$text
"; + $Block['element']['element']['allowRawHtmlInSafeMode'] = true; + + return $Block; + } + */ # # Fenced MathJax protected function blockFencedMathJaxLaTeX($Line) @@ -449,5 +460,5 @@ class ParsedownExtension extends \ParsedownExtra $text = $Block['element']['text']; $Block['element']['text'] = "\$\$\n" . $text . "\n\$\$"; return $Block; - } + } } \ No newline at end of file diff --git a/system/Models/Validation.php b/system/Models/Validation.php index b473ca0..96b9449 100644 --- a/system/Models/Validation.php +++ b/system/Models/Validation.php @@ -63,6 +63,22 @@ class Validation } return false; }, 'contains html'); + + Validator::addRule('markdownSecure', function($field, $value, array $params, array $fields) + { + /* strip out code blocks and blockquotes */ + $value = preg_replace('/[````][\s\S]+?[````]/', '', $value); + $value = preg_replace('/[```][\s\S]+?[```]/', '', $value); + $value = preg_replace('/[``][\s\S]+?[``]/', '', $value); + $value = preg_replace('/`[\s\S]+?`/', '', $value); + $value = preg_replace('/>[\s\S]+?[\n\r]/', '', $value); + + if ( $value == strip_tags($value) ) + { + return true; + } + return false; + }, 'not secure. For code please use markdown `inline-code` or ````fenced code blocks````.'); } /** @@ -172,9 +188,35 @@ class Validation return $this->validationResult($v, $name); } + + /** + * validation for content editor + * + * @param array $params with form data. + * @return true or $v->errors with array of errors to use in json-response + */ + + public function editorInput(array $params) + { + $v = new Validator($params); + + $v->rule('required', ['title', 'content', 'url']); + $v->rule('lengthBetween', 'title', 2, 40); + $v->rule('noHTML', 'title'); + $v->rule('markdownSecure', 'content'); + + if($v->validate()) + { + return true; + } + else + { + return $v->errors(); + } + } /** - * validation for dynamic settings (themes and plugins) + * validation for dynamic fields ( settings for themes and plugins) * * @param string $fieldName with the name of the field. * @param array or string $fieldValue with the values of the field. diff --git a/system/Models/Write.php b/system/Models/Write.php index 2f5549f..e9f65ca 100644 --- a/system/Models/Write.php +++ b/system/Models/Write.php @@ -50,7 +50,7 @@ class Write return true; } - protected function writeFile($folder, $file, $data) + public function writeFile($folder, $file, $data) { if($this->checkPath($folder)) { diff --git a/system/Routes/Api.php b/system/Routes/Api.php index 6727af6..0912789 100644 --- a/system/Routes/Api.php +++ b/system/Routes/Api.php @@ -1,5 +1,10 @@ get('/api/v1/themes', SettingsController::class . ':getThemeSettings')->setName('api.themes'); \ No newline at end of file +$app->get('/api/v1/themes', SettingsController::class . ':getThemeSettings')->setName('api.themes'); +$app->put('/api/v1/article', ContentController::class . ':updateArticle')->setName('api.article.update')->add(new RedirectIfUnauthenticated($container['router'], $container['flash'])); \ No newline at end of file diff --git a/system/author/content/content.twig b/system/author/content/content.twig index 2b294fe..e6bae84 100644 --- a/system/author/content/content.twig +++ b/system/author/content/content.twig @@ -8,18 +8,26 @@