootstrap.
+ */
+class HTMLPurifierExtras
+{
+    
+    public static function autoload($class) {
+        $path = HTMLPurifierExtras::getPath($class);
+        if (!$path) return false;
+        require $path;
+        return true;
+    }
+    
+    public static function getPath($class) {
+        if (
+            strncmp('FSTools', $class, 7) !== 0 &&
+            strncmp('ConfigDoc', $class, 9) !== 0
+        ) return false;
+        // Custom implementations can go here
+        // Standard implementation:
+        return str_replace('_', '/', $class) . '.php';
+    }
+    
+}

extras/README

@@ -0,0 +1,30 @@
+
+HTML Purifier Extras
+    The Method Behind The Madness!
+
+The extras/ folder in HTML Purifier contains--you guessed it--extra things
+for HTML Purifier.  Specifically, these are two extra libraries called
+FSTools and ConfigSchema.  They're extra for a reason: you don't need them
+if you're using HTML Purifier for normal usage: filtering HTML.  However,
+if you're a developer, and would like to test HTML Purifier, or need to
+use one of HTML Purifier's maintenance scripts, chances are they'll need
+these libraries. Who knows: maybe you'll find them useful too!
+
+Here are the libraries:
+
+
+FSTools
+-------
+
+Short for File System Tools, this is a poor-man's object-oriented wrapper for
+the filesystem. It currently consists of two classes:
+
+- FSTools: This is a singleton that contains a manner of useful functions
+  such as recursive glob, directory removal, etc, as well as the ability
+  to call arbitrary native PHP functions through it like $FS->fopen(...).
+  This makes it a lot simpler to mock these filesystem calls for unit testing.
+
+- FSTools_File: This object represents a single file, and has almost any 
+  method imaginable one would need.
+
+Check the files themselves for more information.

library/HTMLPurifier.auto.php

@@ -5,5 +5,5 @@
  */
 
 set_include_path(dirname(__FILE__) . PATH_SEPARATOR . get_include_path() );
-require_once 'HTMLPurifier.php';
-
+require_once 'HTMLPurifier/Bootstrap.php';
+require_once 'HTMLPurifier.autoload.php';

library/HTMLPurifier.autoload.php

@@ -0,0 +1,19 @@
+<?php
+
+/**
+ * @file
+ * Convenience file that registers autoload handler for HTML Purifier.
+ */
+
+if (function_exists('spl_autoload_register') && function_exists('spl_autoload_unregister')) {
+    // We need unregister for our pre-registering functionality
+    HTMLPurifier_Bootstrap::registerAutoload();
+    if (function_exists('__autoload')) {
+        // Be polite and ensure that userland autoload gets retained
+        spl_autoload_register('__autoload');
+    }
+} elseif (!function_exists('__autoload')) {
+    function __autoload($class) {
+        return HTMLPurifier_Bootstrap::autoload($class);
+    }
+}

library/HTMLPurifier.func.php

@@ -1,18 +1,20 @@
 <?php
 
 /**
- * Function wrapper for HTML Purifier for quick use.
- * @note This function only includes the library when it is called. While
- *       this is efficient for instances when you only use HTML Purifier
- *       on a few of your pages, it murders bytecode caching. You still
- *       need to add HTML Purifier to your path.
+ * @file
+ * Defines a function wrapper for HTML Purifier for quick use.
  * @note ''HTMLPurifier()'' is NOT the same as ''new HTMLPurifier()''
  */
 
+/**
+ * Purify HTML.
+ * @param $html String HTML to purify
+ * @param $config Configuration to use, can be any value accepted by
+ *        HTMLPurifier_Config::create()
+ */
 function HTMLPurifier($html, $config = null) {
     static $purifier = false;
     if (!$purifier) {
-        require_once 'HTMLPurifier.php';
         $purifier = new HTMLPurifier();
     }
     return $purifier->purify($html, $config);

library/HTMLPurifier.includes.php

@@ -0,0 +1,189 @@
+<?php
+
+/**
+ * @file
+ * This file was auto-generated by generate-includes.php and includes all of
+ * the core files required by HTML Purifier. Use this if performance is a
+ * primary concern and you are using an opcode cache. PLEASE DO NOT EDIT THIS
+ * FILE, changes will be overwritten the next time the script is run.
+ * 
+ * @version 3.1.0
+ * 
+ * @warning
+ *      You must *not* include any other HTML Purifier files before this file,
+ *      because 'require' not 'require_once' is used.
+ * 
+ * @warning
+ *      This file requires that the include path contains the HTML Purifier
+ *      library directory; this is not auto-set.
+ */
+
+require 'HTMLPurifier.php';
+require 'HTMLPurifier/AttrCollections.php';
+require 'HTMLPurifier/AttrDef.php';
+require 'HTMLPurifier/AttrTransform.php';
+require 'HTMLPurifier/AttrTypes.php';
+require 'HTMLPurifier/AttrValidator.php';
+require 'HTMLPurifier/Bootstrap.php';
+require 'HTMLPurifier/Definition.php';
+require 'HTMLPurifier/CSSDefinition.php';
+require 'HTMLPurifier/ChildDef.php';
+require 'HTMLPurifier/Config.php';
+require 'HTMLPurifier/ConfigDef.php';
+require 'HTMLPurifier/ConfigSchema.php';
+require 'HTMLPurifier/ContentSets.php';
+require 'HTMLPurifier/Context.php';
+require 'HTMLPurifier/DefinitionCache.php';
+require 'HTMLPurifier/DefinitionCacheFactory.php';
+require 'HTMLPurifier/Doctype.php';
+require 'HTMLPurifier/DoctypeRegistry.php';
+require 'HTMLPurifier/ElementDef.php';
+require 'HTMLPurifier/Encoder.php';
+require 'HTMLPurifier/EntityLookup.php';
+require 'HTMLPurifier/EntityParser.php';
+require 'HTMLPurifier/ErrorCollector.php';
+require 'HTMLPurifier/Exception.php';
+require 'HTMLPurifier/Filter.php';
+require 'HTMLPurifier/Generator.php';
+require 'HTMLPurifier/HTMLDefinition.php';
+require 'HTMLPurifier/HTMLModule.php';
+require 'HTMLPurifier/HTMLModuleManager.php';
+require 'HTMLPurifier/IDAccumulator.php';
+require 'HTMLPurifier/Injector.php';
+require 'HTMLPurifier/Language.php';
+require 'HTMLPurifier/LanguageFactory.php';
+require 'HTMLPurifier/Lexer.php';
+require 'HTMLPurifier/PercentEncoder.php';
+require 'HTMLPurifier/Strategy.php';
+require 'HTMLPurifier/StringHash.php';
+require 'HTMLPurifier/StringHashParser.php';
+require 'HTMLPurifier/TagTransform.php';
+require 'HTMLPurifier/Token.php';
+require 'HTMLPurifier/TokenFactory.php';
+require 'HTMLPurifier/URI.php';
+require 'HTMLPurifier/URIDefinition.php';
+require 'HTMLPurifier/URIFilter.php';
+require 'HTMLPurifier/URIParser.php';
+require 'HTMLPurifier/URIScheme.php';
+require 'HTMLPurifier/URISchemeRegistry.php';
+require 'HTMLPurifier/VarParser.php';
+require 'HTMLPurifier/VarParserException.php';
+require 'HTMLPurifier/AttrDef/CSS.php';
+require 'HTMLPurifier/AttrDef/Enum.php';
+require 'HTMLPurifier/AttrDef/Integer.php';
+require 'HTMLPurifier/AttrDef/Lang.php';
+require 'HTMLPurifier/AttrDef/Text.php';
+require 'HTMLPurifier/AttrDef/URI.php';
+require 'HTMLPurifier/AttrDef/CSS/Number.php';
+require 'HTMLPurifier/AttrDef/CSS/AlphaValue.php';
+require 'HTMLPurifier/AttrDef/CSS/Background.php';
+require 'HTMLPurifier/AttrDef/CSS/BackgroundPosition.php';
+require 'HTMLPurifier/AttrDef/CSS/Border.php';
+require 'HTMLPurifier/AttrDef/CSS/Color.php';
+require 'HTMLPurifier/AttrDef/CSS/Composite.php';
+require 'HTMLPurifier/AttrDef/CSS/DenyElementDecorator.php';
+require 'HTMLPurifier/AttrDef/CSS/Filter.php';
+require 'HTMLPurifier/AttrDef/CSS/Font.php';
+require 'HTMLPurifier/AttrDef/CSS/FontFamily.php';
+require 'HTMLPurifier/AttrDef/CSS/ImportantDecorator.php';
+require 'HTMLPurifier/AttrDef/CSS/Length.php';
+require 'HTMLPurifier/AttrDef/CSS/ListStyle.php';
+require 'HTMLPurifier/AttrDef/CSS/Multiple.php';
+require 'HTMLPurifier/AttrDef/CSS/Percentage.php';
+require 'HTMLPurifier/AttrDef/CSS/TextDecoration.php';
+require 'HTMLPurifier/AttrDef/CSS/URI.php';
+require 'HTMLPurifier/AttrDef/HTML/Bool.php';
+require 'HTMLPurifier/AttrDef/HTML/Color.php';
+require 'HTMLPurifier/AttrDef/HTML/FrameTarget.php';
+require 'HTMLPurifier/AttrDef/HTML/ID.php';
+require 'HTMLPurifier/AttrDef/HTML/Pixels.php';
+require 'HTMLPurifier/AttrDef/HTML/Length.php';
+require 'HTMLPurifier/AttrDef/HTML/LinkTypes.php';
+require 'HTMLPurifier/AttrDef/HTML/MultiLength.php';
+require 'HTMLPurifier/AttrDef/HTML/Nmtokens.php';
+require 'HTMLPurifier/AttrDef/URI/Email.php';
+require 'HTMLPurifier/AttrDef/URI/Host.php';
+require 'HTMLPurifier/AttrDef/URI/IPv4.php';
+require 'HTMLPurifier/AttrDef/URI/IPv6.php';
+require 'HTMLPurifier/AttrDef/URI/Email/SimpleCheck.php';
+require 'HTMLPurifier/AttrTransform/BdoDir.php';
+require 'HTMLPurifier/AttrTransform/BgColor.php';
+require 'HTMLPurifier/AttrTransform/BoolToCSS.php';
+require 'HTMLPurifier/AttrTransform/Border.php';
+require 'HTMLPurifier/AttrTransform/EnumToCSS.php';
+require 'HTMLPurifier/AttrTransform/ImgRequired.php';
+require 'HTMLPurifier/AttrTransform/ImgSpace.php';
+require 'HTMLPurifier/AttrTransform/Lang.php';
+require 'HTMLPurifier/AttrTransform/Length.php';
+require 'HTMLPurifier/AttrTransform/Name.php';
+require 'HTMLPurifier/AttrTransform/ScriptRequired.php';
+require 'HTMLPurifier/ChildDef/Chameleon.php';
+require 'HTMLPurifier/ChildDef/Custom.php';
+require 'HTMLPurifier/ChildDef/Empty.php';
+require 'HTMLPurifier/ChildDef/Required.php';
+require 'HTMLPurifier/ChildDef/Optional.php';
+require 'HTMLPurifier/ChildDef/StrictBlockquote.php';
+require 'HTMLPurifier/ChildDef/Table.php';
+require 'HTMLPurifier/ConfigDef/Directive.php';
+require 'HTMLPurifier/ConfigDef/DirectiveAlias.php';
+require 'HTMLPurifier/ConfigDef/Namespace.php';
+require 'HTMLPurifier/DefinitionCache/Decorator.php';
+require 'HTMLPurifier/DefinitionCache/Null.php';
+require 'HTMLPurifier/DefinitionCache/Serializer.php';
+require 'HTMLPurifier/DefinitionCache/Decorator/Cleanup.php';
+require 'HTMLPurifier/DefinitionCache/Decorator/Memory.php';
+require 'HTMLPurifier/HTMLModule/Bdo.php';
+require 'HTMLPurifier/HTMLModule/CommonAttributes.php';
+require 'HTMLPurifier/HTMLModule/Edit.php';
+require 'HTMLPurifier/HTMLModule/Hypertext.php';
+require 'HTMLPurifier/HTMLModule/Image.php';
+require 'HTMLPurifier/HTMLModule/Legacy.php';
+require 'HTMLPurifier/HTMLModule/List.php';
+require 'HTMLPurifier/HTMLModule/NonXMLCommonAttributes.php';
+require 'HTMLPurifier/HTMLModule/Object.php';
+require 'HTMLPurifier/HTMLModule/Presentation.php';
+require 'HTMLPurifier/HTMLModule/Proprietary.php';
+require 'HTMLPurifier/HTMLModule/Ruby.php';
+require 'HTMLPurifier/HTMLModule/Scripting.php';
+require 'HTMLPurifier/HTMLModule/StyleAttribute.php';
+require 'HTMLPurifier/HTMLModule/Tables.php';
+require 'HTMLPurifier/HTMLModule/Target.php';
+require 'HTMLPurifier/HTMLModule/Text.php';
+require 'HTMLPurifier/HTMLModule/Tidy.php';
+require 'HTMLPurifier/HTMLModule/XMLCommonAttributes.php';
+require 'HTMLPurifier/HTMLModule/Tidy/Proprietary.php';
+require 'HTMLPurifier/HTMLModule/Tidy/XHTMLAndHTML4.php';
+require 'HTMLPurifier/HTMLModule/Tidy/Strict.php';
+require 'HTMLPurifier/HTMLModule/Tidy/Transitional.php';
+require 'HTMLPurifier/HTMLModule/Tidy/XHTML.php';
+require 'HTMLPurifier/Injector/AutoParagraph.php';
+require 'HTMLPurifier/Injector/Linkify.php';
+require 'HTMLPurifier/Injector/PurifierLinkify.php';
+require 'HTMLPurifier/Lexer/DOMLex.php';
+require 'HTMLPurifier/Lexer/DirectLex.php';
+require 'HTMLPurifier/Strategy/Composite.php';
+require 'HTMLPurifier/Strategy/Core.php';
+require 'HTMLPurifier/Strategy/FixNesting.php';
+require 'HTMLPurifier/Strategy/MakeWellFormed.php';
+require 'HTMLPurifier/Strategy/RemoveForeignElements.php';
+require 'HTMLPurifier/Strategy/ValidateAttributes.php';
+require 'HTMLPurifier/TagTransform/Font.php';
+require 'HTMLPurifier/TagTransform/Simple.php';
+require 'HTMLPurifier/Token/Comment.php';
+require 'HTMLPurifier/Token/Tag.php';
+require 'HTMLPurifier/Token/Empty.php';
+require 'HTMLPurifier/Token/End.php';
+require 'HTMLPurifier/Token/Start.php';
+require 'HTMLPurifier/Token/Text.php';
+require 'HTMLPurifier/URIFilter/DisableExternal.php';
+require 'HTMLPurifier/URIFilter/DisableExternalResources.php';
+require 'HTMLPurifier/URIFilter/HostBlacklist.php';
+require 'HTMLPurifier/URIFilter/MakeAbsolute.php';
+require 'HTMLPurifier/URIScheme/ftp.php';
+require 'HTMLPurifier/URIScheme/http.php';
+require 'HTMLPurifier/URIScheme/https.php';
+require 'HTMLPurifier/URIScheme/mailto.php';
+require 'HTMLPurifier/URIScheme/news.php';
+require 'HTMLPurifier/URIScheme/nntp.php';
+require 'HTMLPurifier/VarParser/Flexible.php';
+require 'HTMLPurifier/VarParser/Native.php';

library/HTMLPurifier.kses.php

@@ -0,0 +1,28 @@
+<?php
+
+/**
+ * @file
+ * Emulation layer for code that used kses(), substituting in HTML Purifier.
+ */
+
+require_once dirname(__FILE__) . '/HTMLPurifier.auto.php';
+
+function kses($string, $allowed_html, $allowed_protocols = null) {
+    $config = HTMLPurifier_Config::createDefault();
+    $allowed_elements = array();
+    $allowed_attributes = array();
+    foreach ($allowed_html as $element => $attributes) {
+        $allowed_elements[$element] = true;
+        foreach ($attributes as $attribute => $x) {
+            $allowed_attributes["$element.$attribute"] = true;
+        }
+    }
+    $config->set('HTML', 'AllowedElements', $allowed_elements);
+    $config->set('HTML', 'AllowedAttributes', $allowed_attributes);
+    $allowed_schemes = array();
+    if ($allowed_protocols !== null) {
+        $config->set('URI', 'AllowedSchemes', $allowed_protocols);
+    }
+    $purifier = new HTMLPurifier($config);
+    return $purifier->purify($string);
+}

library/HTMLPurifier.path.php

@@ -0,0 +1,9 @@
+<?php
+
+/**
+ * @file
+ * Convenience stub file that adds HTML Purifier's library file to the path
+ * without any other side-effects.
+ */
+
+set_include_path(dirname(__FILE__) . PATH_SEPARATOR . get_include_path() );

library/HTMLPurifier.php

@@ -1,7 +1,6 @@
 <?php
 
-/*!
- * @mainpage
+/*! @mainpage
  * 
  * HTML Purifier is an HTML filter that will take an arbitrary snippet of
  * HTML and rigorously test, validate and filter it into a version that
@@ -16,14 +15,12 @@
  *  -# Generating HTML from the purified tokens.
  * 
  * However, most users will only need to interface with the HTMLPurifier
- * class, so this massive amount of infrastructure is usually concealed.
- * If you plan on working with the internals, be sure to include
- * HTMLPurifier_ConfigSchema and HTMLPurifier_Config.
+ * and HTMLPurifier_Config.
  */
 
 /*
-    HTML Purifier 2.1.3 - Standards Compliant HTML Filtering
-    Copyright (C) 2006-2007 Edward Z. Yang
+    HTML Purifier 3.1.0 - Standards Compliant HTML Filtering
+    Copyright (C) 2006-2008 Edward Z. Yang
 
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Lesser General Public
@@ -40,32 +37,6 @@
     Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
  */
 
-// constants are slow, but we'll make one exception
-define('HTMLPURIFIER_PREFIX', dirname(__FILE__));
-
-// every class has an undocumented dependency to these, must be included!
-require_once 'HTMLPurifier/ConfigSchema.php'; // fatal errors if not included
-require_once 'HTMLPurifier/Config.php';
-require_once 'HTMLPurifier/Context.php';
-
-require_once 'HTMLPurifier/Lexer.php';
-require_once 'HTMLPurifier/Generator.php';
-require_once 'HTMLPurifier/Strategy/Core.php';
-require_once 'HTMLPurifier/Encoder.php';
-
-require_once 'HTMLPurifier/ErrorCollector.php';
-require_once 'HTMLPurifier/LanguageFactory.php';
-
-HTMLPurifier_ConfigSchema::define(
-    'Core', 'CollectErrors', false, 'bool', '
-Whether or not to collect errors found while filtering the document. This
-is a useful way to give feedback to your users. <strong>Warning:</strong>
-Currently this feature is very patchy and experimental, with lots of
-possible error messages not yet implemented. It will not cause any problems,
-but it may not help your users either. This directive has been available
-since 2.0.0.
-');
-
 /**
  * Facade that coordinates HTML Purifier's subsystems in order to purify HTML.
  * 
@@ -75,27 +46,36 @@ since 2.0.0.
  *          -# Instance: new HTMLPurifier($config)
  *          -# Invocation: purify($html, $config)
  *       These configurations are entirely independent of each other and
- *       are *not* merged.
+ *       are *not* merged (this behavior may change in the future).
  * 
- * @todo We need an easier way to inject strategies, it'll probably end
- *       up getting done through config though.
+ * @todo We need an easier way to inject strategies using the configuration
+ *       object.
  */
 class HTMLPurifier
 {
     
-    var $version = '2.1.3';
+    /** Version of HTML Purifier */
+    public $version = '3.1.0';
     
-    var $config;
-    var $filters = array();
+    /** Constant with version of HTML Purifier */
+    const VERSION = '3.1.0';
     
-    var $strategy, $generator;
+    /** Global configuration object */
+    public $config;
+    
+    /** Array of extra HTMLPurifier_Filter objects to run on HTML, for backwards compatibility */
+    private $filters = array();
+    
+    /** Single instance of HTML Purifier */
+    private static $instance;
+    
+    protected $strategy, $generator;
     
     /**
      * Resultant HTMLPurifier_Context of last run purification. Is an array
      * of contexts if the last called method was purifyArray().
-     * @public
      */
-    var $context;
+    public $context;
     
     /**
      * Initializes the purifier.
@@ -105,12 +85,11 @@ class HTMLPurifier
      *                The parameter can also be any type that
      *                HTMLPurifier_Config::create() supports.
      */
-    function HTMLPurifier($config = null) {
+    public function __construct($config = null) {
         
         $this->config = HTMLPurifier_Config::create($config);
         
         $this->strategy     = new HTMLPurifier_Strategy_Core();
-        $this->generator    = new HTMLPurifier_Generator();
         
     }
     
@@ -118,7 +97,8 @@ class HTMLPurifier
      * Adds a filter to process the output. First come first serve
      * @param $filter HTMLPurifier_Filter object
      */
-    function addFilter($filter) {
+    public function addFilter($filter) {
+        trigger_error('HTMLPurifier->addFilter() is deprecated, use configuration directives in the Filter namespace or Filter.Custom', E_USER_WARNING);
         $this->filters[] = $filter;
     }
     
@@ -132,8 +112,9 @@ class HTMLPurifier
      *                that HTMLPurifier_Config::create() supports.
      * @return Purified HTML
      */
-    function purify($html, $config = null) {
+    public function purify($html, $config = null) {
         
+        // :TODO: make the config merge in, instead of replace
         $config = $config ? HTMLPurifier_Config::create($config) : $this->config;
         
         // implementation is partially environment dependant, partially
@@ -142,8 +123,8 @@ class HTMLPurifier
         
         $context = new HTMLPurifier_Context();
         
-        // our friendly neighborhood generator, all primed with configuration too!
-        $this->generator->generateFromTokens(array(), $config, $context);
+        // setup HTML generator
+        $this->generator = new HTMLPurifier_Generator($config, $context);
         $context->register('Generator', $this->generator);
         
         // set up global context variables
@@ -164,8 +145,25 @@ class HTMLPurifier
         
         $html = HTMLPurifier_Encoder::convertToUTF8($html, $config, $context);
         
-        for ($i = 0, $size = count($this->filters); $i < $size; $i++) {
-            $html = $this->filters[$i]->preFilter($html, $config, $context);
+        // setup filters
+        $filter_flags = $config->getBatch('Filter');
+        $custom_filters = $filter_flags['Custom'];
+        unset($filter_flags['Custom']);
+        $filters = array();
+        foreach ($filter_flags as $filter => $flag) {
+            if (!$flag) continue;
+            $class = "HTMLPurifier_Filter_$filter";
+            $filters[] = new $class;
+        }
+        foreach ($custom_filters as $filter) {
+            // maybe "HTMLPurifier_Filter_$filter", but be consistent with AutoFormat
+            $filters[] = $filter;
+        }
+        $filters = array_merge($filters, $this->filters);
+        // maybe prepare(), but later
+        
+        for ($i = 0, $filter_size = count($filters); $i < $filter_size; $i++) {
+            $html = $filters[$i]->preFilter($html, $config, $context);
         }
         
         // purified HTML
@@ -179,12 +177,11 @@ class HTMLPurifier
                         $html, $config, $context
                     ),
                     $config, $context
-                ),
-                $config, $context
+                )
             );
         
-        for ($i = $size - 1; $i >= 0; $i--) {
-            $html = $this->filters[$i]->postFilter($html, $config, $context);
+        for ($i = $filter_size - 1; $i >= 0; $i--) {
+            $html = $filters[$i]->postFilter($html, $config, $context);
         }
         
         $html = HTMLPurifier_Encoder::convertFromUTF8($html, $config, $context);
@@ -198,7 +195,7 @@ class HTMLPurifier
      *                See HTMLPurifier::purify() for more details.
      * @return Array of purified HTML
      */
-    function purifyArray($array_of_html, $config = null) {
+    public function purifyArray($array_of_html, $config = null) {
         $context_array = array();
         foreach ($array_of_html as $key => $html) {
             $array_of_html[$key] = $this->purify($html, $config);
@@ -211,22 +208,27 @@ class HTMLPurifier
     /**
      * Singleton for enforcing just one HTML Purifier in your system
      * @param $prototype Optional prototype HTMLPurifier instance to
-     *                   overload singleton with.
+     *                   overload singleton with, or HTMLPurifier_Config
+     *                   instance to configure the generated version with.
      */
-    function &getInstance($prototype = null) {
-        static $htmlpurifier;
-        if (!$htmlpurifier || $prototype) {
-            if (is_a($prototype, 'HTMLPurifier')) {
-                $htmlpurifier = $prototype;
+    public static function instance($prototype = null) {
+        if (!self::$instance || $prototype) {
+            if ($prototype instanceof HTMLPurifier) {
+                self::$instance = $prototype;
             } elseif ($prototype) {
-                $htmlpurifier = new HTMLPurifier($prototype);
+                self::$instance = new HTMLPurifier($prototype);
             } else {
-                $htmlpurifier = new HTMLPurifier();
+                self::$instance = new HTMLPurifier();
             }
         }
-        return $htmlpurifier;
+        return self::$instance;
     }
     
+    /**
+     * @note Backwards compatibility, see instance()
+     */
+    public static function getInstance($prototype = null) {
+        return HTMLPurifier::instance($prototype);
+    }
     
 }
-

library/HTMLPurifier.safe-includes.php

@@ -0,0 +1,183 @@
+<?php
+
+/**
+ * @file
+ * This file was auto-generated by generate-includes.php and includes all of
+ * the core files required by HTML Purifier. This is a convenience stub that
+ * includes all files using dirname(__FILE__) and require_once. PLEASE DO NOT
+ * EDIT THIS FILE, changes will be overwritten the next time the script is run.
+ * 
+ * Changes to include_path are not necessary.
+ */
+
+$__dir = dirname(__FILE__);
+
+require_once $__dir . '/HTMLPurifier.php';
+require_once $__dir . '/HTMLPurifier/AttrCollections.php';
+require_once $__dir . '/HTMLPurifier/AttrDef.php';
+require_once $__dir . '/HTMLPurifier/AttrTransform.php';
+require_once $__dir . '/HTMLPurifier/AttrTypes.php';
+require_once $__dir . '/HTMLPurifier/AttrValidator.php';
+require_once $__dir . '/HTMLPurifier/Bootstrap.php';
+require_once $__dir . '/HTMLPurifier/Definition.php';
+require_once $__dir . '/HTMLPurifier/CSSDefinition.php';
+require_once $__dir . '/HTMLPurifier/ChildDef.php';
+require_once $__dir . '/HTMLPurifier/Config.php';
+require_once $__dir . '/HTMLPurifier/ConfigDef.php';
+require_once $__dir . '/HTMLPurifier/ConfigSchema.php';
+require_once $__dir . '/HTMLPurifier/ContentSets.php';
+require_once $__dir . '/HTMLPurifier/Context.php';
+require_once $__dir . '/HTMLPurifier/DefinitionCache.php';
+require_once $__dir . '/HTMLPurifier/DefinitionCacheFactory.php';
+require_once $__dir . '/HTMLPurifier/Doctype.php';
+require_once $__dir . '/HTMLPurifier/DoctypeRegistry.php';
+require_once $__dir . '/HTMLPurifier/ElementDef.php';
+require_once $__dir . '/HTMLPurifier/Encoder.php';
+require_once $__dir . '/HTMLPurifier/EntityLookup.php';
+require_once $__dir . '/HTMLPurifier/EntityParser.php';
+require_once $__dir . '/HTMLPurifier/ErrorCollector.php';
+require_once $__dir . '/HTMLPurifier/Exception.php';
+require_once $__dir . '/HTMLPurifier/Filter.php';
+require_once $__dir . '/HTMLPurifier/Generator.php';
+require_once $__dir . '/HTMLPurifier/HTMLDefinition.php';
+require_once $__dir . '/HTMLPurifier/HTMLModule.php';
+require_once $__dir . '/HTMLPurifier/HTMLModuleManager.php';
+require_once $__dir . '/HTMLPurifier/IDAccumulator.php';
+require_once $__dir . '/HTMLPurifier/Injector.php';
+require_once $__dir . '/HTMLPurifier/Language.php';
+require_once $__dir . '/HTMLPurifier/LanguageFactory.php';
+require_once $__dir . '/HTMLPurifier/Lexer.php';
+require_once $__dir . '/HTMLPurifier/PercentEncoder.php';
+require_once $__dir . '/HTMLPurifier/Strategy.php';
+require_once $__dir . '/HTMLPurifier/StringHash.php';
+require_once $__dir . '/HTMLPurifier/StringHashParser.php';
+require_once $__dir . '/HTMLPurifier/TagTransform.php';
+require_once $__dir . '/HTMLPurifier/Token.php';
+require_once $__dir . '/HTMLPurifier/TokenFactory.php';
+require_once $__dir . '/HTMLPurifier/URI.php';
+require_once $__dir . '/HTMLPurifier/URIDefinition.php';
+require_once $__dir . '/HTMLPurifier/URIFilter.php';
+require_once $__dir . '/HTMLPurifier/URIParser.php';
+require_once $__dir . '/HTMLPurifier/URIScheme.php';
+require_once $__dir . '/HTMLPurifier/URISchemeRegistry.php';
+require_once $__dir . '/HTMLPurifier/VarParser.php';
+require_once $__dir . '/HTMLPurifier/VarParserException.php';
+require_once $__dir . '/HTMLPurifier/AttrDef/CSS.php';
+require_once $__dir . '/HTMLPurifier/AttrDef/Enum.php';
+require_once $__dir . '/HTMLPurifier/AttrDef/Integer.php';
+require_once $__dir . '/HTMLPurifier/AttrDef/Lang.php';
+require_once $__dir . '/HTMLPurifier/AttrDef/Text.php';
+require_once $__dir . '/HTMLPurifier/AttrDef/URI.php';
+require_once $__dir . '/HTMLPurifier/AttrDef/CSS/Number.php';
+require_once $__dir . '/HTMLPurifier/AttrDef/CSS/AlphaValue.php';
+require_once $__dir . '/HTMLPurifier/AttrDef/CSS/Background.php';
+require_once $__dir . '/HTMLPurifier/AttrDef/CSS/BackgroundPosition.php';
+require_once $__dir . '/HTMLPurifier/AttrDef/CSS/Border.php';
+require_once $__dir . '/HTMLPurifier/AttrDef/CSS/Color.php';
+require_once $__dir . '/HTMLPurifier/AttrDef/CSS/Composite.php';
+require_once $__dir . '/HTMLPurifier/AttrDef/CSS/DenyElementDecorator.php';
+require_once $__dir . '/HTMLPurifier/AttrDef/CSS/Filter.php';
+require_once $__dir . '/HTMLPurifier/AttrDef/CSS/Font.php';
+require_once $__dir . '/HTMLPurifier/AttrDef/CSS/FontFamily.php';
+require_once $__dir . '/HTMLPurifier/AttrDef/CSS/ImportantDecorator.php';
+require_once $__dir . '/HTMLPurifier/AttrDef/CSS/Length.php';
+require_once $__dir . '/HTMLPurifier/AttrDef/CSS/ListStyle.php';
+require_once $__dir . '/HTMLPurifier/AttrDef/CSS/Multiple.php';
+require_once $__dir . '/HTMLPurifier/AttrDef/CSS/Percentage.php';
+require_once $__dir . '/HTMLPurifier/AttrDef/CSS/TextDecoration.php';
+require_once $__dir . '/HTMLPurifier/AttrDef/CSS/URI.php';
+require_once $__dir . '/HTMLPurifier/AttrDef/HTML/Bool.php';
+require_once $__dir . '/HTMLPurifier/AttrDef/HTML/Color.php';
+require_once $__dir . '/HTMLPurifier/AttrDef/HTML/FrameTarget.php';
+require_once $__dir . '/HTMLPurifier/AttrDef/HTML/ID.php';
+require_once $__dir . '/HTMLPurifier/AttrDef/HTML/Pixels.php';
+require_once $__dir . '/HTMLPurifier/AttrDef/HTML/Length.php';
+require_once $__dir . '/HTMLPurifier/AttrDef/HTML/LinkTypes.php';
+require_once $__dir . '/HTMLPurifier/AttrDef/HTML/MultiLength.php';
+require_once $__dir . '/HTMLPurifier/AttrDef/HTML/Nmtokens.php';
+require_once $__dir . '/HTMLPurifier/AttrDef/URI/Email.php';
+require_once $__dir . '/HTMLPurifier/AttrDef/URI/Host.php';
+require_once $__dir . '/HTMLPurifier/AttrDef/URI/IPv4.php';
+require_once $__dir . '/HTMLPurifier/AttrDef/URI/IPv6.php';
+require_once $__dir . '/HTMLPurifier/AttrDef/URI/Email/SimpleCheck.php';
+require_once $__dir . '/HTMLPurifier/AttrTransform/BdoDir.php';
+require_once $__dir . '/HTMLPurifier/AttrTransform/BgColor.php';
+require_once $__dir . '/HTMLPurifier/AttrTransform/BoolToCSS.php';
+require_once $__dir . '/HTMLPurifier/AttrTransform/Border.php';
+require_once $__dir . '/HTMLPurifier/AttrTransform/EnumToCSS.php';
+require_once $__dir . '/HTMLPurifier/AttrTransform/ImgRequired.php';
+require_once $__dir . '/HTMLPurifier/AttrTransform/ImgSpace.php';
+require_once $__dir . '/HTMLPurifier/AttrTransform/Lang.php';
+require_once $__dir . '/HTMLPurifier/AttrTransform/Length.php';
+require_once $__dir . '/HTMLPurifier/AttrTransform/Name.php';
+require_once $__dir . '/HTMLPurifier/AttrTransform/ScriptRequired.php';
+require_once $__dir . '/HTMLPurifier/ChildDef/Chameleon.php';
+require_once $__dir . '/HTMLPurifier/ChildDef/Custom.php';
+require_once $__dir . '/HTMLPurifier/ChildDef/Empty.php';
+require_once $__dir . '/HTMLPurifier/ChildDef/Required.php';
+require_once $__dir . '/HTMLPurifier/ChildDef/Optional.php';
+require_once $__dir . '/HTMLPurifier/ChildDef/StrictBlockquote.php';
+require_once $__dir . '/HTMLPurifier/ChildDef/Table.php';
+require_once $__dir . '/HTMLPurifier/ConfigDef/Directive.php';
+require_once $__dir . '/HTMLPurifier/ConfigDef/DirectiveAlias.php';
+require_once $__dir . '/HTMLPurifier/ConfigDef/Namespace.php';
+require_once $__dir . '/HTMLPurifier/DefinitionCache/Decorator.php';
+require_once $__dir . '/HTMLPurifier/DefinitionCache/Null.php';
+require_once $__dir . '/HTMLPurifier/DefinitionCache/Serializer.php';
+require_once $__dir . '/HTMLPurifier/DefinitionCache/Decorator/Cleanup.php';
+require_once $__dir . '/HTMLPurifier/DefinitionCache/Decorator/Memory.php';
+require_once $__dir . '/HTMLPurifier/HTMLModule/Bdo.php';
+require_once $__dir . '/HTMLPurifier/HTMLModule/CommonAttributes.php';
+require_once $__dir . '/HTMLPurifier/HTMLModule/Edit.php';
+require_once $__dir . '/HTMLPurifier/HTMLModule/Hypertext.php';
+require_once $__dir . '/HTMLPurifier/HTMLModule/Image.php';
+require_once $__dir . '/HTMLPurifier/HTMLModule/Legacy.php';
+require_once $__dir . '/HTMLPurifier/HTMLModule/List.php';
+require_once $__dir . '/HTMLPurifier/HTMLModule/NonXMLCommonAttributes.php';
+require_once $__dir . '/HTMLPurifier/HTMLModule/Object.php';
+require_once $__dir . '/HTMLPurifier/HTMLModule/Presentation.php';
+require_once $__dir . '/HTMLPurifier/HTMLModule/Proprietary.php';
+require_once $__dir . '/HTMLPurifier/HTMLModule/Ruby.php';
+require_once $__dir . '/HTMLPurifier/HTMLModule/Scripting.php';
+require_once $__dir . '/HTMLPurifier/HTMLModule/StyleAttribute.php';
+require_once $__dir . '/HTMLPurifier/HTMLModule/Tables.php';
+require_once $__dir . '/HTMLPurifier/HTMLModule/Target.php';
+require_once $__dir . '/HTMLPurifier/HTMLModule/Text.php';
+require_once $__dir . '/HTMLPurifier/HTMLModule/Tidy.php';
+require_once $__dir . '/HTMLPurifier/HTMLModule/XMLCommonAttributes.php';
+require_once $__dir . '/HTMLPurifier/HTMLModule/Tidy/Proprietary.php';
+require_once $__dir . '/HTMLPurifier/HTMLModule/Tidy/XHTMLAndHTML4.php';
+require_once $__dir . '/HTMLPurifier/HTMLModule/Tidy/Strict.php';
+require_once $__dir . '/HTMLPurifier/HTMLModule/Tidy/Transitional.php';
+require_once $__dir . '/HTMLPurifier/HTMLModule/Tidy/XHTML.php';
+require_once $__dir . '/HTMLPurifier/Injector/AutoParagraph.php';
+require_once $__dir . '/HTMLPurifier/Injector/Linkify.php';
+require_once $__dir . '/HTMLPurifier/Injector/PurifierLinkify.php';
+require_once $__dir . '/HTMLPurifier/Lexer/DOMLex.php';
+require_once $__dir . '/HTMLPurifier/Lexer/DirectLex.php';
+require_once $__dir . '/HTMLPurifier/Strategy/Composite.php';
+require_once $__dir . '/HTMLPurifier/Strategy/Core.php';
+require_once $__dir . '/HTMLPurifier/Strategy/FixNesting.php';
+require_once $__dir . '/HTMLPurifier/Strategy/MakeWellFormed.php';
+require_once $__dir . '/HTMLPurifier/Strategy/RemoveForeignElements.php';
+require_once $__dir . '/HTMLPurifier/Strategy/ValidateAttributes.php';
+require_once $__dir . '/HTMLPurifier/TagTransform/Font.php';
+require_once $__dir . '/HTMLPurifier/TagTransform/Simple.php';
+require_once $__dir . '/HTMLPurifier/Token/Comment.php';
+require_once $__dir . '/HTMLPurifier/Token/Tag.php';
+require_once $__dir . '/HTMLPurifier/Token/Empty.php';
+require_once $__dir . '/HTMLPurifier/Token/End.php';
+require_once $__dir . '/HTMLPurifier/Token/Start.php';
+require_once $__dir . '/HTMLPurifier/Token/Text.php';
+require_once $__dir . '/HTMLPurifier/URIFilter/DisableExternal.php';
+require_once $__dir . '/HTMLPurifier/URIFilter/DisableExternalResources.php';
+require_once $__dir . '/HTMLPurifier/URIFilter/HostBlacklist.php';
+require_once $__dir . '/HTMLPurifier/URIFilter/MakeAbsolute.php';
+require_once $__dir . '/HTMLPurifier/URIScheme/ftp.php';
+require_once $__dir . '/HTMLPurifier/URIScheme/http.php';
+require_once $__dir . '/HTMLPurifier/URIScheme/https.php';
+require_once $__dir . '/HTMLPurifier/URIScheme/mailto.php';
+require_once $__dir . '/HTMLPurifier/URIScheme/news.php';
+require_once $__dir . '/HTMLPurifier/URIScheme/nntp.php';
+require_once $__dir . '/HTMLPurifier/VarParser/Flexible.php';
+require_once $__dir . '/HTMLPurifier/VarParser/Native.php';

library/HTMLPurifier/AttrCollections.php

@@ -1,7 +1,5 @@
 <?php
 
-require_once 'HTMLPurifier/AttrTypes.php';
-
 /**
  * Defines common attribute collections that modules reference
  */
@@ -12,7 +10,7 @@ class HTMLPurifier_AttrCollections
     /**
      * Associative array of attribute collections, indexed by name
      */
-    var $info = array();
+    public $info = array();
     
     /**
      * Performs all expansions on internal data for use by other inclusions
@@ -21,7 +19,7 @@ class HTMLPurifier_AttrCollections
      * @param $attr_types HTMLPurifier_AttrTypes instance
      * @param $modules Hash array of HTMLPurifier_HTMLModule members
      */
-    function HTMLPurifier_AttrCollections($attr_types, $modules) {
+    public function __construct($attr_types, $modules) {
         // load extensions from the modules
         foreach ($modules as $module) {
             foreach ($module->attr_collections as $coll_i => $coll) {
@@ -53,7 +51,7 @@ class HTMLPurifier_AttrCollections
      * all inclusions specified by the zero index.
      * @param &$attr Reference to attribute array
      */
-    function performInclusions(&$attr) {
+    public function performInclusions(&$attr) {
         if (!isset($attr[0])) return;
         $merge = $attr[0];
         $seen  = array(); // recursion guard
@@ -81,7 +79,7 @@ class HTMLPurifier_AttrCollections
      * @param &$attr Reference to attribute array
      * @param $attr_types HTMLPurifier_AttrTypes instance
      */
-    function expandIdentifiers(&$attr, $attr_types) {
+    public function expandIdentifiers(&$attr, $attr_types) {
         
         // because foreach will process new elements we add, make sure we
         // skip duplicates

library/HTMLPurifier/AttrDef.php

@@ -10,32 +10,29 @@
  * subclasses are also responsible for cleaning the code if possible.
  */
 
-class HTMLPurifier_AttrDef
+abstract class HTMLPurifier_AttrDef
 {
     
     /**
      * Tells us whether or not an HTML attribute is minimized. Has no
      * meaning in other contexts.
      */
-    var $minimized = false;
+    public $minimized = false;
     
     /**
      * Tells us whether or not an HTML attribute is required. Has no
      * meaning in other contexts
      */
-    var $required = false;
+    public $required = false;
     
     /**
      * Validates and cleans passed string according to a definition.
      * 
-     * @public
      * @param $string String to be validated and cleaned.
      * @param $config Mandatory HTMLPurifier_Config object.
      * @param $context Mandatory HTMLPurifier_AttrContext object.
      */
-    function validate($string, $config, &$context) {
-        trigger_error('Cannot call abstract function', E_USER_ERROR);
-    }
+    abstract public function validate($string, $config, $context);
     
     /**
      * Convenience method that parses a string as if it were CDATA.
@@ -59,10 +56,8 @@ class HTMLPurifier_AttrDef
      *          function.  Trim and whitespace collapsing are supposed to only
      *          occur in NMTOKENs.  However, note that we are NOT necessarily
      *          parsing XML, thus, this behavior may still be correct.
-     * 
-     * @public
      */
-    function parseCDATA($string) {
+    public function parseCDATA($string) {
         $string = trim($string);
         $string = str_replace("\n", '', $string);
         $string = str_replace(array("\r", "\t"), ' ', $string);
@@ -73,14 +68,22 @@ class HTMLPurifier_AttrDef
      * Factory method for creating this class from a string.
      * @param $string String construction info
      * @return Created AttrDef object corresponding to $string
-     * @public
      */
-    function make($string) {
-        // default implementation, return flyweight of this object
-        // if overloaded, it is *necessary* for you to clone the
-        // object (usually by instantiating a new copy) and return that
+    public function make($string) {
+        // default implementation, return a flyweight of this object.
+        // If $string has an effect on the returned object (i.e. you
+        // need to overload this method), it is best
+        // to clone or instantiate new copies. (Instantiation is safer.)
         return $this;
     }
     
+    /**
+     * Removes spaces from rgb(0, 0, 0) so that shorthand CSS properties work
+     * properly. THIS IS A HACK!
+     */
+    protected function mungeRgb($string) {
+        return preg_replace('/rgb\((\d+)\s*,\s*(\d+)\s*,\s*(\d+)\)/', 'rgb(\1,\2,\3)', $string);
+    }
+    
 }
 

library/HTMLPurifier/AttrDef/CSS.php

@@ -1,8 +1,5 @@
 <?php
 
-require_once 'HTMLPurifier/AttrDef.php';
-require_once 'HTMLPurifier/CSSDefinition.php';
-
 /**
  * Validates the HTML attribute style, otherwise known as CSS.
  * @note We don't implement the whole CSS specification, so it might be
@@ -17,7 +14,7 @@ require_once 'HTMLPurifier/CSSDefinition.php';
 class HTMLPurifier_AttrDef_CSS extends HTMLPurifier_AttrDef
 {
     
-    function validate($css, $config, &$context) {
+    public function validate($css, $config, $context) {
         
         $css = $this->parseCDATA($css);
         
@@ -38,7 +35,20 @@ class HTMLPurifier_AttrDef_CSS extends HTMLPurifier_AttrDef
             list($property, $value) = explode(':', $declaration, 2);
             $property = trim($property);
             $value    = trim($value);
-            if (!isset($definition->info[$property])) continue;
+            $ok = false;
+            do {
+                if (isset($definition->info[$property])) {
+                    $ok = true;
+                    break;
+                }
+                if (ctype_lower($property)) break;
+                $property = strtolower($property);
+                if (isset($definition->info[$property])) {
+                    $ok = true;
+                    break;
+                }
+            } while(0);
+            if (!$ok) continue;
             // inefficient call, since the validator will do this again
             if (strtolower(trim($value)) !== 'inherit') {
                 // inherit works for everything (but only on the base property)

library/HTMLPurifier/AttrDef/CSS/AlphaValue.php

@@ -0,0 +1,19 @@
+<?php
+
+class HTMLPurifier_AttrDef_CSS_AlphaValue extends HTMLPurifier_AttrDef_CSS_Number
+{
+    
+    public function __construct() {
+        parent::__construct(false); // opacity is non-negative, but we will clamp it
+    }
+    
+    public function validate($number, $config, $context) {
+        $result = parent::validate($number, $config, $context);
+        if ($result === false) return $result;
+        $float = (float) $result;
+        if ($float < 0.0) $result = '0';
+        if ($float > 1.0) $result = '1';
+        return $result;
+    }
+    
+}

library/HTMLPurifier/AttrDef/CSS/Background.php

@@ -1,8 +1,5 @@
 <?php
 
-require_once 'HTMLPurifier/AttrDef.php';
-require_once 'HTMLPurifier/CSSDefinition.php';
-
 /**
  * Validates shorthand CSS property background.
  * @warning Does not support url tokens that have internal spaces.
@@ -14,9 +11,9 @@ class HTMLPurifier_AttrDef_CSS_Background extends HTMLPurifier_AttrDef
      * Local copy of component validators.
      * @note See HTMLPurifier_AttrDef_Font::$info for a similar impl.
      */
-    var $info;
+    protected $info;
     
-    function HTMLPurifier_AttrDef_CSS_Background($config) {
+    public function __construct($config) {
         $def = $config->getCSSDefinition();
         $this->info['background-color'] = $def->info['background-color'];
         $this->info['background-image'] = $def->info['background-image'];
@@ -25,12 +22,15 @@ class HTMLPurifier_AttrDef_CSS_Background extends HTMLPurifier_AttrDef
         $this->info['background-position'] = $def->info['background-position'];
     }
     
-    function validate($string, $config, &$context) {
+    public function validate($string, $config, $context) {
         
         // regular pre-processing
         $string = $this->parseCDATA($string);
         if ($string === '') return false;
         
+        // munge rgb() decl if necessary
+        $string = $this->mungeRgb($string);
+        
         // assumes URI doesn't have spaces in it
         $bits = explode(' ', strtolower($string)); // bits to process
         

library/HTMLPurifier/AttrDef/CSS/BackgroundPosition.php

@@ -1,9 +1,5 @@
 <?php
 
-require_once 'HTMLPurifier/AttrDef.php';
-require_once 'HTMLPurifier/AttrDef/CSS/Length.php';
-require_once 'HTMLPurifier/AttrDef/CSS/Percentage.php';
-
 /* W3C says:
     [ // adjective and number must be in correct order, even if
       // you could switch them without introducing ambiguity.
@@ -48,15 +44,15 @@ require_once 'HTMLPurifier/AttrDef/CSS/Percentage.php';
 class HTMLPurifier_AttrDef_CSS_BackgroundPosition extends HTMLPurifier_AttrDef
 {
     
-    var $length;
-    var $percentage;
+    protected $length;
+    protected $percentage;
     
-    function HTMLPurifier_AttrDef_CSS_BackgroundPosition() {
+    public function __construct() {
         $this->length     = new HTMLPurifier_AttrDef_CSS_Length();
         $this->percentage = new HTMLPurifier_AttrDef_CSS_Percentage();
     }
     
-    function validate($string, $config, &$context) {
+    public function validate($string, $config, $context) {
         $string = $this->parseCDATA($string);
         $bits = explode(' ', $string);
         

library/HTMLPurifier/AttrDef/CSS/Border.php

@@ -1,7 +1,5 @@
 <?php
 
-require_once 'HTMLPurifier/AttrDef.php';
-
 /**
  * Validates the border property as defined by CSS.
  */
@@ -11,18 +9,18 @@ class HTMLPurifier_AttrDef_CSS_Border extends HTMLPurifier_AttrDef
     /**
      * Local copy of properties this property is shorthand for.
      */
-    var $info = array();
+    protected $info = array();
     
-    function HTMLPurifier_AttrDef_CSS_Border($config) {
+    public function __construct($config) {
         $def = $config->getCSSDefinition();
         $this->info['border-width'] = $def->info['border-width'];
         $this->info['border-style'] = $def->info['border-style'];
         $this->info['border-top-color'] = $def->info['border-top-color'];
     }
     
-    function validate($string, $config, &$context) {
+    public function validate($string, $config, $context) {
         $string = $this->parseCDATA($string);
-        // we specifically will not support rgb() syntax with spaces
+        $string = $this->mungeRgb($string);
         $bits = explode(' ', $string);
         $done = array(); // segments we've finished
         $ret = ''; // return value

library/HTMLPurifier/AttrDef/CSS/Color.php

@@ -1,58 +1,24 @@
 <?php
 
-require_once 'HTMLPurifier/AttrDef.php';
-
-HTMLPurifier_ConfigSchema::define(
-    'Core', 'ColorKeywords', array(
-        'maroon'    => '#800000',
-        'red'       => '#FF0000',
-        'orange'    => '#FFA500',
-        'yellow'    => '#FFFF00',
-        'olive'     => '#808000',
-        'purple'    => '#800080',
-        'fuchsia'   => '#FF00FF',
-        'white'     => '#FFFFFF',
-        'lime'      => '#00FF00',
-        'green'     => '#008000',
-        'navy'      => '#000080',
-        'blue'      => '#0000FF',
-        'aqua'      => '#00FFFF',
-        'teal'      => '#008080',
-        'black'     => '#000000',
-        'silver'    => '#C0C0C0',
-        'gray'      => '#808080'
-    ), 'hash', '
-Lookup array of color names to six digit hexadecimal number corresponding
-to color, with preceding hash mark. Used when parsing colors.
-This directive has been available since 2.0.0.
-');
-
 /**
  * Validates Color as defined by CSS.
  */
 class HTMLPurifier_AttrDef_CSS_Color extends HTMLPurifier_AttrDef
 {
     
-    function validate($color, $config, &$context) {
+    public function validate($color, $config, $context) {
         
         static $colors = null;
         if ($colors === null) $colors = $config->get('Core', 'ColorKeywords');
         
         $color = trim($color);
-        if (!$color) return false;
+        if ($color === '') return false;
         
         $lower = strtolower($color);
         if (isset($colors[$lower])) return $colors[$lower];
         
-        if ($color[0] === '#') {
-            // hexadecimal handling
-            $hex = substr($color, 1);
-            $length = strlen($hex);
-            if ($length !== 3 && $length !== 6) return false;
-            if (!ctype_xdigit($hex)) return false;
-        } else {
+        if (strpos($color, 'rgb(') !== false) {
             // rgb literal handling
-            if (strpos($color, 'rgb(')) return false;
             $length = strlen($color);
             if (strpos($color, ')') !== $length - 1) return false;
             $triad = substr($color, 4, $length - 4 - 1);
@@ -90,6 +56,17 @@ class HTMLPurifier_AttrDef_CSS_Color extends HTMLPurifier_AttrDef
             }
             $new_triad = implode(',', $new_parts);
             $color = "rgb($new_triad)";
+        } else {
+            // hexadecimal handling
+            if ($color[0] === '#') {
+                $hex = substr($color, 1);
+            } else {
+                $hex = $color;
+                $color = '#' . $color;
+            }
+            $length = strlen($hex);
+            if ($length !== 3 && $length !== 6) return false;
+            if (!ctype_xdigit($hex)) return false;
         }
         
         return $color;

library/HTMLPurifier/AttrDef/CSS/Composite.php

@@ -14,18 +14,18 @@ class HTMLPurifier_AttrDef_CSS_Composite extends HTMLPurifier_AttrDef
     
     /**
      * List of HTMLPurifier_AttrDef objects that may process strings
-     * @protected
+     * @todo Make protected
      */
-    var $defs;
+    public $defs;
     
     /**
      * @param $defs List of HTMLPurifier_AttrDef objects
      */
-    function HTMLPurifier_AttrDef_CSS_Composite($defs) {
+    public function __construct($defs) {
         $this->defs = $defs;
     }
     
-    function validate($string, $config, &$context) {
+    public function validate($string, $config, $context) {
         foreach ($this->defs as $i => $def) {
             $result = $this->defs[$i]->validate($string, $config, $context);
             if ($result !== false) return $result;

library/HTMLPurifier/AttrDef/CSS/DenyElementDecorator.php

@@ -0,0 +1,26 @@
+<?php
+
+/**
+ * Decorator which enables CSS properties to be disabled for specific elements.
+ */
+class HTMLPurifier_AttrDef_CSS_DenyElementDecorator extends HTMLPurifier_AttrDef
+{
+    protected $def, $element;
+    
+    /**
+     * @param $def Definition to wrap
+     * @param $element Element to deny
+     */
+    public function __construct($def, $element) {
+        $this->def = $def;
+        $this->element = $element;
+    }
+    /**
+     * Checks if CurrentToken is set and equal to $this->element
+     */
+    public function validate($string, $config, $context) {
+        $token = $context->get('CurrentToken', true);
+        if ($token && $token->name == $this->element) return false;
+        return $this->def->validate($string, $config, $context);
+    }
+}

library/HTMLPurifier/AttrDef/CSS/Filter.php

@@ -0,0 +1,52 @@
+<?php
+
+/**
+ * Microsoft's proprietary filter: CSS property
+ * @note Currently supports the alpha filter. In the future, this will
+ *       probably need an extensible framework
+ */
+class HTMLPurifier_AttrDef_CSS_Filter extends HTMLPurifier_AttrDef
+{
+    
+    protected $intValidator;
+    
+    public function __construct() {
+        $this->intValidator = new HTMLPurifier_AttrDef_Integer();
+    }
+    
+    public function validate($value, $config, $context) {
+        $value = $this->parseCDATA($value);
+        if ($value === 'none') return $value;
+        // if we looped this we could support multiple filters
+        $function_length = strcspn($value, '(');
+        $function = trim(substr($value, 0, $function_length));
+        if ($function !== 'alpha' &&
+            $function !== 'Alpha' &&
+            $function !== 'progid:DXImageTransform.Microsoft.Alpha'
+            ) return false;
+        $cursor = $function_length + 1;
+        $parameters_length = strcspn($value, ')', $cursor);
+        $parameters = substr($value, $cursor, $parameters_length);
+        $params = explode(',', $parameters);
+        $ret_params = array();
+        $lookup = array();
+        foreach ($params as $param) {
+            list($key, $value) = explode('=', $param);
+            $key   = trim($key);
+            $value = trim($value);
+            if (isset($lookup[$key])) continue;
+            if ($key !== 'opacity') continue;
+            $value = $this->intValidator->validate($value, $config, $context);
+            if ($value === false) continue;
+            $int = (int) $value;
+            if ($int > 100) $value = '100';
+            if ($int < 0) $value = '0';
+            $ret_params[] = "$key=$value";
+            $lookup[$key] = true;
+        }
+        $ret_parameters = implode(',', $ret_params);
+        $ret_function = "$function($ret_parameters)";
+        return $ret_function;
+    }
+    
+}

library/HTMLPurifier/AttrDef/CSS/Font.php

@@ -1,7 +1,5 @@
 <?php
 
-require_once 'HTMLPurifier/AttrDef.php';
-
 /**
  * Validates shorthand CSS property font.
  */
@@ -16,9 +14,9 @@ class HTMLPurifier_AttrDef_CSS_Font extends HTMLPurifier_AttrDef
      *       CSSDefinition, this wouldn't be necessary.  We'd instantiate
      *       our own copies.
      */
-    var $info = array();
+    protected $info = array();
     
-    function HTMLPurifier_AttrDef_CSS_Font($config) {
+    public function __construct($config) {
         $def = $config->getCSSDefinition();
         $this->info['font-style']   = $def->info['font-style'];
         $this->info['font-variant'] = $def->info['font-variant'];
@@ -28,7 +26,7 @@ class HTMLPurifier_AttrDef_CSS_Font extends HTMLPurifier_AttrDef
         $this->info['font-family']  = $def->info['font-family'];
     }
     
-    function validate($string, $config, &$context) {
+    public function validate($string, $config, $context) {
         
         static $system_fonts = array(
             'caption' => true,

library/HTMLPurifier/AttrDef/CSS/FontFamily.php

@@ -1,16 +1,13 @@
 <?php
 
-require_once 'HTMLPurifier/AttrDef.php';
-
-// whitelisting allowed fonts would be nice
-
 /**
  * Validates a font family list according to CSS spec
+ * @todo whitelisting allowed fonts would be nice
  */
 class HTMLPurifier_AttrDef_CSS_FontFamily extends HTMLPurifier_AttrDef
 {
     
-    function validate($string, $config, &$context) {
+    public function validate($string, $config, $context) {
         static $generic_names = array(
             'serif' => true,
             'sans-serif' => true,

library/HTMLPurifier/AttrDef/CSS/ImportantDecorator.php

@@ -0,0 +1,38 @@
+<?php
+
+/**
+ * Decorator which enables !important to be used in CSS values.
+ */
+class HTMLPurifier_AttrDef_CSS_ImportantDecorator extends HTMLPurifier_AttrDef
+{
+    protected $def, $allow;
+    
+    /**
+     * @param $def Definition to wrap
+     * @param $allow Whether or not to allow !important
+     */
+    public function __construct($def, $allow = false) {
+        $this->def = $def;
+        $this->allow = $allow;
+    }
+    /**
+     * Intercepts and removes !important if necessary
+     */
+    public function validate($string, $config, $context) {
+        // test for ! and important tokens
+        $string = trim($string);
+        $is_important = false;
+        // :TODO: optimization: test directly for !important and ! important
+        if (strlen($string) >= 9 && substr($string, -9) === 'important') {
+            $temp = rtrim(substr($string, 0, -9));
+            // use a temp, because we might want to restore important
+            if (strlen($temp) >= 1 && substr($temp, -1) === '!') {
+                $string = rtrim(substr($temp, 0, -1));
+                $is_important = true;
+            }
+        }
+        $string = $this->def->validate($string, $config, $context);
+        if ($this->allow && $is_important) $string .= ' !important';
+        return $string;
+    }
+}

library/HTMLPurifier/AttrDef/CSS/Length.php

@@ -1,8 +1,5 @@
 <?php
 
-require_once 'HTMLPurifier/AttrDef.php';
-require_once 'HTMLPurifier/AttrDef/CSS/Number.php';
-
 /**
  * Represents a Length as defined by CSS.
  */
@@ -14,22 +11,22 @@ class HTMLPurifier_AttrDef_CSS_Length extends HTMLPurifier_AttrDef
      * @warning The code assumes all units are two characters long.  Be careful
      *          if we have to change this behavior!
      */
-    var $units = array('em' => true, 'ex' => true, 'px' => true, 'in' => true,
+    protected $units = array('em' => true, 'ex' => true, 'px' => true, 'in' => true,
          'cm' => true, 'mm' => true, 'pt' => true, 'pc' => true);
     /**
      * Instance of HTMLPurifier_AttrDef_Number to defer number validation to
      */
-    var $number_def;
+    protected $number_def;
     
     /**
      * @param $non_negative Bool indication whether or not negative values are
      *                      allowed.
      */
-    function HTMLPurifier_AttrDef_CSS_Length($non_negative = false) {
+    public function __construct($non_negative = false) {
         $this->number_def = new HTMLPurifier_AttrDef_CSS_Number($non_negative);
     }
     
-    function validate($length, $config, &$context) {
+    public function validate($length, $config, $context) {
         
         $length = $this->parseCDATA($length);
         if ($length === '') return false;

library/HTMLPurifier/AttrDef/CSS/ListStyle.php

@@ -1,7 +1,5 @@
 <?php
 
-require_once 'HTMLPurifier/AttrDef.php';
-
 /**
  * Validates shorthand CSS property list-style.
  * @warning Does not support url tokens that have internal spaces.
@@ -13,16 +11,16 @@ class HTMLPurifier_AttrDef_CSS_ListStyle extends HTMLPurifier_AttrDef
      * Local copy of component validators.
      * @note See HTMLPurifier_AttrDef_CSS_Font::$info for a similar impl.
      */
-    var $info;
+    protected $info;
     
-    function HTMLPurifier_AttrDef_CSS_ListStyle($config) {
+    public function __construct($config) {
         $def = $config->getCSSDefinition();
         $this->info['list-style-type']     = $def->info['list-style-type'];
         $this->info['list-style-position'] = $def->info['list-style-position'];
         $this->info['list-style-image'] = $def->info['list-style-image'];
     }
     
-    function validate($string, $config, &$context) {
+    public function validate($string, $config, $context) {
         
         // regular pre-processing
         $string = $this->parseCDATA($string);

library/HTMLPurifier/AttrDef/CSS/Multiple.php

@@ -1,7 +1,5 @@
 <?php
 
-require_once 'HTMLPurifier/AttrDef.php';
-
 /**
  * Framework class for strings that involve multiple values.
  * 
@@ -18,24 +16,26 @@ class HTMLPurifier_AttrDef_CSS_Multiple extends HTMLPurifier_AttrDef
     
     /**
      * Instance of component definition to defer validation to.
+     * @todo Make protected
      */
-    var $single;
+    public $single;
     
     /**
      * Max number of values allowed.
+     * @todo Make protected
      */
-    var $max;
+    public $max;
     
     /**
      * @param $single HTMLPurifier_AttrDef to multiply
      * @param $max Max number of values allowed (usually four)
      */
-    function HTMLPurifier_AttrDef_CSS_Multiple($single, $max = 4) {
+    public function __construct($single, $max = 4) {
         $this->single = $single;
         $this->max = $max;
     }
     
-    function validate($string, $config, &$context) {
+    public function validate($string, $config, $context) {
         $string = $this->parseCDATA($string);
         if ($string === '') return false;
         $parts = explode(' ', $string); // parseCDATA replaced \r, \t and \n

library/HTMLPurifier/AttrDef/CSS/Number.php

@@ -9,20 +9,21 @@ class HTMLPurifier_AttrDef_CSS_Number extends HTMLPurifier_AttrDef
     /**
      * Bool indicating whether or not only positive values allowed.
      */
-    var $non_negative = false;
+    protected $non_negative = false;
     
     /**
      * @param $non_negative Bool indicating whether negatives are forbidden
      */
-    function HTMLPurifier_AttrDef_CSS_Number($non_negative = false) {
+    public function __construct($non_negative = false) {
         $this->non_negative = $non_negative;
     }
     
-    function validate($number, $config, &$context) {
+    public function validate($number, $config, $context) {
         
         $number = $this->parseCDATA($number);
         
         if ($number === '') return false;
+        if ($number === '0') return '0';
         
         $sign = '';
         switch ($number[0]) {
@@ -37,13 +38,16 @@ class HTMLPurifier_AttrDef_CSS_Number extends HTMLPurifier_AttrDef
             $number = ltrim($number, '0');
             return $number ? $sign . $number : '0';
         }
-        if (!strpos($number, '.')) return false;
+        
+        // Period is the only non-numeric character allowed
+        if (strpos($number, '.') === false) return false;
         
         list($left, $right) = explode('.', $number, 2);
         
-        if (!ctype_digit($left)) return false;
-        $left = ltrim($left, '0');
+        if ($left === '' && $right === '') return false;
+        if ($left !== '' && !ctype_digit($left)) return false;
         
+        $left  = ltrim($left,  '0');
         $right = rtrim($right, '0');
         
         if ($right === '') {

library/HTMLPurifier/AttrDef/CSS/Percentage.php

@@ -1,8 +1,5 @@
 <?php
 
-require_once 'HTMLPurifier/AttrDef.php';
-require_once 'HTMLPurifier/AttrDef/CSS/Number.php';
-
 /**
  * Validates a Percentage as defined by the CSS spec.
  */
@@ -12,16 +9,16 @@ class HTMLPurifier_AttrDef_CSS_Percentage extends HTMLPurifier_AttrDef
     /**
      * Instance of HTMLPurifier_AttrDef_CSS_Number to defer number validation
      */
-    var $number_def;
+    protected $number_def;
     
     /**
      * @param Bool indicating whether to forbid negative values
      */
-    function HTMLPurifier_AttrDef_CSS_Percentage($non_negative = false) {
+    public function __construct($non_negative = false) {
         $this->number_def = new HTMLPurifier_AttrDef_CSS_Number($non_negative);
     }
     
-    function validate($string, $config, &$context) {
+    public function validate($string, $config, $context) {
         
         $string = $this->parseCDATA($string);
         

library/HTMLPurifier/AttrDef/CSS/TextDecoration.php

@@ -1,7 +1,5 @@
 <?php
 
-require_once 'HTMLPurifier/AttrDef.php';
-
 /**
  * Validates the value for the CSS property text-decoration
  * @note This class could be generalized into a version that acts sort of
@@ -10,7 +8,7 @@ require_once 'HTMLPurifier/AttrDef.php';
 class HTMLPurifier_AttrDef_CSS_TextDecoration extends HTMLPurifier_AttrDef
 {
     
-    function validate($string, $config, &$context) {
+    public function validate($string, $config, $context) {
         
         static $allowed_values = array(
             'line-through' => true,

library/HTMLPurifier/AttrDef/CSS/URI.php

@@ -1,7 +1,5 @@
 <?php
 
-require_once 'HTMLPurifier/AttrDef/URI.php';
-
 /**
  * Validates a URI in CSS syntax, which uses url('http://example.com')
  * @note While theoretically speaking a URI in a CSS document could
@@ -14,11 +12,11 @@ require_once 'HTMLPurifier/AttrDef/URI.php';
 class HTMLPurifier_AttrDef_CSS_URI extends HTMLPurifier_AttrDef_URI
 {
     
-    function HTMLPurifier_AttrDef_CSS_URI() {
-        parent::HTMLPurifier_AttrDef_URI(true); // always embedded
+    public function __construct() {
+        parent::__construct(true); // always embedded
     }
     
-    function validate($uri_string, $config, &$context) {
+    public function validate($uri_string, $config, $context) {
         // parse the URI out of the string and then pass it onto
         // the parent object
         

library/HTMLPurifier/AttrDef/Enum.php

@@ -1,7 +1,5 @@
 <?php
 
-require_once 'HTMLPurifier/AttrDef.php';
-
 // Enum = Enumerated
 /**
  * Validates a keyword against a list of valid values.
@@ -14,27 +12,28 @@ class HTMLPurifier_AttrDef_Enum extends HTMLPurifier_AttrDef
     
     /**
      * Lookup table of valid values.
+     * @todo Make protected
      */
-    var $valid_values   = array();
+    public $valid_values   = array();
     
     /**
      * Bool indicating whether or not enumeration is case sensitive.
      * @note In general this is always case insensitive.
      */
-    var $case_sensitive = false; // values according to W3C spec
+    protected $case_sensitive = false; // values according to W3C spec
     
     /**
      * @param $valid_values List of valid values
      * @param $case_sensitive Bool indicating whether or not case sensitive
      */
-    function HTMLPurifier_AttrDef_Enum(
+    public function __construct(
         $valid_values = array(), $case_sensitive = false
     ) {
         $this->valid_values = array_flip($valid_values);
         $this->case_sensitive = $case_sensitive;
     }
     
-    function validate($string, $config, &$context) {
+    public function validate($string, $config, $context) {
         $string = trim($string);
         if (!$this->case_sensitive) {
             // we may want to do full case-insensitive libraries
@@ -50,7 +49,7 @@ class HTMLPurifier_AttrDef_Enum extends HTMLPurifier_AttrDef
      *      valid values. Example: "foo,bar,baz". Prepend "s:" to make
      *      case sensitive
      */
-    function make($string) {
+    public function make($string) {
         if (strlen($string) > 2 && $string[0] == 's' && $string[1] == ':') {
             $string = substr($string, 2);
             $sensitive = true;

library/HTMLPurifier/AttrDef/HTML/Bool.php

@@ -1,19 +1,17 @@
 <?php
 
-require_once 'HTMLPurifier/AttrDef.php';
-
 /**
  * Validates a boolean attribute
  */
 class HTMLPurifier_AttrDef_HTML_Bool extends HTMLPurifier_AttrDef
 {
     
-    var $name;
-    var $minimized = true;
+    protected $name;
+    public $minimized = true;
     
-    function HTMLPurifier_AttrDef_HTML_Bool($name = false) {$this->name = $name;}
+    public function __construct($name = false) {$this->name = $name;}
     
-    function validate($string, $config, &$context) {
+    public function validate($string, $config, $context) {
         if (empty($string)) return false;
         return $this->name;
     }
@@ -21,7 +19,7 @@ class HTMLPurifier_AttrDef_HTML_Bool extends HTMLPurifier_AttrDef
     /**
      * @param $string Name of attribute
      */
-    function make($string) {
+    public function make($string) {
         return new HTMLPurifier_AttrDef_HTML_Bool($string);
     }
     

library/HTMLPurifier/AttrDef/HTML/Color.php

@@ -1,15 +1,12 @@
 <?php
 
-require_once 'HTMLPurifier/AttrDef.php';
-require_once 'HTMLPurifier/AttrDef/CSS/Color.php'; // for %Core.ColorKeywords
-
 /**
  * Validates a color according to the HTML spec.
  */
 class HTMLPurifier_AttrDef_HTML_Color extends HTMLPurifier_AttrDef
 {
     
-    function validate($string, $config, &$context) {
+    public function validate($string, $config, $context) {
         
         static $colors = null;
         if ($colors === null) $colors = $config->get('Core', 'ColorKeywords');

library/HTMLPurifier/AttrDef/HTML/FrameTarget.php

@@ -1,30 +1,17 @@
 <?php
 
-HTMLPurifier_ConfigSchema::define(
-    'Attr', 'AllowedFrameTargets', array(), 'lookup',
-    'Lookup table of all allowed link frame targets.  Some commonly used '.
-    'link targets include _blank, _self, _parent and _top. Values should '.
-    'be lowercase, as validation will be done in a case-sensitive manner '.
-    'despite W3C\'s recommendation. XHTML 1.0 Strict does not permit '.
-    'the target attribute so this directive will have no effect in that '.
-    'doctype. XHTML 1.1 does not enable the Target module by default, you '.
-    'will have to manually enable it (see the module documentation for more details.)'
-);
-
-require_once 'HTMLPurifier/AttrDef/Enum.php';
-
 /**
  * Special-case enum attribute definition that lazy loads allowed frame targets
  */
 class HTMLPurifier_AttrDef_HTML_FrameTarget extends HTMLPurifier_AttrDef_Enum
 {
     
-    var $valid_values = false; // uninitialized value
-    var $case_sensitive = false;
+    public $valid_values = false; // uninitialized value
+    protected $case_sensitive = false;
     
-    function HTMLPurifier_AttrDef_HTML_FrameTarget() {}
+    public function __construct() {}
     
-    function validate($string, $config, &$context) {
+    public function validate($string, $config, $context) {
         if ($this->valid_values === false) $this->valid_values = $config->get('Attr', 'AllowedFrameTargets');
         return parent::validate($string, $config, $context);
     }

library/HTMLPurifier/AttrDef/HTML/ID.php

@@ -1,56 +1,5 @@
 <?php
 
-require_once 'HTMLPurifier/AttrDef.php';
-require_once 'HTMLPurifier/IDAccumulator.php';
-
-HTMLPurifier_ConfigSchema::define(
-    'Attr', 'EnableID', false, 'bool',
-    'Allows the ID attribute in HTML.  This is disabled by default '.
-    'due to the fact that without proper configuration user input can '.
-    'easily break the validation of a webpage by specifying an ID that is '.
-    'already on the surrounding HTML.  If you don\'t mind throwing caution to '.
-    'the wind, enable this directive, but I strongly recommend you also '.
-    'consider blacklisting IDs you use (%Attr.IDBlacklist) or prefixing all '.
-    'user supplied IDs (%Attr.IDPrefix).  This directive has been available '.
-    'since 1.2.0, and when set to true reverts to the behavior of pre-1.2.0 '.
-    'versions.'
-);
-HTMLPurifier_ConfigSchema::defineAlias(
-    'HTML', 'EnableAttrID', 'Attr', 'EnableID'
-);
-
-HTMLPurifier_ConfigSchema::define(
-    'Attr', 'IDPrefix', '', 'string',
-    'String to prefix to IDs.  If you have no idea what IDs your pages '.
-    'may use, you may opt to simply add a prefix to all user-submitted ID '.
-    'attributes so that they are still usable, but will not conflict with '.
-    'core page IDs. Example: setting the directive to \'user_\' will result in '.
-    'a user submitted \'foo\' to become \'user_foo\'  Be sure to set '.
-    '%HTML.EnableAttrID to true before using '.
-    'this.  This directive was available since 1.2.0.'
-);
-
-HTMLPurifier_ConfigSchema::define(
-    'Attr', 'IDPrefixLocal', '', 'string',
-    'Temporary prefix for IDs used in conjunction with %Attr.IDPrefix.  If '.
-    'you need to allow multiple sets of '.
-    'user content on web page, you may need to have a seperate prefix that '.
-    'changes with each iteration.  This way, seperately submitted user content '.
-    'displayed on the same page doesn\'t clobber each other. Ideal values '.
-    'are unique identifiers for the content it represents (i.e. the id of '.
-    'the row in the database). Be sure to add a seperator (like an underscore) '.
-    'at the end.  Warning: this directive will not work unless %Attr.IDPrefix '.
-    'is set to a non-empty value! This directive was available since 1.2.0.'
-);
-
-HTMLPurifier_ConfigSchema::define(
-    'Attr', 'IDBlacklistRegexp', null, 'string/null',
-    'PCRE regular expression to be matched against all IDs. If the expression '.
-    'is matches, the ID is rejected. Use this with care: may cause '.
-    'significant degradation. ID matching is done after all other '.
-    'validation. This directive was available since 1.6.0.'
-);
-
 /**
  * Validates the HTML attribute ID.
  * @warning Even though this is the id processor, it
@@ -66,7 +15,7 @@ class HTMLPurifier_AttrDef_HTML_ID extends HTMLPurifier_AttrDef
     // ref functionality disabled, since we also have to verify
     // whether or not the ID it refers to exists
     
-    function validate($id, $config, &$context) {
+    public function validate($id, $config, $context) {
         
         if (!$config->get('Attr', 'EnableID')) return false;
         

library/HTMLPurifier/AttrDef/HTML/Length.php

@@ -1,8 +1,5 @@
 <?php
 
-require_once 'HTMLPurifier/AttrDef.php';
-require_once 'HTMLPurifier/AttrDef/HTML/Pixels.php';
-
 /**
  * Validates the HTML type length (not to be confused with CSS's length).
  * 
@@ -13,7 +10,7 @@ require_once 'HTMLPurifier/AttrDef/HTML/Pixels.php';
 class HTMLPurifier_AttrDef_HTML_Length extends HTMLPurifier_AttrDef_HTML_Pixels
 {
     
-    function validate($string, $config, &$context) {
+    public function validate($string, $config, $context) {
         
         $string = trim($string);
         if ($string === '') return false;

library/HTMLPurifier/AttrDef/HTML/LinkTypes.php

@@ -1,22 +1,5 @@
 <?php
 
-require_once 'HTMLPurifier/AttrDef.php';
-
-HTMLPurifier_ConfigSchema::define(
-    'Attr', 'AllowedRel', array(), 'lookup',
-    'List of allowed forward document relationships in the rel attribute. '.
-    'Common values may be nofollow or print. By default, this is empty, '.
-    'meaning that no document relationships are allowed. This directive '.
-    'was available since 1.6.0.'
-);
-
-HTMLPurifier_ConfigSchema::define(
-    'Attr', 'AllowedRev', array(), 'lookup',
-    'List of allowed reverse document relationships in the rev attribute. '.
-    'This attribute is a bit of an edge-case; if you don\'t know what it '.
-    'is for, stay away. This directive was available since 1.6.0.'
-);
-
 /**
  * Validates a rel/rev link attribute against a directive of allowed values
  * @note We cannot use Enum because link types allow multiple
@@ -27,9 +10,9 @@ class HTMLPurifier_AttrDef_HTML_LinkTypes extends HTMLPurifier_AttrDef
 {
     
     /** Name config attribute to pull. */
-    var $name;
+    protected $name;
     
-    function HTMLPurifier_AttrDef_HTML_LinkTypes($name) {
+    public function __construct($name) {
         $configLookup = array(
             'rel' => 'AllowedRel',
             'rev' => 'AllowedRev'
@@ -42,7 +25,7 @@ class HTMLPurifier_AttrDef_HTML_LinkTypes extends HTMLPurifier_AttrDef
         $this->name = $configLookup[$name];
     }
     
-    function validate($string, $config, &$context) {
+    public function validate($string, $config, $context) {
         
         $allowed = $config->get('Attr', $this->name);
         if (empty($allowed)) return false;

library/HTMLPurifier/AttrDef/HTML/MultiLength.php

@@ -1,8 +1,5 @@
 <?php
 
-require_once 'HTMLPurifier/AttrDef.php';
-require_once 'HTMLPurifier/AttrDef/HTML/Length.php';
-
 /**
  * Validates a MultiLength as defined by the HTML spec.
  * 
@@ -12,7 +9,7 @@ require_once 'HTMLPurifier/AttrDef/HTML/Length.php';
 class HTMLPurifier_AttrDef_HTML_MultiLength extends HTMLPurifier_AttrDef_HTML_Length
 {
     
-    function validate($string, $config, &$context) {
+    public function validate($string, $config, $context) {
         
         $string = trim($string);
         if ($string === '') return false;

library/HTMLPurifier/AttrDef/HTML/Nmtokens.php

@@ -1,8 +1,5 @@
 <?php
 
-require_once 'HTMLPurifier/AttrDef.php';
-require_once 'HTMLPurifier/Config.php';
-
 /**
  * Validates contents based on NMTOKENS attribute type.
  * @note The only current use for this is the class attribute in HTML
@@ -13,7 +10,7 @@ require_once 'HTMLPurifier/Config.php';
 class HTMLPurifier_AttrDef_HTML_Nmtokens extends HTMLPurifier_AttrDef
 {
     
-    function validate($string, $config, &$context) {
+    public function validate($string, $config, $context) {
         
         $string = trim($string);
         

library/HTMLPurifier/AttrDef/HTML/Pixels.php

@@ -1,14 +1,12 @@
 <?php
 
-require_once 'HTMLPurifier/AttrDef.php';
-
 /**
  * Validates an integer representation of pixels according to the HTML spec.
  */
 class HTMLPurifier_AttrDef_HTML_Pixels extends HTMLPurifier_AttrDef
 {
     
-    function validate($string, $config, &$context) {
+    public function validate($string, $config, $context) {
         
         $string = trim($string);
         if ($string === '0') return $string;

library/HTMLPurifier/AttrDef/Integer.php

@@ -1,7 +1,5 @@
 <?php
 
-require_once 'HTMLPurifier/AttrDef.php';
-
 /**
  * Validates an integer.
  * @note While this class was modeled off the CSS definition, no currently
@@ -15,24 +13,24 @@ class HTMLPurifier_AttrDef_Integer extends HTMLPurifier_AttrDef
     /**
      * Bool indicating whether or not negative values are allowed
      */
-    var $negative = true;
+    protected $negative = true;
     
     /**
      * Bool indicating whether or not zero is allowed
      */
-    var $zero = true;
+    protected $zero = true;
     
     /**
      * Bool indicating whether or not positive values are allowed
      */
-    var $positive = true;
+    protected $positive = true;
     
     /**
      * @param $negative Bool indicating whether or not negative values are allowed
      * @param $zero Bool indicating whether or not zero is allowed
      * @param $positive Bool indicating whether or not positive values are allowed
      */
-    function HTMLPurifier_AttrDef_Integer(
+    public function __construct(
         $negative = true, $zero = true, $positive = true
     ) {
         $this->negative = $negative;
@@ -40,7 +38,7 @@ class HTMLPurifier_AttrDef_Integer extends HTMLPurifier_AttrDef
         $this->positive = $positive;
     }
     
-    function validate($integer, $config, &$context) {
+    public function validate($integer, $config, $context) {
         
         $integer = $this->parseCDATA($integer);
         if ($integer === '') return false;

library/HTMLPurifier/AttrDef/Lang.php

@@ -1,7 +1,5 @@
 <?php
 
-require_once 'HTMLPurifier/AttrDef.php';
-
 /**
  * Validates the HTML attribute lang, effectively a language code.
  * @note Built according to RFC 3066, which obsoleted RFC 1766
@@ -9,7 +7,7 @@ require_once 'HTMLPurifier/AttrDef.php';
 class HTMLPurifier_AttrDef_Lang extends HTMLPurifier_AttrDef
 {
     
-    function validate($string, $config, &$context) {
+    public function validate($string, $config, $context) {
         
         $string = trim($string);
         if (!$string) return false;

library/HTMLPurifier/AttrDef/Text.php

@@ -1,14 +1,12 @@
 <?php
 
-require_once 'HTMLPurifier/AttrDef.php';
-
 /**
  * Validates arbitrary text according to the HTML spec.
  */
 class HTMLPurifier_AttrDef_Text extends HTMLPurifier_AttrDef
 {
     
-    function validate($string, $config, &$context) {
+    public function validate($string, $config, $context) {
         return $this->parseCDATA($string);
     }
     

library/HTMLPurifier/AttrDef/URI.php

@@ -1,66 +1,5 @@
 <?php
 
-require_once 'HTMLPurifier/AttrDef.php';
-require_once 'HTMLPurifier/URIParser.php';
-require_once 'HTMLPurifier/URIScheme.php';
-require_once 'HTMLPurifier/URISchemeRegistry.php';
-require_once 'HTMLPurifier/AttrDef/URI/Host.php';
-require_once 'HTMLPurifier/PercentEncoder.php';
-require_once 'HTMLPurifier/AttrDef/URI/Email.php';
-
-// special case filtering directives 
-
-HTMLPurifier_ConfigSchema::define(
-    'URI', 'Munge', null, 'string/null', '
-<p>
-    Munges all browsable (usually http, https and ftp)
-    absolute URI\'s into another URI, usually a URI redirection service.
-    This directive accepts a URI, formatted with a <code>%s</code> where 
-    the url-encoded original URI should be inserted (sample: 
-    <code>http://www.google.com/url?q=%s</code>).
-</p>
-<p>
-    Uses for this directive:
-</p>
-<ul>
-    <li>
-        Prevent PageRank leaks, while being fairly transparent 
-        to users (you may also want to add some client side JavaScript to 
-        override the text in the statusbar). <strong>Notice</strong>:
-        Many security experts believe that this form of protection does not deter spam-bots. 
-    </li>
-    <li>
-        Redirect users to a splash page telling them they are leaving your
-        website. While this is poor usability practice, it is often mandated
-        in corporate environments.
-    </li>
-</ul>
-<p>
-    This directive has been available since 1.3.0.
-</p>
-');
-
-// disabling directives
-
-HTMLPurifier_ConfigSchema::define(
-    'URI', 'Disable', false, 'bool', '
-<p>
-    Disables all URIs in all forms. Not sure why you\'d want to do that 
-    (after all, the Internet\'s founded on the notion of a hyperlink). 
-    This directive has been available since 1.3.0.
-</p>
-');
-HTMLPurifier_ConfigSchema::defineAlias('Attr', 'DisableURI', 'URI', 'Disable');
-
-HTMLPurifier_ConfigSchema::define(
-    'URI', 'DisableResources', false, 'bool', '
-<p>
-    Disables embedding resources, essentially meaning no pictures. You can 
-    still link to them though. See %URI.DisableExternalResources for why 
-    this might be a good idea. This directive has been available since 1.3.0.
-</p>
-');
-
 /**
  * Validates a URI as defined by RFC 3986.
  * @note Scheme-specific mechanics deferred to HTMLPurifier_URIScheme
@@ -68,25 +7,22 @@ HTMLPurifier_ConfigSchema::define(
 class HTMLPurifier_AttrDef_URI extends HTMLPurifier_AttrDef
 {
     
-    var $parser, $percentEncoder;
-    var $embedsResource;
+    protected $parser;
+    protected $embedsResource;
     
     /**
      * @param $embeds_resource_resource Does the URI here result in an extra HTTP request?
      */
-    function HTMLPurifier_AttrDef_URI($embeds_resource = false) {
+    public function __construct($embeds_resource = false) {
         $this->parser = new HTMLPurifier_URIParser();
-        $this->percentEncoder = new HTMLPurifier_PercentEncoder();
         $this->embedsResource = (bool) $embeds_resource;
     }
     
-    function validate($uri, $config, &$context) {
+    public function validate($uri, $config, $context) {
         
         if ($config->get('URI', 'Disable')) return false;
         
-        // initial operations
         $uri = $this->parseCDATA($uri);
-        $uri = $this->percentEncoder->normalize($uri);
         
         // parse the URI
         $uri = $this->parser->parse($uri);
@@ -103,7 +39,7 @@ class HTMLPurifier_AttrDef_URI extends HTMLPurifier_AttrDef
             if (!$result) break;
             
             // chained filtering
-            $uri_def =& $config->getDefinition('URI');
+            $uri_def = $config->getDefinition('URI');
             $result = $uri_def->filter($uri, $config, $context);
             if (!$result) break;
             
@@ -122,13 +58,6 @@ class HTMLPurifier_AttrDef_URI extends HTMLPurifier_AttrDef
         $context->destroy('EmbeddedURI');
         if (!$ok) return false;
         
-        // munge scheme off if necessary (this must be last)
-        if (!is_null($uri->scheme) && is_null($uri->host)) {
-            if ($uri_def->defaultScheme == $uri->scheme) {
-                $uri->scheme = null;
-            }
-        }
-        
         // back to string
         $result = $uri->toString();
         

library/HTMLPurifier/AttrDef/URI/Email.php

@@ -1,8 +1,6 @@
 <?php
 
-require_once 'HTMLPurifier/AttrDef.php';
-
-class HTMLPurifier_AttrDef_URI_Email extends HTMLPurifier_AttrDef
+abstract class HTMLPurifier_AttrDef_URI_Email extends HTMLPurifier_AttrDef
 {
     
     /**
@@ -15,4 +13,3 @@ class HTMLPurifier_AttrDef_URI_Email extends HTMLPurifier_AttrDef
 }
 
 // sub-implementations
-require_once 'HTMLPurifier/AttrDef/URI/Email/SimpleCheck.php';

library/HTMLPurifier/AttrDef/URI/Email/SimpleCheck.php

@@ -1,7 +1,5 @@
 <?php
 
-require_once 'HTMLPurifier/AttrDef/URI/Email.php';
-
 /**
  * Primitive email validation class based on the regexp found at 
  * http://www.regular-expressions.info/email.html
@@ -9,7 +7,7 @@ require_once 'HTMLPurifier/AttrDef/URI/Email.php';
 class HTMLPurifier_AttrDef_URI_Email_SimpleCheck extends HTMLPurifier_AttrDef_URI_Email
 {
     
-    function validate($string, $config, &$context) {
+    public function validate($string, $config, $context) {
         // no support for named mailboxes i.e. "Bob <bob@example.com>"
         // that needs more percent encoding to be done
         if ($string == '') return false;

library/HTMLPurifier/AttrDef/URI/Host.php

@@ -1,9 +1,5 @@
 <?php
 
-require_once 'HTMLPurifier/AttrDef.php';
-require_once 'HTMLPurifier/AttrDef/URI/IPv4.php';
-require_once 'HTMLPurifier/AttrDef/URI/IPv6.php';
-
 /**
  * Validates a host according to the IPv4, IPv6 and DNS (future) specifications.
  */
@@ -13,19 +9,19 @@ class HTMLPurifier_AttrDef_URI_Host extends HTMLPurifier_AttrDef
     /**
      * Instance of HTMLPurifier_AttrDef_URI_IPv4 sub-validator
      */
-    var $ipv4;
+    protected $ipv4;
     
     /**
      * Instance of HTMLPurifier_AttrDef_URI_IPv6 sub-validator
      */
-    var $ipv6;
+    protected $ipv6;
     
-    function HTMLPurifier_AttrDef_URI_Host() {
+    public function __construct() {
         $this->ipv4 = new HTMLPurifier_AttrDef_URI_IPv4();
         $this->ipv6 = new HTMLPurifier_AttrDef_URI_IPv6();
     }
     
-    function validate($string, $config, &$context) {
+    public function validate($string, $config, $context) {
         $length = strlen($string);
         if ($string === '') return '';
         if ($length > 1 && $string[0] === '[' && $string[$length-1] === ']') {
@@ -40,11 +36,23 @@ class HTMLPurifier_AttrDef_URI_Host extends HTMLPurifier_AttrDef
         $ipv4 = $this->ipv4->validate($string, $config, $context);
         if ($ipv4 !== false) return $ipv4;
         
-        // validate a domain name here, do filtering, etc etc etc
+        // A regular domain name.
         
-        // We could use this, but it would break I18N domain names
-        //$match = preg_match('/^[a-z0-9][\w\-\.]*[a-z0-9]$/i', $string);
-        //if (!$match) return false;
+        // This breaks I18N domain names, but we don't have proper IRI support,
+        // so force users to insert Punycode. If there's complaining we'll 
+        // try to fix things into an international friendly form.
+        
+        // The productions describing this are:
+        $a   = '[a-z]';     // alpha
+        $an  = '[a-z0-9]';  // alphanum
+        $and = '[a-z0-9-]'; // alphanum | "-"
+        // domainlabel = alphanum | alphanum *( alphanum | "-" ) alphanum
+        $domainlabel   = "$an($and*$an)?";
+        // toplabel    = alpha | alpha *( alphanum | "-" ) alphanum
+        $toplabel      = "$a($and*$an)?";
+        // hostname    = *( domainlabel "." ) toplabel [ "." ]
+        $match = preg_match("/^($domainlabel\.)*$toplabel\.?$/i", $string);
+        if (!$match) return false;
         
         return $string;
     }

library/HTMLPurifier/AttrDef/URI/IPv4.php

@@ -1,7 +1,5 @@
 <?php
 
-require_once 'HTMLPurifier/AttrDef.php';
-
 /**
  * Validates an IPv4 address
  * @author Feyd @ forums.devnetwork.net (public domain)
@@ -11,11 +9,10 @@ class HTMLPurifier_AttrDef_URI_IPv4 extends HTMLPurifier_AttrDef
     
     /**
      * IPv4 regex, protected so that IPv6 can reuse it
-     * @protected
      */
-    var $ip4;
+    protected $ip4;
     
-    function validate($aIP, $config, &$context) {
+    public function validate($aIP, $config, $context) {
         
         if (!$this->ip4) $this->_loadRegex();
         
@@ -32,7 +29,7 @@ class HTMLPurifier_AttrDef_URI_IPv4 extends HTMLPurifier_AttrDef
      * Lazy load function to prevent regex from being stuffed in
      * cache.
      */
-    function _loadRegex() {
+    protected function _loadRegex() {
         $oct = '(?:25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9][0-9]|[0-9])'; // 0-255
         $this->ip4 = "(?:{$oct}\\.{$oct}\\.{$oct}\\.{$oct})";
     }

library/HTMLPurifier/AttrDef/URI/IPv6.php

@@ -1,7 +1,5 @@
 <?php
 
-require_once 'HTMLPurifier/AttrDef/URI/IPv4.php';
-
 /**
  * Validates an IPv6 address.
  * @author Feyd @ forums.devnetwork.net (public domain)
@@ -11,7 +9,7 @@ require_once 'HTMLPurifier/AttrDef/URI/IPv4.php';
 class HTMLPurifier_AttrDef_URI_IPv6 extends HTMLPurifier_AttrDef_URI_IPv4
 {
     
-    function validate($aIP, $config, &$context) {
+    public function validate($aIP, $config, $context) {
         
         if (!$this->ip4) $this->_loadRegex();
         

library/HTMLPurifier/AttrTransform.php

@@ -14,7 +14,7 @@
  * more details.
  */
 
-class HTMLPurifier_AttrTransform
+abstract class HTMLPurifier_AttrTransform
 {
     
     /**
@@ -26,9 +26,7 @@ class HTMLPurifier_AttrTransform
      * @param $context Mandatory HTMLPurifier_Context object
      * @returns Processed attribute array.
      */
-    function transform($attr, $config, &$context) {
-        trigger_error('Cannot call abstract function', E_USER_ERROR);
-    }
+    abstract public function transform($attr, $config, $context);
     
     /**
      * Prepends CSS properties to the style attribute, creating the
@@ -36,7 +34,7 @@ class HTMLPurifier_AttrTransform
      * @param $attr Attribute array to process (passed by reference)
      * @param $css CSS to prepend
      */
-    function prependCSS(&$attr, $css) {
+    public function prependCSS(&$attr, $css) {
         $attr['style'] = isset($attr['style']) ? $attr['style'] : '';
         $attr['style'] = $css . $attr['style'];
     }
@@ -46,7 +44,7 @@ class HTMLPurifier_AttrTransform
      * @param $attr Attribute array to process (passed by reference)
      * @param $key Key of attribute to confiscate
      */
-    function confiscateAttr(&$attr, $key) {
+    public function confiscateAttr(&$attr, $key) {
         if (!isset($attr[$key])) return null;
         $value = $attr[$key];
         unset($attr[$key]);

library/HTMLPurifier/AttrTransform/BdoDir.php

@@ -1,26 +1,14 @@
 <?php
 
-require_once 'HTMLPurifier/AttrTransform.php';
-
 // this MUST be placed in post, as it assumes that any value in dir is valid
 
-HTMLPurifier_ConfigSchema::define(
-    'Attr', 'DefaultTextDir', 'ltr', 'string',
-    'Defines the default text direction (ltr or rtl) of the document '.
-    'being parsed.  This generally is the same as the value of the dir '.
-    'attribute in HTML, or ltr if that is not specified.'
-);
-HTMLPurifier_ConfigSchema::defineAllowedValues(
-    'Attr', 'DefaultTextDir', array( 'ltr', 'rtl' )
-);
-
 /**
  * Post-trasnform that ensures that bdo tags have the dir attribute set.
  */
 class HTMLPurifier_AttrTransform_BdoDir extends HTMLPurifier_AttrTransform
 {
     
-    function transform($attr, $config, &$context) {
+    public function transform($attr, $config, $context) {
         if (isset($attr['dir'])) return $attr;
         $attr['dir'] = $config->get('Attr', 'DefaultTextDir');
         return $attr;

library/HTMLPurifier/AttrTransform/BgColor.php

@@ -1,14 +1,11 @@
 <?php
 
-require_once 'HTMLPurifier/AttrTransform.php';
-
 /**
  * Pre-transform that changes deprecated bgcolor attribute to CSS.
  */
-class HTMLPurifier_AttrTransform_BgColor
-extends HTMLPurifier_AttrTransform {
+class HTMLPurifier_AttrTransform_BgColor extends HTMLPurifier_AttrTransform {
 
-    function transform($attr, $config, &$context) {
+    public function transform($attr, $config, $context) {
         
         if (!isset($attr['bgcolor'])) return $attr;
         

library/HTMLPurifier/AttrTransform/BoolToCSS.php

@@ -1,33 +1,30 @@
 <?php
 
-require_once 'HTMLPurifier/AttrTransform.php';
-
 /**
  * Pre-transform that changes converts a boolean attribute to fixed CSS
  */
-class HTMLPurifier_AttrTransform_BoolToCSS
-extends HTMLPurifier_AttrTransform {
+class HTMLPurifier_AttrTransform_BoolToCSS extends HTMLPurifier_AttrTransform {
     
     /**
      * Name of boolean attribute that is trigger
      */
-    var $attr;
+    protected $attr;
     
     /**
      * CSS declarations to add to style, needs trailing semicolon
      */
-    var $css;
+    protected $css;
     
     /**
      * @param $attr string attribute name to convert from
      * @param $css string CSS declarations to add to style (needs semicolon)
      */
-    function HTMLPurifier_AttrTransform_BoolToCSS($attr, $css) {
+    public function __construct($attr, $css) {
         $this->attr = $attr;
         $this->css  = $css;
     }
     
-    function transform($attr, $config, &$context) {
+    public function transform($attr, $config, $context) {
         if (!isset($attr[$this->attr])) return $attr;
         unset($attr[$this->attr]);
         $this->prependCSS($attr, $this->css);

library/HTMLPurifier/AttrTransform/Border.php

@@ -1,13 +1,11 @@
 <?php
 
-require_once 'HTMLPurifier/AttrTransform.php';
-
 /**
  * Pre-transform that changes deprecated border attribute to CSS.
  */
 class HTMLPurifier_AttrTransform_Border extends HTMLPurifier_AttrTransform {
 
-    function transform($attr, $config, &$context) {
+    public function transform($attr, $config, $context) {
         if (!isset($attr['border'])) return $attr;
         $border_width = $this->confiscateAttr($attr, 'border');
         // some validation should happen here

library/HTMLPurifier/AttrTransform/EnumToCSS.php

@@ -1,7 +1,5 @@
 <?php
 
-require_once 'HTMLPurifier/AttrTransform.php';
-
 /**
  * Generic pre-transform that converts an attribute with a fixed number of
  * values (enumerated) to CSS.
@@ -11,32 +9,32 @@ class HTMLPurifier_AttrTransform_EnumToCSS extends HTMLPurifier_AttrTransform {
     /**
      * Name of attribute to transform from
      */
-    var $attr;
+    protected $attr;
     
     /**
      * Lookup array of attribute values to CSS
      */
-    var $enumToCSS = array();
+    protected $enumToCSS = array();
     
     /**
      * Case sensitivity of the matching
      * @warning Currently can only be guaranteed to work with ASCII
      *          values.
      */
-    var $caseSensitive = false;
+    protected $caseSensitive = false;
     
     /**
      * @param $attr String attribute name to transform from
      * @param $enumToCSS Lookup array of attribute values to CSS
      * @param $case_sensitive Boolean case sensitivity indicator, default false
      */
-    function HTMLPurifier_AttrTransform_EnumToCSS($attr, $enum_to_css, $case_sensitive = false) {
+    public function __construct($attr, $enum_to_css, $case_sensitive = false) {
         $this->attr = $attr;
         $this->enumToCSS = $enum_to_css;
         $this->caseSensitive = (bool) $case_sensitive;
     }
     
-    function transform($attr, $config, &$context) {
+    public function transform($attr, $config, $context) {
         
         if (!isset($attr[$this->attr])) return $attr;
         

library/HTMLPurifier/AttrTransform/ImgRequired.php

@@ -1,24 +1,7 @@
 <?php
 
-require_once 'HTMLPurifier/AttrTransform.php';
-
 // must be called POST validation
 
-HTMLPurifier_ConfigSchema::define(
-    'Attr', 'DefaultInvalidImage', '', 'string',
-    'This is the default image an img tag will be pointed to if it does '.
-    'not have a valid src attribute.  In future versions, we may allow the '.
-    'image tag to be removed completely, but due to design issues, this is '.
-    'not possible right now.'
-);
-
-HTMLPurifier_ConfigSchema::define(
-    'Attr', 'DefaultInvalidImageAlt', 'Invalid image', 'string',
-    'This is the content of the alt tag of an invalid image if the user '.
-    'had not previously specified an alt attribute.  It has no effect when the '.
-    'image is valid but there was no alt attribute present.'
-);
-
 /**
  * Transform that supplies default values for the src and alt attributes
  * in img tags, as well as prevents the img tag from being removed
@@ -28,7 +11,7 @@ HTMLPurifier_ConfigSchema::define(
 class HTMLPurifier_AttrTransform_ImgRequired extends HTMLPurifier_AttrTransform
 {
     
-    function transform($attr, $config, &$context) {
+    public function transform($attr, $config, $context) {
         
         $src = true;
         if (!isset($attr['src'])) {

library/HTMLPurifier/AttrTransform/ImgSpace.php

@@ -1,27 +1,24 @@
 <?php
 
-require_once 'HTMLPurifier/AttrTransform.php';
-
 /**
  * Pre-transform that changes deprecated hspace and vspace attributes to CSS
  */
-class HTMLPurifier_AttrTransform_ImgSpace
-extends HTMLPurifier_AttrTransform {
+class HTMLPurifier_AttrTransform_ImgSpace extends HTMLPurifier_AttrTransform {
     
-    var $attr;
-    var $css = array(
+    protected $attr;
+    protected $css = array(
         'hspace' => array('left', 'right'),
         'vspace' => array('top', 'bottom')
     );
     
-    function HTMLPurifier_AttrTransform_ImgSpace($attr) {
+    public function __construct($attr) {
         $this->attr = $attr;
         if (!isset($this->css[$attr])) {
             trigger_error(htmlspecialchars($attr) . ' is not valid space attribute');
         }
     }
     
-    function transform($attr, $config, &$context) {
+    public function transform($attr, $config, $context) {
         
         if (!isset($attr[$this->attr])) return $attr;
         

library/HTMLPurifier/AttrTransform/Lang.php

@@ -1,7 +1,5 @@
 <?php
 
-require_once 'HTMLPurifier/AttrTransform.php';
-
 /**
  * Post-transform that copies lang's value to xml:lang (and vice-versa)
  * @note Theoretically speaking, this could be a pre-transform, but putting
@@ -10,7 +8,7 @@ require_once 'HTMLPurifier/AttrTransform.php';
 class HTMLPurifier_AttrTransform_Lang extends HTMLPurifier_AttrTransform
 {
     
-    function transform($attr, $config, &$context) {
+    public function transform($attr, $config, $context) {
         
         $lang     = isset($attr['lang']) ? $attr['lang'] : false;
         $xml_lang = isset($attr['xml:lang']) ? $attr['xml:lang'] : false;

library/HTMLPurifier/AttrTransform/Length.php

@@ -1,22 +1,20 @@
 <?php
 
-require_once 'HTMLPurifier/AttrTransform.php';
-
 /**
  * Class for handling width/height length attribute transformations to CSS
  */
 class HTMLPurifier_AttrTransform_Length extends HTMLPurifier_AttrTransform
 {
     
-    var $name;
-    var $cssName;
+    protected $name;
+    protected $cssName;
     
-    function HTMLPurifier_AttrTransform_Length($name, $css_name = null) {
+    public function __construct($name, $css_name = null) {
         $this->name = $name;
         $this->cssName = $css_name ? $css_name : $name;
     }
     
-    function transform($attr, $config, &$context) {
+    public function transform($attr, $config, $context) {
         if (!isset($attr[$this->name])) return $attr;
         $length = $this->confiscateAttr($attr, $this->name);
         if(ctype_digit($length)) $length .= 'px';

library/HTMLPurifier/AttrTransform/Name.php

@@ -1,14 +1,12 @@
 <?php
 
-require_once 'HTMLPurifier/AttrTransform.php';
-
 /**
  * Pre-transform that changes deprecated name attribute to ID if necessary
  */
 class HTMLPurifier_AttrTransform_Name extends HTMLPurifier_AttrTransform
 {
     
-    function transform($attr, $config, &$context) {
+    public function transform($attr, $config, $context) {
         if (!isset($attr['name'])) return $attr;
         $id = $this->confiscateAttr($attr, 'name');
         if ( isset($attr['id']))   return $attr;

library/HTMLPurifier/AttrTransform/ScriptRequired.php

@@ -0,0 +1,14 @@
+<?php
+
+/**
+ * Implements required attribute stipulation for <script>
+ */
+class HTMLPurifier_AttrTransform_ScriptRequired extends HTMLPurifier_AttrTransform
+{
+    public function transform($attr, $config, $context) {
+        if (!isset($attr['type'])) {
+            $attr['type'] = 'text/javascript';
+        }
+        return $attr;
+    }
+}