MyTextSanitizer

Complexity

Total Complexity

102

Size/Duplication

Total Lines	1000
Duplicated Lines	0 %

Importance

Changes	2
Bugs	0	Features	0

49 Methods

Rating	Name	Duplication	Size	Complexity
A	codeConvCallback()	0	3	1
A	executeExtensions()	0	10	3
A	censorString()	0	8	2
A	codePreConv()	0	17	2
A	codeConv()	0	9	2
A	previewTarea()	0	6	1
F	displayTarea()	0	42	12
A	nl2Br()	0	3	1
A	htmlSpecialChars()	0	13	5
A	xoopsCodeDecode()	0	54	2
A	makeTboxData4Preview()	0	7	1
A	oopsAddSlashes()	0	5	1
A	makeTboxData4Edit()	0	5	1
A	oopsNl2Br()	0	5	1
A	makeTboxData4Show()	0	6	1
A	loadExtension()	0	16	4
A	smiley()	0	8	2
A	codeSanitizer()	0	7	1
A	makeTareaData4Show()	0	6	1
A	makeTareaData4PreviewInForm()	0	7	1
A	quoteConv()	0	14	2
A	makeClickableCallback03()	0	3	1
A	oopsStripSlashesRT()	0	8	2
A	makeClickableCallback01()	0	3	1
B	getSmileys()	0	24	7
A	makeClickableCallback04()	0	3	1
A	makeClickable()	0	40	1
A	sanitizeForDisplay()	0	20	4
A	executeExtension()	0	7	1
A	makeTareaData4Preview()	0	6	1
A	getInstance()	0	8	2
A	makeTareaData4InsideQuotes()	0	5	1
A	undoHtmlSpecialChars()	0	3	1
A	truncate()	0	10	4
A	makeTboxData4PreviewInForm()	0	6	1
A	makeTareaData4Save()	0	5	1
A	makeClickableCallback02()	0	3	1
A	oopsStripSlashesGPC()	0	5	1
A	addSlashes()	0	7	2
A	makeTareaData4Edit()	0	5	1
A	oopsHtmlSpecialChars()	0	5	1
A	mergeConfig()	0	13	5
A	makeTboxData4Save()	0	6	1
A	sanitizeForPreview()	0	21	4
A	filterXss()	0	15	1
A	loadConfig()	0	17	4
A	__construct()	0	6	1
A	textFilter()	0	8	2
A	stripSlashesGPC()	0	7	2

<?php
/**
 * XOOPS TextSanitizer extension
 *
 * You may not change or alter any portion of this comment or credits
 * of supporting developers from this source code or any supporting source code
 * which is considered copyrighted (c) material of the original comment or credit authors.
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
 *
 * @copyright       (c) 2000-2021 XOOPS Project (https://xoops.org)
 * @license             GNU GPL 2 (https://www.gnu.org/licenses/gpl-2.0.html)
 * @package             class
 * @since               2.0.0
 * @author              Kazumi Ono (http://www.myweb.ne.jp/, http://jp.xoops.org/)
 * @author              Goghs Cheng (http://www.eqiao.com, http://www.devbeez.com/)
 * @author              Taiwen Jiang <phppp@users.sourceforge.net>
 */

/**
 * Abstract class for extensions
 *
 * @author              Taiwen Jiang <phppp@users.sourceforge.net>
 * @copyright       (c) 2000-2021 XOOPS Project (https://xoops.org)
 */
class MyTextSanitizerExtension
{
    public $instance;
    public $ts;
    public $config;
    public $image_path;

    /**
     * Constructor
     *
     * @param MyTextSanitizer $ts
     */
    public function __construct(MyTextSanitizer $ts)
    {
        $this->ts         = $ts;
        $this->image_path = XOOPS_URL . '/images/form';
    }

    /**
     * loadConfig
     *
     * @param  string $path
     * @return string|array
     */
    public static function loadConfig($path = null)
    {
        $ts   = MyTextSanitizer::getInstance();
        $extensionName = (null === $path) ? '' : basename($path);
        $pathDist = $ts->path_basic;
        $pathConfig = $ts->path_config;

        if ('' !== $extensionName) {
            $configFileName = $pathConfig . '/config.' . $extensionName . '.php';
            $distFileName = $pathDist . '/' . $extensionName . '/config.' . $extensionName . '.dist.php';
        } else {
            $configFileName = $pathConfig . '/config.php';
            $distFileName = $pathDist . '/config.dist.php';
        }
        if (!file_exists($configFileName)) {
            if (false === copy($distFileName, $configFileName)) {
                trigger_error('Could not create textsanitizer config file ' . basename($configFileName));
                return $a = array();

The assignment to $a is dead and can be removed.

            }
        }
        $configs = include $configFileName;
        return $configs;
    }

    /**
     * Merge Config
     *
     * @param  array $config_default
     * @param  array $config_custom
     * @return array
     */
    public static function mergeConfig($config_default, $config_custom)
    {
        if (is_array($config_custom)) {

The condition is_array($config_custom) is always true.

            foreach ($config_custom as $key => $val) {
                if (is_array($config_default[$key])) {
                    $config_default[$key] = self::mergeConfig($config_default[$key], $config_custom[$key]);
                } else {
                    $config_default[$key] = $val;
                }
            }
        }

        return $config_default;
    }

    /**
     * encode
     *
     * @param string $textarea_id id attribute of text area
     *
     * @return array
     */
    public function encode($textarea_id)

The parameter $textarea_id is not used and could be removed.

    {
        return array();
    }

    /**
     * decode
     *
     * @param string $url
     * @param string|integer $width
     * @param string|integer $height
     *
     * @return Null
     */
    public static function decode($url, $width, $height)

The parameter $height is not used and could be removed.

The parameter $width is not used and could be removed.

    {
        return null;
    }
}

/**
 * Class to "clean up" text for various uses
 *
 * <strong>Singleton</strong>
 *
 * @package       kernel
 * @subpackage    core
 * @author        Kazumi Ono <onokazu@xoops.org>
 * @author        Taiwen Jiang <phppp@users.sourceforge.net>
 * @author        Goghs Cheng
 * @copyright (c) 2000-2021 XOOPS Project (https://xoops.org)
 */
class MyTextSanitizer
{
    /**
     *
     * @var array
     */
    public $smileys = array();

    /**
     */
    public $censorConf;

    /**
     *
     * @var string holding reference to text
     */
    public $text         = '';
    public $patterns     = array();
    public $replacements = array();

    //mb------------------------------
    public $callbackPatterns = array();
    public $callbacks        = array();
    //mb------------------------------

    public $path_basic;
    public $path_config;
    public $path_plugin;

    public $config;

    /**
     * Constructor of this class
     *
     * Gets allowed html tags from admin config settings
     * <br> should not be allowed since nl2br will be used
     * when storing data.
     *
     * @access private
     */

    public function __construct()
    {
        $this->path_basic  = XOOPS_ROOT_PATH . '/class/textsanitizer';
        $this->path_config = XOOPS_VAR_PATH . '/configs/textsanitizer';
        $this->path_plugin = XOOPS_ROOT_PATH . '/Frameworks/textsanitizer';
        $this->config      = $this->loadConfig();
    }

    /**
     * Enter description here...
     *
     * @param  string $name
     * @return array|string
     */
    public function loadConfig($name = null)
    {
        // NB: sending a null name results in an infinite loop
        if (!empty($name)) {
            return MyTextSanitizerExtension::loadConfig($name);
        }

        $configFileName = $this->path_config . '/config.php';
        $distFileName = $this->path_basic . '/config.dist.php';

        if (!file_exists($configFileName)) {
            if (false===copy($distFileName, $configFileName)) {
                trigger_error('Could not create textsanitizer config file ' . basename($configFileName));
                return array();
            }
        }
        return include $configFileName;
    }

    /**
     * Enter description here...
     *
     * @param  array $config_default
     * @param  array $config_custom
     * @return mixed
     */
    public function mergeConfig($config_default, $config_custom)
    {
        if (is_array($config_custom)) {

The condition is_array($config_custom) is always true.

            foreach ($config_custom as $key => $val) {
                if (isset($config_default[$key]) && is_array($config_default[$key])) {
                    $config_default[$key] = $this->mergeConfig($config_default[$key], $config_custom[$key]);
                } else {
                    $config_default[$key] = $val;
                }
            }
        }

        return $config_default;
    }

    /**
     * Access the only instance of this class
     *
     * @return MyTextSanitizer
     */
    public static function getInstance()
    {
        static $instance;
        if (!isset($instance)) {
            $instance = new MyTextSanitizer();
        }

        return $instance;
    }

    /**
     * Get the smileys
     *
     * @param bool $isAll TRUE for all smileys, FALSE for smileys with display = 1
     *
     * @return array
     */
    public function getSmileys($isAll = true)
    {
        if (count($this->smileys) == 0) {
            /* @var XoopsMySQLDatabase $xoopsDB */
            $xoopsDB = XoopsDatabaseFactory::getDatabaseConnection();
            if ($getsmiles = $xoopsDB->query('SELECT * FROM ' . $xoopsDB->prefix('smiles'))) {
                while (false !== ($smiles = $xoopsDB->fetchArray($getsmiles))) {

It seems like $getsmiles can also be of type true; however, parameter $result of XoopsMySQLDatabase::fetchArray() does only seem to accept mysqli_result, maybe add an additional type check?

                    $this->smileys[] = $smiles;
                }
            }
        }
        if ($isAll) {
            return $this->smileys;
        }

        $smileys = array();
        foreach ($this->smileys as $smile) {
            if (empty($smile['display'])) {
                continue;
            }
            $smileys[] = $smile;
        }

        return $smileys;
    }

    /**
     * Replace emoticons in the message with smiley images
     *
     * @param  string $message
     * @return string
     */
    public function smiley($message)
    {
        $smileys = $this->getSmileys();
        foreach ($smileys as $smile) {
            $message = str_replace($smile['code'], '<img class="imgsmile" src="' . XOOPS_UPLOAD_URL . '/' . htmlspecialchars($smile['smile_url']) . '" alt="" />', $message);
        }

        return $message;
    }

    /**
     * @param $match
     *
     * @return string
     */
    public function makeClickableCallback01($match)
    {
        return $match[1] . "<a href=\"$match[2]://$match[3]\" title=\"$match[2]://$match[3]\" rel=\"noopener external\">$match[2]://" . $this->truncate($match[3]) . '</a>';
    }

    /**
     * @param $match
     *
     * @return string
     */
    public function makeClickableCallback02($match)
    {
        return $match[1] . "<a href=\"http://www.$match[2]$match[6]\" title=\"www.$match[2]$match[6]\" rel=\"noopener external\">" . $this->truncate('www.' . $match[2] . $match[6]) . '</a>';
    }

    /**
     * @param $match
     *
     * @return string
     */
    public function makeClickableCallback03($match)
    {
        return $match[1] . "<a href=\"ftp://ftp.$match[2].$match[3]\" title=\"ftp.$match[2].$match[3]\" rel=\"external\">" . $this->truncate('ftp.' . $match[2] . $match[3]) . '</a>';
    }

    /**
     * @param $match
     *
     * @return string
     */
    public function makeClickableCallback04($match)
    {
        return $match[1] . "<a href=\"mailto:$match[2]@$match[3]\" title=\"$match[2]@$match[3]\">" . $this->truncate($match[2] . '@' . $match[3]) . '</a>';
    }

    /**
     * Make links in the text clickable
     *
     * @param  string $text
     * @return string
     */
    public function makeClickable(&$text)
    {
        $text1 = $text;

        $valid_chars = "a-z0-9\/\-_+=.~!%@?#&;:$\|";
        $end_chars   = "a-z0-9\/\-_+=~!%@?#&;:$\|";

        //        $patterns   = array();
        //        $replacements   = array();
        //
        //        $patterns[]     = "/(^|[^]_a-z0-9-=\"'\/])([a-z]+?):\/\/([{$valid_chars}]+[{$end_chars}])/ei";
        //        $replacements[] = "'\\1<a href=\"\\2://\\3\" title=\"\\2://\\3\" rel=\"external\">\\2://'.MyTextSanitizer::truncate( '\\3' ).'</a>'";
        //
        //
        //        $patterns[]     = "/(^|[^]_a-z0-9-=\"'\/:\.])www\.((([a-zA-Z0-9\-]*\.){1,}){1}([a-zA-Z]{2,6}){1})((\/([a-zA-Z0-9\-\._\?\,\'\/\\+&%\$#\=~])*)*)/ei";
        //        $replacements[] = "'\\1<a href=\"http://www.\\2\\6\" title=\"www.\\2\\6\" rel=\"external\">'.MyTextSanitizer::truncate( 'www.\\2\\6' ).'</a>'";
        //
        //        $patterns[]     = "/(^|[^]_a-z0-9-=\"'\/])ftp\.([a-z0-9\-]+)\.([{$valid_chars}]+[{$end_chars}])/ei";
        //        $replacements[] = "'\\1<a href=\"ftp://ftp.\\2.\\3\" title=\"ftp.\\2.\\3\" rel=\"external\">'.MyTextSanitizer::truncate( 'ftp.\\2.\\3' ).'</a>'";
        //
        //        $patterns[]     = "/(^|[^]_a-z0-9-=\"'\/:\.])([-_a-z0-9\'+*$^&%=~!?{}]++(?:\.[-_a-z0-9\'+*$^&%=~!?{}]+)*+)@((?:(?![-.])[-a-z0-9.]+(?<![-.])\.[a-z]{2,6}|\d{1,3}(?:\.\d{1,3}){3})(?::\d++)?)/ei";
        //        $replacements[] = "'\\1<a href=\"mailto:\\2@\\3\" title=\"\\2@\\3\">'.MyTextSanitizer::truncate( '\\2@\\3' ).'</a>'";
        //
        //        $text = preg_replace($patterns, $replacements, $text);
        //
        //----------------------------------------------------------------------------------

        $pattern = "/(^|[^]_a-z0-9-=\"'\/])([a-z]+?):\/\/([{$valid_chars}]+[{$end_chars}])/i";
        $text1   = preg_replace_callback($pattern, 'self::makeClickableCallback01', $text1);

        $pattern = "/(^|[^]_a-z0-9-=\"'\/:\.])www\.((([a-zA-Z0-9\-]*\.){1,}){1}([a-zA-Z]{2,6}){1})((\/([a-zA-Z0-9\-\._\?\,\'\/\\+&%\$#\=~])*)*)/i";
        $text1   = preg_replace_callback($pattern, 'self::makeClickableCallback02', $text1);

        $pattern = "/(^|[^]_a-z0-9-=\"'\/])ftp\.([a-z0-9\-]+)\.([{$valid_chars}]+[{$end_chars}])/i";
        $text1   = preg_replace_callback($pattern, 'self::makeClickableCallback03', $text1);

        $pattern = "/(^|[^]_a-z0-9-=\"'\/:\.])([-_a-z0-9\'+*$^&%=~!?{}]++(?:\.[-_a-z0-9\'+*$^&%=~!?{}]+)*+)@((?:(?![-.])[-a-z0-9.]+(?<![-.])\.[a-z]{2,6}|\d{1,3}(?:\.\d{1,3}){3})(?::\d++)?)/i";
        $text1   = preg_replace_callback($pattern, 'self::makeClickableCallback04', $text1);

        return $text1;
    }

    /**
     * MyTextSanitizer::truncate()
     *
     * @param  mixed $text
     * @return mixed|string
     */
    public function truncate($text)
    {
        $instance = MyTextSanitizer::getInstance();
        if (empty($text) || empty($instance->config['truncate_length']) || strlen($text) < $instance->config['truncate_length']) {
            return $text;
        }
        $len = floor($instance->config['truncate_length'] / 2);
        $ret = substr($text, 0, $len) . ' ... ' . substr($text, 5 - $len);

$len of type double is incompatible with the type integer|null expected by parameter $length of substr().

5 - $len of type double is incompatible with the type integer expected by parameter $offset of substr().

        return $ret;
    }

    /**
     * Replace XoopsCodes with their equivalent HTML formatting
     *
     * @param  string   $text
     * @param  bool|int $allowimage Allow images in the text?
     *                              On FALSE, uses links to images.
     * @return string
     */
    public function &xoopsCodeDecode(&$text, $allowimage = 1)
    {
        $patterns       = array();
        $replacements   = array();
        $patterns[]     = "/\[siteurl=(['\"]?)([^\"'<>]*)\\1](.*)\[\/siteurl\]/sU";
        $replacements[] = '<a href="' . XOOPS_URL . '/\\2" title="">\\3</a>';
        $patterns[]     = "/\[url=(['\"]?)(http[s]?:\/\/[^\"'<>]*)\\1](.*)\[\/url\]/sU";
        $replacements[] = '<a href="\\2" rel="noopener external" title="">\\3</a>';
        $patterns[]     = "/\[url=(['\"]?)(ftp?:\/\/[^\"'<>]*)\\1](.*)\[\/url\]/sU";
        $replacements[] = '<a href="\\2" rel="external" title="">\\3</a>';
        $patterns[]     = "/\[url=(['\"]?)([^'\"<>]*)\\1](.*)\[\/url\]/sU";
        $replacements[] = '<a href="http://\\2" rel="noopener external" title="">\\3</a>';
        $patterns[]     = "/\[color=(['\"]?)([a-zA-Z0-9]*)\\1](.*)\[\/color\]/sU";
        $replacements[] = '<span style="color: #\\2;">\\3</span>';
        $patterns[]     = "/\[size=(['\"]?)([a-z0-9-]*)\\1](.*)\[\/size\]/sU";
        $replacements[] = '<span style="font-size: \\2;">\\3</span>';
        $patterns[]     = "/\[font=(['\"]?)([^;<>\*\(\)\"']*)\\1](.*)\[\/font\]/sU";
        $replacements[] = '<span style="font-family: \\2;">\\3</span>';
        $patterns[]     = "/\[email]([^;<>\*\(\)\"']*)\[\/email\]/sU";
        $replacements[] = '<a href="mailto:\\1" title="">\\1</a>';

        $patterns[]     = "/\[b](.*)\[\/b\]/sU";
        $replacements[] = '<strong>\\1</strong>';
        $patterns[]     = "/\[i](.*)\[\/i\]/sU";
        $replacements[] = '<em>\\1</em>';
        $patterns[]     = "/\[u](.*)\[\/u\]/sU";
        $replacements[] = '<span style="text-decoration: underline;">\\1</span>';
        $patterns[]     = "/\[d](.*)\[\/d\]/sU";
        $replacements[] = '<del>\\1</del>';
        $patterns[]     = "/\[center](.*)\[\/center\]/sU";
        $replacements[] = '<div style="text-align: center;">\\1</div>';
        $patterns[]     = "/\[left](.*)\[\/left\]/sU";
        $replacements[] = '<div style="text-align: left;">\\1</div>';
        $patterns[]     = "/\[right](.*)\[\/right\]/sU";
        $replacements[] = '<div style="text-align: right;">\\1</div>';

        $this->text         = $text;
        $this->patterns     = $patterns;
        $this->replacements = $replacements;

        $this->config['allowimage'] = $allowimage;
        $this->executeExtensions();

        $text = preg_replace($this->patterns, $this->replacements, $this->text);
        //-------------------------------------------------------------------------------
        $count = count($this->callbackPatterns);

        for ($i = 0; $i < $count; ++$i) {
            $text = preg_replace_callback($this->callbackPatterns[$i], $this->callbacks[$i], $text);
        }
        //------------------------------------------------------------------------------
        $text = $this->quoteConv($text);

        return $text;
    }

    /**
     * Convert quote tags
     *
     * @param  string $text
     * @return string
     */
    public function quoteConv($text)
    {
        //look for both open and closing tags in the correct order
        $pattern     = "/\[quote](.*)\[\/quote\]/sU";
        $replacement = _QUOTEC . '<div class="xoopsQuote"><blockquote>\\1</blockquote></div>';

        $text = preg_replace($pattern, $replacement, $text, -1, $count);
        //no more matches, return now
        if (!$count) {
            return $text;
        }

        //new matches could have been created, keep doing it until we have no matches
        return $this->quoteConv($text);
    }

    /**
     * A quick solution for filtering XSS scripts
     *
     * @TODO : To be improved
     * @param $text
     * @return mixed
     */
    public function filterXss($text)
    {
        $patterns       = array();
        $replacements   = array();
        $text           = str_replace("\x00", '', $text);
        $c              = "[\x01-\x1f]*";
        $patterns[]     = "/\bj{$c}a{$c}v{$c}a{$c}s{$c}c{$c}r{$c}i{$c}p{$c}t{$c}[\s]*:/si";
        $replacements[] = 'javascript;';
        $patterns[]     = "/\ba{$c}b{$c}o{$c}u{$c}t{$c}[\s]*:/si";
        $replacements[] = 'about;';
        $patterns[]     = "/\bx{$c}s{$c}s{$c}[\s]*:/si";
        $replacements[] = 'xss;';
        $text           = preg_replace($patterns, $replacements, $text);

        return $text;
    }

    /**
     * Convert linebreaks to <br> tags
     *
     * @param  string $text
     * @return string
     */
    public function nl2Br($text)
    {
        return preg_replace('/(\015\012)|(\015)|(\012)/', '<br>', $text);
    }

    /**
     * Add slashes to the text if magic_quotes_gpc is turned off.
     *
     * @param  string $text
     * @return string
     */
    public function addSlashes($text)
    {
        if (!@get_magic_quotes_gpc()) {
            $text = addslashes($text);
        }

        return $text;
    }

    /**
     * Convert special characters to HTML entities
     *
     * @param  string $text    string being converted
     * @param  int|null    $quote_style
     * @param  string $charset character set used in conversion
     * @param  bool   $double_encode
     * @return string
     */
    public function htmlSpecialChars($text, $quote_style = NULL, $charset = null, $double_encode = true)
    {
        if ($quote_style === NULL) {
            $quote_style = ENT_QUOTES;
        }

        if (version_compare(phpversion(), '5.2.3', '>=')) {
            $text = htmlspecialchars($text, $quote_style, $charset ?: (defined('_CHARSET') ? _CHARSET : 'UTF-8'), $double_encode);
        } else {
            $text = htmlspecialchars($text, $quote_style);
        }

        return preg_replace(array('/&amp;/i', '/&nbsp;/i'), array('&', '&amp;nbsp;'), $text);
    }

    /**
     * Reverses {@link htmlSpecialChars()}
     *
     * @param  string $text
     * @return string
     */
    public function undoHtmlSpecialChars($text)
    {
        return preg_replace(array('/&gt;/i', '/&lt;/i', '/&quot;/i', '/&#039;/i', '/&amp;nbsp;/i'), array('>', '<', '"', '\'', '&nbsp;'), $text);
    }

    /**
     * Filters textarea form data in DB for display
     *
     * @param  string   $text
     * @param  bool|int $html   allow html?
     * @param  bool|int $smiley allow smileys?
     * @param  bool|int $xcode  allow xoopscode?
     * @param  bool|int $image  allow inline images?
     * @param  bool|int $br     convert linebreaks?
     * @return string
     */
    public function &displayTarea($text, $html = 0, $smiley = 1, $xcode = 1, $image = 1, $br = 1)
    {
        $charset = (defined('_CHARSET') ? _CHARSET : 'UTF-8');
        if (function_exists('mb_convert_encoding')) {
            $text = mb_convert_encoding($text, $charset, mb_detect_encoding($text, mb_detect_order(), true));

It seems like mb_detect_order() can also be of type true; however, parameter $encodings of mb_detect_encoding() does only seem to accept array|null|string, maybe add an additional type check?

        }
        if ($html && $br) {
            $testText = strip_tags($text);

It seems like $text can also be of type array; however, parameter $string of strip_tags() does only seem to accept string, maybe add an additional type check?

            if (mb_strlen($text) != mb_strlen($testText)) {

It seems like $text can also be of type array; however, parameter $string of mb_strlen() does only seem to accept string, maybe add an additional type check?

                $br = 0;
            }
            unset($testText);
        }
        if ($html != 1) {
            // html not allowed
            $text = $this->htmlSpecialChars($text, ENT_COMPAT, $charset);

It seems like $text can also be of type array; however, parameter $text of MyTextSanitizer::htmlSpecialChars() does only seem to accept string, maybe add an additional type check?

        }
        $text = $this->codePreConv($text, $xcode); // Ryuji_edit(2003-11-18)
        if ($smiley != 0) {
            // process smiley
            $text = $this->smiley($text);

It seems like $text can also be of type array; however, parameter $message of MyTextSanitizer::smiley() does only seem to accept string, maybe add an additional type check?

        }
        if ($xcode != 0) {
            // decode xcode
            if ($image != 0) {
                // image allowed
                $text =& $this->xoopsCodeDecode($text);

It seems like $text can also be of type array; however, parameter $text of MyTextSanitizer::xoopsCodeDecode() does only seem to accept string, maybe add an additional type check?

            } else {
                // image not allowed
                $text =& $this->xoopsCodeDecode($text, 0);
            }
        }
        if ($br != 0) {
            $text = $this->nl2Br($text);

It seems like $text can also be of type array; however, parameter $text of MyTextSanitizer::nl2Br() does only seem to accept string, maybe add an additional type check?

        }
        $text = $this->codeConv($text, $xcode);
        $text = $this->makeClickable($text);

It seems like $text can also be of type array; however, parameter $text of MyTextSanitizer::makeClickable() does only seem to accept string, maybe add an additional type check?

        if (!empty($this->config['filterxss_on_display'])) {
            $text = $this->filterXss($text);
        }

        return $text;
    }

    /**
     * Filters textarea form data submitted for preview
     *
     * @param  string   $text
     * @param  bool|int $html   allow html?
     * @param  bool|int $smiley allow smileys?
     * @param  bool|int $xcode  allow xoopscode?
     * @param  bool|int $image  allow inline images?
     * @param  bool|int $br     convert linebreaks?
     * @return string
     */
    public function &previewTarea($text, $html = 0, $smiley = 1, $xcode = 1, $image = 1, $br = 1)
    {
        $text = $this->stripSlashesGPC($text);

The function MyTextSanitizer::stripSlashesGPC() has been deprecated: as of XOOPS 2.5.11 and will be removed in next XOOPS version

        $text =& $this->displayTarea($text, $html, $smiley, $xcode, $image, $br);

        return $text;
    }

    /**
     * Replaces banned words in a string with their replacements
     *
     * @param  string $text
     * @return string
     * @deprecated
     */
    public function &censorString(&$text)
    {
        $ret = $this->executeExtension('censor', $text);
        if ($ret === false) {
            return $text;
        }

        return $ret;
    }

    /**
     * MyTextSanitizer::codePreConv()
     *
     * @param  mixed $text
     * @param  mixed $xcode
     * @return mixed
     */
    public function codePreConv($text, $xcode = 1)
    {
        if ($xcode != 0) {
            //            $patterns = "/\[code([^\]]*?)\](.*)\[\/code\]/esU";
            //            $replacements = "'[code\\1]'.base64_encode('\\2').'[/code]'";

            $patterns = "/\[code([^\]]*?)\](.*)\[\/code\]/sU";
            $text = preg_replace_callback(
                $patterns,
                function ($matches) {
                    return '[code'. $matches[1] . ']' . base64_encode($matches[2]) . '[/code]';
                },
                $text
            );
        }

        return $text;
    }

    /**
     * @param $match
     *
     * @return string
     */
    public function codeConvCallback($match)
    {
        return '<div class="xoopsCode">' . $this->executeExtension('syntaxhighlight', str_replace('\\\"', '\"', base64_decode($match[2])), $match[1]) . '</div>';
    }

    /**
     * MyTextSanitizer::codeConv()
     *
     * @param  mixed $text
     * @param  mixed $xcode
     * @return mixed
     */
    public function codeConv($text, $xcode = 1)
    {
        if (empty($xcode)) {
            return $text;
        }
        $patterns = "/\[code([^\]]*?)\](.*)\[\/code\]/sU";
        $text1    = preg_replace_callback($patterns, array($this, 'codeConvCallback'), $text);

        return $text1;
    }

    /**
     * MyTextSanitizer::executeExtensions()
     *
     * @return bool
     */
    public function executeExtensions()
    {
        $extensions = array_filter($this->config['extensions']);
        if (empty($extensions)) {
            return true;
        }
        foreach (array_keys($extensions) as $extension) {
            $this->executeExtension($extension);
        }
        return null;
    }

    /**
     * MyTextSanitizer::loadExtension()
     *
     * @param  mixed $name
     * @return MyTextSanitizerExtension|false
     */
    public function loadExtension($name)
    {
        if (file_exists($file = $this->path_basic . '/' . $name . '/' . $name . '.php')) {
            include_once $file;
        } elseif (file_exists($file = $this->path_plugin . '/' . $name . '/' . $name . '.php')) {
            include_once $file;
        } else {
            return false;
        }
        $class = 'Myts' . ucfirst($name);
        if (!class_exists($class)) {
            trigger_error("Extension '{$name}' does not exist", E_USER_WARNING);

            return false;
        }
        return new $class($this);
    }

    /**
     * MyTextSanitizer::executeExtension()
     *
     * @param  mixed $name
     * @return mixed
     */
    public function executeExtension($name)
    {
        $extension = $this->loadExtension($name);
        $args      = array_slice(func_get_args(), 1);
        array_unshift($args, $this);

        return call_user_func_array(array($extension, 'load'), $args);
    }

    /**
     * Filter out possible malicious text
     * kses project at SF could be a good solution to check
     *
     * @param  string $text  text to filter
     * @param  bool   $force force filtering
     * @return string filtered text
     */
    public function textFilter($text, $force = false)
    {
        $ret = $this->executeExtension('textfilter', $text, $force);
        if ($ret === false) {
            return $text;
        }

        return $ret;
    }

    // #################### Deprecated Methods ######################

    /**
     * if magic_quotes_gpc is on, strip back slashes
     *
     * @param  string $text
     * @return string
     * @deprecated as of XOOPS 2.5.11 and will be removed in next XOOPS version
     *
     * This remains here until we officially drop support for PHP 5.3 in next release
     */
    public function stripSlashesGPC($text)
    {
        if (@get_magic_quotes_gpc()) {
            $text = stripslashes($text);
        }

        return $text;
    }

    /**
     * MyTextSanitizer::codeSanitizer()
     *
     * @param  mixed $str
     * @param  mixed $image
     * @return mixed|string
     * @deprecated will be removed in next XOOPS version
     */
    public function codeSanitizer($str, $image = 1)
    {
        $GLOBALS['xoopsLogger']->addDeprecated(__CLASS__ . '::' . __FUNCTION__ . ' is deprecated');
        $str = $this->htmlSpecialChars(str_replace('\"', '"', base64_decode($str)));
        $str =& $this->xoopsCodeDecode($str, $image);

        return $str;
    }

    /**
     * MyTextSanitizer::sanitizeForDisplay()
     *
     * @param  mixed   $text
     * @param  integer $allowhtml
     * @param  integer $smiley
     * @param  mixed   $bbcode
     * @return mixed|string
     * @deprecated will be removed in next XOOPS version
     */
    public function sanitizeForDisplay($text, $allowhtml = 0, $smiley = 1, $bbcode = 1)
    {
        $GLOBALS['xoopsLogger']->addDeprecated(__CLASS__ . '::' . __FUNCTION__ . ' is deprecated');
        if ($allowhtml == 0) {
            $text = $this->htmlSpecialChars($text);
        } else {
            // $config =& $GLOBALS['xoopsConfig'];
            // $allowed = $config['allowed_html'];
            // $text = strip_tags($text, $allowed);
            $text = $this->makeClickable($text);
        }
        if ($smiley == 1) {
            $text = $this->smiley($text);
        }
        if ($bbcode == 1) {
            $text =& $this->xoopsCodeDecode($text);
        }
        $text = $this->nl2Br($text);

        return $text;
    }

    /**
     * MyTextSanitizer::sanitizeForPreview()
     *
     * @param  mixed   $text
     * @param  integer $allowhtml
     * @param  integer $smiley
     * @param  mixed   $bbcode
     * @return mixed|string
     * @deprecated will be removed in next XOOPS version
     */
    public function sanitizeForPreview($text, $allowhtml = 0, $smiley = 1, $bbcode = 1)
    {
        $GLOBALS['xoopsLogger']->addDeprecated(__CLASS__ . '::' . __FUNCTION__ . ' is deprecated');
        $text = $this->oopsStripSlashesGPC($text);

The function MyTextSanitizer::oopsStripSlashesGPC() has been deprecated: will be removed in next XOOPS version

        if ($allowhtml == 0) {
            $text = $this->htmlSpecialChars($text);
        } else {
            // $config =& $GLOBALS['xoopsConfig'];
            // $allowed = $config['allowed_html'];
            // $text = strip_tags($text, $allowed);
            $text = $this->makeClickable($text);
        }
        if ($smiley == 1) {
            $text = $this->smiley($text);
        }
        if ($bbcode == 1) {
            $text =& $this->xoopsCodeDecode($text);
        }
        $text = $this->nl2Br($text);

        return $text;
    }

    /**
     * MyTextSanitizer::makeTboxData4Save()
     *
     * @param  mixed $text
     * @return string
     * @deprecated will be removed in next XOOPS version
     */
    public function makeTboxData4Save($text)
    {
        $GLOBALS['xoopsLogger']->addDeprecated(__CLASS__ . '::' . __FUNCTION__ . ' is deprecated');

        // $text = $this->undoHtmlSpecialChars($text);
        return $this->addSlashes($text);
    }

    /**
     * MyTextSanitizer::makeTboxData4Show()
     *
     * @param  mixed $text
     * @param  mixed $smiley
     * @return mixed|string
     * @deprecated will be removed in next XOOPS version
     */
    public function makeTboxData4Show($text, $smiley = 0)

The parameter $smiley is not used and could be removed.

    {
        $GLOBALS['xoopsLogger']->addDeprecated(__CLASS__ . '::' . __FUNCTION__ . ' is deprecated');
        $text = $this->htmlSpecialChars($text);

        return $text;
    }

    /**
     * MyTextSanitizer::makeTboxData4Edit()
     *
     * @param  mixed $text
     * @return string
     * @deprecated will be removed in next XOOPS version
     */
    public function makeTboxData4Edit($text)
    {
        $GLOBALS['xoopsLogger']->addDeprecated(__CLASS__ . '::' . __FUNCTION__ . ' is deprecated');

        return $this->htmlSpecialChars($text);
    }

    /**
     * MyTextSanitizer::makeTboxData4Preview()
     *
     * @param  mixed $text
     * @param  mixed $smiley
     * @return mixed|string
     * @deprecated will be removed in next XOOPS version
     */
    public function makeTboxData4Preview($text, $smiley = 0)

The parameter $smiley is not used and could be removed.

    {
        $GLOBALS['xoopsLogger']->addDeprecated(__CLASS__ . '::' . __FUNCTION__ . ' is deprecated');
        $text = $this->stripSlashesGPC($text);

The function MyTextSanitizer::stripSlashesGPC() has been deprecated: as of XOOPS 2.5.11 and will be removed in next XOOPS version

        $text = $this->htmlSpecialChars($text);

        return $text;
    }

    /**
     * MyTextSanitizer::makeTboxData4PreviewInForm()
     *
     * @param  mixed $text
     * @return string
     * @deprecated will be removed in next XOOPS version
     */
    public function makeTboxData4PreviewInForm($text)
    {
        $GLOBALS['xoopsLogger']->addDeprecated(__CLASS__ . '::' . __FUNCTION__ . ' is deprecated');
        $text = $this->stripSlashesGPC($text);