|
@@ -29,32 +29,32 @@ discard block |
|
|
block discarded – undo |
|
29
|
29
|
//define('TEST_DB_FORCE_TYPE','mysql'); // This is to force using mysql driver |
|
30
|
30
|
//require_once 'PHPUnit/Autoload.php'; |
|
31
|
31
|
|
|
32
|
|
-if (! defined('NOREQUIRESOC')) { |
|
|
32
|
+if (!defined('NOREQUIRESOC')) { |
|
33
|
33
|
define('NOREQUIRESOC', '1'); |
|
34
|
34
|
} |
|
35
|
|
-if (! defined('NOCSRFCHECK')) { |
|
|
35
|
+if (!defined('NOCSRFCHECK')) { |
|
36
|
36
|
define('NOCSRFCHECK', '1'); |
|
37
|
37
|
} |
|
38
|
|
-if (! defined('NOTOKENRENEWAL')) { |
|
|
38
|
+if (!defined('NOTOKENRENEWAL')) { |
|
39
|
39
|
define('NOTOKENRENEWAL', '1'); |
|
40
|
40
|
} |
|
41
|
|
-if (! defined('NOREQUIREMENU')) { |
|
|
41
|
+if (!defined('NOREQUIREMENU')) { |
|
42
|
42
|
define('NOREQUIREMENU', '1'); // If there is no menu to show |
|
43
|
43
|
} |
|
44
|
|
-if (! defined('NOREQUIREHTML')) { |
|
|
44
|
+if (!defined('NOREQUIREHTML')) { |
|
45
|
45
|
define('NOREQUIREHTML', '1'); // If we don't need to load the html.form.class.php |
|
46
|
46
|
} |
|
47
|
|
-if (! defined('NOREQUIREAJAX')) { |
|
|
47
|
+if (!defined('NOREQUIREAJAX')) { |
|
48
|
48
|
define('NOREQUIREAJAX', '1'); |
|
49
|
49
|
} |
|
50
|
|
-if (! defined("NOLOGIN")) { |
|
51
|
|
- define("NOLOGIN", '1'); // If this page is public (can be called outside logged session) |
|
|
50
|
+if (!defined("NOLOGIN")) { |
|
|
51
|
+ define("NOLOGIN", '1'); // If this page is public (can be called outside logged session) |
|
52
|
52
|
} |
|
53
|
|
-if (! defined("NOSESSION")) { |
|
|
53
|
+if (!defined("NOSESSION")) { |
|
54
|
54
|
define("NOSESSION", '1'); |
|
55
|
55
|
} |
|
56
|
56
|
|
|
57
|
|
-require_once dirname(__FILE__).'/../../htdocs/main.inc.php'; // We force include of main.inc.php instead of master.inc.php even if we are in CLI mode because it contains a lot of security components we want to test. |
|
|
57
|
+require_once dirname(__FILE__).'/../../htdocs/main.inc.php'; // We force include of main.inc.php instead of master.inc.php even if we are in CLI mode because it contains a lot of security components we want to test. |
|
58
|
58
|
require_once dirname(__FILE__).'/../../htdocs/core/lib/security.lib.php'; |
|
59
|
59
|
require_once dirname(__FILE__).'/../../htdocs/core/lib/security2.lib.php'; |
|
60
|
60
|
require_once dirname(__FILE__).'/CommonClassTest.class.php'; |
|
@@ -68,7 +68,7 @@ discard block |
|
|
block discarded – undo |
|
68
|
68
|
|
|
69
|
69
|
|
|
70
|
70
|
print "PHP Version: ".phpversion()."\n"; |
|
71
|
|
-print "Memory limit: ". ini_get('memory_limit')."\n"; |
|
|
71
|
+print "Memory limit: ".ini_get('memory_limit')."\n"; |
|
72
|
72
|
|
|
73
|
73
|
|
|
74
|
74
|
/** |
|
@@ -206,11 +206,11 @@ discard block |
|
|
block discarded – undo |
|
206
|
206
|
$result = testSqlAndScriptInject($test, 0); |
|
207
|
207
|
$this->assertGreaterThanOrEqual($expectedresult, $result, 'Error on testSqlAndScriptInject bbb'); |
|
208
|
208
|
|
|
209
|
|
- $test='<marquee onbeforeintput="alert(1)">'; |
|
210
|
|
- $result=testSqlAndScriptInject($test, 0); |
|
|
209
|
+ $test = '<marquee onbeforeintput="alert(1)">'; |
|
|
210
|
+ $result = testSqlAndScriptInject($test, 0); |
|
211
|
211
|
$this->assertGreaterThanOrEqual($expectedresult, $result, 'Error on testSqlAndScriptInject onbeforeintput'); |
|
212
|
|
- $test='<marquee onbounce="alert(1)">'; |
|
213
|
|
- $result=testSqlAndScriptInject($test, 0); |
|
|
212
|
+ $test = '<marquee onbounce="alert(1)">'; |
|
|
213
|
+ $result = testSqlAndScriptInject($test, 0); |
|
214
|
214
|
$this->assertGreaterThanOrEqual($expectedresult, $result, 'Error on testSqlAndScriptInject onbounce'); |
|
215
|
215
|
|
|
216
|
216
|
$test = '<SCRIPT SRC=http://xss.rocks/xss.js></SCRIPT>'; |
|
@@ -239,8 +239,8 @@ discard block |
|
|
block discarded – undo |
|
239
|
239
|
$result = testSqlAndScriptInject($test, 0); |
|
240
|
240
|
$this->assertGreaterThanOrEqual($expectedresult, $result, 'Error on testSqlAndScriptInject eee'); |
|
241
|
241
|
|
|
242
|
|
- $test = "<IMG SRC=\"jav\tascript:alert('XSS');\">"; // Is locked by some browser like chrome because the default directive no-referrer-when-downgrade is sent when requesting the SRC and then refused because of browser protection on img src load without referrer. |
|
243
|
|
- $test = "<IMG SRC=\"jav
ascript:alert('XSS');\">"; // Same |
|
|
242
|
+ $test = "<IMG SRC=\"jav\tascript:alert('XSS');\">"; // Is locked by some browser like chrome because the default directive no-referrer-when-downgrade is sent when requesting the SRC and then refused because of browser protection on img src load without referrer. |
|
|
243
|
+ $test = "<IMG SRC=\"jav
ascript:alert('XSS');\">"; // Same |
|
244
|
244
|
|
|
245
|
245
|
$test = '<SCRIPT/XSS SRC="http://xss.rocks/xss.js"></SCRIPT>'; |
|
246
|
246
|
$result = testSqlAndScriptInject($test, 0); |
|
@@ -274,21 +274,21 @@ discard block |
|
|
block discarded – undo |
|
274
|
274
|
$result = testSqlAndScriptInject($test, 0); |
|
275
|
275
|
$this->assertGreaterThanOrEqual($expectedresult, $result, 'Error on testSqlAndScriptInject lll'); |
|
276
|
276
|
|
|
277
|
|
- $test = '<a onscrollend=alert(1) style="display:block;overflow:auto;border:1px+dashed;width:500px;height:100px;"><br><br><br><br><br><span+id=x>test</span></a>'; // Add the char %F6 into the variable |
|
|
277
|
+ $test = '<a onscrollend=alert(1) style="display:block;overflow:auto;border:1px+dashed;width:500px;height:100px;"><br><br><br><br><br><span+id=x>test</span></a>'; // Add the char %F6 into the variable |
|
278
|
278
|
$result = testSqlAndScriptInject($test, 0); |
|
279
|
279
|
//print "test=".$test." result=".$result."\n"; |
|
280
|
280
|
$this->assertGreaterThanOrEqual($expectedresult, $result, 'Error on testSqlAndScriptInject mmm'); |
|
281
|
281
|
|
|
282
|
282
|
|
|
283
|
283
|
$test = "Text with ' encoded with the numeric html entity converted into text entity ' (like when submitted by CKEditor)"; |
|
284
|
|
- $result = testSqlAndScriptInject($test, 0); // result must be 0 |
|
|
284
|
+ $result = testSqlAndScriptInject($test, 0); // result must be 0 |
|
285
|
285
|
$this->assertEquals(0, $result, 'Error on testSqlAndScriptInject mmm, result should be 0 and is not'); |
|
286
|
286
|
|
|
287
|
287
|
$test = '<a href="j	a	v	asc
ri	pt:(a	l	e	r	t	(document.cookie))">XSS</a>'; |
|
288
|
288
|
$result = testSqlAndScriptInject($test, 0); |
|
289
|
289
|
$this->assertGreaterThanOrEqual($expectedresult, $result, 'Error on testSqlAndScriptInject nnn, result should be >= 1 and is not'); |
|
290
|
290
|
|
|
291
|
|
- $test = "/dolibarr/htdocs/index.php/".chr('246')."abc"; // Add the char %F6 into the variable |
|
|
291
|
+ $test = "/dolibarr/htdocs/index.php/".chr('246')."abc"; // Add the char %F6 into the variable |
|
292
|
292
|
$result = testSqlAndScriptInject($test, 2); |
|
293
|
293
|
//print "test=".$test." result=".$result."\n"; |
|
294
|
294
|
$this->assertGreaterThanOrEqual($expectedresult, $result, 'Error on testSqlAndScriptInject with a non valid UTF8 char'); |
|
@@ -304,7 +304,7 @@ discard block |
|
|
block discarded – undo |
|
304
|
304
|
// Can allow the " in GET parameter value |
|
305
|
305
|
define("SECURITY_WAF_ALLOW_QUOTES_IN_GET", 1); |
|
306
|
306
|
$test = 'aa"bb'; |
|
307
|
|
- $result = testSqlAndScriptInject($test, 1); // Should return 0 = allowed |
|
|
307
|
+ $result = testSqlAndScriptInject($test, 1); // Should return 0 = allowed |
|
308
|
308
|
$this->assertEquals(0, $result, 'Error on testSqlAndScriptInject with SECURITY_WAF_ALLOW_QUOTES_IN_GET, should return 0, result='.$result); |
|
309
|
309
|
} |
|
310
|
310
|
|
|
@@ -406,21 +406,21 @@ discard block |
|
|
block discarded – undo |
|
406
|
406
|
{ |
|
407
|
407
|
global $conf; |
|
408
|
408
|
|
|
409
|
|
- $genpass1 = getRandomPassword(true); // Should be a string return by dol_hash (if no option set, will be md5) |
|
|
409
|
+ $genpass1 = getRandomPassword(true); // Should be a string return by dol_hash (if no option set, will be md5) |
|
410
|
410
|
print __METHOD__." genpass1=".$genpass1."\n"; |
|
411
|
411
|
$this->assertEquals(strlen($genpass1), 32); |
|
412
|
412
|
|
|
413
|
|
- $genpass1 = getRandomPassword(true, array('I')); // Should be a string return by dol_hash (if no option set, will be md5) |
|
|
413
|
+ $genpass1 = getRandomPassword(true, array('I')); // Should be a string return by dol_hash (if no option set, will be md5) |
|
414
|
414
|
print __METHOD__." genpass1=".$genpass1."\n"; |
|
415
|
415
|
$this->assertEquals(strlen($genpass1), 32); |
|
416
|
416
|
|
|
417
|
417
|
$conf->global->USER_PASSWORD_GENERATED = 'None'; |
|
418
|
|
- $genpass2 = getRandomPassword(false); // Should return an empty string |
|
|
418
|
+ $genpass2 = getRandomPassword(false); // Should return an empty string |
|
419
|
419
|
print __METHOD__." genpass2=".$genpass2."\n"; |
|
420
|
420
|
$this->assertEquals($genpass2, ''); |
|
421
|
421
|
|
|
422
|
422
|
$conf->global->USER_PASSWORD_GENERATED = 'Standard'; |
|
423
|
|
- $genpass3 = getRandomPassword(false); // Should return a password of 12 chars |
|
|
423
|
+ $genpass3 = getRandomPassword(false); // Should return a password of 12 chars |
|
424
|
424
|
print __METHOD__." genpass3=".$genpass3."\n"; |
|
425
|
425
|
$this->assertEquals(strlen($genpass3), 12); |
|
426
|
426
|
|
|
@@ -434,7 +434,7 @@ discard block |
|
|
block discarded – undo |
|
434
|
434
|
*/ |
|
435
|
435
|
public function testRestrictedArea() |
|
436
|
436
|
{ |
|
437
|
|
- global $conf,$user,$langs,$db; |
|
|
437
|
+ global $conf, $user, $langs, $db; |
|
438
|
438
|
$conf = $this->savconf; |
|
439
|
439
|
$user = $this->savuser; |
|
440
|
440
|
$langs = $this->savlangs; |
|
@@ -465,40 +465,40 @@ discard block |
|
|
block discarded – undo |
|
465
|
465
|
$tmpvar = preg_match('/not supported/', $tmp['curl_error_msg']); |
|
466
|
466
|
$this->assertEquals(1, $tmpvar, "Did not find the /not supported/ in getURLContent error message. We should."); |
|
467
|
467
|
|
|
468
|
|
- $url = 'https://www.dolibarr.fr'; // This is a redirect 301 page |
|
469
|
|
- $tmp = getURLContent($url, 'GET', '', 0); // We do NOT follow |
|
|
468
|
+ $url = 'https://www.dolibarr.fr'; // This is a redirect 301 page |
|
|
469
|
+ $tmp = getURLContent($url, 'GET', '', 0); // We do NOT follow |
|
470
|
470
|
print __METHOD__." url=".$url."\n"; |
|
471
|
471
|
$this->assertEquals(301, (empty($tmp['http_code']) ? 0 : $tmp['http_code']), 'Should GET url 301 response'); |
|
472
|
472
|
|
|
473
|
|
- $url = 'https://www.dolibarr.fr'; // This is a redirect 301 page |
|
474
|
|
- $tmp = getURLContent($url); // We DO follow a page with return 300 so result should be 200 |
|
|
473
|
+ $url = 'https://www.dolibarr.fr'; // This is a redirect 301 page |
|
|
474
|
+ $tmp = getURLContent($url); // We DO follow a page with return 300 so result should be 200 |
|
475
|
475
|
print __METHOD__." url=".$url."\n"; |
|
476
|
476
|
$this->assertEquals(200, (empty($tmp['http_code']) ? 0 : $tmp['http_code']), 'Should GET url 301 with a follow -> 200 but we get '.(empty($tmp['http_code']) ? 0 : $tmp['http_code'])); |
|
477
|
477
|
|
|
478
|
478
|
$url = 'http://localhost'; |
|
479
|
|
- $tmp = getURLContent($url, 'GET', '', 0, array(), array('http', 'https'), 0); // Only external URL |
|
|
479
|
+ $tmp = getURLContent($url, 'GET', '', 0, array(), array('http', 'https'), 0); // Only external URL |
|
480
|
480
|
print __METHOD__." url=".$url."\n"; |
|
481
|
|
- $this->assertEquals(400, (empty($tmp['http_code']) ? 0 : $tmp['http_code']), 'Should GET url to '.$url.' that resolves to a local URL'); // Test we receive an error because localtest.me is not an external URL |
|
|
481
|
+ $this->assertEquals(400, (empty($tmp['http_code']) ? 0 : $tmp['http_code']), 'Should GET url to '.$url.' that resolves to a local URL'); // Test we receive an error because localtest.me is not an external URL |
|
482
|
482
|
|
|
483
|
483
|
$url = 'http://127.0.0.1'; |
|
484
|
|
- $tmp = getURLContent($url, 'GET', '', 0, array(), array('http', 'https'), 0); // Only external URL |
|
|
484
|
+ $tmp = getURLContent($url, 'GET', '', 0, array(), array('http', 'https'), 0); // Only external URL |
|
485
|
485
|
print __METHOD__." url=".$url."\n"; |
|
486
|
|
- $this->assertEquals(400, (empty($tmp['http_code']) ? 0 : $tmp['http_code']), 'Should GET url to '.$url.' that is a local URL'); // Test we receive an error because 127.0.0.1 is not an external URL |
|
|
486
|
+ $this->assertEquals(400, (empty($tmp['http_code']) ? 0 : $tmp['http_code']), 'Should GET url to '.$url.' that is a local URL'); // Test we receive an error because 127.0.0.1 is not an external URL |
|
487
|
487
|
|
|
488
|
488
|
$url = 'http://127.0.2.1'; |
|
489
|
|
- $tmp = getURLContent($url, 'GET', '', 0, array(), array('http', 'https'), 0); // Only external URL |
|
|
489
|
+ $tmp = getURLContent($url, 'GET', '', 0, array(), array('http', 'https'), 0); // Only external URL |
|
490
|
490
|
print __METHOD__." url=".$url."\n"; |
|
491
|
|
- $this->assertEquals(400, (empty($tmp['http_code']) ? 0 : $tmp['http_code']), 'Should GET url to '.$url.' that is a local URL'); // Test we receive an error because 127.0.2.1 is not an external URL |
|
|
491
|
+ $this->assertEquals(400, (empty($tmp['http_code']) ? 0 : $tmp['http_code']), 'Should GET url to '.$url.' that is a local URL'); // Test we receive an error because 127.0.2.1 is not an external URL |
|
492
|
492
|
|
|
493
|
493
|
$url = 'https://169.254.0.1'; |
|
494
|
|
- $tmp = getURLContent($url, 'GET', '', 0, array(), array('http', 'https'), 0); // Only external URL |
|
|
494
|
+ $tmp = getURLContent($url, 'GET', '', 0, array(), array('http', 'https'), 0); // Only external URL |
|
495
|
495
|
print __METHOD__." url=".$url."\n"; |
|
496
|
|
- $this->assertEquals(400, (empty($tmp['http_code']) ? 0 : $tmp['http_code']), 'Should GET url to '.$url.' that is a local URL'); // Test we receive an error because 169.254.0.1 is not an external URL |
|
|
496
|
+ $this->assertEquals(400, (empty($tmp['http_code']) ? 0 : $tmp['http_code']), 'Should GET url to '.$url.' that is a local URL'); // Test we receive an error because 169.254.0.1 is not an external URL |
|
497
|
497
|
|
|
498
|
498
|
$url = 'http://[::1]'; |
|
499
|
|
- $tmp = getURLContent($url, 'GET', '', 0, array(), array('http', 'https'), 0); // Only external URL |
|
|
499
|
+ $tmp = getURLContent($url, 'GET', '', 0, array(), array('http', 'https'), 0); // Only external URL |
|
500
|
500
|
print __METHOD__." url=".$url."\n"; |
|
501
|
|
- $this->assertEquals(400, (empty($tmp['http_code']) ? 0 : $tmp['http_code']), 'Should GET url to '.$url.' that is a local URL'); // Test we receive an error because [::1] is not an external URL |
|
|
501
|
+ $this->assertEquals(400, (empty($tmp['http_code']) ? 0 : $tmp['http_code']), 'Should GET url to '.$url.' that is a local URL'); // Test we receive an error because [::1] is not an external URL |
|
502
|
502
|
|
|
503
|
503
|
/*$url = 'localtest.me'; |
|
504
|
504
|
$tmp = getURLContent($url, 'GET', '', 0, array(), array('http', 'https'), 0); // Only external URL |
|
@@ -507,9 +507,9 @@ discard block |
|
|
block discarded – undo |
|
507
|
507
|
*/ |
|
508
|
508
|
|
|
509
|
509
|
$url = 'http://192.0.0.192'; |
|
510
|
|
- $tmp = getURLContent($url, 'GET', '', 0, array(), array('http', 'https'), 0); // Only external URL but on an IP in blacklist |
|
|
510
|
+ $tmp = getURLContent($url, 'GET', '', 0, array(), array('http', 'https'), 0); // Only external URL but on an IP in blacklist |
|
511
|
511
|
print __METHOD__." url=".$url." tmp['http_code'] = ".(empty($tmp['http_code']) ? 0 : $tmp['http_code'])."\n"; |
|
512
|
|
- $this->assertEquals(400, (empty($tmp['http_code']) ? 0 : $tmp['http_code']), 'Access should be refused and was not'); // Test we receive an error because ip is in blacklist |
|
|
512
|
+ $this->assertEquals(400, (empty($tmp['http_code']) ? 0 : $tmp['http_code']), 'Access should be refused and was not'); // Test we receive an error because ip is in blacklist |
|
513
|
513
|
|
|
514
|
514
|
return 0; |
|
515
|
515
|
} |
|
@@ -521,7 +521,7 @@ discard block |
|
|
block discarded – undo |
|
521
|
521
|
*/ |
|
522
|
522
|
public function testDolSanitizeUrl() |
|
523
|
523
|
{ |
|
524
|
|
- global $conf,$user,$langs,$db; |
|
|
524
|
+ global $conf, $user, $langs, $db; |
|
525
|
525
|
$conf = $this->savconf; |
|
526
|
526
|
$user = $this->savuser; |
|
527
|
527
|
$langs = $this->savlangs; |
|
@@ -547,7 +547,7 @@ discard block |
|
|
block discarded – undo |
|
547
|
547
|
*/ |
|
548
|
548
|
public function testDolSanitizeEmail() |
|
549
|
549
|
{ |
|
550
|
|
- global $conf,$user,$langs,$db; |
|
|
550
|
+ global $conf, $user, $langs, $db; |
|
551
|
551
|
$conf = $this->savconf; |
|
552
|
552
|
$user = $this->savuser; |
|
553
|
553
|
$langs = $this->savlangs; |
|
@@ -577,7 +577,7 @@ discard block |
|
|
block discarded – undo |
|
577
|
577
|
*/ |
|
578
|
578
|
public function testDolSanitizeFileName() |
|
579
|
579
|
{ |
|
580
|
|
- global $conf,$user,$langs,$db; |
|
|
580
|
+ global $conf, $user, $langs, $db; |
|
581
|
581
|
$conf = $this->savconf; |
|
582
|
582
|
$user = $this->savuser; |
|
583
|
583
|
$langs = $this->savlangs; |
|
@@ -600,7 +600,7 @@ discard block |
|
|
block discarded – undo |
|
600
|
600
|
*/ |
|
601
|
601
|
public function testDolEval() |
|
602
|
602
|
{ |
|
603
|
|
- global $conf,$user,$langs,$db; |
|
|
603
|
+ global $conf, $user, $langs, $db; |
|
604
|
604
|
$conf = $this->savconf; |
|
605
|
605
|
$user = $this->savuser; |
|
606
|
606
|
$langs = $this->savlangs; |
|
@@ -643,7 +643,7 @@ discard block |
|
|
block discarded – undo |
|
643
|
643
|
print "result4 = ".$result."\n"; |
|
644
|
644
|
$this->assertEquals('Parent project not found', $result, 'Test 4'); |
|
645
|
645
|
|
|
646
|
|
- $result = dol_eval('1==\x01', 1, 0); // Check that we can't make dol_eval on string containing \ char. |
|
|
646
|
+ $result = dol_eval('1==\x01', 1, 0); // Check that we can't make dol_eval on string containing \ char. |
|
647
|
647
|
print "result5 = ".$result."\n"; |
|
648
|
648
|
$this->assertStringContainsString('Bad string syntax to evaluate (found chars that are not chars for a simple one line clean eval string)', $result); |
|
649
|
649
|
|
|
@@ -668,12 +668,12 @@ discard block |
|
|
block discarded – undo |
|
668
|
668
|
// Now string not allowed |
|
669
|
669
|
|
|
670
|
670
|
$s = '4 <5'; |
|
671
|
|
- $result = (string) dol_eval($s, 1, 1, '2'); // in mode 2, char < is allowed only if followed by a space |
|
|
671
|
+ $result = (string) dol_eval($s, 1, 1, '2'); // in mode 2, char < is allowed only if followed by a space |
|
672
|
672
|
print "result = ".$result."\n"; |
|
673
|
673
|
$this->assertStringContainsString('Bad string syntax to evaluate', $result, 'Test 4 <5 - The string was not detected as evil'); |
|
674
|
674
|
|
|
675
|
675
|
$s = '4 < 5'; |
|
676
|
|
- $result = (string) dol_eval($s, 1, 1, '1'); // in mode 1, char < is always forbidden |
|
|
676
|
+ $result = (string) dol_eval($s, 1, 1, '1'); // in mode 1, char < is always forbidden |
|
677
|
677
|
print "result = ".$result."\n"; |
|
678
|
678
|
$this->assertStringContainsString('Bad string syntax to evaluate', $result, 'Test 4 < 5 - The string was not detected as evil'); |
|
679
|
679
|
|
|
@@ -687,19 +687,19 @@ discard block |
|
|
block discarded – undo |
|
687
|
687
|
print "result = ".$result."\n"; |
|
688
|
688
|
$this->assertStringContainsString('Bad string syntax to evaluate', $result, 'The string was not detected as evil'); |
|
689
|
689
|
|
|
690
|
|
- $result = dol_eval('json_encode(array_map(implode("",["ex","ec"]), ["id"]))', 1, 1, '1'); // result of dol_eval may be an object Closure |
|
|
690
|
+ $result = dol_eval('json_encode(array_map(implode("",["ex","ec"]), ["id"]))', 1, 1, '1'); // result of dol_eval may be an object Closure |
|
691
|
691
|
print "result4a = ".json_encode($result)."\n"; |
|
692
|
692
|
$this->assertStringContainsString('Bad string syntax to evaluate', json_encode($result), 'The string was not detected as evil, it should due to the [ char and method "2"'); |
|
693
|
693
|
|
|
694
|
|
- $result = dol_eval('json_encode(array_map(implode("",["ex","ec"]), ["id"]))', 1, 1, '2'); // result of dol_eval may be an object Closure |
|
|
694
|
+ $result = dol_eval('json_encode(array_map(implode("",["ex","ec"]), ["id"]))', 1, 1, '2'); // result of dol_eval may be an object Closure |
|
695
|
695
|
print "result4b = ".json_encode($result)."\n"; |
|
696
|
696
|
$this->assertStringContainsString('Bad string syntax to evaluate', json_encode($result), 'The string was not detected as evil, it should due to the use of array_map'); |
|
697
|
697
|
|
|
698
|
|
- $result = dol_eval('json_encode(array_map(implode("",array("ex","ec"), array("id")))', 1, 1, '1'); // result of dol_eval may be an object Closure |
|
|
698
|
+ $result = dol_eval('json_encode(array_map(implode("",array("ex","ec"), array("id")))', 1, 1, '1'); // result of dol_eval may be an object Closure |
|
699
|
699
|
print "result4c = ".json_encode($result)."\n"; |
|
700
|
700
|
$this->assertStringContainsString('Bad string syntax to evaluate', json_encode($result), 'The string was not detected as evil, it should due to the use of array_map'); |
|
701
|
701
|
|
|
702
|
|
- $result = dol_eval('$a=function() { }; $a', 1, 1, '0'); // result of dol_eval may be an object Closure |
|
|
702
|
+ $result = dol_eval('$a=function() { }; $a', 1, 1, '0'); // result of dol_eval may be an object Closure |
|
703
|
703
|
print "result5 = ".json_encode($result)."\n"; |
|
704
|
704
|
$this->assertStringContainsString('Bad string syntax to evaluate', json_encode($result), 'The string was not detected as evil'); |
|
705
|
705
|
|
|
@@ -707,7 +707,7 @@ discard block |
|
|
block discarded – undo |
|
707
|
707
|
print "result6 = ".json_encode($result)."\n"; |
|
708
|
708
|
$this->assertStringContainsString('Bad string syntax to evaluate', json_encode($result), 'The string was not detected as evil'); |
|
709
|
709
|
|
|
710
|
|
- $result = (string) dol_eval('instruction;', 1, 1); // ; is not allowed. |
|
|
710
|
+ $result = (string) dol_eval('instruction;', 1, 1); // ; is not allowed. |
|
711
|
711
|
print "result7 = ".$result."\n"; |
|
712
|
712
|
$this->assertStringContainsString('Bad string syntax to evaluate (found chars that are not chars for a simple one line clean eval string)', $result, 'The string was not detected as evil'); |
|
713
|
713
|
|
|
@@ -737,11 +737,11 @@ discard block |
|
|
block discarded – undo |
|
737
|
737
|
print "result10 = ".$result."\n"; |
|
738
|
738
|
$this->assertStringContainsString('Bad string syntax to evaluate', $result, 'The string was not detected as evil'); |
|
739
|
739
|
|
|
740
|
|
- $result = (string) dol_eval("('ex'.'ec')('ls')", 1, 0); // This will execute exec of ls |
|
|
740
|
+ $result = (string) dol_eval("('ex'.'ec')('ls')", 1, 0); // This will execute exec of ls |
|
741
|
741
|
print "result11 = ".$result."\n"; |
|
742
|
742
|
$this->assertStringContainsString('Bad string syntax to evaluate (mode 1, found call of a function or method without using the direct name of the function)', $result, 'The string was not detected as evil'); |
|
743
|
743
|
|
|
744
|
|
- $result = (string) dol_eval("('ex'.'ec') /* */ (/* */'ls')", 1, 0); // This will execute exec of ls |
|
|
744
|
+ $result = (string) dol_eval("('ex'.'ec') /* */ (/* */'ls')", 1, 0); // This will execute exec of ls |
|
745
|
745
|
print "result11 = ".$result."\n"; |
|
746
|
746
|
$this->assertStringContainsString('Bad string syntax to evaluate (mode 1, found call of a function or method without using the direct name of the function)', $result, 'The string was not detected as evil'); |
|
747
|
747
|
|
|
@@ -755,7 +755,7 @@ discard block |
|
|
block discarded – undo |
|
755
|
755
|
|
|
756
|
756
|
// Must be allowed |
|
757
|
757
|
|
|
758
|
|
- global $mainmenu,$leftmenu; // Used into following strings to eval |
|
|
758
|
+ global $mainmenu, $leftmenu; // Used into following strings to eval |
|
759
|
759
|
|
|
760
|
760
|
$leftmenu = 'AAA'; |
|
761
|
761
|
$result = dol_eval('$conf->currency && preg_match(\'/^(AAA|BBB)/\',$leftmenu)', 1, 1, '1'); |
|
@@ -779,13 +779,13 @@ discard block |
|
|
block discarded – undo |
|
779
|
779
|
$this->assertFalse($result); |
|
780
|
780
|
|
|
781
|
781
|
$leftmenu = 'XXX'; |
|
782
|
|
- $conf->global->MAIN_FEATURES_LEVEL = 1; // Force for the case option is -1 |
|
|
782
|
+ $conf->global->MAIN_FEATURES_LEVEL = 1; // Force for the case option is -1 |
|
783
|
783
|
$string = '(isModEnabled("user") || isModEnabled("resource")) && getDolGlobalInt("MAIN_FEATURES_LEVEL") >= 0 && preg_match(\'/^(admintools|all|XXX)/\', $leftmenu)'; |
|
784
|
784
|
$result = dol_eval($string, 1, 1, '1'); |
|
785
|
785
|
print "result17 = ".$result."\n"; |
|
786
|
786
|
$this->assertTrue($result); |
|
787
|
787
|
|
|
788
|
|
- $result = dol_eval('1 && getDolGlobalInt("doesnotexist1") && $conf->global->MAIN_FEATURES_LEVEL', 1, 0); // Should return false and not a 'Bad string syntax to evaluate ...' |
|
|
788
|
+ $result = dol_eval('1 && getDolGlobalInt("doesnotexist1") && $conf->global->MAIN_FEATURES_LEVEL', 1, 0); // Should return false and not a 'Bad string syntax to evaluate ...' |
|
789
|
789
|
print "result18 = ".$result."\n"; |
|
790
|
790
|
$this->assertFalse($result); |
|
791
|
791
|
|
|
@@ -863,11 +863,11 @@ discard block |
|
|
block discarded – undo |
|
863
|
863
|
$this->assertEquals('a', $result); |
|
864
|
864
|
|
|
865
|
865
|
// Test that testRealCharforNumericEntities return an emoji utf8 char when code is inside Emoji range |
|
866
|
|
- $arraytmp = array(0 => '✅', 1 => '9989;'); // Encoded as decimal |
|
|
866
|
+ $arraytmp = array(0 => '✅', 1 => '9989;'); // Encoded as decimal |
|
867
|
867
|
$result = realCharForNumericEntities($arraytmp); |
|
868
|
868
|
$this->assertEquals('✅', $result); |
|
869
|
869
|
|
|
870
|
|
- $arraytmp = array(0 => '✅', 1 => 'x2705;'); // Encoded as hexadecimal |
|
|
870
|
+ $arraytmp = array(0 => '✅', 1 => 'x2705;'); // Encoded as hexadecimal |
|
871
|
871
|
$result = realCharForNumericEntities($arraytmp); |
|
872
|
872
|
$this->assertEquals('✅', $result); |
|
873
|
873
|
|
|
@@ -886,7 +886,7 @@ discard block |
|
|
block discarded – undo |
|
886
|
886
|
global $conf; |
|
887
|
887
|
|
|
888
|
888
|
// Set options for cleaning data |
|
889
|
|
- $conf->global->MAIN_RESTRICTHTML_ONLY_VALID_HTML = 0; // disabled, does not work on HTML5 and some libxml versions |
|
|
889
|
+ $conf->global->MAIN_RESTRICTHTML_ONLY_VALID_HTML = 0; // disabled, does not work on HTML5 and some libxml versions |
|
890
|
890
|
// Enable option MAIN_RESTRICTHTML_ONLY_VALID_HTML_TIDY if possible |
|
891
|
891
|
if (extension_loaded('tidy') && class_exists("tidy")) { |
|
892
|
892
|
$conf->global->MAIN_RESTRICTHTML_ONLY_VALID_HTML_TIDY = 1; |
|
@@ -894,7 +894,7 @@ discard block |
|
|
block discarded – undo |
|
894
|
894
|
$conf->global->MAIN_RESTRICTHTML_ONLY_VALID_HTML_TIDY = 0; |
|
895
|
895
|
print "WARNING !!! php-tidy is not available !!!"; |
|
896
|
896
|
} |
|
897
|
|
- $conf->global->MAIN_RESTRICTHTML_REMOVE_ALSO_BAD_ATTRIBUTES = 0; // disabled, does not work on HTML5 and some libxml versions |
|
|
897
|
+ $conf->global->MAIN_RESTRICTHTML_REMOVE_ALSO_BAD_ATTRIBUTES = 0; // disabled, does not work on HTML5 and some libxml versions |
|
898
|
898
|
|
|
899
|
899
|
|
|
900
|
900
|
// dolPrintHTML - With dolPrintHTML(), only content not already in HTML is encoded with HTML. |
|
@@ -907,7 +907,7 @@ discard block |
|
|
block discarded – undo |
|
907
|
907
|
//$result = dol_escape_htmltag(dol_htmlwithnojs(dol_string_onlythesehtmltags(dol_htmlentitiesbr($stringtotest), 1, 1, 1, 0, array())), 1, 1, 'common', 0, 1); |
|
908
|
908
|
$result = dolPrintHTML($stringtotest); |
|
909
|
909
|
print __METHOD__." result=".$result."\n"; |
|
910
|
|
- $this->assertEquals($stringfixed, $result, 'Error in dolPrintHTML test 1'); // Expected '' because should failed because login 'auto' does not exists |
|
|
910
|
+ $this->assertEquals($stringfixed, $result, 'Error in dolPrintHTML test 1'); // Expected '' because should failed because login 'auto' does not exists |
|
911
|
911
|
|
|
912
|
912
|
// For a string that is already HTML (contains HTML tags) with special tags but badly formatted |
|
913
|
913
|
$stringtotest = "" > < <b>bold</b>"; |
|
@@ -918,7 +918,7 @@ discard block |
|
|
block discarded – undo |
|
918
|
918
|
//$result = dol_escape_htmltag(dol_htmlwithnojs(dol_string_onlythesehtmltags(dol_htmlentitiesbr($stringtotest), 1, 1, 1, 0, array())), 1, 1, 'common', 0, 1); |
|
919
|
919
|
$result = dolPrintHTML($stringtotest); |
|
920
|
920
|
print __METHOD__." result=".$result."\n"; |
|
921
|
|
- $this->assertEquals($stringfixed, $result, 'Error in dolPrintHTML test 2'); // Expected '' because should failed because login 'auto' does not exists |
|
|
921
|
+ $this->assertEquals($stringfixed, $result, 'Error in dolPrintHTML test 2'); // Expected '' because should failed because login 'auto' does not exists |
|
922
|
922
|
|
|
923
|
923
|
|
|
924
|
924
|
// dolPrintHTMLForAttribute - With dolPrintHTMLForAttribute(), the content is HTML encode, even if it is already HTML content. |
|
@@ -931,7 +931,7 @@ discard block |
|
|
block discarded – undo |
|
931
|
931
|
//$result = dol_escape_htmltag(dol_htmlwithnojs(dol_string_onlythesehtmltags(dol_htmlentitiesbr($stringtotest), 1, 1, 1, 0, array())), 1, 1, 'common', 0, 1); |
|
932
|
932
|
$result = dolPrintHTMLForAttribute($stringtotest); |
|
933
|
933
|
print __METHOD__." result=".$result."\n"; |
|
934
|
|
- $this->assertEquals($stringfixed, $result, 'Error in dolPrintHTMLForAttribute test 1'); // Expected '' because should failed because login 'auto' does not exists |
|
|
934
|
+ $this->assertEquals($stringfixed, $result, 'Error in dolPrintHTMLForAttribute test 1'); // Expected '' because should failed because login 'auto' does not exists |
|
935
|
935
|
|
|
936
|
936
|
// For a string that is already HTML (contains HTML tags) with special tags but badly formatted |
|
937
|
937
|
$stringtotest = "" > < <b>bold</b>"; |
|
@@ -942,7 +942,7 @@ discard block |
|
|
block discarded – undo |
|
942
|
942
|
//$result = dol_escape_htmltag(dol_htmlwithnojs(dol_string_onlythesehtmltags(dol_htmlentitiesbr($stringtotest), 1, 1, 1, 0, array())), 1, 1, 'common', 0, 1); |
|
943
|
943
|
$result = dolPrintHTMLForAttribute($stringtotest); |
|
944
|
944
|
print __METHOD__." result=".$result."\n"; |
|
945
|
|
- $this->assertEquals($stringfixed, $result, 'Error in dolPrintHTMLForAttribute test 2'); // Expected '' because should failed because login 'auto' does not exists |
|
|
945
|
+ $this->assertEquals($stringfixed, $result, 'Error in dolPrintHTMLForAttribute test 2'); // Expected '' because should failed because login 'auto' does not exists |
|
946
|
946
|
|
|
947
|
947
|
|
|
948
|
948
|
// dolPrintHTMLForAttributeUrl - With dolPrintHTMLForAttributeUrl(), the param should already be and HTML URL encoded |
|
@@ -952,7 +952,7 @@ discard block |
|
|
block discarded – undo |
|
952
|
952
|
// $result = dol_escape_htmltag(dol_string_onlythesehtmltags($s, 1, 1, 1, 0, array()), 0, 0, '', $escapeonlyhtmltags, 1); |
|
953
|
953
|
$result = dolPrintHTMLForAttributeUrl($stringtotest); |
|
954
|
954
|
print __METHOD__." result=".$result."\n"; |
|
955
|
|
- $this->assertEquals($stringfixed, $result, 'Error in dolPrintHTMLForAttributeUrl test 1'); // Expected '' because should failed because login 'auto' does not exists |
|
|
955
|
+ $this->assertEquals($stringfixed, $result, 'Error in dolPrintHTMLForAttributeUrl test 1'); // Expected '' because should failed because login 'auto' does not exists |
|
956
|
956
|
|
|
957
|
957
|
// For a string that is already HTML (contains HTML tags) with special tags but badly formatted |
|
958
|
958
|
$stringtotest = "aa & & a=%10"; |
|
@@ -960,7 +960,7 @@ discard block |
|
|
block discarded – undo |
|
960
|
960
|
// $result = dol_escape_htmltag(dol_string_onlythesehtmltags($s, 1, 1, 1, 0, array()), 0, 0, '', $escapeonlyhtmltags, 1); |
|
961
|
961
|
$result = dolPrintHTMLForAttributeUrl($stringtotest); |
|
962
|
962
|
print __METHOD__." result=".$result."\n"; |
|
963
|
|
- $this->assertEquals($stringfixed, $result, 'Error in dolPrintHTMLForAttributeUrl test 2'); // Expected '' because should failed because login 'auto' does not exists |
|
|
963
|
+ $this->assertEquals($stringfixed, $result, 'Error in dolPrintHTMLForAttributeUrl test 2'); // Expected '' because should failed because login 'auto' does not exists |
|
964
|
964
|
|
|
965
|
965
|
|
|
966
|
966
|
// dolPrintHTML |
|
@@ -1091,7 +1091,7 @@ discard block |
|
|
block discarded – undo |
|
1091
|
1091
|
global $conf; |
|
1092
|
1092
|
|
|
1093
|
1093
|
// Set options for cleaning data |
|
1094
|
|
- $conf->global->MAIN_RESTRICTHTML_ONLY_VALID_HTML = 0; // disabled, does not work on HTML5 and some libxml versions |
|
|
1094
|
+ $conf->global->MAIN_RESTRICTHTML_ONLY_VALID_HTML = 0; // disabled, does not work on HTML5 and some libxml versions |
|
1095
|
1095
|
// Enable option MAIN_RESTRICTHTML_ONLY_VALID_HTML_TIDY if possible |
|
1096
|
1096
|
if (extension_loaded('tidy') && class_exists("tidy")) { |
|
1097
|
1097
|
$conf->global->MAIN_RESTRICTHTML_ONLY_VALID_HTML_TIDY = 1; |
|
@@ -1100,22 +1100,22 @@ discard block |
|
|
block discarded – undo |
|
1100
|
1100
|
print "WARNING !!! php-tidy is not available !!!"; |
|
1101
|
1101
|
} |
|
1102
|
1102
|
|
|
1103
|
|
- $libXmlIsOkForMAIN_RESTRICTHTML_REMOVE_ALSO_BAD_ATTRIBUTES = 0; // Ok with 2.9.14, not ok on HTML5 and some libxmlversion like the one of travis |
|
|
1103
|
+ $libXmlIsOkForMAIN_RESTRICTHTML_REMOVE_ALSO_BAD_ATTRIBUTES = 0; // Ok with 2.9.14, not ok on HTML5 and some libxmlversion like the one of travis |
|
1104
|
1104
|
|
|
1105
|
1105
|
|
|
1106
|
1106
|
// With no clean option |
|
1107
|
1107
|
$conf->global->MAIN_RESTRICTHTML_ONLY_VALID_HTML = 0; |
|
1108
|
|
- $conf->global->MAIN_RESTRICTHTML_ONLY_VALID_HTML_TIDY = 0; // |
|
1109
|
|
- $conf->global->MAIN_RESTRICTHTML_REMOVE_ALSO_BAD_ATTRIBUTES = 0; // 1 = Replaces & alone into & and replaces ' into ' |
|
|
1108
|
+ $conf->global->MAIN_RESTRICTHTML_ONLY_VALID_HTML_TIDY = 0; // |
|
|
1109
|
+ $conf->global->MAIN_RESTRICTHTML_REMOVE_ALSO_BAD_ATTRIBUTES = 0; // 1 = Replaces & alone into & and replaces ' into ' |
|
1110
|
1110
|
|
|
1111
|
1111
|
// For a string with a simple & inside and already encoded |
|
1112
|
|
- $s = 'List of char+their entities: & & é é < < " " \' ' <a href="aaa?aaa=1&bbb=2&ccc=3">a</a> <zzz>z</zzz>'; // Detected as already HTML |
|
|
1112
|
+ $s = 'List of char+their entities: & & é é < < " " \' ' <a href="aaa?aaa=1&bbb=2&ccc=3">a</a> <zzz>z</zzz>'; // Detected as already HTML |
|
1113
|
1113
|
$expectedresult = 'List of char+their entities: & & é é < < " " \' ' <a href="aaa?aaa=1&bbb=2&ccc=3">a</a> z'; |
|
1114
|
1114
|
$result = dolPrintHTML($s); |
|
1115
|
1115
|
$this->assertEquals($expectedresult, $result, 'Error on test dolPrintHTML'); |
|
1116
|
1116
|
|
|
1117
|
1117
|
// For a string that is not an already HTML content |
|
1118
|
|
- $s = 'List: & é < " \''; // Detected as non already HTML |
|
|
1118
|
+ $s = 'List: & é < " \''; // Detected as non already HTML |
|
1119
|
1119
|
$expectedresult = 'List: & é < " \''; |
|
1120
|
1120
|
$result = dolPrintHTML($s); |
|
1121
|
1121
|
$this->assertEquals($expectedresult, $result, 'Error on test dolPrintHTML'); |
|
@@ -1124,17 +1124,17 @@ discard block |
|
|
block discarded – undo |
|
1124
|
1124
|
if (extension_loaded('tidy') && class_exists("tidy")) { |
|
1125
|
1125
|
// With clean TIDY only |
|
1126
|
1126
|
$conf->global->MAIN_RESTRICTHTML_ONLY_VALID_HTML = 0; |
|
1127
|
|
- $conf->global->MAIN_RESTRICTHTML_ONLY_VALID_HTML_TIDY = 1; // |
|
1128
|
|
- $conf->global->MAIN_RESTRICTHTML_REMOVE_ALSO_BAD_ATTRIBUTES = 0; // 1 = Replaces & alone into & and replaces ' into ' |
|
|
1127
|
+ $conf->global->MAIN_RESTRICTHTML_ONLY_VALID_HTML_TIDY = 1; // |
|
|
1128
|
+ $conf->global->MAIN_RESTRICTHTML_REMOVE_ALSO_BAD_ATTRIBUTES = 0; // 1 = Replaces & alone into & and replaces ' into ' |
|
1129
|
1129
|
|
|
1130
|
1130
|
// For a string with a simple & inside and already encoded |
|
1131
|
|
- $s = 'List of char+their entities: & & é é < < " " \' ' <a href="aaa?aaa=1&bbb=2&ccc=3">a</a> <zzz>z</zzz>'; // Detected as already HTML |
|
|
1131
|
+ $s = 'List of char+their entities: & & é é < < " " \' ' <a href="aaa?aaa=1&bbb=2&ccc=3">a</a> <zzz>z</zzz>'; // Detected as already HTML |
|
1132
|
1132
|
$expectedresult = 'List of char+their entities: & & é é < < " " \' ' <a href="aaa?aaa=1&bbb=2&ccc=3">a</a> z'; |
|
1133
|
1133
|
$result = dolPrintHTML($s); |
|
1134
|
1134
|
$this->assertEquals($expectedresult, $result, 'Error on test dolPrintHTML'); |
|
1135
|
1135
|
|
|
1136
|
1136
|
// For a string that is not an already HTML content |
|
1137
|
|
- $s = 'List: & é < " \''; // Detected as non already HTML |
|
|
1137
|
+ $s = 'List: & é < " \''; // Detected as non already HTML |
|
1138
|
1138
|
$expectedresult = 'List: & é < " \''; |
|
1139
|
1139
|
$result = dolPrintHTML($s); |
|
1140
|
1140
|
$this->assertEquals($expectedresult, $result, 'Error on test dolPrintHTML'); |
|
@@ -1142,17 +1142,17 @@ discard block |
|
|
block discarded – undo |
|
1142
|
1142
|
if ($libXmlIsOkForMAIN_RESTRICTHTML_REMOVE_ALSO_BAD_ATTRIBUTES) { |
|
1143
|
1143
|
// With clean TIDY and remove Bad attributes option |
|
1144
|
1144
|
$conf->global->MAIN_RESTRICTHTML_ONLY_VALID_HTML = 0; |
|
1145
|
|
- $conf->global->MAIN_RESTRICTHTML_ONLY_VALID_HTML_TIDY = 1; // |
|
1146
|
|
- $conf->global->MAIN_RESTRICTHTML_REMOVE_ALSO_BAD_ATTRIBUTES = 1; // 1 = Replaces & alone into & and replaces ' into ' |
|
|
1145
|
+ $conf->global->MAIN_RESTRICTHTML_ONLY_VALID_HTML_TIDY = 1; // |
|
|
1146
|
+ $conf->global->MAIN_RESTRICTHTML_REMOVE_ALSO_BAD_ATTRIBUTES = 1; // 1 = Replaces & alone into & and replaces ' into ' |
|
1147
|
1147
|
|
|
1148
|
1148
|
// For a string with a simple & inside and already encoded |
|
1149
|
|
- $s = 'List of char+their entities: & & é é < < " " \' ' <a href="aaa?aaa=1&bbb=2&ccc=3">a</a> <zzz>z</zzz>'; // Detected as already HTML |
|
|
1149
|
+ $s = 'List of char+their entities: & & é é < < " " \' ' <a href="aaa?aaa=1&bbb=2&ccc=3">a</a> <zzz>z</zzz>'; // Detected as already HTML |
|
1150
|
1150
|
$expectedresult = 'List of char+their entities: & & é é < < " " \' \' <a href="aaa?aaa=1&bbb=2&ccc=3">a</a> z'; |
|
1151
|
1151
|
$result = dolPrintHTML($s); |
|
1152
|
1152
|
$this->assertEquals($expectedresult, $result, 'Error on test dolPrintHTML'); |
|
1153
|
1153
|
|
|
1154
|
1154
|
// For a string that is not an already HTML content |
|
1155
|
|
- $s = 'List: & é < " \''; // Detected as non already HTML |
|
|
1155
|
+ $s = 'List: & é < " \''; // Detected as non already HTML |
|
1156
|
1156
|
$expectedresult = 'List: & é < " \''; |
|
1157
|
1157
|
$result = dolPrintHTML($s); |
|
1158
|
1158
|
$this->assertEquals($expectedresult, $result, 'Error on test dolPrintHTML'); |
|
@@ -1162,17 +1162,17 @@ discard block |
|
|
block discarded – undo |
|
1162
|
1162
|
if ($libXmlIsOkForMAIN_RESTRICTHTML_REMOVE_ALSO_BAD_ATTRIBUTES) { |
|
1163
|
1163
|
// With remove Bad attributes option only |
|
1164
|
1164
|
$conf->global->MAIN_RESTRICTHTML_ONLY_VALID_HTML = 0; |
|
1165
|
|
- $conf->global->MAIN_RESTRICTHTML_ONLY_VALID_HTML_TIDY = 0; // |
|
1166
|
|
- $conf->global->MAIN_RESTRICTHTML_REMOVE_ALSO_BAD_ATTRIBUTES = 1; // 1 = Replaces & alone into & and replaces ' into ' |
|
|
1165
|
+ $conf->global->MAIN_RESTRICTHTML_ONLY_VALID_HTML_TIDY = 0; // |
|
|
1166
|
+ $conf->global->MAIN_RESTRICTHTML_REMOVE_ALSO_BAD_ATTRIBUTES = 1; // 1 = Replaces & alone into & and replaces ' into ' |
|
1167
|
1167
|
|
|
1168
|
1168
|
// For a string with a simple & inside and already encoded |
|
1169
|
|
- $s = 'List of char+their entities: & & é é < < " " \' ' <a href="aaa?aaa=1&bbb=2&ccc=3">a</a> <zzz>z</zzz>'; // Detected as already HTML |
|
|
1169
|
+ $s = 'List of char+their entities: & & é é < < " " \' ' <a href="aaa?aaa=1&bbb=2&ccc=3">a</a> <zzz>z</zzz>'; // Detected as already HTML |
|
1170
|
1170
|
$expectedresult = 'List of char+their entities: & & é é < < " " \' \' <a href="aaa?aaa=1&bbb=2&ccc=3">a</a> z'; |
|
1171
|
1171
|
$result = dolPrintHTML($s); |
|
1172
|
1172
|
$this->assertEquals($expectedresult, $result, 'Error on test dolPrintHTML'); |
|
1173
|
1173
|
|
|
1174
|
1174
|
// For a string that is not an already HTML content |
|
1175
|
|
- $s = 'List: & é < " \''; // Detected as non already HTML |
|
|
1175
|
+ $s = 'List: & é < " \''; // Detected as non already HTML |
|
1176
|
1176
|
$expectedresult = 'List: & é < " \''; |
|
1177
|
1177
|
$result = dolPrintHTML($s); |
|
1178
|
1178
|
$this->assertEquals($expectedresult, $result, 'Error on test dolPrintHTML'); |
|
@@ -1193,7 +1193,7 @@ discard block |
|
|
block discarded – undo |
|
1193
|
1193
|
global $conf; |
|
1194
|
1194
|
|
|
1195
|
1195
|
// Set options for cleaning data |
|
1196
|
|
- $conf->global->MAIN_RESTRICTHTML_ONLY_VALID_HTML = 0; // disabled, does not work on HTML5 and some libxml versions |
|
|
1196
|
+ $conf->global->MAIN_RESTRICTHTML_ONLY_VALID_HTML = 0; // disabled, does not work on HTML5 and some libxml versions |
|
1197
|
1197
|
// Enable option MAIN_RESTRICTHTML_ONLY_VALID_HTML_TIDY if possible |
|
1198
|
1198
|
if (extension_loaded('tidy') && class_exists("tidy")) { |
|
1199
|
1199
|
$conf->global->MAIN_RESTRICTHTML_ONLY_VALID_HTML_TIDY = 1; |
|
@@ -1202,22 +1202,22 @@ discard block |
|
|
block discarded – undo |
|
1202
|
1202
|
print "WARNING !!! php-tidy is not available !!!"; |
|
1203
|
1203
|
} |
|
1204
|
1204
|
|
|
1205
|
|
- $libXmlIsOkForMAIN_RESTRICTHTML_REMOVE_ALSO_BAD_ATTRIBUTES = 0; // Ok with 2.9.14, not ok on HTML5 and some libxmlversion like the one of travis |
|
|
1205
|
+ $libXmlIsOkForMAIN_RESTRICTHTML_REMOVE_ALSO_BAD_ATTRIBUTES = 0; // Ok with 2.9.14, not ok on HTML5 and some libxmlversion like the one of travis |
|
1206
|
1206
|
|
|
1207
|
1207
|
|
|
1208
|
1208
|
// With no clean option |
|
1209
|
1209
|
$conf->global->MAIN_RESTRICTHTML_ONLY_VALID_HTML = 0; |
|
1210
|
|
- $conf->global->MAIN_RESTRICTHTML_ONLY_VALID_HTML_TIDY = 0; // |
|
1211
|
|
- $conf->global->MAIN_RESTRICTHTML_REMOVE_ALSO_BAD_ATTRIBUTES = 0; // 1 = Replaces & alone into & and replaces ' into ' |
|
|
1210
|
+ $conf->global->MAIN_RESTRICTHTML_ONLY_VALID_HTML_TIDY = 0; // |
|
|
1211
|
+ $conf->global->MAIN_RESTRICTHTML_REMOVE_ALSO_BAD_ATTRIBUTES = 0; // 1 = Replaces & alone into & and replaces ' into ' |
|
1212
|
1212
|
|
|
1213
|
1213
|
// For a string with a simple & inside and already encoded |
|
1214
|
|
- $s = 'List of char+their entities: & & é é < < " " \' ' <a href="aaa?aaa=1&bbb=2&ccc=3">a</a> <zzz>z</zzz>'; // Detected as already HTML |
|
|
1214
|
+ $s = 'List of char+their entities: & & é é < < " " \' ' <a href="aaa?aaa=1&bbb=2&ccc=3">a</a> <zzz>z</zzz>'; // Detected as already HTML |
|
1215
|
1215
|
$expectedresult = 'List of char+their entities: & &amp; é é < &lt; " &quot; \' &apos; a z'; |
|
1216
|
1216
|
$result = dolPrintHTMLForAttribute($s); |
|
1217
|
1217
|
$this->assertEquals($expectedresult, $result, 'Error on test dolPrintHTML'); |
|
1218
|
1218
|
|
|
1219
|
1219
|
// For a string that is not an already HTML content |
|
1220
|
|
- $s = 'List: & é < " \''; // Detected as non already HTML |
|
|
1220
|
+ $s = 'List: & é < " \''; // Detected as non already HTML |
|
1221
|
1221
|
$expectedresult = 'List: &amp; é &lt; &quot; \''; |
|
1222
|
1222
|
$result = dolPrintHTMLForAttribute($s); |
|
1223
|
1223
|
$this->assertEquals($expectedresult, $result, 'Error on test dolPrintHTML'); |
|
@@ -1226,17 +1226,17 @@ discard block |
|
|
block discarded – undo |
|
1226
|
1226
|
if (extension_loaded('tidy') && class_exists("tidy")) { |
|
1227
|
1227
|
// With clean TIDY only |
|
1228
|
1228
|
$conf->global->MAIN_RESTRICTHTML_ONLY_VALID_HTML = 0; |
|
1229
|
|
- $conf->global->MAIN_RESTRICTHTML_ONLY_VALID_HTML_TIDY = 1; // |
|
1230
|
|
- $conf->global->MAIN_RESTRICTHTML_REMOVE_ALSO_BAD_ATTRIBUTES = 0; // 1 = Replaces & alone into & and replaces ' into ' |
|
|
1229
|
+ $conf->global->MAIN_RESTRICTHTML_ONLY_VALID_HTML_TIDY = 1; // |
|
|
1230
|
+ $conf->global->MAIN_RESTRICTHTML_REMOVE_ALSO_BAD_ATTRIBUTES = 0; // 1 = Replaces & alone into & and replaces ' into ' |
|
1231
|
1231
|
|
|
1232
|
1232
|
// For a string with a simple & inside and already encoded |
|
1233
|
|
- $s = 'List of char+their entities: & & é é < < " " \' ' <a href="aaa?aaa=1&bbb=2&ccc=3">a</a> <zzz>z</zzz>'; // Detected as already HTML |
|
|
1233
|
+ $s = 'List of char+their entities: & & é é < < " " \' ' <a href="aaa?aaa=1&bbb=2&ccc=3">a</a> <zzz>z</zzz>'; // Detected as already HTML |
|
1234
|
1234
|
$expectedresult = 'List of char+their entities: & &amp; é é < &lt; " &quot; \' &apos; a z'; |
|
1235
|
1235
|
$result = dolPrintHTMLForAttribute($s); |
|
1236
|
1236
|
$this->assertEquals($expectedresult, $result, 'Error on test dolPrintHTML'); |
|
1237
|
1237
|
|
|
1238
|
1238
|
// For a string that is not an already HTML content |
|
1239
|
|
- $s = 'List: & é < " \''; // Detected as non already HTML |
|
|
1239
|
+ $s = 'List: & é < " \''; // Detected as non already HTML |
|
1240
|
1240
|
$expectedresult = 'List: &amp; é &lt; &quot; \''; |
|
1241
|
1241
|
$result = dolPrintHTMLForAttribute($s); |
|
1242
|
1242
|
$this->assertEquals($expectedresult, $result, 'Error on test dolPrintHTML'); |
|
@@ -1245,17 +1245,17 @@ discard block |
|
|
block discarded – undo |
|
1245
|
1245
|
if ($libXmlIsOkForMAIN_RESTRICTHTML_REMOVE_ALSO_BAD_ATTRIBUTES) { |
|
1246
|
1246
|
// With clean TIDY and remove Bad attributes option |
|
1247
|
1247
|
$conf->global->MAIN_RESTRICTHTML_ONLY_VALID_HTML = 0; |
|
1248
|
|
- $conf->global->MAIN_RESTRICTHTML_ONLY_VALID_HTML_TIDY = 1; // |
|
1249
|
|
- $conf->global->MAIN_RESTRICTHTML_REMOVE_ALSO_BAD_ATTRIBUTES = 1; // 1 = Replaces & alone into & and replaces ' into ' |
|
|
1248
|
+ $conf->global->MAIN_RESTRICTHTML_ONLY_VALID_HTML_TIDY = 1; // |
|
|
1249
|
+ $conf->global->MAIN_RESTRICTHTML_REMOVE_ALSO_BAD_ATTRIBUTES = 1; // 1 = Replaces & alone into & and replaces ' into ' |
|
1250
|
1250
|
|
|
1251
|
1251
|
// For a string with a simple & inside and already encoded |
|
1252
|
|
- $s = 'List of char+their entities: & & é é < < " " \' ' <a href="aaa?aaa=1&bbb=2&ccc=3">a</a> <zzz>z</zzz>'; // Detected as already HTML |
|
|
1252
|
+ $s = 'List of char+their entities: & & é é < < " " \' ' <a href="aaa?aaa=1&bbb=2&ccc=3">a</a> <zzz>z</zzz>'; // Detected as already HTML |
|
1253
|
1253
|
$expectedresult = 'List of char+their entities: & &amp; é é < &lt; " &quot; \' &apos; a z'; |
|
1254
|
1254
|
$result = dolPrintHTMLForAttribute($s); |
|
1255
|
1255
|
$this->assertEquals($expectedresult, $result, 'Error on test dolPrintHTML'); |
|
1256
|
1256
|
|
|
1257
|
1257
|
// For a string that is not an already HTML content |
|
1258
|
|
- $s = 'List: & é < " \''; // Detected as non already HTML |
|
|
1258
|
+ $s = 'List: & é < " \''; // Detected as non already HTML |
|
1259
|
1259
|
$expectedresult = 'List: &amp; é &lt; &quot; \''; |
|
1260
|
1260
|
$result = dolPrintHTMLForAttribute($s); |
|
1261
|
1261
|
$this->assertEquals($expectedresult, $result, 'Error on test dolPrintHTML'); |
|
@@ -1265,17 +1265,17 @@ discard block |
|
|
block discarded – undo |
|
1265
|
1265
|
if ($libXmlIsOkForMAIN_RESTRICTHTML_REMOVE_ALSO_BAD_ATTRIBUTES) { |
|
1266
|
1266
|
// With remove Bad attributes option only |
|
1267
|
1267
|
$conf->global->MAIN_RESTRICTHTML_ONLY_VALID_HTML = 0; |
|
1268
|
|
- $conf->global->MAIN_RESTRICTHTML_ONLY_VALID_HTML_TIDY = 0; // |
|
1269
|
|
- $conf->global->MAIN_RESTRICTHTML_REMOVE_ALSO_BAD_ATTRIBUTES = 1; // 1 = Replaces & alone into & and replaces ' into ' |
|
|
1268
|
+ $conf->global->MAIN_RESTRICTHTML_ONLY_VALID_HTML_TIDY = 0; // |
|
|
1269
|
+ $conf->global->MAIN_RESTRICTHTML_REMOVE_ALSO_BAD_ATTRIBUTES = 1; // 1 = Replaces & alone into & and replaces ' into ' |
|
1270
|
1270
|
|
|
1271
|
1271
|
// For a string with a simple & inside and already encoded |
|
1272
|
|
- $s = 'List of char+their entities: & & é é < < " " \' ' <a href="aaa?aaa=1&bbb=2&ccc=3">a</a> <zzz>z</zzz>'; // Detected as already HTML |
|
|
1272
|
+ $s = 'List of char+their entities: & & é é < < " " \' ' <a href="aaa?aaa=1&bbb=2&ccc=3">a</a> <zzz>z</zzz>'; // Detected as already HTML |
|
1273
|
1273
|
$expectedresult = 'List of char+their entities: & &amp; é é < &lt; " &quot; \' &apos; a z'; |
|
1274
|
1274
|
$result = dolPrintHTMLForAttribute($s); |
|
1275
|
1275
|
$this->assertEquals($expectedresult, $result, 'Error on test dolPrintHTML'); |
|
1276
|
1276
|
|
|
1277
|
1277
|
// For a string that is not an already HTML content |
|
1278
|
|
- $s = 'List: & é < " \''; // Detected as non already HTML |
|
|
1278
|
+ $s = 'List: & é < " \''; // Detected as non already HTML |
|
1279
|
1279
|
$expectedresult = 'List: &amp; é &lt; &quot; \''; |
|
1280
|
1280
|
$result = dolPrintHTMLForAttribute($s); |
|
1281
|
1281
|
$this->assertEquals($expectedresult, $result, 'Error on test dolPrintHTML'); |
|
@@ -1367,7 +1367,7 @@ discard block |
|
|
block discarded – undo |
|
1367
|
1367
|
// For a string with js and link with restricthtmlallowlinkscript |
|
1368
|
1368
|
$conf->global->MAIN_RESTRICTHTML_ONLY_VALID_HTML = 0; |
|
1369
|
1369
|
$conf->global->MAIN_RESTRICTHTML_ONLY_VALID_HTML_TIDY = 0; |
|
1370
|
|
- $s='<link rel="stylesheet" id="google-fonts-css" href="//fonts.googleapis.com/css?family=Open+Sans:300,400,700"> |
|
|
1370
|
+ $s = '<link rel="stylesheet" id="google-fonts-css" href="//fonts.googleapis.com/css?family=Open+Sans:300,400,700"> |
|
1371
|
1371
|
<link rel="stylesheet" id="font-wasesome-css" href="//cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/font-awesome.min.css"> |
|
1372
|
1372
|
<script src="//cdnjs.cloudflare.com/ajax/libs/jquery/3.2.1/jquery.min.js"></script> |
|
1373
|
1373
|
<script src="//cdnjs.cloudflare.com/ajax/libs/jqueryui/1.12.1/jquery-ui.min.js"></script>'; |
|
@@ -1380,7 +1380,7 @@ discard block |
|
|
block discarded – undo |
|
1380
|
1380
|
// For a string with js and link with restricthtmlallowlinkscript |
|
1381
|
1381
|
$conf->global->MAIN_RESTRICTHTML_ONLY_VALID_HTML = 0; |
|
1382
|
1382
|
$conf->global->MAIN_RESTRICTHTML_ONLY_VALID_HTML_TIDY = 1; |
|
1383
|
|
- $s='<link rel="stylesheet" id="google-fonts-css" href="//fonts.googleapis.com/css?family=Open+Sans:300,400,700"> |
|
|
1383
|
+ $s = '<link rel="stylesheet" id="google-fonts-css" href="//fonts.googleapis.com/css?family=Open+Sans:300,400,700"> |
|
1384
|
1384
|
<link rel="stylesheet" id="font-wasesome-css" href="//cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/font-awesome.min.css"> |
|
1385
|
1385
|
<script src="//cdnjs.cloudflare.com/ajax/libs/jquery/3.2.1/jquery.min.js"></script> |
|
1386
|
1386
|
<script src="//cdnjs.cloudflare.com/ajax/libs/jqueryui/1.12.1/jquery-ui.min.js"></script>'; |
|
@@ -1393,7 +1393,7 @@ discard block |
|
|
block discarded – undo |
|
1393
|
1393
|
// For a string with js and link with restricthtmlallowlinkscript |
|
1394
|
1394
|
$conf->global->MAIN_RESTRICTHTML_ONLY_VALID_HTML = 1; |
|
1395
|
1395
|
$conf->global->MAIN_RESTRICTHTML_ONLY_VALID_HTML_TIDY = 0; |
|
1396
|
|
- $s='<link rel="stylesheet" id="google-fonts-css" href="//fonts.googleapis.com/css?family=Open+Sans:300,400,700"> |
|
|
1396
|
+ $s = '<link rel="stylesheet" id="google-fonts-css" href="//fonts.googleapis.com/css?family=Open+Sans:300,400,700"> |
|
1397
|
1397
|
<link rel="stylesheet" id="font-wasesome-css" href="//cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/font-awesome.min.css"> |
|
1398
|
1398
|
<script src="//cdnjs.cloudflare.com/ajax/libs/jquery/3.2.1/jquery.min.js"></script> |
|
1399
|
1399
|
<script src="//cdnjs.cloudflare.com/ajax/libs/jqueryui/1.12.1/jquery-ui.min.js"></script>'; |
Dolibarr /
dolibarr
