Release 4.13.0

Signed-off-by: Edward Z. Yang <ezyang@mit.edu>
Update changelog
2025-08-02 20:27:40 +02:00 · 2020-06-28 20:56:53 -04:00 · 2020-06-28 20:55:45 -04:00 · 2020-06-28 20:38:16 -04:00 · 2020-06-28 20:26:33 -04:00 · 2020-06-06 10:29:01 -04:00
80 changed files with 713 additions and 399 deletions
--- a/.gitattributes
+++ b/.gitattributes
@@ -1,13 +1,23 @@
 /.gitattributes export-ignore
 /.gitignore export-ignore
 /.travis.yml export-ignore
-/Doxyfile export-ignore
-/art/ export-ignore
-/benchmarks/ export-ignore
-/configdoc/ export-ignore
+/art export-ignore
+/benchmarks export-ignore
+/configdoc export-ignore
 /configdoc/usage.xml -crlf
-/docs/ export-ignore
-/phpdoc.ini
-/smoketests/ export-ignore
-/tests/* export-ignore
-/tests/path2class.func.php -export-ignore
+/docs export-ignore
+/Doxyfile export-ignore
+/extras export-ignore
+/INSTALL* export-ignore
+/maintenance export-ignore
+/NEWS export-ignore
+/package.php export-ignore
+/plugins export-ignore
+/phpdoc.ini export-ignore
+/smoketests export-ignore
+/test-* export-ignore
+/tests export-ignore
+/TODO export-ignore
+/update-for-release export-ignore
+/WHATSNEW export-ignore
+/WYSIWYG export-ignore
--- a/.travis.yml
+++ b/.travis.yml
@@ -1,9 +1,17 @@
 language: php
 php:
-    - '5.4'
-    - '5.5'
    - '5.6'
    - '7.0'
+    - '7.1'
+    - '7.2'
+    - '7.3'
+    - '7.4'
+matrix:
+    include:
+        - php: '5.4'
+          dist: trusty
+        - php: '5.5'
+          dist: trusty
 before_script:
    - git clone --depth=50 https://github.com/ezyang/simpletest.git
    - cp test-settings.travis.php test-settings.php
--- a/2
+++ b/2
@@ -31,7 +31,7 @@ PROJECT_NAME           = HTMLPurifier
 # This could be handy for archiving the generated documentation or
 # if some version control system is used.

-PROJECT_NUMBER         = 4.9.1
+PROJECT_NUMBER         = 4.13.0

 # The OUTPUT_DIRECTORY tag is used to specify the (relative or absolute)
 # base path where the generated documentation will be put.
--- a/36
+++ b/36
@@ -15,7 +15,7 @@ with these contents.
 ---------------------------------------------------------------------------
 1.  Compatibility

-HTML Purifier is PHP 5 and PHP 7, and is actively tested from PHP 5.0.5
+HTML Purifier is PHP 5 and PHP 7, and is actively tested from PHP 5.3
 and up. It has no core dependencies with other libraries.

 These optional extensions can enhance the capabilities of HTML Purifier:
@@ -101,31 +101,6 @@ Autoload compatibility
    autoloader, but there are some cases where you will need to change
    your own code to accomodate HTML Purifier. These are those cases:

-    PHP VERSION IS LESS THAN 5.1.2, AND YOU'VE DEFINED __autoload
-        Because spl_autoload_register() doesn't exist in early versions
-        of PHP 5, HTML Purifier has no way of adding itself to the autoload
-        stack. Modify your __autoload function to test
-        HTMLPurifier_Bootstrap::autoload($class)
-
-        For example, suppose your autoload function looks like this:
-
-            function __autoload($class) {
-                require str_replace('_', '/', $class) . '.php';
-                return true;
-            }
-
-        A modified version with HTML Purifier would look like this:
-
-            function __autoload($class) {
-                if (HTMLPurifier_Bootstrap::autoload($class)) return true;
-                require str_replace('_', '/', $class) . '.php';
-                return true;
-            }
-
-        Note that there *is* some custom behavior in our autoloader; the
-        original autoloader in our example would work for 99% of the time,
-        but would fail when including language files.
-
    AN __autoload FUNCTION IS DECLARED AFTER OUR AUTOLOADER IS REGISTERED
        spl_autoload_register() has the curious behavior of disabling
        the existing __autoload() handler. Users need to explicitly
@@ -138,11 +113,6 @@ Autoload compatibility

            spl_autoload_register('__autoload')

-    Users should also be on guard if they use a version of PHP previous
-    to 5.1.2 without an autoloader--HTML Purifier will define __autoload()
-    for you, which can collide with an autoloader that was added by *you*
-    later.
-

 For better performance
 ----------------------
@@ -204,9 +174,7 @@ For advanced users
        HTMLPurifier.autoload.php
            Registers our autoload handler HTMLPurifier_Bootstrap::autoload($class).

-    You can do these operations by yourself--in fact, you must modify your own
-    autoload handler if you are using a version of PHP earlier than PHP 5.1.2
-    (See "Autoload compatibility" above).
+    You can do these operations by yourself, if you like.


 ---------------------------------------------------------------------------
--- a/INSTALL.fr.utf8
+++ b/INSTALL.fr.utf8
@@ -11,7 +11,7 @@ pied de page, mais je recommande de lire le document.

 1.  Compatibilité

-HTML Purifier fonctionne avec PHP 5. PHP 5.0.5 est la dernière version testée.
+HTML Purifier fonctionne avec PHP 5. PHP 5.3 est la dernière version testée.
 Il ne dépend pas d'autres librairies.

 Les extensions optionnelles sont iconv (généralement déjà installée) et tidy
--- a/82
+++ b/82
@@ -9,6 +9,88 @@ NEWS ( CHANGELOG and HISTORY )                                     HTMLPurifier
    . Internal change
 ==========================

+4.13.0, released 2020-06-28
+! Add %HTML.Forms directive, which lets you accept forms in user
+  HTML without requiring full %HTML.Trusted.  Note that forms can
+  be (trivially) used to setup phishing; e.g., an attacker can
+  use CSS absolute positioning to overlay a form on top of a login
+  element, so please be sure to use this with care!   Fixes #213.
+  Thanks Mateusz Turcza for contributing this feature.
+! tr@bgcolor attribute is now supported.  Thanks Kieran Brahney
+  for this enhancement.
+- Further improvements to PHP 6.4 support, contributed by Witold
+  Wasiczko and Eloy Lafuente.
+- Fix PSR-0 compatibility.  Thanks Jordi Boggiano for contributing
+  part of this fix.
+- Fix bug with purifyArray where it doesn't work on empty arrays.
+  Thanks Fräntz Miccoli for the fix.
+- Reduce amount of maintenance scripts included in distribution
+  packages.  Thanks Sergei Morozov for this patch.
+- Remove leading zeros unless if it is only a zero, fixes #239.  Thanks
+  lubomirbartos for this fix.
+- Correct type hinting of maybeGet*, fixes #240.   Thanks Anders Jenbo
+  for this fix.
+
+4.12.0, released 2019-10-27
+! PHP 7.4 is supported, thank you Witold Wasiczko, Mateuz Turcza and
+  Edi Modrić
+- PHPDocs for HTMLModule::addElement() and Bool attr are fixed (thanks
+  Mateusz)
+
+4.11.0, released 2019-07-14
+# SafeScripting now matches case-sensitively against its whitelist (previously it was
+  case-insensitive.)  Thanks Dimitri Gritsajuk <gritsajuk.dimitri@gmail.com>
+  for reporting.
+! New directive %Core.AllowParseManyTags which allows parsing of many nested tags.
+  Thanks M. Suzuki <msuzuki1986@gmail.com> for contributing the patch.
+! purifyArray now supports multidimensional arrays.  Thanks
+  Sandro Miguel Marques <sandromiguel@sandromiguel.com> for contributing this patch.
+! initial and inherit settings available for width, height, and the min-/max-
+  versions thereof.  Thanks Michael Kliewe <info@phpgansta.de> for contributing
+  this patch.
+! More color names are supported.  Thanks Daijobou for contributing.
+- Compatibility fixes for PHP 7.3, including new CI for PHP 7.3
+  (thank you Lukas Neumann <lksnmnn@gmail.com>) and removal of
+  reserved words in our constants (thanks Darko Hrgovic <darko@darkodev.com>
+- Compatibility fixes for HHVM.  Thanks Mateusz Turcza for contributing
+  this fix.
+- HTML Purifier now never defines __autoload, fixing #196.  Thanks
+  Michael Kliewe for reporting.
+- In some situations, Config.php would report an undefined index: class
+  error; this has been fixed.  Thanks DiLong Fa for contributing
+  this fix.
+- We no longer produce <script /> tags; we always explicitly write
+  out the open and close tag.  Thanks Dimitri Gritsajuk
+  <gritsajuk.dimitri@gmail.com> for contributing this fix.
+- Better compatibility when IDNA constants are not present.  Thanks
+  Mateusz Turcza <xemlock@gmail.com> for contributing this fix.
+
+4.10.0, released 2018-02-22
+# PHP 5.3 is no longer officially supported by HTML Purifier
+  (we did not specifically break support, but we are no longer
+  testing on PHP 5.3)
+! Relative CSS length units are now supported
+- A few PHP 7.2 compatibility fixes, thanks John Flatness
+  <john@zerocrates.org>
+- Improve portability with old versions of libxml which don't
+  support accessing the data of a node
+- IDNA2008 is now used for converting domains to ASCII, fixing
+  some rather strange bugs with international domains
+- Fix race condition resulting in E_WARNING when creating
+  directories with Serializer
+
+4.9.3, released 2017-06-02
+- Workaround PHP 7.1 infinite loop when opcode cache is enabled.
+  Thanks @Xiphin (#134, #135)
+- Don't use autoloader when testing for DOMDocument.  Hypothetically,
+  this could cause your install to start using DirectLex if you had
+  previously been monkeypatching in a custom, autoloaded implementation
+  of DOMDocument.  Don't do that.  Thanks @Izumi-kun (#130)
+
+4.9.2, released 2017-03-12
+- Fixes PHP 5.3 compatibility
+- Fix breakage when decoding decimal entities.  Thanks @rybakit (#129)
+
 4.9.1, released 2017-03-08
 ! %URI.DefaultScheme can now be set to null, in which case
  all relative paths are removed.
--- a/README.md
+++ b/README.md
@@ -2,7 +2,7 @@ HTML Purifier [![Build Status](https://secure.travis-ci.org/ezyang/htmlpurifier.
 =============

 HTML Purifier is an HTML filtering solution that uses a unique combination
-of robust whitelists and agressive parsing to ensure that not only are
+of robust whitelists and aggressive parsing to ensure that not only are
 XSS attacks thwarted, but the resulting HTML is standards compliant.

 HTML Purifier is oriented towards richly formatted documents from
@@ -26,4 +26,4 @@ Package available on [Composer](https://packagist.org/packages/ezyang/htmlpurifi

 If you're using Composer to manage dependencies, you can use

-    $ composer require "ezyang/htmlpurifier": "dev-master"
+    $ composer require ezyang/htmlpurifier
--- a/2
+++ b/2
@@ -1 +1 @@
-4.9.1
+4.13.0
--- a/12
+++ b/12
@@ -1,8 +1,4 @@
-HTML Purifier 4.9.0 is a maintenance release, collecting a year
-of accumulated bug fixes plus a few new feature.  New features
-include support for min/max-width/height CSS, and rgba/hsl/hsla
-in color specifications.  Major bugfixes include improvements
-in the Serializer cache to avoid chmod'ing directories, better
-entity decoding (we won't accidentally encode entities that occur
-in URLs) and rel="noopener" on links with target attributes,
-to prevent them from overwriting the original frame.
+HTML Purifier 4.13.x is a maintenance release which fixes
+PSR-0 compatibility of our package.  There are also a few
+new features (%HTML.Forms and tg@bgcolor support) and
+a number of minor bugfixes.
--- a/benchmarks/.htaccess
+++ b/benchmarks/.htaccess
@@ -1 +1,7 @@
-Deny from all
+<IfModule mod_authz_core.c>
+    Require all denied
+</IfModule>
+
+<IfModule !mod_authz_core.c>
+    Deny from all
+</ifModule>
--- a/composer.json
+++ b/composer.json
@@ -4,7 +4,7 @@
    "type": "library",
    "keywords": ["html"],
    "homepage": "http://htmlpurifier.org/",
-    "license": "LGPL",
+    "license": "LGPL-2.1-or-later",
    "authors": [
        {
            "name": "Edward Z. Yang",
@@ -16,10 +16,13 @@
        "php": ">=5.2"
    },
    "require-dev": {
-        "simpletest/simpletest": "^1.1"
+        "simpletest/simpletest": "dev-master#72de02a7b80c6bb8864ef9bf66d41d2f58f826bd"
    },
    "autoload": {
        "psr-0": { "HTMLPurifier": "library/" },
-        "files": ["library/HTMLPurifier.composer.php"]
+        "files": ["library/HTMLPurifier.composer.php"],
+        "exclude-from-classmap": [
+            "/library/HTMLPurifier/Language/"
+        ]
    }
 }
--- a/configdoc/usage.xml
+++ b/configdoc/usage.xml
@@ -19,37 +19,37 @@
 </directive>
 <directive id="CSS.MaxImgLength">
  <file name="HTMLPurifier/CSSDefinition.php">
-   <line>226</line>
+   <line>240</line>
  </file>
 </directive>
 <directive id="CSS.Proprietary">
  <file name="HTMLPurifier/CSSDefinition.php">
-   <line>323</line>
+   <line>365</line>
  </file>
 </directive>
 <directive id="CSS.AllowTricky">
  <file name="HTMLPurifier/CSSDefinition.php">
-   <line>327</line>
+   <line>369</line>
  </file>
 </directive>
 <directive id="CSS.Trusted">
  <file name="HTMLPurifier/CSSDefinition.php">
-   <line>331</line>
+   <line>373</line>
  </file>
 </directive>
 <directive id="CSS.AllowImportant">
  <file name="HTMLPurifier/CSSDefinition.php">
-   <line>335</line>
+   <line>377</line>
  </file>
 </directive>
 <directive id="CSS.AllowedProperties">
  <file name="HTMLPurifier/CSSDefinition.php">
-   <line>464</line>
+   <line>506</line>
  </file>
 </directive>
 <directive id="CSS.ForbiddenProperties">
  <file name="HTMLPurifier/CSSDefinition.php">
-   <line>480</line>
+   <line>522</line>
  </file>
 </directive>
 <directive id="Cache.DefinitionImpl">
@@ -173,7 +173,7 @@
  </file>
  <file name="HTMLPurifier/Lexer.php">
   <line>313</line>
-   <line>352</line>
+   <line>353</line>
  </file>
  <file name="HTMLPurifier/HTMLModule/Image.php">
   <line>37</line>
@@ -277,25 +277,25 @@
   <line>347</line>
  </file>
 </directive>
- <directive id="Core.AggressivelyRemoveScript">
+ <directive id="Core.HiddenElements">
  <file name="HTMLPurifier/Lexer.php">
   <line>351</line>
  </file>
+  <file name="HTMLPurifier/Strategy/RemoveForeignElements.php">
+   <line>36</line>
+  </file>
+ </directive>
+ <directive id="Core.AggressivelyRemoveScript">
+  <file name="HTMLPurifier/Lexer.php">
+   <line>352</line>
+  </file>
 </directive>
 <directive id="Core.RemoveScriptContents">
-  <file name="HTMLPurifier/Lexer.php">
-   <line>352</line>
-  </file>
-  <file name="HTMLPurifier/Strategy/RemoveForeignElements.php">
-   <line>35</line>
-  </file>
- </directive>
- <directive id="Core.HiddenElements">
  <file name="HTMLPurifier/Lexer.php">
   <line>353</line>
  </file>
  <file name="HTMLPurifier/Strategy/RemoveForeignElements.php">
-   <line>36</line>
+   <line>35</line>
  </file>
 </directive>
 <directive id="URI.">
@@ -410,7 +410,7 @@
 </directive>
 <directive id="Core.EnableIDNA">
  <file name="HTMLPurifier/AttrDef/URI/Host.php">
-   <line>105</line>
+   <line>109</line>
  </file>
 </directive>
 <directive id="Attr.DefaultTextDir">
@@ -480,6 +480,11 @@
   <line>330</line>
  </file>
 </directive>
+ <directive id="HTML.Forms">
+  <file name="HTMLPurifier/HTMLModule/Forms.php">
+   <line>31</line>
+  </file>
+ </directive>
 <directive id="HTML.SafeIframe">
  <file name="HTMLPurifier/HTMLModule/Iframe.php">
   <line>28</line>
@@ -539,6 +544,11 @@
   <line>54</line>
  </file>
 </directive>
+ <directive id="Core.AllowParseManyTags">
+  <file name="HTMLPurifier/Lexer/DOMLex.php">
+   <line>72</line>
+  </file>
+ </directive>
 <directive id="Core.DirectLexLineNumberSyncInterval">
  <file name="HTMLPurifier/Lexer/DirectLex.php">
   <line>84</line>
--- a/docs/dev-config-naming.txt
+++ b/docs/dev-config-naming.txt
@@ -75,6 +75,7 @@ Core is the potpourri of directives, mostly regarding some minor behavioral
 tweaks for HTML handling abilities.

    AggressivelyFixLt
+    AllowParseManyTags
    ConvertDocumentToFragment
    DirectLexLineNumberSyncInterval
    LexerImpl
--- a/docs/dev-config-schema.html
+++ b/docs/dev-config-schema.html
@@ -228,7 +228,7 @@ Test.Example</pre>
        </tr>
        <tr>
          <td>mixed</td>
-          <td>new stdclass</td>
+          <td>new stdClass</td>
          <td>Any PHP variable is fine</td>
        </tr>
      </tbody>
--- a/extras/HTMLPurifierExtras.autoload-legacy.php
+++ b/extras/HTMLPurifierExtras.autoload-legacy.php
@@ -0,0 +1,15 @@
+<?php
+
+/**
+ * @file
+ * Legacy autoloader for systems lacking spl_autoload_register
+ *
+ * Must be separate to prevent deprecation warning on PHP 7.2
+ */
+
+function __autoload($class)
+{
+    return HTMLPurifierExtras::autoload($class);
+}
+
+// vim: et sw=4 sts=4
--- a/extras/HTMLPurifierExtras.autoload.php
+++ b/extras/HTMLPurifierExtras.autoload.php
@@ -17,10 +17,7 @@ if (function_exists('spl_autoload_register')) {
        spl_autoload_register('__autoload');
    }
 } elseif (!function_exists('__autoload')) {
-    function __autoload($class)
-    {
-        return HTMLPurifierExtras::autoload($class);
-    }
+    require dirname(__FILE__) . '/HTMLPurifierExtras.autoload-legacy.php';
 }

 // vim: et sw=4 sts=4
--- a/library/HTMLPurifier.autoload-legacy.php
+++ b/library/HTMLPurifier.autoload-legacy.php
@@ -0,0 +1,15 @@
+<?php
+
+/**
+ * @file
+ * Legacy autoloader for systems lacking spl_autoload_register
+ *
+ * Must be separate to prevent deprecation warning on PHP 7.2
+ */
+
+function __autoload($class)
+{
+    return HTMLPurifier_Bootstrap::autoload($class);
+}
+
+// vim: et sw=4 sts=4
--- a/library/HTMLPurifier.autoload.php
+++ b/library/HTMLPurifier.autoload.php
@@ -14,10 +14,7 @@ if (function_exists('spl_autoload_register') && function_exists('spl_autoload_un
        spl_autoload_register('__autoload');
    }
 } elseif (!function_exists('__autoload')) {
-    function __autoload($class)
-    {
-        return HTMLPurifier_Bootstrap::autoload($class);
-    }
+    require dirname(__FILE__) . '/HTMLPurifier.autoload-legacy.php';
 }

 if (ini_get('zend.ze1_compatibility_mode')) {
--- a/library/HTMLPurifier.includes.php
+++ b/library/HTMLPurifier.includes.php
@@ -7,7 +7,7 @@
 * primary concern and you are using an opcode cache. PLEASE DO NOT EDIT THIS
 * FILE, changes will be overwritten the next time the script is run.
 *
- * @version 4.9.1
+ * @version 4.13.0
 *
 * @warning
 *      You must *not* include any other HTML Purifier files before this file,
--- a/library/HTMLPurifier.php
+++ b/library/HTMLPurifier.php
@@ -19,7 +19,7 @@
 */

 /*
-    HTML Purifier 4.9.1 - Standards Compliant HTML Filtering
+    HTML Purifier 4.13.0 - Standards Compliant HTML Filtering
    Copyright (C) 2006-2008 Edward Z. Yang

    This library is free software; you can redistribute it and/or
@@ -58,12 +58,12 @@ class HTMLPurifier
     * Version of HTML Purifier.
     * @type string
     */
-    public $version = '4.9.1';
+    public $version = '4.13.0';

    /**
     * Constant with version of HTML Purifier.
     */
-    const VERSION = '4.9.1';
+    const VERSION = '4.13.0';

    /**
     * Global configuration object.
@@ -240,12 +240,17 @@ class HTMLPurifier
    public function purifyArray($array_of_html, $config = null)
    {
        $context_array = array();
-        foreach ($array_of_html as $key => $html) {
-            $array_of_html[$key] = $this->purify($html, $config);
+        $array = array();
+        foreach($array_of_html as $key=>$value){
+            if (is_array($value)) {
+                $array[$key] = $this->purifyArray($value, $config);
+            } else {
+                $array[$key] = $this->purify($value, $config);
+            }
            $context_array[$key] = $this->context;
        }
        $this->context = $context_array;
-        return $array_of_html;
+        return $array;
    }

    /**
--- a/library/HTMLPurifier/AttrDef/CSS/Color.php
+++ b/library/HTMLPurifier/AttrDef/CSS/Color.php
@@ -59,19 +59,19 @@ class HTMLPurifier_AttrDef_CSS_Color extends HTMLPurifier_AttrDef
             * Allowed types for values :
             * parameter_position => [type => max_value]
             */
-            $allowed_types = [
-                1 => ['percentage' => 100, 'integer' => 255],
-                2 => ['percentage' => 100, 'integer' => 255],
-                3 => ['percentage' => 100, 'integer' => 255],
-            ];
+            $allowed_types = array(
+                1 => array('percentage' => 100, 'integer' => 255),
+                2 => array('percentage' => 100, 'integer' => 255),
+                3 => array('percentage' => 100, 'integer' => 255),
+            );
            $allow_different_types = false;

            if (strpos($function, 'hsl') !== false) {
-                $allowed_types = [
-                    1 => ['integer' => 360],
-                    2 => ['percentage' => 100],
-                    3 => ['percentage' => 100],
-                ];
+                $allowed_types = array(
+                    1 => array('integer' => 360),
+                    2 => array('percentage' => 100),
+                    3 => array('percentage' => 100),
+                );
                $allow_different_types = true;
            }

--- a/library/HTMLPurifier/AttrDef/CSS/Number.php
+++ b/library/HTMLPurifier/AttrDef/CSS/Number.php
@@ -69,7 +69,13 @@ class HTMLPurifier_AttrDef_CSS_Number extends HTMLPurifier_AttrDef
            return false;
        }

-        $left = ltrim($left, '0');
+        // Remove leading zeros until positive number or a zero stays left
+        if (ltrim($left, '0') != '') {
+            $left = ltrim($left, '0');
+        } else {
+            $left = '0';
+        }
+
        $right = rtrim($right, '0');

        if ($right === '') {
--- a/library/HTMLPurifier/AttrDef/HTML/Bool.php
+++ b/library/HTMLPurifier/AttrDef/HTML/Bool.php
@@ -7,7 +7,7 @@ class HTMLPurifier_AttrDef_HTML_Bool extends HTMLPurifier_AttrDef
 {

    /**
-     * @type bool
+     * @type string
     */
    protected $name;

@@ -17,7 +17,7 @@ class HTMLPurifier_AttrDef_HTML_Bool extends HTMLPurifier_AttrDef
    public $minimized = true;

    /**
-     * @param bool $name
+     * @param bool|string $name
     */
    public function __construct($name = false)
    {
--- a/library/HTMLPurifier/AttrDef/URI/Host.php
+++ b/library/HTMLPurifier/AttrDef/URI/Host.php
@@ -97,7 +97,11 @@ class HTMLPurifier_AttrDef_URI_Host extends HTMLPurifier_AttrDef

        // PHP 5.3 and later support this functionality natively
        if (function_exists('idn_to_ascii')) {
-            $string = idn_to_ascii($string);
+            if (defined('IDNA_NONTRANSITIONAL_TO_ASCII') && defined('INTL_IDNA_VARIANT_UTS46')) {
+                $string = idn_to_ascii($string, IDNA_NONTRANSITIONAL_TO_ASCII, INTL_IDNA_VARIANT_UTS46);
+            } else {
+                $string = idn_to_ascii($string);
+            }

        // If we have Net_IDNA2 support, we can support IRIs by
        // punycoding them. (This is the most portable thing to do,
--- a/library/HTMLPurifier/CSSDefinition.php
+++ b/library/HTMLPurifier/CSSDefinition.php
@@ -220,15 +220,25 @@ class HTMLPurifier_CSSDefinition extends HTMLPurifier_Definition
            array(
                new HTMLPurifier_AttrDef_CSS_Length('0'),
                new HTMLPurifier_AttrDef_CSS_Percentage(true),
-                new HTMLPurifier_AttrDef_Enum(array('auto'))
+                new HTMLPurifier_AttrDef_Enum(array('auto', 'initial', 'inherit'))
+            )
+        );
+        $trusted_min_wh = new HTMLPurifier_AttrDef_CSS_Composite(
+            array(
+                new HTMLPurifier_AttrDef_CSS_Length('0'),
+                new HTMLPurifier_AttrDef_CSS_Percentage(true),
+                new HTMLPurifier_AttrDef_Enum(array('initial', 'inherit'))
+            )
+        );
+        $trusted_max_wh = new HTMLPurifier_AttrDef_CSS_Composite(
+            array(
+                new HTMLPurifier_AttrDef_CSS_Length('0'),
+                new HTMLPurifier_AttrDef_CSS_Percentage(true),
+                new HTMLPurifier_AttrDef_Enum(array('none', 'initial', 'inherit'))
            )
        );
        $max = $config->get('CSS.MaxImgLength');

-        $this->info['min-width'] =
-        $this->info['max-width'] =
-        $this->info['min-height'] =
-        $this->info['max-height'] =
        $this->info['width'] =
        $this->info['height'] =
            $max === null ?
@@ -245,6 +255,38 @@ class HTMLPurifier_CSSDefinition extends HTMLPurifier_Definition
                    // For everyone else:
                    $trusted_wh
                );
+        $this->info['min-width'] =
+        $this->info['min-height'] =
+            $max === null ?
+                $trusted_min_wh :
+                new HTMLPurifier_AttrDef_Switch(
+                    'img',
+                    // For img tags:
+                    new HTMLPurifier_AttrDef_CSS_Composite(
+                        array(
+                            new HTMLPurifier_AttrDef_CSS_Length('0', $max),
+                            new HTMLPurifier_AttrDef_Enum(array('initial', 'inherit'))
+                        )
+                    ),
+                    // For everyone else:
+                    $trusted_min_wh
+                );
+        $this->info['max-width'] =
+        $this->info['max-height'] =
+            $max === null ?
+                $trusted_max_wh :
+                new HTMLPurifier_AttrDef_Switch(
+                    'img',
+                    // For img tags:
+                    new HTMLPurifier_AttrDef_CSS_Composite(
+                        array(
+                            new HTMLPurifier_AttrDef_CSS_Length('0', $max),
+                            new HTMLPurifier_AttrDef_Enum(array('none', 'initial', 'inherit'))
+                        )
+                    ),
+                    // For everyone else:
+                    $trusted_max_wh
+                );

        $this->info['text-decoration'] = new HTMLPurifier_AttrDef_CSS_TextDecoration();

--- a/library/HTMLPurifier/ChildDef/Custom.php
+++ b/library/HTMLPurifier/ChildDef/Custom.php
@@ -45,7 +45,7 @@ class HTMLPurifier_ChildDef_Custom extends HTMLPurifier_ChildDef
    protected function _compileRegex()
    {
        $raw = str_replace(' ', '', $this->dtd_regex);
-        if ($raw{0} != '(') {
+        if ($raw[0] != '(') {
            $raw = "($raw)";
        }
        $el = '[#a-zA-Z0-9_.-]+';
--- a/library/HTMLPurifier/ChildDef/List.php
+++ b/library/HTMLPurifier/ChildDef/List.php
@@ -50,7 +50,7 @@ class HTMLPurifier_ChildDef_List extends HTMLPurifier_ChildDef
        // a little sanity check to make sure it's not ALL whitespace
        $all_whitespace = true;

-        $current_li = false;
+        $current_li = null;

        foreach ($children as $node) {
            if (!empty($node->is_whitespace)) {
@@ -71,7 +71,7 @@ class HTMLPurifier_ChildDef_List extends HTMLPurifier_ChildDef
                // to handle non-list elements; non-list elements should
                // not be appended to an existing li; only li created
                // for non-list. This distinction is not currently made.
-                if ($current_li === false) {
+                if ($current_li === null) {
                    $current_li = new HTMLPurifier_Node_Element('li');
                    $result[] = $current_li;
                }
--- a/library/HTMLPurifier/Config.php
+++ b/library/HTMLPurifier/Config.php
@@ -21,7 +21,7 @@ class HTMLPurifier_Config
     * HTML Purifier's version
     * @type string
     */
-    public $version = '4.9.1';
+    public $version = '4.13.0';

    /**
     * Whether or not to automatically finalize
@@ -333,7 +333,7 @@ class HTMLPurifier_Config
        }

        // Raw type might be negative when using the fully optimized form
-        // of stdclass, which indicates allow_null == true
+        // of stdClass, which indicates allow_null == true
        $rtype = is_int($def) ? $def : $def->type;
        if ($rtype < 0) {
            $type = -$rtype;
@@ -408,7 +408,7 @@ class HTMLPurifier_Config
     *             maybeGetRawHTMLDefinition, which is more explicitly
     *             named, instead.
     *
-     * @return HTMLPurifier_HTMLDefinition
+     * @return HTMLPurifier_HTMLDefinition|null
     */
    public function getHTMLDefinition($raw = false, $optimized = false)
    {
@@ -427,7 +427,7 @@ class HTMLPurifier_Config
     *             maybeGetRawCSSDefinition, which is more explicitly
     *             named, instead.
     *
-     * @return HTMLPurifier_CSSDefinition
+     * @return HTMLPurifier_CSSDefinition|null
     */
    public function getCSSDefinition($raw = false, $optimized = false)
    {
@@ -446,7 +446,7 @@ class HTMLPurifier_Config
     *             maybeGetRawURIDefinition, which is more explicitly
     *             named, instead.
     *
-     * @return HTMLPurifier_URIDefinition
+     * @return HTMLPurifier_URIDefinition|null
     */
    public function getURIDefinition($raw = false, $optimized = false)
    {
@@ -468,7 +468,7 @@ class HTMLPurifier_Config
     *        maybe semantics is the "right thing to do."
     *
     * @throws HTMLPurifier_Exception
-     * @return HTMLPurifier_Definition
+     * @return HTMLPurifier_Definition|null
     */
    public function getDefinition($type, $raw = false, $optimized = false)
    {
@@ -647,7 +647,7 @@ class HTMLPurifier_Config
    }

    /**
-     * @return HTMLPurifier_HTMLDefinition
+     * @return HTMLPurifier_HTMLDefinition|null
     */
    public function maybeGetRawHTMLDefinition()
    {
@@ -655,7 +655,7 @@ class HTMLPurifier_Config
    }
    
    /**
-     * @return HTMLPurifier_CSSDefinition
+     * @return HTMLPurifier_CSSDefinition|null
     */
    public function maybeGetRawCSSDefinition()
    {
@@ -663,7 +663,7 @@ class HTMLPurifier_Config
    }
    
    /**
-     * @return HTMLPurifier_URIDefinition
+     * @return HTMLPurifier_URIDefinition|null
     */
    public function maybeGetRawURIDefinition()
    {
@@ -890,7 +890,7 @@ class HTMLPurifier_Config
            // zip(tail(trace), trace) -- but PHP is not Haskell har har
            for ($i = 0, $c = count($trace); $i < $c - 1; $i++) {
                // XXX this is not correct on some versions of HTML Purifier
-                if ($trace[$i + 1]['class'] === 'HTMLPurifier_Config') {
+                if (isset($trace[$i + 1]['class']) && $trace[$i + 1]['class'] === 'HTMLPurifier_Config') {
                    continue;
                }
                $frame = $trace[$i];
--- a/library/HTMLPurifier/ConfigSchema.php
+++ b/library/HTMLPurifier/ConfigSchema.php
@@ -24,11 +24,11 @@ class HTMLPurifier_ConfigSchema
     *
     *  array(
     *      'Namespace' => array(
-     *          'Directive' => new stdclass(),
+     *          'Directive' => new stdClass(),
     *      )
     *  )
     *
-     * The stdclass may have the following properties:
+     * The stdClass may have the following properties:
     *
     *  - If isAlias isn't set:
     *      - type: Integer type of directive, see HTMLPurifier_VarParser for definitions
@@ -39,8 +39,8 @@ class HTMLPurifier_ConfigSchema
     *      - namespace: Namespace this directive aliases to
     *      - name: Directive name this directive aliases to
     *
-     * In certain degenerate cases, stdclass will actually be an integer. In
-     * that case, the value is equivalent to an stdclass with the type
+     * In certain degenerate cases, stdClass will actually be an integer. In
+     * that case, the value is equivalent to an stdClass with the type
     * property set to the integer. If the integer is negative, type is
     * equal to the absolute value of integer, and allow_null is true.
     *
@@ -100,12 +100,12 @@ class HTMLPurifier_ConfigSchema
     * @param string $key Name of directive
     * @param mixed $default Default value of directive
     * @param string $type Allowed type of the directive. See
-     *      HTMLPurifier_DirectiveDef::$type for allowed values
+     *      HTMLPurifier_VarParser::$types for allowed values
     * @param bool $allow_null Whether or not to allow null values
     */
    public function add($key, $default, $type, $allow_null)
    {
-        $obj = new stdclass();
+        $obj = new stdClass();
        $obj->type = is_int($type) ? $type : HTMLPurifier_VarParser::$types[$type];
        if ($allow_null) {
            $obj->allow_null = true;
@@ -152,14 +152,14 @@ class HTMLPurifier_ConfigSchema
     */
    public function addAlias($key, $new_key)
    {
-        $obj = new stdclass;
+        $obj = new stdClass;
        $obj->key = $new_key;
        $obj->isAlias = true;
        $this->info[$key] = $obj;
    }

    /**
-     * Replaces any stdclass that only has the type property with type integer.
+     * Replaces any stdClass that only has the type property with type integer.
     */
    public function postProcess()
    {
--- a/library/HTMLPurifier/ConfigSchema/schema.ser
+++ b/library/HTMLPurifier/ConfigSchema/schema.ser
--- a/library/HTMLPurifier/ConfigSchema/schema/AutoFormat.RemoveEmpty.RemoveNbsp.txt
+++ b/library/HTMLPurifier/ConfigSchema/schema/AutoFormat.RemoveEmpty.RemoveNbsp.txt
@@ -6,7 +6,7 @@ DEFAULT: false
 <p>
  When enabled, HTML Purifier will treat any elements that contain only
  non-breaking spaces as well as regular whitespace as empty, and remove
-  them when %AutoForamt.RemoveEmpty is enabled.
+  them when %AutoFormat.RemoveEmpty is enabled.
 </p>
 <p>
  See %AutoFormat.RemoveEmpty.RemoveNbsp.Exceptions for a list of elements
--- a/library/HTMLPurifier/ConfigSchema/schema/Core.AllowParseManyTags.txt
+++ b/library/HTMLPurifier/ConfigSchema/schema/Core.AllowParseManyTags.txt
@@ -0,0 +1,12 @@
+Core.AllowParseManyTags
+TYPE: bool
+DEFAULT: false
+VERSION: 4.10.1
+--DESCRIPTION--
+<p>
+    This directive allows parsing of many nested tags.
+    If you set true, relaxes any hardcoded limit from the parser.
+    However, in that case it may cause a Dos attack.
+    Be careful when enabling it.
+</p>
+--# vim: et sw=4 sts=4
--- a/library/HTMLPurifier/ConfigSchema/schema/Core.ColorKeywords.txt
+++ b/library/HTMLPurifier/ConfigSchema/schema/Core.ColorKeywords.txt
@@ -3,23 +3,154 @@ TYPE: hash
 VERSION: 2.0.0
 --DEFAULT--
 array (
-  'maroon' => '#800000',
-  'red' => '#FF0000',
-  'orange' => '#FFA500',
-  'yellow' => '#FFFF00',
-  'olive' => '#808000',
-  'purple' => '#800080',
-  'fuchsia' => '#FF00FF',
-  'white' => '#FFFFFF',
-  'lime' => '#00FF00',
-  'green' => '#008000',
-  'navy' => '#000080',
-  'blue' => '#0000FF',
+  'aliceblue' => '#F0F8FF',
+  'antiquewhite' => '#FAEBD7',
  'aqua' => '#00FFFF',
-  'teal' => '#008080',
+  'aquamarine' => '#7FFFD4',
+  'azure' => '#F0FFFF',
+  'beige' => '#F5F5DC',
+  'bisque' => '#FFE4C4',
  'black' => '#000000',
-  'silver' => '#C0C0C0',
+  'blanchedalmond' => '#FFEBCD',
+  'blue' => '#0000FF',
+  'blueviolet' => '#8A2BE2',
+  'brown' => '#A52A2A',
+  'burlywood' => '#DEB887',
+  'cadetblue' => '#5F9EA0',
+  'chartreuse' => '#7FFF00',
+  'chocolate' => '#D2691E',
+  'coral' => '#FF7F50',
+  'cornflowerblue' => '#6495ED',
+  'cornsilk' => '#FFF8DC',
+  'crimson' => '#DC143C',
+  'cyan' => '#00FFFF',
+  'darkblue' => '#00008B',
+  'darkcyan' => '#008B8B',
+  'darkgoldenrod' => '#B8860B',
+  'darkgray' => '#A9A9A9',
+  'darkgrey' => '#A9A9A9',
+  'darkgreen' => '#006400',
+  'darkkhaki' => '#BDB76B',
+  'darkmagenta' => '#8B008B',
+  'darkolivegreen' => '#556B2F',
+  'darkorange' => '#FF8C00',
+  'darkorchid' => '#9932CC',
+  'darkred' => '#8B0000',
+  'darksalmon' => '#E9967A',
+  'darkseagreen' => '#8FBC8F',
+  'darkslateblue' => '#483D8B',
+  'darkslategray' => '#2F4F4F',
+  'darkslategrey' => '#2F4F4F',
+  'darkturquoise' => '#00CED1',
+  'darkviolet' => '#9400D3',
+  'deeppink' => '#FF1493',
+  'deepskyblue' => '#00BFFF',
+  'dimgray' => '#696969',
+  'dimgrey' => '#696969',
+  'dodgerblue' => '#1E90FF',
+  'firebrick' => '#B22222',
+  'floralwhite' => '#FFFAF0',
+  'forestgreen' => '#228B22',
+  'fuchsia' => '#FF00FF',
+  'gainsboro' => '#DCDCDC',
+  'ghostwhite' => '#F8F8FF',
+  'gold' => '#FFD700',
+  'goldenrod' => '#DAA520',
  'gray' => '#808080',
+  'grey' => '#808080',
+  'green' => '#008000',
+  'greenyellow' => '#ADFF2F',
+  'honeydew' => '#F0FFF0',
+  'hotpink' => '#FF69B4',
+  'indianred' => '#CD5C5C',
+  'indigo' => '#4B0082',
+  'ivory' => '#FFFFF0',
+  'khaki' => '#F0E68C',
+  'lavender' => '#E6E6FA',
+  'lavenderblush' => '#FFF0F5',
+  'lawngreen' => '#7CFC00',
+  'lemonchiffon' => '#FFFACD',
+  'lightblue' => '#ADD8E6',
+  'lightcoral' => '#F08080',
+  'lightcyan' => '#E0FFFF',
+  'lightgoldenrodyellow' => '#FAFAD2',
+  'lightgray' => '#D3D3D3',
+  'lightgrey' => '#D3D3D3',
+  'lightgreen' => '#90EE90',
+  'lightpink' => '#FFB6C1',
+  'lightsalmon' => '#FFA07A',
+  'lightseagreen' => '#20B2AA',
+  'lightskyblue' => '#87CEFA',
+  'lightslategray' => '#778899',
+  'lightslategrey' => '#778899',
+  'lightsteelblue' => '#B0C4DE',
+  'lightyellow' => '#FFFFE0',
+  'lime' => '#00FF00',
+  'limegreen' => '#32CD32',
+  'linen' => '#FAF0E6',
+  'magenta' => '#FF00FF',
+  'maroon' => '#800000',
+  'mediumaquamarine' => '#66CDAA',
+  'mediumblue' => '#0000CD',
+  'mediumorchid' => '#BA55D3',
+  'mediumpurple' => '#9370DB',
+  'mediumseagreen' => '#3CB371',
+  'mediumslateblue' => '#7B68EE',
+  'mediumspringgreen' => '#00FA9A',
+  'mediumturquoise' => '#48D1CC',
+  'mediumvioletred' => '#C71585',
+  'midnightblue' => '#191970',
+  'mintcream' => '#F5FFFA',
+  'mistyrose' => '#FFE4E1',
+  'moccasin' => '#FFE4B5',
+  'navajowhite' => '#FFDEAD',
+  'navy' => '#000080',
+  'oldlace' => '#FDF5E6',
+  'olive' => '#808000',
+  'olivedrab' => '#6B8E23',
+  'orange' => '#FFA500',
+  'orangered' => '#FF4500',
+  'orchid' => '#DA70D6',
+  'palegoldenrod' => '#EEE8AA',
+  'palegreen' => '#98FB98',
+  'paleturquoise' => '#AFEEEE',
+  'palevioletred' => '#DB7093',
+  'papayawhip' => '#FFEFD5',
+  'peachpuff' => '#FFDAB9',
+  'peru' => '#CD853F',
+  'pink' => '#FFC0CB',
+  'plum' => '#DDA0DD',
+  'powderblue' => '#B0E0E6',
+  'purple' => '#800080',
+  'rebeccapurple' => '#663399',
+  'red' => '#FF0000',
+  'rosybrown' => '#BC8F8F',
+  'royalblue' => '#4169E1',
+  'saddlebrown' => '#8B4513',
+  'salmon' => '#FA8072',
+  'sandybrown' => '#F4A460',
+  'seagreen' => '#2E8B57',
+  'seashell' => '#FFF5EE',
+  'sienna' => '#A0522D',
+  'silver' => '#C0C0C0',
+  'skyblue' => '#87CEEB',
+  'slateblue' => '#6A5ACD',
+  'slategray' => '#708090',
+  'slategrey' => '#708090',
+  'snow' => '#FFFAFA',
+  'springgreen' => '#00FF7F',
+  'steelblue' => '#4682B4',
+  'tan' => '#D2B48C',
+  'teal' => '#008080',
+  'thistle' => '#D8BFD8',
+  'tomato' => '#FF6347',
+  'turquoise' => '#40E0D0',
+  'violet' => '#EE82EE',
+  'wheat' => '#F5DEB3',
+  'white' => '#FFFFFF',
+  'whitesmoke' => '#F5F5F5',
+  'yellow' => '#FFFF00',
+  'yellowgreen' => '#9ACD32'
 )
 --DESCRIPTION--

--- a/library/HTMLPurifier/ConfigSchema/schema/HTML.Forms.txt
+++ b/library/HTMLPurifier/ConfigSchema/schema/HTML.Forms.txt
@@ -0,0 +1,11 @@
+HTML.Forms
+TYPE: bool
+VERSION: 4.13.0
+DEFAULT: false
+--DESCRIPTION--
+<p>
+    Whether or not to permit form elements in the user input, regardless of
+    %HTML.Trusted value. Please be very careful when using this functionality, as
+    enabling forms in untrusted documents may allow for phishing attacks.
+</p>
+--# vim: et sw=4 sts=4
--- a/library/HTMLPurifier/DefinitionCache/Serializer.php
+++ b/library/HTMLPurifier/DefinitionCache/Serializer.php
@@ -217,9 +217,14 @@ class HTMLPurifier_DefinitionCache_Serializer extends HTMLPurifier_DefinitionCac
        $directory = $this->generateDirectoryPath($config);
        $chmod = $config->get('Cache.SerializerPermissions');
        if ($chmod === null) {
-            // TODO: This races
-            if (is_dir($directory)) return true;
-            return mkdir($directory);
+            if (!@mkdir($directory) && !is_dir($directory)) {
+                trigger_error(
+                    'Could not create directory ' . $directory . '',
+                    E_USER_WARNING
+                );
+                return false;
+            }
+            return true;
        }
        if (!is_dir($directory)) {
            $base = $this->generateBaseDirectoryPath($config);
@@ -233,7 +238,7 @@ class HTMLPurifier_DefinitionCache_Serializer extends HTMLPurifier_DefinitionCac
            } elseif (!$this->_testPermissions($base, $chmod)) {
                return false;
            }
-            if (!mkdir($directory, $chmod)) {
+            if (!@mkdir($directory, $chmod) && !is_dir($directory)) {
                trigger_error(
                    'Could not create directory ' . $directory . '',
                    E_USER_WARNING
--- a/library/HTMLPurifier/Encoder.php
+++ b/library/HTMLPurifier/Encoder.php
@@ -159,7 +159,7 @@ class HTMLPurifier_Encoder

        $len = strlen($str);
        for ($i = 0; $i < $len; $i++) {
-            $in = ord($str{$i});
+            $in = ord($str[$i]);
            $char .= $str[$i]; // append byte to char
            if (0 == $mState) {
                // When mState is zero we expect either a US-ASCII character
--- a/library/HTMLPurifier/EntityParser.php
+++ b/library/HTMLPurifier/EntityParser.php
@@ -118,11 +118,11 @@ class HTMLPurifier_EntityParser
        $entity = $matches[0];
        $hex_part = @$matches[1];
        $dec_part = @$matches[2];
-        $named_part = empty($matches[3]) ? @$matches[4] : $matches[3];
-        if ($hex_part) {
+        $named_part = empty($matches[3]) ? (empty($matches[4]) ? "" : $matches[4]) : $matches[3];
+        if ($hex_part !== NULL && $hex_part !== "") {
            return HTMLPurifier_Encoder::unichr(hexdec($hex_part));
-        } elseif ($dec_part) {
-            return HTMLPurifier_Encoder((int) $dec_part);
+        } elseif ($dec_part !== NULL && $dec_part !== "") {
+            return HTMLPurifier_Encoder::unichr((int) $dec_part);
        } else {
            if (!$this->_entity_lookup) {
                $this->_entity_lookup = HTMLPurifier_EntityLookup::instance();
--- a/library/HTMLPurifier/Generator.php
+++ b/library/HTMLPurifier/Generator.php
@@ -146,7 +146,7 @@ class HTMLPurifier_Generator
            $attr = $this->generateAttributes($token->attr, $token->name);
            if ($this->_flashCompat) {
                if ($token->name == "object") {
-                    $flash = new stdclass();
+                    $flash = new stdClass();
                    $flash->attr = $token->attr;
                    $flash->param = array();
                    $this->_flashStack[] = $flash;
--- a/library/HTMLPurifier/HTMLModule.php
+++ b/library/HTMLPurifier/HTMLModule.php
@@ -132,9 +132,9 @@ class HTMLPurifier_HTMLModule
     * @param string $element Name of element to add
     * @param string|bool $type What content set should element be registered to?
     *              Set as false to skip this step.
-     * @param string $contents Allowed children in form of:
+     * @param string|HTMLPurifier_ChildDef $contents Allowed children in form of:
     *              "$content_model_type: $content_model"
-     * @param array $attr_includes What attribute collections to register to
+     * @param array|string $attr_includes What attribute collections to register to
     *              element?
     * @param array $attr What unique attributes does the element define?
     * @see HTMLPurifier_ElementDef:: for in-depth descriptions of these parameters.
--- a/library/HTMLPurifier/HTMLModule/Forms.php
+++ b/library/HTMLPurifier/HTMLModule/Forms.php
@@ -28,6 +28,10 @@ class HTMLPurifier_HTMLModule_Forms extends HTMLPurifier_HTMLModule
     */
    public function setup($config)
    {
+        if ($config->get('HTML.Forms')) {
+            $this->safe = true;
+        }
+
        $form = $this->addElement(
            'form',
            'Form',
--- a/library/HTMLPurifier/HTMLModule/SafeScripting.php
+++ b/library/HTMLPurifier/HTMLModule/SafeScripting.php
@@ -23,13 +23,13 @@ class HTMLPurifier_HTMLModule_SafeScripting extends HTMLPurifier_HTMLModule
        $script = $this->addElement(
            'script',
            'Inline',
-            'Empty',
+            'Optional:', // Not `Empty` to not allow to autoclose the <script /> tag @see https://www.w3.org/TR/html4/interact/scripts.html
            null,
            array(
                // While technically not required by the spec, we're forcing
                // it to this value.
                'type' => 'Enum#text/javascript',
-                'src*' => new HTMLPurifier_AttrDef_Enum(array_keys($allowed))
+                'src*' => new HTMLPurifier_AttrDef_Enum(array_keys($allowed), /*case sensitive*/ true)
            )
        );
        $script->attr_transform_pre[] =
--- a/library/HTMLPurifier/HTMLModule/Tidy/XHTMLAndHTML4.php
+++ b/library/HTMLPurifier/HTMLModule/Tidy/XHTMLAndHTML4.php
@@ -96,6 +96,7 @@ class HTMLPurifier_HTMLModule_Tidy_XHTMLAndHTML4 extends HTMLPurifier_HTMLModule

        // @bgcolor for table, tr, td, th ---------------------------------
        $r['table@bgcolor'] =
+        $r['tr@bgcolor'] =
        $r['td@bgcolor'] =
        $r['th@bgcolor'] =
            new HTMLPurifier_AttrTransform_BgColor();
--- a/library/HTMLPurifier/Injector.php
+++ b/library/HTMLPurifier/Injector.php
@@ -157,11 +157,13 @@ abstract class HTMLPurifier_Injector
            return false;
        }
        // check for exclusion
-        for ($i = count($this->currentNesting) - 2; $i >= 0; $i--) {
-            $node = $this->currentNesting[$i];
-            $def  = $this->htmlDefinition->info[$node->name];
-            if (isset($def->excludes[$name])) {
-                return false;
+        if (!empty($this->currentNesting)) {
+            for ($i = count($this->currentNesting) - 2; $i >= 0; $i--) {
+                $node = $this->currentNesting[$i];
+                $def  = $this->htmlDefinition->info[$node->name];
+                if (isset($def->excludes[$name])) {
+                    return false;
+                }
            }
        }
        return true;
--- a/library/HTMLPurifier/Language/classes/en-x-test.php
+++ b/library/HTMLPurifier/Language/classes/en-x-test.php
@@ -1,9 +0,0 @@
-<?php
-
-// private class for unit testing
-
-class HTMLPurifier_Language_en_x_test extends HTMLPurifier_Language
-{
-}
-
-// vim: et sw=4 sts=4
--- a/library/HTMLPurifier/Language/messages/en-x-test.php
+++ b/library/HTMLPurifier/Language/messages/en-x-test.php
@@ -1,11 +0,0 @@
-<?php
-
-// private language message file for unit testing purposes
-
-$fallback = 'en';
-
-$messages = array(
-    'HTMLPurifier' => 'HTML Purifier X'
-);
-
-// vim: et sw=4 sts=4
--- a/library/HTMLPurifier/Language/messages/en-x-testmini.php
+++ b/library/HTMLPurifier/Language/messages/en-x-testmini.php
@@ -1,12 +0,0 @@
-<?php
-
-// private language message file for unit testing purposes
-// this language file has no class associated with it
-
-$fallback = 'en';
-
-$messages = array(
-    'HTMLPurifier' => 'HTML Purifier XNone'
-);
-
-// vim: et sw=4 sts=4
--- a/library/HTMLPurifier/Length.php
+++ b/library/HTMLPurifier/Length.php
@@ -26,12 +26,14 @@ class HTMLPurifier_Length
    protected $isValid;

    /**
-     * Array Lookup array of units recognized by CSS 2.1
+     * Array Lookup array of units recognized by CSS 3
     * @type array
     */
    protected static $allowedUnits = array(
        'em' => true, 'ex' => true, 'px' => true, 'in' => true,
-        'cm' => true, 'mm' => true, 'pt' => true, 'pc' => true
+        'cm' => true, 'mm' => true, 'pt' => true, 'pc' => true,
+        'ch' => true, 'rem' => true, 'vw' => true, 'vh' => true,
+        'vmin' => true, 'vmax' => true
    );

    /**
--- a/library/HTMLPurifier/Lexer.php
+++ b/library/HTMLPurifier/Lexer.php
@@ -96,7 +96,7 @@ class HTMLPurifier_Lexer
                        break;
                    }

-                    if (class_exists('DOMDocument') &&
+                    if (class_exists('DOMDocument', false) &&
                        method_exists('DOMDocument', 'loadHTML') &&
                        !extension_loaded('domxml')
                    ) {
@@ -348,9 +348,10 @@ class HTMLPurifier_Lexer
            $html = preg_replace('#<\?.+?\?>#s', '', $html);
        }

+        $hidden_elements = $config->get('Core.HiddenElements');
        if ($config->get('Core.AggressivelyRemoveScript') &&
            !($config->get('HTML.Trusted') || !$config->get('Core.RemoveScriptContents')
-            || empty($config->get('Core.HiddenElements')["script"]))) {
+            || empty($hidden_elements["script"]))) {
            $html = preg_replace('#<script[^>]*>.*?</script>#i', '', $html);
        }

--- a/library/HTMLPurifier/Lexer/DOMLex.php
+++ b/library/HTMLPurifier/Lexer/DOMLex.php
@@ -68,8 +68,18 @@ class HTMLPurifier_Lexer_DOMLex extends HTMLPurifier_Lexer
        $doc = new DOMDocument();
        $doc->encoding = 'UTF-8'; // theoretically, the above has this covered

+        $options = 0;
+        if ($config->get('Core.AllowParseManyTags') && defined('LIBXML_PARSEHUGE')) {
+            $options |= LIBXML_PARSEHUGE;
+        }
+
        set_error_handler(array($this, 'muteErrorHandler'));
-        $doc->loadHTML($html);
+        // loadHTML() fails on PHP 5.3 when second parameter is given
+        if ($options) {
+            $doc->loadHTML($html, $options);
+        } else {
+            $doc->loadHTML($html);
+        }
        restore_error_handler();

        $body = $doc->getElementsByTagName('html')->item(0)-> // <html>
@@ -126,6 +136,41 @@ class HTMLPurifier_Lexer_DOMLex extends HTMLPurifier_Lexer
        } while ($level > 0);
    }

+    /**
+     * Portably retrieve the tag name of a node; deals with older versions
+     * of libxml like 2.7.6
+     * @param DOMNode $node
+     */
+    protected function getTagName($node)
+    {
+        if (isset($node->tagName)) {
+            return $node->tagName;
+        } else if (isset($node->nodeName)) {
+            return $node->nodeName;
+        } else if (isset($node->localName)) {
+            return $node->localName;
+        }
+        return null;
+    }
+
+    /**
+     * Portably retrieve the data of a node; deals with older versions
+     * of libxml like 2.7.6
+     * @param DOMNode $node
+     */
+    protected function getData($node)
+    {
+        if (isset($node->data)) {
+            return $node->data;
+        } else if (isset($node->nodeValue)) {
+            return $node->nodeValue;
+        } else if (isset($node->textContent)) {
+            return $node->textContent;
+        }
+        return null;
+    }
+
+
    /**
     * @param DOMNode $node DOMNode to be tokenized.
     * @param HTMLPurifier_Token[] $tokens   Array-list of already tokenized tokens.
@@ -141,7 +186,10 @@ class HTMLPurifier_Lexer_DOMLex extends HTMLPurifier_Lexer
        // but we're not getting the character reference nodes because
        // those should have been preprocessed
        if ($node->nodeType === XML_TEXT_NODE) {
-            $tokens[] = $this->factory->createText($node->data);
+            $data = $this->getData($node); // Handle variable data property
+            if ($data !== null) {
+              $tokens[] = $this->factory->createText($data);
+            }
            return false;
        } elseif ($node->nodeType === XML_CDATA_SECTION_NODE) {
            // undo libxml's special treatment of <script> and <style> tags
@@ -171,21 +219,20 @@ class HTMLPurifier_Lexer_DOMLex extends HTMLPurifier_Lexer
            // not-well tested: there may be other nodes we have to grab
            return false;
        }
-
        $attr = $node->hasAttributes() ? $this->transformAttrToAssoc($node->attributes) : array();
-
+        $tag_name = $this->getTagName($node); // Handle variable tagName property
+        if (empty($tag_name)) {
+            return (bool) $node->childNodes->length;
+        }
        // We still have to make sure that the element actually IS empty
        if (!$node->childNodes->length) {
            if ($collect) {
-                $tokens[] = $this->factory->createEmpty($node->tagName, $attr);
+                $tokens[] = $this->factory->createEmpty($tag_name, $attr);
            }
            return false;
        } else {
            if ($collect) {
-                $tokens[] = $this->factory->createStart(
-                    $tag_name = $node->tagName, // somehow, it get's dropped
-                    $attr
-                );
+                $tokens[] = $this->factory->createStart($tag_name, $attr);
            }
            return true;
        }
@@ -197,10 +244,10 @@ class HTMLPurifier_Lexer_DOMLex extends HTMLPurifier_Lexer
     */
    protected function createEndNode($node, &$tokens)
    {
-        $tokens[] = $this->factory->createEnd($node->tagName);
+        $tag_name = $this->getTagName($node); // Handle variable tagName property
+        $tokens[] = $this->factory->createEnd($tag_name);
    }

-
    /**
     * Converts a DOMNamedNodeMap of DOMAttr objects into an assoc array.
     *
--- a/library/HTMLPurifier/Lexer/PH5P.php
+++ b/library/HTMLPurifier/Lexer/PH5P.php
@@ -1507,7 +1507,7 @@ class HTML5
                $entity = $this->character($start, $this->char);
                $cond = strlen($e_name) > 0;

-                // The rest of the parsing happens bellow.
+                // The rest of the parsing happens below.
                break;

            // Anything else
@@ -1535,7 +1535,7 @@ class HTML5
                }

                $cond = isset($entity);
-                // The rest of the parsing happens bellow.
+                // The rest of the parsing happens below.
                break;
        }

--- a/library/HTMLPurifier/Printer/ConfigForm.php
+++ b/library/HTMLPurifier/Printer/ConfigForm.php
@@ -48,7 +48,7 @@ class HTMLPurifier_Printer_ConfigForm extends HTMLPurifier_Printer
        $this->compress = $compress;
        // initialize sub-printers
        $this->fields[0] = new HTMLPurifier_Printer_ConfigForm_default();
-        $this->fields[HTMLPurifier_VarParser::BOOL] = new HTMLPurifier_Printer_ConfigForm_bool();
+        $this->fields[HTMLPurifier_VarParser::C_BOOL] = new HTMLPurifier_Printer_ConfigForm_bool();
    }

    /**
@@ -339,7 +339,7 @@ class HTMLPurifier_Printer_ConfigForm_default extends HTMLPurifier_Printer
                    $value = '';
            }
        }
-        if ($type === HTMLPurifier_VarParser::MIXED) {
+        if ($type === HTMLPurifier_VarParser::C_MIXED) {
            return 'Not supported';
            $value = serialize($value);
        }
--- a/library/HTMLPurifier/Printer/HTMLDefinition.php
+++ b/library/HTMLPurifier/Printer/HTMLDefinition.php
@@ -43,8 +43,8 @@ class HTMLPurifier_Printer_HTMLDefinition extends HTMLPurifier_Printer
        $ret .= $this->element('caption', 'Doctype');
        $ret .= $this->row('Name', $doctype->name);
        $ret .= $this->row('XML', $doctype->xml ? 'Yes' : 'No');
-        $ret .= $this->row('Default Modules', implode($doctype->modules, ', '));
-        $ret .= $this->row('Default Tidy Modules', implode($doctype->tidyModules, ', '));
+        $ret .= $this->row('Default Modules', implode(', ', $doctype->modules));
+        $ret .= $this->row('Default Tidy Modules', implode(', ', $doctype->tidyModules));
        $ret .= $this->end('table');
        return $ret;
    }
--- a/library/HTMLPurifier/TagTransform/Font.php
+++ b/library/HTMLPurifier/TagTransform/Font.php
@@ -75,7 +75,7 @@ class HTMLPurifier_TagTransform_Font extends HTMLPurifier_TagTransform
        if (isset($attr['size'])) {
            // normalize large numbers
            if ($attr['size'] !== '') {
-                if ($attr['size']{0} == '+' || $attr['size']{0} == '-') {
+                if ($attr['size'][0] == '+' || $attr['size'][0] == '-') {
                    $size = (int)$attr['size'];
                    if ($size < -2) {
                        $attr['size'] = '-2';
--- a/library/HTMLPurifier/VarParser.php
+++ b/library/HTMLPurifier/VarParser.php
@@ -7,34 +7,34 @@
 class HTMLPurifier_VarParser
 {

-    const STRING = 1;
+    const C_STRING = 1;
    const ISTRING = 2;
    const TEXT = 3;
    const ITEXT = 4;
-    const INT = 5;
-    const FLOAT = 6;
-    const BOOL = 7;
+    const C_INT = 5;
+    const C_FLOAT = 6;
+    const C_BOOL = 7;
    const LOOKUP = 8;
    const ALIST = 9;
    const HASH = 10;
-    const MIXED = 11;
+    const C_MIXED = 11;

    /**
     * Lookup table of allowed types. Mainly for backwards compatibility, but
     * also convenient for transforming string type names to the integer constants.
     */
    public static $types = array(
-        'string' => self::STRING,
+        'string' => self::C_STRING,
        'istring' => self::ISTRING,
        'text' => self::TEXT,
        'itext' => self::ITEXT,
-        'int' => self::INT,
-        'float' => self::FLOAT,
-        'bool' => self::BOOL,
+        'int' => self::C_INT,
+        'float' => self::C_FLOAT,
+        'bool' => self::C_BOOL,
        'lookup' => self::LOOKUP,
        'list' => self::ALIST,
        'hash' => self::HASH,
-        'mixed' => self::MIXED
+        'mixed' => self::C_MIXED
    );

    /**
@@ -42,7 +42,7 @@ class HTMLPurifier_VarParser
     * allowed value lists.
     */
    public static $stringTypes = array(
-        self::STRING => true,
+        self::C_STRING => true,
        self::ISTRING => true,
        self::TEXT => true,
        self::ITEXT => true,
@@ -74,7 +74,7 @@ class HTMLPurifier_VarParser
        // These are basic checks, to make sure nothing horribly wrong
        // happened in our implementations.
        switch ($type) {
-            case (self::STRING):
+            case (self::C_STRING):
            case (self::ISTRING):
            case (self::TEXT):
            case (self::ITEXT):
@@ -85,17 +85,17 @@ class HTMLPurifier_VarParser
                    $var = strtolower($var);
                }
                return $var;
-            case (self::INT):
+            case (self::C_INT):
                if (!is_int($var)) {
                    break;
                }
                return $var;
-            case (self::FLOAT):
+            case (self::C_FLOAT):
                if (!is_float($var)) {
                    break;
                }
                return $var;
-            case (self::BOOL):
+            case (self::C_BOOL):
                if (!is_bool($var)) {
                    break;
                }
@@ -119,7 +119,7 @@ class HTMLPurifier_VarParser
                    }
                }
                return $var;
-            case (self::MIXED):
+            case (self::C_MIXED):
                return $var;
            default:
                $this->errorInconsistent(get_class($this), $type);
--- a/library/HTMLPurifier/VarParser/Flexible.php
+++ b/library/HTMLPurifier/VarParser/Flexible.php
@@ -23,23 +23,23 @@ class HTMLPurifier_VarParser_Flexible extends HTMLPurifier_VarParser
            // Note: if code "breaks" from the switch, it triggers a generic
            // exception to be thrown. Specific errors can be specifically
            // done here.
-            case self::MIXED:
+            case self::C_MIXED:
            case self::ISTRING:
-            case self::STRING:
+            case self::C_STRING:
            case self::TEXT:
            case self::ITEXT:
                return $var;
-            case self::INT:
+            case self::C_INT:
                if (is_string($var) && ctype_digit($var)) {
                    $var = (int)$var;
                }
                return $var;
-            case self::FLOAT:
+            case self::C_FLOAT:
                if ((is_string($var) && is_numeric($var)) || is_int($var)) {
                    $var = (float)$var;
                }
                return $var;
-            case self::BOOL:
+            case self::C_BOOL:
                if (is_int($var) && ($var === 0 || $var === 1)) {
                    $var = (bool)$var;
                } elseif (is_string($var)) {
--- a/maintenance/.htaccess
+++ b/maintenance/.htaccess
@@ -1 +1,7 @@
-Deny from all
+<IfModule mod_authz_core.c>
+    Require all denied
+</IfModule>
+
+<IfModule !mod_authz_core.c>
+    Deny from all
+</ifModule>
--- a/maintenance/PH5P.php
+++ b/maintenance/PH5P.php
@@ -1080,7 +1080,7 @@ class HTML5
                $entity = $this->character($start, $this->char);
                $cond = strlen($e_name) > 0;

-                // The rest of the parsing happens bellow.
+                // The rest of the parsing happens below.
            break;

            // Anything else
@@ -1102,7 +1102,7 @@ class HTML5
                }

                $cond = isset($entity);
-                // The rest of the parsing happens bellow.
+                // The rest of the parsing happens below.
            break;
        }

--- a/maintenance/flush.php
+++ b/maintenance/flush.php
@@ -1,30 +0,0 @@
-#!/usr/bin/php
-<?php
-
-chdir(dirname(__FILE__));
-require_once 'common.php';
-assertCli();
-
-/**
- * @file
- * Runs all generation/flush cache scripts to ensure that somewhat volatile
- * generated files are up-to-date.
- */
-
-function e($cmd)
-{
-    echo "\$ $cmd\n";
-    passthru($cmd, $status);
-    echo "\n";
-    if ($status) exit($status);
-}
-
-$php = empty($_SERVER['argv'][1]) ? 'php' : $_SERVER['argv'][1];
-
-e($php . ' generate-includes.php');
-e($php . ' generate-schema-cache.php');
-e($php . ' flush-definition-cache.php');
-e($php . ' generate-standalone.php');
-e($php . ' config-scanner.php');
-
-// vim: et sw=4 sts=4
--- a/maintenance/flush.sh
+++ b/maintenance/flush.sh
@@ -0,0 +1,8 @@
+#!/bin/bash
+set -ex
+DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" >/dev/null && pwd )"
+php "$DIR/generate-includes.php"
+php "$DIR/generate-schema-cache.php"
+php "$DIR/flush-definition-cache.php"
+php "$DIR/generate-standalone.php"
+php "$DIR/config-scanner.php"
--- a/maintenance/update-config.php
+++ b/maintenance/update-config.php
@@ -1,34 +0,0 @@
-#!/usr/bin/php
-<?php
-
-chdir(dirname(__FILE__));
-require_once 'common.php';
-assertCli();
-
-/**
- * @file
- * Converts all instances of $config->set and $config->get to the new
- * format, as described by docs/dev-config-bcbreaks.txt
- */
-
-$FS = new FSTools();
-chdir(dirname(__FILE__) . '/..');
-$raw_files = $FS->globr('.', '*.php');
-foreach ($raw_files as $file) {
-    $file = substr($file, 2); // rm leading './'
-    if (strpos($file, 'library/standalone/') === 0) continue;
-    if (strpos($file, 'maintenance/update-config.php') === 0) continue;
-    if (strpos($file, 'test-settings.php') === 0) continue;
-    if (substr_count($file, '.') > 1) continue; // rm meta files
-    // process the file
-    $contents = file_get_contents($file);
-    $contents = preg_replace(
-        "#config->(set|get)\('(.+?)', '(.+?)'#",
-        "config->\\1('\\2.\\3'",
-        $contents
-    );
-    if ($contents === '') continue;
-    file_put_contents($file, $contents);
-}
-
-// vim: et sw=4 sts=4
--- a/plugins/phorum/config.default.php
+++ b/plugins/phorum/config.default.php
@@ -53,5 +53,6 @@ $config->set('Core.Encoding', $GLOBALS['PHORUM']['DATA']['CHARSET']); // we'll c
 if (strtolower($GLOBALS['PHORUM']['DATA']['CHARSET']) !== 'utf-8') {
  $config->set('Core.EscapeNonASCIICharacters', true);
 }
+$config->set('Core.AllowParseManyTags', false);

 // vim: et sw=4 sts=4
--- a/release2-tag.php
+++ b/release2-tag.php
@@ -1,22 +0,0 @@
-<?php
-
-// Tags releases
-
-if (php_sapi_name() != 'cli') {
-    echo 'Release script cannot be called from web-browser.';
-    exit;
-}
-
-require 'svn.php';
-
-$svn_info = my_svn_info('.');
-
-$version = trim(file_get_contents('VERSION'));
-
-$trunk_url  = $svn_info['Repository Root'] . '/htmlpurifier/trunk';
-$trunk_tag_url  = $svn_info['Repository Root'] . '/htmlpurifier/tags/' . $version;
-
-echo "Tagging trunk to tags/$version...";
-passthru("svn copy --message \"Tag $version release.\" $trunk_url $trunk_tag_url");
-
-// vim: et sw=4 sts=4
--- a/smoketests/test-schema/Type.mixed.txt
+++ b/smoketests/test-schema/Type.mixed.txt
@@ -1,5 +1,5 @@
 Type.mixed
 TYPE: mixed
-DEFAULT: new stdclass()
+DEFAULT: new stdClass()
 DESCRIPTION: The mixed type allows any type, and is not form-editable.
 --# vim: et sw=4 sts=4
--- a/tests/HTMLPurifier/AttrDef/CSS/AlphaValueTest.php
+++ b/tests/HTMLPurifier/AttrDef/CSS/AlphaValueTest.php
@@ -9,7 +9,7 @@ class HTMLPurifier_AttrDef_CSS_AlphaValueTest extends HTMLPurifier_AttrDefHarnes

        $this->assertDef('0');
        $this->assertDef('1');
-        $this->assertDef('.2');
+        $this->assertDef('0.2');

        // clamping to [0.0, 1,0]
        $this->assertDef('1.2', '1');
--- a/tests/HTMLPurifier/AttrDef/CSS/BackgroundTest.php
+++ b/tests/HTMLPurifier/AttrDef/CSS/BackgroundTest.php
@@ -17,7 +17,7 @@ class HTMLPurifier_AttrDef_CSS_BackgroundTest extends HTMLPurifier_AttrDefHarnes
        );
        $this->assertDef(
            'rgba(74, 12, 85, 0.35) repeat fixed bottom',
-            'rgba(74,12,85,.35) repeat fixed bottom'
+            'rgba(74,12,85,0.35) repeat fixed bottom'
        );
        $this->assertDef(
            'hsl(244, 47.4%, 88.1%) right center',
--- a/tests/HTMLPurifier/AttrDef/CSS/ColorTest.php
+++ b/tests/HTMLPurifier/AttrDef/CSS/ColorTest.php
@@ -20,8 +20,8 @@ class HTMLPurifier_AttrDef_CSS_ColorTest extends HTMLPurifier_AttrDefHarness
        $this->assertDef('rgb(12%,150%,0%)', 'rgb(12%,100%,0%)'); // percentage max values

        $this->assertDef('rgba(255, 0, 0, 0)', 'rgba(255,0,0,0)'); // rm spaces
-        $this->assertDef('rgba(100%,0%,0%,.4)');
-        $this->assertDef('rgba(38.1%,59.7%,1.8%,0.7)', 'rgba(38.1%,59.7%,1.8%,.7)'); // decimals okay
+        $this->assertDef('rgba(100%,0%,0%,0.4)');
+        $this->assertDef('rgba(38.1%,59.7%,1.8%,0.7)', 'rgba(38.1%,59.7%,1.8%,0.7)'); // decimals okay

        $this->assertDef('hsl(275, 45%, 81%)', 'hsl(275,45%,81%)'); // rm spaces
        $this->assertDef('hsl(100,0%,0%)');
@@ -30,8 +30,8 @@ class HTMLPurifier_AttrDef_CSS_ColorTest extends HTMLPurifier_AttrDefHarness
        $this->assertDef('hsl(380,125%,0%)', 'hsl(360,100%,0%)'); // max values

        $this->assertDef('hsla(100, 74%, 29%, 0)', 'hsla(100,74%,29%,0)'); // rm spaces
-        $this->assertDef('hsla(154,87%,21%,.4)');
-        $this->assertDef('hsla(45,94.3%,4.1%,0.7)', 'hsla(45,94.3%,4.1%,.7)'); // decimals okay
+        $this->assertDef('hsla(154,87%,21%,0.4)');
+        $this->assertDef('hsla(45,94.3%,4.1%,0.7)', 'hsla(45,94.3%,4.1%,0.7)'); // decimals okay

        $this->assertDef('#G00', false);
        $this->assertDef('cmyk(40, 23, 43, 23)', false);
--- a/tests/HTMLPurifier/AttrDef/CSS/NumberTest.php
+++ b/tests/HTMLPurifier/AttrDef/CSS/NumberTest.php
@@ -12,8 +12,8 @@ class HTMLPurifier_AttrDef_CSS_NumberTest extends HTMLPurifier_AttrDefHarness
        $this->assertDef('1.0', '1');
        $this->assertDef('34');
        $this->assertDef('4.5');
-        $this->assertDef('.5');
-        $this->assertDef('0.5', '.5');
+        $this->assertDef('0.5');
+        $this->assertDef('0.5', '0.5');
        $this->assertDef('-56.9');

        $this->assertDef('0.', '0');
@@ -21,10 +21,10 @@ class HTMLPurifier_AttrDef_CSS_NumberTest extends HTMLPurifier_AttrDefHarness
        $this->assertDef('0.0', '0');

        $this->assertDef('1.', '1');
-        $this->assertDef('.1', '.1');
+        $this->assertDef('.1', '0.1');

        $this->assertDef('1.0', '1');
-        $this->assertDef('0.1', '.1');
+        $this->assertDef('0.1', '0.1');

        $this->assertDef('000', '0');
        $this->assertDef(' 9', '9');
--- a/tests/HTMLPurifier/AttrDef/CSSTest.php
+++ b/tests/HTMLPurifier/AttrDef/CSSTest.php
@@ -64,8 +64,14 @@ class HTMLPurifier_AttrDef_CSSTest extends HTMLPurifier_AttrDefHarness
        $this->assertDef('width:-50px;', false);
        $this->assertDef('min-width:50%;');
        $this->assertDef('min-width:50px;');
-        $this->assertDef('min-width:auto;');
+        $this->assertDef('min-width:auto;', false);
+        $this->assertDef('min-width:initial;');
+        $this->assertDef('min-width:inherit;');
        $this->assertDef('min-width:-50px;', false);
+        $this->assertDef('min-width:50ch;');
+        $this->assertDef('min-width:50rem;');
+        $this->assertDef('min-width:50vw;');
+        $this->assertDef('min-width:-50vw;', false);
        $this->assertDef('text-decoration:underline;');
        $this->assertDef('font-family:sans-serif;');
        $this->assertDef("font-family:Gill, 'Times New Roman', sans-serif;");
@@ -134,8 +140,8 @@ class HTMLPurifier_AttrDef_CSSTest extends HTMLPurifier_AttrDefHarness
        $this->assertDef('scrollbar-highlight-color:#ff69b4;');
        $this->assertDef('scrollbar-shadow-color:#f0f;');

-        $this->assertDef('-moz-opacity:.2;');
-        $this->assertDef('-khtml-opacity:.2;');
+        $this->assertDef('-moz-opacity:0.2;');
+        $this->assertDef('-khtml-opacity:0.2;');
        $this->assertDef('filter:alpha(opacity=20);');

        $this->assertDef('border-top-left-radius:55pt 25pt;');
@@ -154,7 +160,7 @@ class HTMLPurifier_AttrDef_CSSTest extends HTMLPurifier_AttrDefHarness
        $this->assertDef('display:none;');
        $this->assertDef('visibility:visible;');
        $this->assertDef('overflow:scroll;');
-        $this->assertDef('opacity:.2;');
+        $this->assertDef('opacity:0.2;');
    }

    public function testForbidden()
--- a/tests/HTMLPurifier/AttrDef/URI/HostTest.php
+++ b/tests/HTMLPurifier/AttrDef/URI/HostTest.php
@@ -49,6 +49,7 @@ class HTMLPurifier_AttrDef_URI_HostTest extends HTMLPurifier_AttrDefHarness
        }
        $this->config->set('Core.EnableIDNA', true);
        $this->assertDef("\xE4\xB8\xAD\xE6\x96\x87.com.cn", "xn--fiq228c.com.cn");
+        $this->assertDef("faß.de", "xn--fa-hia.de");
        $this->assertDef("\xe2\x80\x85.com", false); // rejected
    }

--- a/tests/HTMLPurifier/ConfigSchemaTest.php
+++ b/tests/HTMLPurifier/ConfigSchemaTest.php
@@ -15,12 +15,12 @@ class HTMLPurifier_ConfigSchemaTest extends HTMLPurifier_Harness
        $this->schema->add('Car.Seats', 5, 'int', false);

        $this->assertIdentical($this->schema->defaults['Car.Seats'], 5);
-        $this->assertIdentical($this->schema->info['Car.Seats']->type, HTMLPurifier_VarParser::INT);
+        $this->assertIdentical($this->schema->info['Car.Seats']->type, HTMLPurifier_VarParser::C_INT);

        $this->schema->add('Car.Age', null, 'int', true);

        $this->assertIdentical($this->schema->defaults['Car.Age'], null);
-        $this->assertIdentical($this->schema->info['Car.Age']->type, HTMLPurifier_VarParser::INT);
+        $this->assertIdentical($this->schema->info['Car.Age']->type, HTMLPurifier_VarParser::C_INT);

    }

@@ -35,7 +35,7 @@ class HTMLPurifier_ConfigSchemaTest extends HTMLPurifier_Harness
        );

        $this->assertIdentical($this->schema->defaults['QuantumNumber.Difficulty'], null);
-        $this->assertIdentical($this->schema->info['QuantumNumber.Difficulty']->type, HTMLPurifier_VarParser::STRING);
+        $this->assertIdentical($this->schema->info['QuantumNumber.Difficulty']->type, HTMLPurifier_VarParser::C_STRING);
        $this->assertIdentical($this->schema->info['QuantumNumber.Difficulty']->allow_null, true);
        $this->assertIdentical($this->schema->info['QuantumNumber.Difficulty']->allowed,
            array(
@@ -70,7 +70,7 @@ class HTMLPurifier_ConfigSchemaTest extends HTMLPurifier_Harness
        );

        $this->assertIdentical($this->schema->defaults['Abbrev.HTH'], 'Happy to Help');
-        $this->assertIdentical($this->schema->info['Abbrev.HTH']->type, HTMLPurifier_VarParser::STRING);
+        $this->assertIdentical($this->schema->info['Abbrev.HTH']->type, HTMLPurifier_VarParser::C_STRING);
        $this->assertIdentical($this->schema->info['Abbrev.HTH']->allowed,
            array(
                'Happy to Help' => true,
--- a/tests/HTMLPurifier/EntityParserTest.php
+++ b/tests/HTMLPurifier/EntityParserTest.php
@@ -16,8 +16,12 @@ class HTMLPurifier_EntityParserTest extends HTMLPurifier_Harness
        $char_theta = $this->_entity_lookup->table['theta'];
        $this->assertIdentical($char_theta,
            $this->EntityParser->substituteNonSpecialEntities('&theta;') );
+        $this->assertIdentical($char_theta,
+            $this->EntityParser->substituteTextEntities('&theta;') );
        $this->assertIdentical('"',
            $this->EntityParser->substituteNonSpecialEntities('"') );
+        $this->assertIdentical('"',
+            $this->EntityParser->substituteTextEntities('"') );

        // numeric tests, adapted from Feyd
        $args = array();
@@ -71,6 +75,11 @@ class HTMLPurifier_EntityParserTest extends HTMLPurifier_Harness
                $expect,
                'Identical expectation [Hex: '. dechex($arg[0]) .']'
            );
+            $this->assertIdentical(
+                $this->EntityParser->substituteTextEntities($string),
+                $expect,
+                'Identical expectation [Hex: '. dechex($arg[0]) .']'
+            );
        }

    }
@@ -81,6 +90,10 @@ class HTMLPurifier_EntityParserTest extends HTMLPurifier_Harness
            "'",
            $this->EntityParser->substituteSpecialEntities('&#39;')
        );
+        $this->assertIdentical(
+            "'",
+            $this->EntityParser->substituteTextEntities('&#39;')
+        );
    }

 }
--- a/tests/HTMLPurifier/HTMLDefinitionTest.php
+++ b/tests/HTMLPurifier/HTMLDefinitionTest.php
@@ -384,6 +384,21 @@ a[href|title]
        $this->config->getHTMLDefinition();
    }

+    public function test_manyNestedTags()
+    {
+        $config = HTMLPurifier_Config::createDefault();
+        $config->set('Core.AllowParseManyTags', true);
+        $purifier = new HTMLPurifier($config);
+
+        $input = 'I am inside a lot of tags';
+        for ($i = 0; $i < 300; $i++) {
+            $input = '<div>' . $input . '</div>';
+        }
+        $output = $purifier->purify($input);
+
+        $this->assertIdentical($input, $output);
+    }
+
 }

 // vim: et sw=4 sts=4
--- a/tests/HTMLPurifier/HTMLModule/FormsTest.php
+++ b/tests/HTMLPurifier/HTMLModule/FormsTest.php
@@ -161,6 +161,13 @@ class HTMLPurifier_HTMLModule_FormsTest extends HTMLPurifier_HTMLModuleHarness
        $this->assertResult('<form action=""><input align="left" /></form>');
    }

+    public function testHTMLFormsConfigDirective()
+    {
+        $this->config->set('HTML.Trusted', false);
+        $this->config->set('HTML.Forms', true);
+
+        $this->assertResult('<form action="..." method="post"><input type="text" /><textarea cols="20" rows="3"></textarea></form>');
+    }
 }

 // vim: et sw=4 sts=4
--- a/tests/HTMLPurifier/HTMLModule/SafeScriptingTest.php
+++ b/tests/HTMLPurifier/HTMLModule/SafeScriptingTest.php
@@ -20,7 +20,15 @@ class HTMLPurifier_HTMLModule_SafeScriptingTest extends HTMLPurifier_HTMLModuleH
    public function testGood()
    {
        $this->assertResult(
-            '<script type="text/javascript" src="http://localhost/foo.js" />'
+            '<script type="text/javascript" src="http://localhost/foo.js"></script>'
+        );
+    }
+
+    public function testGoodWithAutoclosedTag()
+    {
+        $this->assertResult(
+            '<script type="text/javascript" src="http://localhost/foo.js"/>',
+            '<script type="text/javascript" src="http://localhost/foo.js"></script>'
        );
    }

@@ -30,6 +38,10 @@ class HTMLPurifier_HTMLModule_SafeScriptingTest extends HTMLPurifier_HTMLModuleH
            '<script type="text/javascript" src="http://localhost/foobar.js" />',
            ''
        );
+        $this->assertResult(
+            '<script type="text/javascript" src="http://localhost/FOO.JS" />',
+            ''
+        );
    }

 }
--- a/tests/HTMLPurifier/LanguageFactoryTest.php
+++ b/tests/HTMLPurifier/LanguageFactoryTest.php
@@ -29,45 +29,6 @@ class HTMLPurifier_LanguageFactoryTest extends HTMLPurifier_Harness

    }

-    public function testFallback()
-    {
-        $this->config->set('Core.Language', 'en-x-test');
-        $language = $this->factory->create($this->config, $this->context);
-
-        $this->assertIsA($language, 'HTMLPurifier_Language_en_x_test');
-        $this->assertIdentical($language->code, 'en-x-test');
-
-        $language->load();
-
-        // test overloaded message
-        $this->assertIdentical($language->getMessage('HTMLPurifier'), 'HTML Purifier X');
-
-        // test inherited message
-        $this->assertIdentical($language->getMessage('LanguageFactoryTest: Pizza'), 'Pizza');
-
-    }
-
-    public function testFallbackWithNoClass()
-    {
-        $this->config->set('Core.Language', 'en-x-testmini');
-        $language = $this->factory->create($this->config, $this->context);
-        $this->assertIsA($language, 'HTMLPurifier_Language');
-        $this->assertIdentical($language->code, 'en-x-testmini');
-        $language->load();
-        $this->assertIdentical($language->getMessage('HTMLPurifier'), 'HTML Purifier XNone');
-        $this->assertIdentical($language->getMessage('LanguageFactoryTest: Pizza'), 'Pizza');
-        $this->assertIdentical($language->error, false);
-    }
-
-    public function testNoSuchLanguage()
-    {
-        $this->config->set('Core.Language', 'en-x-testnone');
-        $language = $this->factory->create($this->config, $this->context);
-        $this->assertIsA($language, 'HTMLPurifier_Language');
-        $this->assertIdentical($language->code, 'en-x-testnone');
-        $this->assertIdentical($language->error, true);
-    }
-
 }

 // vim: et sw=4 sts=4
--- a/tests/HTMLPurifier/VarParser/FlexibleTest.php
+++ b/tests/HTMLPurifier/VarParser/FlexibleTest.php
@@ -53,7 +53,7 @@ class HTMLPurifier_VarParser_FlexibleTest extends HTMLPurifier_VarParserHarness

    public function testValidate_withMagicNumbers()
    {
-        $this->assertValid('foobar', HTMLPurifier_VarParser::STRING);
+        $this->assertValid('foobar', HTMLPurifier_VarParser::C_STRING);
    }

    public function testValidate_null()
--- a/tests/HTMLPurifierTest.php
+++ b/tests/HTMLPurifierTest.php
@@ -22,6 +22,23 @@ class HTMLPurifierTest extends HTMLPurifier_Harness

    }

+    public function test_purifyArray_nested()
+    {
+        $this->assertIdentical(
+            $this->purifier->purifyArray(
+                array('Good', '<b>Sketchy', 'foo' => array('bar' => '<script>bad</script>'))
+            ),
+            array('Good', '<b>Sketchy</b>', 'foo' => array('bar' => ''))
+        );
+    }
+
+    public function test_purifyArray_empty() {
+        $purifiedEmptyArray = $this->purifier->purifyArray(array());
+        $this->assertTrue(
+            empty($purifiedEmptyArray)
+        );
+    }
+
    public function testGetInstance()
    {
        $purifier  = HTMLPurifier::getInstance();
--- a/tests/common.php
+++ b/tests/common.php
@@ -7,7 +7,7 @@ if (!defined('HTMLPurifierTest')) {

 // setup our own autoload, checking for HTMLPurifier library if spl_autoload_register
 // is not allowed
-function __autoload($class)
+function test_autoload($class)
 {
    if (!function_exists('spl_autoload_register')) {
        if (HTMLPurifier_Bootstrap::autoload($class)) return true;
@@ -17,7 +17,7 @@ function __autoload($class)
    return true;
 }
 if (function_exists('spl_autoload_register')) {
-    spl_autoload_register('__autoload');
+    spl_autoload_register('test_autoload');
 }

 // default settings (protect against register_globals)
--- a/tests/index.php
+++ b/tests/index.php
@@ -33,6 +33,10 @@ error_reporting(E_ALL | E_STRICT);
 // exercises an error condition to detect for it.
 ini_set('log_errors', false);

+// But make it easier for us to debug if there is some misconfiguration
+// in the initial setup of the tests.
+ini_set('display_errors', true);
+
 define('HTMLPurifierTest', 1);
 define('HTMLPURIFIER_SCHEMA_STRICT', true); // validate schemas
 chdir(dirname(__FILE__));
--- a/release1-update.php
+++ b/release1-update.php
@@ -102,9 +102,9 @@ if (!$c) {
 }
 file_put_contents('library/HTMLPurifier/Config.php', $config_c);

-passthru('php maintenance/flush.php');
+passthru('maintenance/flush.sh');

-if ($is_dev) echo "Review changes, write something in WHATSNEW and FOCUS, and then commit with log 'Release $version.'" . PHP_EOL;
+if ($is_dev) echo "Review changes, write something in WHATSNEW, and then commit with log 'Release $version.'" . PHP_EOL;
 else echo "Numbers updated to dev, no other modifications necessary!";

 // vim: et sw=4 sts=4
Author	SHA1	Message	Date
Edward Z. Yang	08e27c97e4	Release 4.13.0 Signed-off-by: Edward Z. Yang <ezyang@mit.edu>	2020-06-28 20:56:53 -04:00
Edward Z. Yang	d7be9d2a8c	Update changelog Signed-off-by: Edward Z. Yang <ezyang@mit.edu>	2020-06-28 20:55:45 -04:00
Edward Z. Yang	ce7efc11b2	Delete language tests that are interfering with PSR-0 compatibility Signed-off-by: Edward Z. Yang <ezyang@mit.edu>	2020-06-28 20:38:16 -04:00
Mateusz Turcza	3bdc031224	Add %HTML.Forms config directive (#260 ) The %HTML.Forms directive enables Forms module regardless of the %HTML.Trusted value. This adds support for form elements without enabling other unsafe modules, such as Scripts, Iframe or Object. To achieve the same effect without this directive one has to explicitly list all enabled modules in %HTML.AllowedModules, and any not listed will be removed. This however is not very convenient, as the allowed modules may vary between doctypes. Resolves #213.	2020-06-28 20:26:33 -04:00
Sergei Morozov	d148edbcf1	Exclude more resources from the distribution package (#257 )	2020-06-06 10:29:01 -04:00
Fräntz Miccoli	ced089434d	Make purifyArray work with empty array (#245 )	2020-02-22 12:12:02 -05:00
Kieran	c2c91f52d0	Added tr@bgcolor to tidy (#244 )	2020-02-22 12:10:30 -05:00
Eloy Lafuente	37dd61c45f	Correct implode() params for php74 compliance (#243 ) Passing parameters to implode() in reverse order is deprecated, use implode($glue, $parts) instead of implode($parts, $glue). Part of https://tracker.moodle.org/browse/MDL-67115	2020-01-21 11:17:18 -05:00
Witold Wasiczko	d15890222b	Add support for stable php 7.4 (#242 )	2020-01-02 06:58:15 -05:00
Anders Jenbo	fe0452d688	Correct typehinting of maybeGet* (#240 ) getDefinition can return null, this wasn't properly hinted leaning to false error detections with static analyzers	2019-12-04 10:29:08 -05:00
lubomirbartos	df923d1f15	Issue 238 remove leading zeroes except if there is only zero (#239 ) * Issue 238 remove leading zeroes except if there is only zero * Issue-238 unit test fixes	2019-11-21 10:05:07 -05:00
Jordi Boggiano	4faca32a4d	Exclude language classes from autoloader optimization (#236 ) These classes are autoloaded by a custom autoloader	2019-10-31 13:42:00 -04:00
Edward Z. Yang	a617e55bc6	Release 4.12.0 Signed-off-by: Edward Z. Yang <ezyang@mit.edu>	2019-10-27 23:44:26 -04:00
Edward Z. Yang	3060a5606c	Update changelog Signed-off-by: Edward Z. Yang <ezyang@mit.edu>	2019-10-27 23:42:45 -04:00
Edward Z. Yang	b4ec8c8036	Merge remote-tracking branch 'ezyang/master'	2019-10-27 23:40:25 -04:00
Mateusz Turcza	06b3fc4cf4	Fix phpdoc params in HTMLModule::addElement() and Bool attr (#233 )	2019-10-25 10:07:38 -04:00
Witold Wasiczko	c6ca293eab	Add support for PHP 7.4 (#230 ) * Add php7.4 * 7.4 cannot fail * Disallow failures	2019-09-11 20:25:44 -04:00
Mateusz Turcza	ab2887e423	Fix DOM Lexer for PHP versions older than 5.4 (#225 )	2019-08-09 17:01:13 -04:00
Mateusz Turcza	029d1df5e3	Fix PHP 5.4 and 5.5 builds on Travis CI (#227 )	2019-08-09 09:45:41 -04:00
Edi Modrić	b88fcd180c	Replace curly braces with square brackets in string offsets (#224 )	2019-07-30 22:50:43 -04:00
Edward Z. Yang	83ab08bc1a	Release 4.11.0 Signed-off-by: Edward Z. Yang <ezyang@mit.edu>	2019-07-14 14:58:38 -04:00
Edward Z. Yang	2739fa5462	Update changelog. Signed-off-by: Edward Z. Yang <ezyang@mit.edu>	2019-07-14 14:22:14 -04:00
Sandro Miguel Marques	b91833877a	Method purifyArray() updated (#143 ) * Methof purifyArray() updated Now it works with multidimensional arrays * Add test case. Signed-off-by: Edward Z. Yang <ezyang@mit.edu>	2019-07-14 14:10:33 -04:00
Edward Z. Yang	abba77a80b	Recent PHPs default to display_error=0, override this in index.php Signed-off-by: Edward Z. Yang <ezyang@mit.edu>	2019-07-14 14:04:12 -04:00
Michael Kliewe	7cfc44654a	CSS: added "initial" and "inherit" to width + height (#144 ) * CSS: added "initial" and "inherit" to width + height CSS: added "initial" and "inherit" to min-width + min-height, removed "auto" CSS: added "initial" and "inherit" and "none" to max-width + max-height, removed "auto" * Fixed test: min-width:auto; should be false	2019-07-14 13:20:58 -04:00
msuzuki	8c153eef3a	Supported hundreds of nested HTML (#202 ) * Supported hundreds of nested HTML (#201) * Add Core.AllowParseManyTags	2019-07-14 13:15:31 -04:00
DiLong Fa	524cd08a59	Update Config.php (#211 ) Fixed Undefined index: class	2019-07-14 13:11:34 -04:00
Lukas Neumann	5a90c92d83	Adds PHP 7.3 to Travis (#214 ) * Adds PHP 7.3 to Travis * Fix tests for PHP 7.3	2019-07-14 13:10:24 -04:00
Darko Hrgovic	f03e1a2c48	Fixed reserved words in constants for PHP 7 as per https://www.php.net/manual/en/reserved.other-reserved-words.php (#222 )	2019-07-10 22:24:27 -04:00
Edward Z. Yang	a93250f251	Don't use @ warning suppression. Signed-off-by: Edward Z. Yang <ezyang@cs.stanford.edu>	2018-11-11 18:20:33 -05:00
Edward Z. Yang	5a8e48d672	Remove php extension from release1-update script, to appease #192 Signed-off-by: Edward Z. Yang <ezyang@cs.stanford.edu>	2018-11-11 17:05:51 -05:00
Edward Z. Yang	cb5a742574	Replace flush.php with a shell script, to appease #192 Signed-off-by: Edward Z. Yang <ezyang@cs.stanford.edu>	2018-11-11 17:04:11 -05:00
Edward Z. Yang	ff41146439	Delete defunct release2-tag.php script. Thanks Adham Saad <asaad@edrnet.com> for reporting. Signed-off-by: Edward Z. Yang <ezyang@cs.stanford.edu>	2018-11-11 16:59:24 -05:00
Edward Z. Yang	aa83689188	Delete references to PHP 5.1 in INSTALL. Signed-off-by: Edward Z. Yang <ezyang@cs.stanford.edu>	2018-11-11 16:56:06 -05:00
Edward Z. Yang	3d15f5253b	Don't define __autoload; rely on spl_autoload_register Fixes #196 Signed-off-by: Edward Z. Yang <ezyang@cs.stanford.edu>	2018-11-11 16:55:01 -05:00
Edward Z. Yang	21e32042e9	Update schema for case-sensitive safe scripting Signed-off-by: Edward Z. Yang <ezyang@cs.stanford.edu>	2018-11-11 16:54:33 -05:00
Edward Z. Yang	ce0ccc4bff	Delete unneeded update-config.php script Signed-off-by: Edward Z. Yang <ezyang@cs.stanford.edu>	2018-11-11 16:54:33 -05:00
Chris Pelzer	ab7bbefe8a	Update reference to the valid types to refer to HTMLPurifier_VarParser::types (#189 )	2018-11-11 16:23:01 -05:00
Edward Z. Yang	0f7b138aaf	Make SafeScripting case-sensitive. Signed-off-by: Edward Z. Yang <ezyang@cs.stanford.edu>	2018-11-11 16:21:58 -05:00
Edward Z. Yang	4b6b3b31e8	Typofix: AutoForamt -> AutoFormat Signed-off-by: Edward Z. Yang <ezyang@cs.stanford.edu>	2018-11-11 16:21:58 -05:00
Dimitri Gritsajuk	5a01e6535d	[SafeScripting] disable autoclosing of <script /> tag (#198 )	2018-11-11 15:04:11 -05:00
Benjamin Brahmer	b74425bee5	.htaccess support apache 2.4+ (#190 )	2018-11-11 14:55:13 -05:00
Oleg Kainov	39068e6d08	Update PHP version in INSTALL (#195 ) * update PHP version in INSTALL Fix #194 * update PHP version in INSTALL Fix #194	2018-10-23 20:03:41 -04:00
Daijobou	b81690c17e	More colors names (#176 ) Added more colors names https://www.w3schools.com/colors/colors_names.asp remove old unorded colors names	2018-06-09 22:48:13 -04:00
Mathias Brodala	4005ffd563	Suggest stable Composer installation (#179 ) Normally people should not use the latest master but the latest stable release instead.	2018-06-09 22:44:20 -04:00
Mateusz Turcza	89b3fe431e	Use IDNA constants only if defined (#171 ) Fixes #168. Solution based on https://git.ispconfig.org/ispconfig/ispconfig3/commit/0e3cf6f51b4fd.	2018-03-04 19:16:11 -05:00
Mateusz Turcza	3cb77da11d	Make tagName and node data detection hhvm compatible (#170 )	2018-03-04 13:22:03 -05:00
Edward Z. Yang	c1167edbf1	dummy commit Signed-off-by: Edward Z. Yang <ezyang@cs.stanford.edu>	2018-02-22 21:36:54 -05:00
Edward Z. Yang	c7b5148c4f	New changelog entry. Signed-off-by: Edward Z. Yang <ezyang@cs.stanford.edu>	2018-02-22 21:34:16 -05:00
Edward Z. Yang	f8c830de12	Fix SPDX identifier Signed-off-by: Edward Z. Yang <ezyang@cs.stanford.edu>	2018-02-22 21:26:02 -05:00
Edward Z. Yang	0737a6e916	Whoops, forgot to edit WHATSNEW Signed-off-by: Edward Z. Yang <ezyang@cs.stanford.edu>	2018-02-22 21:07:33 -05:00
Edward Z. Yang	d85d39da45	Release 4.10.0 Signed-off-by: Edward Z. Yang <ezyang@cs.stanford.edu>	2018-02-22 20:58:20 -05:00
Edward Z. Yang	f33d1f8e99	Changelog prep for release. (#167 ) Signed-off-by: Edward Z. Yang <ezyang@cs.stanford.edu>	2018-02-22 20:55:01 -05:00
John Flatness	6d6d88512a	Skip counting currentNesting if null This is an error starting in PHP 7.2	2017-12-30 00:23:44 -05:00
John Flatness	bb7ad66526	Quarantine __autoload defs for PHP 7.2 compat	2017-12-30 00:23:05 -05:00
Edward Z. Yang	64baeda65c	Deal with old libxml incompatibilities. Signed-off-by: Edward Z. Yang <ezyang@cs.stanford.edu>	2017-12-22 22:03:02 -05:00
Jan Dageförde	67c3798922	Add relative length units from CSS 3 cf. https://www.w3schools.com/cssref/css_units.asp	2017-12-22 21:59:47 -05:00
Brad Mostert	df64746caa	Fix spelling	2017-12-22 21:59:19 -05:00
Roberto	ab9c9f30fd	Small typos in comments	2017-12-13 11:16:39 -05:00
Edward Z. Yang	5988f29583	Remove PHP 5.3 support. Signed-off-by: Edward Z. Yang <ezyang@cs.stanford.edu>	2017-10-08 19:52:05 -04:00
Marina Glancy	ce0ede24de	Use IDNA2008 for converting domains to ASCII	2017-10-03 11:19:50 -04:00
Edward Z. Yang	17f80cd74b	Merge pull request #141 from pawelkania/master Fix E_WARNING when cache directory exists	2017-06-23 22:50:48 -04:00
pawelkania	e11f7c9802	Fix E_WARNING when cache directory exists Sometimes Serializer from another thread already creaded dir - this commit resolves this issue.	2017-06-20 09:53:14 +02:00
Edward Z. Yang	d21213e0d3	Merge pull request #139 from Edgars-Burtnieks/patch-1 Unnecessary space which gives error removed	2017-06-10 15:57:51 -04:00
Edgars-Burtnieks	9b3f856fb9	Update README.md	2017-06-10 22:36:19 +03:00
Edward Z. Yang	95e1bae318	Release 4.9.3 Signed-off-by: Edward Z. Yang <ezyang@cs.stanford.edu>	2017-06-02 22:28:16 -04:00
Edward Z. Yang	ff16ed3de4	Merge pull request #137 from Xiphin/master Fix: using null instead of false. Fixed CPU is 100% on PHP 7.1.*	2017-06-02 21:07:56 -04:00
Xiphin	1df505296f	Mod: using stdClass instead of stdclass	2017-06-02 09:55:46 +08:00
Xiphin	b9bc1039da	Mod: using null instead of false	2017-06-02 08:50:38 +08:00
Xiphin	cb4871f446	Fix: It runs on PHP 7.1.* CPU process is 100%	2017-06-01 21:32:25 +08:00
Edward Z. Yang	65d5cdee50	Merge pull request #130 from Izumi-kun/lexer-create-fix Autoloading must be skipped while checking for php builtin class.	2017-03-21 17:50:26 -07:00
Viktor Khokhryakov	b45c6f5363	Autoloading must be skipped while checking for php builtin class.	2017-03-20 10:42:28 +04:00
Edward Z. Yang	6d50e5282a	Release 4.9.2 Signed-off-by: Edward Z. Yang <ezyang@cs.stanford.edu>	2017-03-12 23:30:53 -07:00
Edward Z. Yang	5bc7c72608	Add tests for new entity decoding codepath. Signed-off-by: Edward Z. Yang <ezyang@cs.stanford.edu>	2017-03-12 20:05:09 -07:00
Edward Z. Yang	98984546d4	NEWS for 4.9.2 Signed-off-by: Edward Z. Yang <ezyang@cs.stanford.edu>	2017-03-12 20:03:47 -07:00
Edward Z. Yang	c7a2f6f0df	Merge pull request #129 from rybakit/patch-1 Fix a call to undefined function HTMLPurifier_Encoder()	2017-03-12 16:25:58 -07:00
Eugene Leonovich	fd24de69a3	Fix a call to undefined function HTMLPurifier_Encoder()	2017-03-12 22:44:03 +01:00
Edward Z. Yang	5688656174	Fix more PHP 5.3 problems. Signed-off-by: Edward Z. Yang <ezyang@cs.stanford.edu>	2017-03-08 18:01:58 -08:00
Edward Z. Yang	d728205767	Turn on 5.3 Travis testing. Signed-off-by: Edward Z. Yang <ezyang@cs.stanford.edu>	2017-03-08 17:47:14 -08:00
Edward Z. Yang	8836ae05aa	Fix PHP 5.3 compatibility, fixes #125 . Signed-off-by: Edward Z. Yang <ezyang@cs.stanford.edu>	2017-03-08 17:46:29 -08:00
Edward Z. Yang	b90295deda	Enable PHP 7.1 testing. Signed-off-by: Edward Z. Yang <ezyang@cs.stanford.edu>	2017-03-08 13:38:20 -08:00
@@ -1 +1 @@
 .9.1
 .13.0