mirror of
https://github.com/moodle/moodle.git
synced 2025-05-08 09:16:46 +02:00
be7f6d4834
Prior to this change, all the line endings in the imported HTMLPurifier library were using CRLF (\r\n aka Windows style), but the HTMLPurifier source and also the downloadable artefacts use LF (\n aka Linux style) as line endings. This has been the case since 510d190382003985eafd6f4407190d43509016a5 when with the commit "MDL-38672 import HTML Purifier 4.5.0" all line endings were changed from LF to CRLF. There was no comment in the commit on why this change was done. As the original source uses LF, this commit partly reverts 510d190382003985eafd6f4407190d43509016a5 and goes back to LF as line endings. Signed-off-by: Daniel Ziegenberg <daniel@ziegenberg.at>
63 lines
1.9 KiB
PHP
63 lines
1.9 KiB
PHP
<?php
|
|
|
|
/**
|
|
* A "safe" object module. In theory, objects permitted by this module will
|
|
* be safe, and untrusted users can be allowed to embed arbitrary flash objects
|
|
* (maybe other types too, but only Flash is supported as of right now).
|
|
* Highly experimental.
|
|
*/
|
|
class HTMLPurifier_HTMLModule_SafeObject extends HTMLPurifier_HTMLModule
|
|
{
|
|
/**
|
|
* @type string
|
|
*/
|
|
public $name = 'SafeObject';
|
|
|
|
/**
|
|
* @param HTMLPurifier_Config $config
|
|
*/
|
|
public function setup($config)
|
|
{
|
|
// These definitions are not intrinsically safe: the attribute transforms
|
|
// are a vital part of ensuring safety.
|
|
|
|
$max = $config->get('HTML.MaxImgLength');
|
|
$object = $this->addElement(
|
|
'object',
|
|
'Inline',
|
|
'Optional: param | Flow | #PCDATA',
|
|
'Common',
|
|
array(
|
|
// While technically not required by the spec, we're forcing
|
|
// it to this value.
|
|
'type' => 'Enum#application/x-shockwave-flash',
|
|
'width' => 'Pixels#' . $max,
|
|
'height' => 'Pixels#' . $max,
|
|
'data' => 'URI#embedded',
|
|
'codebase' => new HTMLPurifier_AttrDef_Enum(
|
|
array(
|
|
'http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=6,0,40,0'
|
|
)
|
|
),
|
|
)
|
|
);
|
|
$object->attr_transform_post[] = new HTMLPurifier_AttrTransform_SafeObject();
|
|
|
|
$param = $this->addElement(
|
|
'param',
|
|
false,
|
|
'Empty',
|
|
false,
|
|
array(
|
|
'id' => 'ID',
|
|
'name*' => 'Text',
|
|
'value' => 'Text'
|
|
)
|
|
);
|
|
$param->attr_transform_post[] = new HTMLPurifier_AttrTransform_SafeParam();
|
|
$this->info_injector[] = 'SafeObject';
|
|
}
|
|
}
|
|
|
|
// vim: et sw=4 sts=4
|