@@ -52,6 +52,9 @@ discard block |
||
52 | 52 | } |
53 | 53 | } |
54 | 54 | |
55 | + /** |
|
56 | + * @param string|null $cropParameters |
|
57 | + */ |
|
55 | 58 | public function crop($cropParameters) { |
56 | 59 | $image_size = $this->get_image_size($this->image_wrapper->path); |
57 | 60 | $src_width = $image_size['width']; |
@@ -66,6 +69,9 @@ discard block |
||
66 | 69 | return $image; |
67 | 70 | } |
68 | 71 | |
72 | + /** |
|
73 | + * @param string $convert_file_to |
|
74 | + */ |
|
69 | 75 | public function send_image( |
70 | 76 | $file = '', |
71 | 77 | $compress = -1, |
@@ -147,6 +153,9 @@ discard block |
||
147 | 153 | public $image; |
148 | 154 | public $filter = Imagick::FILTER_LANCZOS; |
149 | 155 | |
156 | + /** |
|
157 | + * @param string $path |
|
158 | + */ |
|
150 | 159 | public function __construct($path) |
151 | 160 | { |
152 | 161 | parent::__construct($path); |
@@ -194,6 +203,10 @@ discard block |
||
194 | 203 | } |
195 | 204 | |
196 | 205 | //@todo implement border logic case for Imagick |
206 | + |
|
207 | + /** |
|
208 | + * @param integer $border |
|
209 | + */ |
|
197 | 210 | public function resize($thumbw, $thumbh, $border, $specific_size = false) |
198 | 211 | { |
199 | 212 | if (!$this->image_validated) return false; |
@@ -275,6 +288,9 @@ discard block |
||
275 | 288 | { |
276 | 289 | public $bg; |
277 | 290 | |
291 | + /** |
|
292 | + * @param string $path |
|
293 | + */ |
|
278 | 294 | function __construct($path) { |
279 | 295 | parent::__construct($path); |
280 | 296 | } |
@@ -332,6 +348,9 @@ discard block |
||
332 | 348 | } |
333 | 349 | } |
334 | 350 | |
351 | + /** |
|
352 | + * @param integer $border |
|
353 | + */ |
|
335 | 354 | public function resize($thumbw, $thumbh, $border, $specific_size = false) |
336 | 355 | { |
337 | 356 | if (!$this->image_validated) return false; |
@@ -47,7 +47,7 @@ discard block |
||
47 | 47 | if ($height >= $max_size_for_picture) { |
48 | 48 | // scale width |
49 | 49 | $new_width = round($width * ($max_size_for_picture / $height)); |
50 | - $this->image_wrapper->resize($new_width, $max_size_for_picture, 0); |
|
50 | + $this->image_wrapper->resize($new_width, $max_size_for_picture, 0); |
|
51 | 51 | } |
52 | 52 | } |
53 | 53 | } |
@@ -149,7 +149,7 @@ discard block |
||
149 | 149 | |
150 | 150 | public function __construct($path) |
151 | 151 | { |
152 | - parent::__construct($path); |
|
152 | + parent::__construct($path); |
|
153 | 153 | } |
154 | 154 | |
155 | 155 | public function set_image_wrapper() |
@@ -184,19 +184,19 @@ discard block |
||
184 | 184 | } |
185 | 185 | } |
186 | 186 | |
187 | - public function get_image_size() |
|
187 | + public function get_image_size() |
|
188 | 188 | { |
189 | - $imagesize = array('width'=>0,'height'=>0); |
|
190 | - if ($this->image_validated) { |
|
189 | + $imagesize = array('width'=>0,'height'=>0); |
|
190 | + if ($this->image_validated) { |
|
191 | 191 | $imagesize = $this->image->getImageGeometry(); |
192 | - } |
|
193 | - return $imagesize; |
|
194 | - } |
|
192 | + } |
|
193 | + return $imagesize; |
|
194 | + } |
|
195 | 195 | |
196 | - //@todo implement border logic case for Imagick |
|
197 | - public function resize($thumbw, $thumbh, $border, $specific_size = false) |
|
196 | + //@todo implement border logic case for Imagick |
|
197 | + public function resize($thumbw, $thumbh, $border, $specific_size = false) |
|
198 | 198 | { |
199 | - if (!$this->image_validated) return false; |
|
199 | + if (!$this->image_validated) return false; |
|
200 | 200 | |
201 | 201 | if ($specific_size) { |
202 | 202 | $width = $thumbw; |
@@ -206,10 +206,10 @@ discard block |
||
206 | 206 | $width = (int)($this->width * $scale); |
207 | 207 | $height = (int)($this->height * $scale); |
208 | 208 | } |
209 | - $result = $this->image->resizeImage($width, $height, $this->filter, 1); |
|
210 | - $this->width = $thumbw; |
|
211 | - $this->height = $thumbh; |
|
212 | - } |
|
209 | + $result = $this->image->resizeImage($width, $height, $this->filter, 1); |
|
210 | + $this->width = $thumbw; |
|
211 | + $this->height = $thumbh; |
|
212 | + } |
|
213 | 213 | |
214 | 214 | /** |
215 | 215 | * @author José Loguercio <[email protected]> |
@@ -224,8 +224,8 @@ discard block |
||
224 | 224 | public function crop($x, $y, $width, $height, $src_width, $src_height) { |
225 | 225 | if (!$this->image_validated) return false; |
226 | 226 | $this->image->cropimage($width, $height, $x, $y); |
227 | - $this->width = $width; |
|
228 | - $this->height = $height; |
|
227 | + $this->width = $width; |
|
228 | + $this->height = $height; |
|
229 | 229 | } |
230 | 230 | |
231 | 231 | public function send_image($file = '', $compress = -1, $convert_file_to = null) |
@@ -235,35 +235,35 @@ discard block |
||
235 | 235 | if (!empty($convert_file_to) && in_array($convert_file_to, $this->allowed_extensions)) { |
236 | 236 | $type = $convert_file_to; |
237 | 237 | } |
238 | - switch ($type) { |
|
239 | - case 'jpeg': |
|
240 | - case 'jpg': |
|
241 | - if (!$file) header("Content-type: image/jpeg"); |
|
242 | - break; |
|
243 | - case 'png': |
|
244 | - if (!$file) header("Content-type: image/png"); |
|
245 | - break; |
|
246 | - case 'gif': |
|
247 | - if (!$file) header("Content-type: image/gif"); |
|
248 | - break; |
|
249 | - } |
|
250 | - $result = false; |
|
251 | - try { |
|
252 | - $result = $this->image->writeImage($file); |
|
253 | - } catch(ImagickException $e) { |
|
238 | + switch ($type) { |
|
239 | + case 'jpeg': |
|
240 | + case 'jpg': |
|
241 | + if (!$file) header("Content-type: image/jpeg"); |
|
242 | + break; |
|
243 | + case 'png': |
|
244 | + if (!$file) header("Content-type: image/png"); |
|
245 | + break; |
|
246 | + case 'gif': |
|
247 | + if (!$file) header("Content-type: image/gif"); |
|
248 | + break; |
|
249 | + } |
|
250 | + $result = false; |
|
251 | + try { |
|
252 | + $result = $this->image->writeImage($file); |
|
253 | + } catch(ImagickException $e) { |
|
254 | 254 | if ($this->debug) error_log($e->getMessage()); |
255 | 255 | } |
256 | 256 | |
257 | - if (!$file) { |
|
258 | - echo $this->image; |
|
259 | - $this->image->clear(); |
|
257 | + if (!$file) { |
|
258 | + echo $this->image; |
|
259 | + $this->image->clear(); |
|
260 | 260 | $this->image->destroy(); |
261 | - } else { |
|
262 | - $this->image->clear(); |
|
261 | + } else { |
|
262 | + $this->image->clear(); |
|
263 | 263 | $this->image->destroy(); |
264 | - return $result; |
|
265 | - } |
|
266 | - } |
|
264 | + return $result; |
|
265 | + } |
|
266 | + } |
|
267 | 267 | |
268 | 268 | } |
269 | 269 | |
@@ -285,21 +285,21 @@ discard block |
||
285 | 285 | $this->fill_image_info(); |
286 | 286 | |
287 | 287 | switch ($this->type) { |
288 | - case 0: |
|
289 | - $handler = false; |
|
290 | - break; |
|
291 | - case 1 : |
|
288 | + case 0: |
|
289 | + $handler = false; |
|
290 | + break; |
|
291 | + case 1 : |
|
292 | 292 | $handler = @imagecreatefromgif($this->path); |
293 | 293 | $this->type = 'gif'; |
294 | 294 | break; |
295 | - case 2 : |
|
295 | + case 2 : |
|
296 | 296 | $handler = @imagecreatefromjpeg($this->path); |
297 | 297 | $this->type = 'jpg'; |
298 | 298 | break; |
299 | - case 3 : |
|
300 | - $handler = @imagecreatefrompng($this->path); |
|
301 | - $this->type = 'png'; |
|
302 | - break; |
|
299 | + case 3 : |
|
300 | + $handler = @imagecreatefrompng($this->path); |
|
301 | + $this->type = 'png'; |
|
302 | + break; |
|
303 | 303 | } |
304 | 304 | if ($handler) { |
305 | 305 | $this->image_validated = true; |
@@ -313,29 +313,29 @@ discard block |
||
313 | 313 | { |
314 | 314 | $return_array = array('width'=>0,'height'=>0); |
315 | 315 | if ($this->image_validated) { |
316 | - $return_array = array('width'=>$this->width,'height'=>$this->height); |
|
316 | + $return_array = array('width'=>$this->width,'height'=>$this->height); |
|
317 | 317 | } |
318 | 318 | return $return_array; |
319 | - } |
|
319 | + } |
|
320 | 320 | |
321 | 321 | public function fill_image_info() |
322 | 322 | { |
323 | - if (file_exists($this->path)) { |
|
324 | - $image_info = getimagesize($this->path); |
|
325 | - $this->width = $image_info[0]; |
|
326 | - $this->height = $image_info[1]; |
|
327 | - $this->type = $image_info[2]; |
|
328 | - } else { |
|
329 | - $this->width = 0; |
|
330 | - $this->height = 0; |
|
331 | - $this->type = 0; |
|
332 | - } |
|
323 | + if (file_exists($this->path)) { |
|
324 | + $image_info = getimagesize($this->path); |
|
325 | + $this->width = $image_info[0]; |
|
326 | + $this->height = $image_info[1]; |
|
327 | + $this->type = $image_info[2]; |
|
328 | + } else { |
|
329 | + $this->width = 0; |
|
330 | + $this->height = 0; |
|
331 | + $this->type = 0; |
|
332 | + } |
|
333 | 333 | } |
334 | 334 | |
335 | 335 | public function resize($thumbw, $thumbh, $border, $specific_size = false) |
336 | 336 | { |
337 | 337 | if (!$this->image_validated) return false; |
338 | - if ($border == 1) { |
|
338 | + if ($border == 1) { |
|
339 | 339 | if ($specific_size) { |
340 | 340 | $width = $thumbw; |
341 | 341 | $height = $thumbh; |
@@ -344,17 +344,17 @@ discard block |
||
344 | 344 | $width = (int)($this->width * $scale); |
345 | 345 | $height = (int)($this->height * $scale); |
346 | 346 | } |
347 | - $deltaw = (int)(($thumbw - $width) / 2); |
|
348 | - $deltah = (int)(($thumbh - $height) / 2); |
|
349 | - $dst_img = @ImageCreateTrueColor($thumbw, $thumbh); |
|
350 | - @imagealphablending($dst_img, false); |
|
351 | - @imagesavealpha($dst_img, true); |
|
352 | - if (!empty($this->color)) { |
|
353 | - @imagefill($dst_img, 0, 0, $this->color); |
|
354 | - } |
|
355 | - $this->width = $thumbw; |
|
356 | - $this->height = $thumbh; |
|
357 | - } elseif ($border == 0) { |
|
347 | + $deltaw = (int)(($thumbw - $width) / 2); |
|
348 | + $deltah = (int)(($thumbh - $height) / 2); |
|
349 | + $dst_img = @ImageCreateTrueColor($thumbw, $thumbh); |
|
350 | + @imagealphablending($dst_img, false); |
|
351 | + @imagesavealpha($dst_img, true); |
|
352 | + if (!empty($this->color)) { |
|
353 | + @imagefill($dst_img, 0, 0, $this->color); |
|
354 | + } |
|
355 | + $this->width = $thumbw; |
|
356 | + $this->height = $thumbh; |
|
357 | + } elseif ($border == 0) { |
|
358 | 358 | if ($specific_size) { |
359 | 359 | $width = $thumbw; |
360 | 360 | $height = $thumbh; |
@@ -363,19 +363,19 @@ discard block |
||
363 | 363 | $width = (int)($this->width * $scale); |
364 | 364 | $height = (int)($this->height * $scale); |
365 | 365 | } |
366 | - $deltaw = 0; |
|
367 | - $deltah = 0; |
|
368 | - $dst_img = @ImageCreateTrueColor($width, $height); |
|
369 | - @imagealphablending($dst_img, false); |
|
370 | - @imagesavealpha($dst_img, true); |
|
371 | - $this->width = $width; |
|
372 | - $this->height = $height; |
|
373 | - } |
|
374 | - $src_img = $this->bg; |
|
375 | - @ImageCopyResampled($dst_img, $src_img, $deltaw, $deltah, 0, 0, $width, $height, ImageSX($src_img), ImageSY($src_img)); |
|
376 | - $this->bg = $dst_img; |
|
377 | - @imagedestroy($src_img); |
|
378 | - } |
|
366 | + $deltaw = 0; |
|
367 | + $deltah = 0; |
|
368 | + $dst_img = @ImageCreateTrueColor($width, $height); |
|
369 | + @imagealphablending($dst_img, false); |
|
370 | + @imagesavealpha($dst_img, true); |
|
371 | + $this->width = $width; |
|
372 | + $this->height = $height; |
|
373 | + } |
|
374 | + $src_img = $this->bg; |
|
375 | + @ImageCopyResampled($dst_img, $src_img, $deltaw, $deltah, 0, 0, $width, $height, ImageSX($src_img), ImageSY($src_img)); |
|
376 | + $this->bg = $dst_img; |
|
377 | + @imagedestroy($src_img); |
|
378 | + } |
|
379 | 379 | |
380 | 380 | /** |
381 | 381 | * @author José Loguercio <[email protected]> |
@@ -389,7 +389,7 @@ discard block |
||
389 | 389 | public function crop($x, $y, $width, $height, $src_width, $src_height) { |
390 | 390 | if (!$this->image_validated) return false; |
391 | 391 | $this->width = $width; |
392 | - $this->height = $height; |
|
392 | + $this->height = $height; |
|
393 | 393 | $src = null; |
394 | 394 | $dest = @imagecreatetruecolor($width, $height); |
395 | 395 | $type = $this->type; |
@@ -400,56 +400,56 @@ discard block |
||
400 | 400 | @imagecopy($dest, $src, 0, 0, $x, $y, $src_width, $src_height); |
401 | 401 | @imagejpeg($dest, $this->path); |
402 | 402 | break; |
403 | - case 'png' : |
|
403 | + case 'png' : |
|
404 | 404 | $src = @imagecreatefrompng($this->path); |
405 | 405 | @imagecopy($dest, $src, 0, 0, $x, $y, $src_width, $src_height); |
406 | 406 | @imagepng($dest, $this->path); |
407 | 407 | break; |
408 | - case 'gif' : |
|
409 | - $src = @imagecreatefromgif($this->path); |
|
408 | + case 'gif' : |
|
409 | + $src = @imagecreatefromgif($this->path); |
|
410 | 410 | @imagecopy($dest, $src, 0, 0, $x, $y, $src_width, $src_height); |
411 | 411 | @imagegif($dest, $this->path); |
412 | - break; |
|
412 | + break; |
|
413 | 413 | default: return 0; |
414 | 414 | } |
415 | 415 | @imagedestroy($dest); |
416 | 416 | @imagedestroy($src); |
417 | 417 | } |
418 | 418 | |
419 | - public function send_image($file = '', $compress = -1, $convert_file_to = null) |
|
419 | + public function send_image($file = '', $compress = -1, $convert_file_to = null) |
|
420 | 420 | { |
421 | - if (!$this->image_validated) return false; |
|
421 | + if (!$this->image_validated) return false; |
|
422 | 422 | $compress = (int)$compress; |
423 | 423 | $type = $this->type; |
424 | 424 | if (!empty($convert_file_to) && in_array($convert_file_to, $this->allowed_extensions)) { |
425 | 425 | $type = $convert_file_to; |
426 | 426 | } |
427 | - switch ($type) { |
|
428 | - case 'jpeg': |
|
429 | - case 'jpg': |
|
430 | - if (!$file) header("Content-type: image/jpeg"); |
|
431 | - if ($compress == -1) $compress = 100; |
|
432 | - return imagejpeg($this->bg, $file, $compress); |
|
433 | - break; |
|
434 | - case 'png': |
|
435 | - if (!$file) header("Content-type: image/png"); |
|
436 | - if ($compress != -1) { |
|
437 | - @imagetruecolortopalette($this->bg, true, $compress); |
|
438 | - } |
|
439 | - return imagepng($this->bg, $file, $compress); |
|
440 | - break; |
|
441 | - case 'gif': |
|
442 | - if (!$file) header("Content-type: image/gif"); |
|
443 | - if ($compress != -1) { |
|
444 | - @imagetruecolortopalette($this->bg, true, $compress); |
|
445 | - } |
|
446 | - return imagegif($this->bg, $file, $compress); |
|
447 | - break; |
|
448 | - default: return 0; |
|
449 | - } |
|
450 | - // TODO: Occupied memory is not released, because the following fragment of code is actually dead. |
|
451 | - @imagedestroy($this->bg); |
|
452 | - } |
|
427 | + switch ($type) { |
|
428 | + case 'jpeg': |
|
429 | + case 'jpg': |
|
430 | + if (!$file) header("Content-type: image/jpeg"); |
|
431 | + if ($compress == -1) $compress = 100; |
|
432 | + return imagejpeg($this->bg, $file, $compress); |
|
433 | + break; |
|
434 | + case 'png': |
|
435 | + if (!$file) header("Content-type: image/png"); |
|
436 | + if ($compress != -1) { |
|
437 | + @imagetruecolortopalette($this->bg, true, $compress); |
|
438 | + } |
|
439 | + return imagepng($this->bg, $file, $compress); |
|
440 | + break; |
|
441 | + case 'gif': |
|
442 | + if (!$file) header("Content-type: image/gif"); |
|
443 | + if ($compress != -1) { |
|
444 | + @imagetruecolortopalette($this->bg, true, $compress); |
|
445 | + } |
|
446 | + return imagegif($this->bg, $file, $compress); |
|
447 | + break; |
|
448 | + default: return 0; |
|
449 | + } |
|
450 | + // TODO: Occupied memory is not released, because the following fragment of code is actually dead. |
|
451 | + @imagedestroy($this->bg); |
|
452 | + } |
|
453 | 453 | |
454 | 454 | /** |
455 | 455 | * Convert image to black & white |
@@ -115,7 +115,7 @@ discard block |
||
115 | 115 | return false; |
116 | 116 | } |
117 | 117 | $this->path = preg_match(VALID_WEB_PATH, $path) ? (api_is_internal_path($path) ? api_get_path(TO_SYS, $path) : $path) : $path; |
118 | - $this->set_image_wrapper(); //Creates image obj |
|
118 | + $this->set_image_wrapper(); //Creates image obj |
|
119 | 119 | } |
120 | 120 | |
121 | 121 | abstract function set_image_wrapper(); |
@@ -157,7 +157,7 @@ discard block |
||
157 | 157 | if ($this->debug) error_log('Image::set_image_wrapper loaded'); |
158 | 158 | try { |
159 | 159 | if (file_exists($this->path)) { |
160 | - $this->image = new Imagick($this->path); |
|
160 | + $this->image = new Imagick($this->path); |
|
161 | 161 | |
162 | 162 | if ($this->image) { |
163 | 163 | $this->fill_image_info(); //Fills height, width and type |
@@ -165,7 +165,7 @@ discard block |
||
165 | 165 | } else { |
166 | 166 | if ($this->debug) error_log('Image::image does not exist'); |
167 | 167 | } |
168 | - } catch(ImagickException $e) { |
|
168 | + } catch (ImagickException $e) { |
|
169 | 169 | if ($this->debug) error_log($e->getMessage()); |
170 | 170 | } |
171 | 171 | } |
@@ -186,7 +186,7 @@ discard block |
||
186 | 186 | |
187 | 187 | public function get_image_size() |
188 | 188 | { |
189 | - $imagesize = array('width'=>0,'height'=>0); |
|
189 | + $imagesize = array('width'=>0, 'height'=>0); |
|
190 | 190 | if ($this->image_validated) { |
191 | 191 | $imagesize = $this->image->getImageGeometry(); |
192 | 192 | } |
@@ -203,8 +203,8 @@ discard block |
||
203 | 203 | $height = $thumbh; |
204 | 204 | } else { |
205 | 205 | $scale = ($this->width > 0 && $this->height > 0) ? min($thumbw / $this->width, $thumbh / $this->height) : 0; |
206 | - $width = (int)($this->width * $scale); |
|
207 | - $height = (int)($this->height * $scale); |
|
206 | + $width = (int) ($this->width * $scale); |
|
207 | + $height = (int) ($this->height * $scale); |
|
208 | 208 | } |
209 | 209 | $result = $this->image->resizeImage($width, $height, $this->filter, 1); |
210 | 210 | $this->width = $thumbw; |
@@ -250,7 +250,7 @@ discard block |
||
250 | 250 | $result = false; |
251 | 251 | try { |
252 | 252 | $result = $this->image->writeImage($file); |
253 | - } catch(ImagickException $e) { |
|
253 | + } catch (ImagickException $e) { |
|
254 | 254 | if ($this->debug) error_log($e->getMessage()); |
255 | 255 | } |
256 | 256 | |
@@ -311,9 +311,9 @@ discard block |
||
311 | 311 | |
312 | 312 | public function get_image_size() |
313 | 313 | { |
314 | - $return_array = array('width'=>0,'height'=>0); |
|
314 | + $return_array = array('width'=>0, 'height'=>0); |
|
315 | 315 | if ($this->image_validated) { |
316 | - $return_array = array('width'=>$this->width,'height'=>$this->height); |
|
316 | + $return_array = array('width'=>$this->width, 'height'=>$this->height); |
|
317 | 317 | } |
318 | 318 | return $return_array; |
319 | 319 | } |
@@ -321,7 +321,7 @@ discard block |
||
321 | 321 | public function fill_image_info() |
322 | 322 | { |
323 | 323 | if (file_exists($this->path)) { |
324 | - $image_info = getimagesize($this->path); |
|
324 | + $image_info = getimagesize($this->path); |
|
325 | 325 | $this->width = $image_info[0]; |
326 | 326 | $this->height = $image_info[1]; |
327 | 327 | $this->type = $image_info[2]; |
@@ -341,11 +341,11 @@ discard block |
||
341 | 341 | $height = $thumbh; |
342 | 342 | } else { |
343 | 343 | $scale = min($thumbw / $this->width, $thumbh / $this->height); |
344 | - $width = (int)($this->width * $scale); |
|
345 | - $height = (int)($this->height * $scale); |
|
344 | + $width = (int) ($this->width * $scale); |
|
345 | + $height = (int) ($this->height * $scale); |
|
346 | 346 | } |
347 | - $deltaw = (int)(($thumbw - $width) / 2); |
|
348 | - $deltah = (int)(($thumbh - $height) / 2); |
|
347 | + $deltaw = (int) (($thumbw - $width) / 2); |
|
348 | + $deltah = (int) (($thumbh - $height) / 2); |
|
349 | 349 | $dst_img = @ImageCreateTrueColor($thumbw, $thumbh); |
350 | 350 | @imagealphablending($dst_img, false); |
351 | 351 | @imagesavealpha($dst_img, true); |
@@ -360,8 +360,8 @@ discard block |
||
360 | 360 | $height = $thumbh; |
361 | 361 | } else { |
362 | 362 | $scale = ($this->width > 0 && $this->height > 0) ? min($thumbw / $this->width, $thumbh / $this->height) : 0; |
363 | - $width = (int)($this->width * $scale); |
|
364 | - $height = (int)($this->height * $scale); |
|
363 | + $width = (int) ($this->width * $scale); |
|
364 | + $height = (int) ($this->height * $scale); |
|
365 | 365 | } |
366 | 366 | $deltaw = 0; |
367 | 367 | $deltah = 0; |
@@ -419,7 +419,7 @@ discard block |
||
419 | 419 | public function send_image($file = '', $compress = -1, $convert_file_to = null) |
420 | 420 | { |
421 | 421 | if (!$this->image_validated) return false; |
422 | - $compress = (int)$compress; |
|
422 | + $compress = (int) $compress; |
|
423 | 423 | $type = $this->type; |
424 | 424 | if (!empty($convert_file_to) && in_array($convert_file_to, $this->allowed_extensions)) { |
425 | 425 | $type = $convert_file_to; |
@@ -463,11 +463,11 @@ discard block |
||
463 | 463 | * so that we can use black (0,0,0) as transparent, which is what |
464 | 464 | * the image is filled with when created. |
465 | 465 | */ |
466 | - $transparent = imagecolorallocate($dest_img, 0,0,0); |
|
466 | + $transparent = imagecolorallocate($dest_img, 0, 0, 0); |
|
467 | 467 | imagealphablending($dest_img, false); |
468 | 468 | imagesavealpha($dest_img, true); |
469 | 469 | imagecolortransparent($dest_img, $transparent); |
470 | - imagecopy($dest_img, $this->bg, 0,0, 0, 0,imagesx($this->bg), imagesx($this->bg)); |
|
470 | + imagecopy($dest_img, $this->bg, 0, 0, 0, 0, imagesx($this->bg), imagesx($this->bg)); |
|
471 | 471 | imagefilter($dest_img, IMG_FILTER_GRAYSCALE); |
472 | 472 | $this->bg = $dest_img; |
473 | 473 |
@@ -154,7 +154,9 @@ discard block |
||
154 | 154 | |
155 | 155 | public function set_image_wrapper() |
156 | 156 | { |
157 | - if ($this->debug) error_log('Image::set_image_wrapper loaded'); |
|
157 | + if ($this->debug) { |
|
158 | + error_log('Image::set_image_wrapper loaded'); |
|
159 | + } |
|
158 | 160 | try { |
159 | 161 | if (file_exists($this->path)) { |
160 | 162 | $this->image = new Imagick($this->path); |
@@ -163,10 +165,14 @@ discard block |
||
163 | 165 | $this->fill_image_info(); //Fills height, width and type |
164 | 166 | } |
165 | 167 | } else { |
166 | - if ($this->debug) error_log('Image::image does not exist'); |
|
168 | + if ($this->debug) { |
|
169 | + error_log('Image::image does not exist'); |
|
170 | + } |
|
167 | 171 | } |
168 | 172 | } catch(ImagickException $e) { |
169 | - if ($this->debug) error_log($e->getMessage()); |
|
173 | + if ($this->debug) { |
|
174 | + error_log($e->getMessage()); |
|
175 | + } |
|
170 | 176 | } |
171 | 177 | } |
172 | 178 | |
@@ -180,7 +186,9 @@ discard block |
||
180 | 186 | |
181 | 187 | if (in_array($this->type, $this->allowed_extensions)) { |
182 | 188 | $this->image_validated = true; |
183 | - if ($this->debug) error_log('image_validated true'); |
|
189 | + if ($this->debug) { |
|
190 | + error_log('image_validated true'); |
|
191 | + } |
|
184 | 192 | } |
185 | 193 | } |
186 | 194 | |
@@ -196,7 +204,9 @@ discard block |
||
196 | 204 | //@todo implement border logic case for Imagick |
197 | 205 | public function resize($thumbw, $thumbh, $border, $specific_size = false) |
198 | 206 | { |
199 | - if (!$this->image_validated) return false; |
|
207 | + if (!$this->image_validated) { |
|
208 | + return false; |
|
209 | + } |
|
200 | 210 | |
201 | 211 | if ($specific_size) { |
202 | 212 | $width = $thumbw; |
@@ -222,7 +232,9 @@ discard block |
||
222 | 232 | */ |
223 | 233 | |
224 | 234 | public function crop($x, $y, $width, $height, $src_width, $src_height) { |
225 | - if (!$this->image_validated) return false; |
|
235 | + if (!$this->image_validated) { |
|
236 | + return false; |
|
237 | + } |
|
226 | 238 | $this->image->cropimage($width, $height, $x, $y); |
227 | 239 | $this->width = $width; |
228 | 240 | $this->height = $height; |
@@ -230,7 +242,9 @@ discard block |
||
230 | 242 | |
231 | 243 | public function send_image($file = '', $compress = -1, $convert_file_to = null) |
232 | 244 | { |
233 | - if (!$this->image_validated) return false; |
|
245 | + if (!$this->image_validated) { |
|
246 | + return false; |
|
247 | + } |
|
234 | 248 | $type = $this->type; |
235 | 249 | if (!empty($convert_file_to) && in_array($convert_file_to, $this->allowed_extensions)) { |
236 | 250 | $type = $convert_file_to; |
@@ -238,20 +252,28 @@ discard block |
||
238 | 252 | switch ($type) { |
239 | 253 | case 'jpeg': |
240 | 254 | case 'jpg': |
241 | - if (!$file) header("Content-type: image/jpeg"); |
|
255 | + if (!$file) { |
|
256 | + header("Content-type: image/jpeg"); |
|
257 | + } |
|
242 | 258 | break; |
243 | 259 | case 'png': |
244 | - if (!$file) header("Content-type: image/png"); |
|
260 | + if (!$file) { |
|
261 | + header("Content-type: image/png"); |
|
262 | + } |
|
245 | 263 | break; |
246 | 264 | case 'gif': |
247 | - if (!$file) header("Content-type: image/gif"); |
|
265 | + if (!$file) { |
|
266 | + header("Content-type: image/gif"); |
|
267 | + } |
|
248 | 268 | break; |
249 | 269 | } |
250 | 270 | $result = false; |
251 | 271 | try { |
252 | 272 | $result = $this->image->writeImage($file); |
253 | 273 | } catch(ImagickException $e) { |
254 | - if ($this->debug) error_log($e->getMessage()); |
|
274 | + if ($this->debug) { |
|
275 | + error_log($e->getMessage()); |
|
276 | + } |
|
255 | 277 | } |
256 | 278 | |
257 | 279 | if (!$file) { |
@@ -334,7 +356,9 @@ discard block |
||
334 | 356 | |
335 | 357 | public function resize($thumbw, $thumbh, $border, $specific_size = false) |
336 | 358 | { |
337 | - if (!$this->image_validated) return false; |
|
359 | + if (!$this->image_validated) { |
|
360 | + return false; |
|
361 | + } |
|
338 | 362 | if ($border == 1) { |
339 | 363 | if ($specific_size) { |
340 | 364 | $width = $thumbw; |
@@ -387,7 +411,9 @@ discard block |
||
387 | 411 | * @param int $src_height the source height of the original image |
388 | 412 | */ |
389 | 413 | public function crop($x, $y, $width, $height, $src_width, $src_height) { |
390 | - if (!$this->image_validated) return false; |
|
414 | + if (!$this->image_validated) { |
|
415 | + return false; |
|
416 | + } |
|
391 | 417 | $this->width = $width; |
392 | 418 | $this->height = $height; |
393 | 419 | $src = null; |
@@ -418,7 +444,9 @@ discard block |
||
418 | 444 | |
419 | 445 | public function send_image($file = '', $compress = -1, $convert_file_to = null) |
420 | 446 | { |
421 | - if (!$this->image_validated) return false; |
|
447 | + if (!$this->image_validated) { |
|
448 | + return false; |
|
449 | + } |
|
422 | 450 | $compress = (int)$compress; |
423 | 451 | $type = $this->type; |
424 | 452 | if (!empty($convert_file_to) && in_array($convert_file_to, $this->allowed_extensions)) { |
@@ -427,19 +455,27 @@ discard block |
||
427 | 455 | switch ($type) { |
428 | 456 | case 'jpeg': |
429 | 457 | case 'jpg': |
430 | - if (!$file) header("Content-type: image/jpeg"); |
|
431 | - if ($compress == -1) $compress = 100; |
|
458 | + if (!$file) { |
|
459 | + header("Content-type: image/jpeg"); |
|
460 | + } |
|
461 | + if ($compress == -1) { |
|
462 | + $compress = 100; |
|
463 | + } |
|
432 | 464 | return imagejpeg($this->bg, $file, $compress); |
433 | 465 | break; |
434 | 466 | case 'png': |
435 | - if (!$file) header("Content-type: image/png"); |
|
467 | + if (!$file) { |
|
468 | + header("Content-type: image/png"); |
|
469 | + } |
|
436 | 470 | if ($compress != -1) { |
437 | 471 | @imagetruecolortopalette($this->bg, true, $compress); |
438 | 472 | } |
439 | 473 | return imagepng($this->bg, $file, $compress); |
440 | 474 | break; |
441 | 475 | case 'gif': |
442 | - if (!$file) header("Content-type: image/gif"); |
|
476 | + if (!$file) { |
|
477 | + header("Content-type: image/gif"); |
|
478 | + } |
|
443 | 479 | if ($compress != -1) { |
444 | 480 | @imagetruecolortopalette($this->bg, true, $compress); |
445 | 481 | } |
@@ -456,7 +492,9 @@ discard block |
||
456 | 492 | */ |
457 | 493 | function convert2bw() |
458 | 494 | { |
459 | - if (!$this->image_validated) return false; |
|
495 | + if (!$this->image_validated) { |
|
496 | + return false; |
|
497 | + } |
|
460 | 498 | |
461 | 499 | $dest_img = imagecreatetruecolor(imagesx($this->bg), imagesy($this->bg)); |
462 | 500 | /* copy ignore the transparent color |
@@ -435,6 +435,7 @@ discard block |
||
435 | 435 | * If null, the timezone will be determined based on user preference, |
436 | 436 | * or timezone chosen by the admin for the platform. |
437 | 437 | * @param string The timezone to be converted from. If null, UTC will be assumed. |
438 | + * @param string $to_timezone |
|
438 | 439 | * @return string The converted time formatted as Y-m-d H:i:s |
439 | 440 | * |
440 | 441 | * @author Guillaume Viguier <[email protected]> |
@@ -483,6 +484,7 @@ discard block |
||
483 | 484 | * @param string String to be converted |
484 | 485 | * @param string Timezone (if null, the timezone will be determined based |
485 | 486 | * on user preference, or timezone chosen by the admin for the platform) |
487 | + * @param string $timezone |
|
486 | 488 | * @return int Timestamp |
487 | 489 | * |
488 | 490 | * @author Guillaume Viguier <[email protected]> |
@@ -784,6 +786,7 @@ discard block |
||
784 | 786 | * @param mixed The time to be converted |
785 | 787 | * @param mixed Format to be used (TIME_NO_SEC_FORMAT, DATE_FORMAT_SHORT, DATE_FORMAT_LONG, DATE_TIME_FORMAT_LONG) |
786 | 788 | * @param string Timezone to be converted from. If null, UTC will be assumed. |
789 | + * @param string $from_timezone |
|
787 | 790 | * @return string Converted and localized date |
788 | 791 | * |
789 | 792 | * @author Guillaume Viguier <[email protected]> |
@@ -853,7 +856,7 @@ discard block |
||
853 | 856 | * @param int/string $format (optional) The person name format. It may be a pattern-string (for example '%t %l, %f' or '%T %F %L', ...) or some of the constants PERSON_NAME_COMMON_CONVENTION (default), PERSON_NAME_WESTERN_ORDER, PERSON_NAME_EASTERN_ORDER, PERSON_NAME_LIBRARY_ORDER. |
854 | 857 | * @param string $language (optional) The language id. If it is omitted, the current interface language is assumed. This parameter has meaning with the format PERSON_NAME_COMMON_CONVENTION only. |
855 | 858 | * @param string $encoding (optional) The used internally by this function character encoding. If it is omitted, the platform character set will be used by default. |
856 | - * @return bool The result is sort of full name of the person. |
|
859 | + * @return string The result is sort of full name of the person. |
|
857 | 860 | * Sample results: |
858 | 861 | * Peter Ustinoff or Dr. Peter Ustinoff - the Western order |
859 | 862 | * Ustinoff Peter or Dr. Ustinoff Peter - the Eastern order |
@@ -947,7 +950,7 @@ discard block |
||
947 | 950 | |
948 | 951 | /** |
949 | 952 | * Checks whether a given format represents person name in Western order (for which first name is first). |
950 | - * @param int/string $format (optional) The person name format. It may be a pattern-string (for example '%t. %l, %f') or some of the constants PERSON_NAME_COMMON_CONVENTION (default), PERSON_NAME_WESTERN_ORDER, PERSON_NAME_EASTERN_ORDER, PERSON_NAME_LIBRARY_ORDER. |
|
953 | + * @param integer $format (optional) The person name format. It may be a pattern-string (for example '%t. %l, %f') or some of the constants PERSON_NAME_COMMON_CONVENTION (default), PERSON_NAME_WESTERN_ORDER, PERSON_NAME_EASTERN_ORDER, PERSON_NAME_LIBRARY_ORDER. |
|
951 | 954 | * @param string $language (optional) The language id. If it is omitted, the current interface language is assumed. This parameter has meaning with the format PERSON_NAME_COMMON_CONVENTION only. |
952 | 955 | * @return bool The result TRUE means that the order is first_name last_name, FALSE means last_name first_name. |
953 | 956 | * Note: You may use this function for determing the order of the fields or columns "First name" and "Last name" in forms, tables and reports. |
@@ -1175,8 +1178,8 @@ discard block |
||
1175 | 1178 | |
1176 | 1179 | /** |
1177 | 1180 | * This function returns a string or an array with all occurrences of search in subject (ignoring case) replaced with the given replace value. |
1178 | - * @param mixed $search String or array of strings to be found. |
|
1179 | - * @param mixed $replace String or array of strings used for replacement. |
|
1181 | + * @param string $search String or array of strings to be found. |
|
1182 | + * @param string $replace String or array of strings used for replacement. |
|
1180 | 1183 | * @param mixed $subject String or array of strings being searched. |
1181 | 1184 | * @param int $count (optional) The number of matched and replaced needles will be returned in count, which is passed by reference. |
1182 | 1185 | * @param string $encoding (optional) The used internally by this function character encoding. |
@@ -1239,10 +1242,10 @@ discard block |
||
1239 | 1242 | /** |
1240 | 1243 | * Finds first occurrence of a string within another, case insensitive. |
1241 | 1244 | * @param string $haystack The string from which to get the first occurrence. |
1242 | - * @param mixed $needle The string to be found. |
|
1245 | + * @param string $needle The string to be found. |
|
1243 | 1246 | * @param bool $before_needle (optional) Determines which portion of $haystack this function returns. The default value is FALSE. |
1244 | 1247 | * @param string $encoding (optional) The used internally by this function character encoding. If it is omitted, the platform character set will be used by default. |
1245 | - * @return mixed Returns the portion of $haystack, or FALSE if $needle is not found. |
|
1248 | + * @return false|string Returns the portion of $haystack, or FALSE if $needle is not found. |
|
1246 | 1249 | * Notes: |
1247 | 1250 | * If $needle is not a string, it is converted to an integer and applied as the ordinal value (codepoint if the encoding is UTF-8) of a character. |
1248 | 1251 | * If $before_needle is set to TRUE, the function returns all of $haystack from the beginning to the first occurrence of $needle. |
@@ -1298,7 +1301,7 @@ discard block |
||
1298 | 1301 | * @param mixed $needle The string which first character is to be found. |
1299 | 1302 | * @param bool $before_needle (optional) Determines which portion of $haystack this function returns. The default value is FALSE. |
1300 | 1303 | * @param string $encoding (optional) The used internally by this function character encoding. If it is omitted, the platform character set will be used by default. |
1301 | - * @return mixed Returns the portion of $haystack, or FALSE if the first character from $needle is not found. |
|
1304 | + * @return false|string Returns the portion of $haystack, or FALSE if the first character from $needle is not found. |
|
1302 | 1305 | * Notes: |
1303 | 1306 | * If $needle is not a string, it is converted to an integer and applied as the ordinal value (codepoint if the encoding is UTF-8) of a character. |
1304 | 1307 | * If $before_needle is set to TRUE, the function returns all of $haystack from the beginning to the first occurrence. |
@@ -1348,7 +1351,7 @@ discard block |
||
1348 | 1351 | * @param string $needle The string to be found. |
1349 | 1352 | * @param int $offset (optional) $offset may be specified to begin searching an arbitrary position. Negative values will stop searching at an arbitrary point prior to the end of the string. |
1350 | 1353 | * @param string $encoding (optional) The used internally by this function character encoding. If it is omitted, the platform character set will be used by default. |
1351 | - * @return mixed Returns the numeric position of the first occurrence of $needle in the $haystack, or FALSE if $needle is not found. |
|
1354 | + * @return integer|null Returns the numeric position of the first occurrence of $needle in the $haystack, or FALSE if $needle is not found. |
|
1352 | 1355 | * Note: The first character's position is 0, the second character position is 1, and so on. |
1353 | 1356 | * This function is aimed at replacing the functions strrpos() and mb_strrpos() for human-language strings. |
1354 | 1357 | * @link http://php.net/manual/en/function.strrpos |
@@ -1365,7 +1368,7 @@ discard block |
||
1365 | 1368 | * @param mixed $needle The string to be found. |
1366 | 1369 | * @param bool $before_needle (optional) Determines which portion of $haystack this function returns. The default value is FALSE. |
1367 | 1370 | * @param string $encoding (optional) The used internally by this function character encoding. If it is omitted, the platform character set will be used by default. |
1368 | - * @return mixed Returns the portion of $haystack, or FALSE if $needle is not found. |
|
1371 | + * @return false|string Returns the portion of $haystack, or FALSE if $needle is not found. |
|
1369 | 1372 | * Notes: |
1370 | 1373 | * If $needle is not a string, it is converted to an integer and applied as the ordinal value (codepoint if the encoding is UTF-8) of a character. |
1371 | 1374 | * If $before_needle is set to TRUE, the function returns all of $haystack from the beginning to the first occurrence of $needle. |
@@ -1508,7 +1511,7 @@ discard block |
||
1508 | 1511 | * Note that this changes the return value in an array where every element is an array consisting of the matched string at index 0 and its string offset into subject at index 1. |
1509 | 1512 | * @param int $offset (optional) Normally, the search starts from the beginning of the subject string. The optional parameter offset can be used to specify the alternate place from which to start the search. |
1510 | 1513 | * @param string $encoding (optional) The used internally by this function character encoding. If it is omitted, the platform character set will be used by default. |
1511 | - * @return int|boolean Returns the number of times pattern matches or FALSE if an error occurred. |
|
1514 | + * @return integer Returns the number of times pattern matches or FALSE if an error occurred. |
|
1512 | 1515 | * @link http://php.net/preg_match |
1513 | 1516 | */ |
1514 | 1517 | function api_preg_match($pattern, $subject, &$matches = null, $flags = 0, $offset = 0, $encoding = null) { |
@@ -1531,7 +1534,7 @@ discard block |
||
1531 | 1534 | * If no order flag is given, PREG_PATTERN_ORDER is assumed. |
1532 | 1535 | * @param int $offset (optional) Normally, the search starts from the beginning of the subject string. The optional parameter offset can be used to specify the alternate place from which to start the search. |
1533 | 1536 | * @param string $encoding (optional) The used internally by this function character encoding. If it is omitted, the platform character set will be used by default. |
1534 | - * @return int|boolean Returns the number of full pattern matches (which might be zero), or FALSE if an error occurred. |
|
1537 | + * @return integer Returns the number of full pattern matches (which might be zero), or FALSE if an error occurred. |
|
1535 | 1538 | * @link http://php.net/preg_match_all |
1536 | 1539 | */ |
1537 | 1540 | function api_preg_match_all($pattern, $subject, &$matches, $flags = PREG_PATTERN_ORDER, $offset = 0, $encoding = null) { |
@@ -1546,8 +1549,8 @@ discard block |
||
1546 | 1549 | |
1547 | 1550 | /** |
1548 | 1551 | * Performs a regular expression search and replace, UTF-8 aware when it is applicable. |
1549 | - * @param string|array $pattern The pattern to search for. It can be either a string or an array with strings. |
|
1550 | - * @param string|array $replacement The string or an array with strings to replace. |
|
1552 | + * @param string $pattern The pattern to search for. It can be either a string or an array with strings. |
|
1553 | + * @param string $replacement The string or an array with strings to replace. |
|
1551 | 1554 | * @param string|array $subject The string or an array with strings to search and replace. |
1552 | 1555 | * @param int $limit The maximum possible replacements for each pattern in each subject string. Defaults to -1 (no limit). |
1553 | 1556 | * @param int &$count If specified, this variable will be filled with the number of replacements done. |
@@ -1799,6 +1802,7 @@ discard block |
||
1799 | 1802 | /** |
1800 | 1803 | * Checks a string for UTF-8 validity. |
1801 | 1804 | * |
1805 | + * @param string $string |
|
1802 | 1806 | */ |
1803 | 1807 | function api_is_valid_utf8(&$string) |
1804 | 1808 | { |
@@ -1941,7 +1945,7 @@ discard block |
||
1941 | 1945 | /** |
1942 | 1946 | * Replaces non-valid formats for person names with the default (English) format. |
1943 | 1947 | * @param string $format The input format to be verified. |
1944 | - * @return bool Returns the same format if is is valid, otherwise returns a valid English format. |
|
1948 | + * @return string Returns the same format if is is valid, otherwise returns a valid English format. |
|
1945 | 1949 | */ |
1946 | 1950 | function _api_validate_person_name_format($format) { |
1947 | 1951 | if (empty($format) || stripos($format, '%f') === false || stripos($format, '%l') === false) { |
@@ -2068,6 +2072,9 @@ discard block |
||
2068 | 2072 | |
2069 | 2073 | // This function checks whether the function _api_convert_encoding() (the php- |
2070 | 2074 | // implementation) is able to convert from/to a given encoding. |
2075 | +/** |
|
2076 | + * @param string $encoding |
|
2077 | + */ |
|
2071 | 2078 | function _api_convert_encoding_supports($encoding) { |
2072 | 2079 | static $supports = array(); |
2073 | 2080 | if (!isset($supports[$encoding])) { |
@@ -103,13 +103,13 @@ discard block |
||
103 | 103 | if (isset($_configuration['language_measure_frequency']) && |
104 | 104 | $_configuration['language_measure_frequency'] == 1 |
105 | 105 | ) { |
106 | - require_once api_get_path(SYS_CODE_PATH).'/cron/lang/langstats.class.php'; |
|
107 | - global $langstats; |
|
108 | - $langstats->add_use($variable,''); |
|
106 | + require_once api_get_path(SYS_CODE_PATH).'/cron/lang/langstats.class.php'; |
|
107 | + global $langstats; |
|
108 | + $langstats->add_use($variable,''); |
|
109 | 109 | } |
110 | 110 | |
111 | 111 | if (!isset($used_lang_vars)) { |
112 | - $used_lang_vars = array(); |
|
112 | + $used_lang_vars = array(); |
|
113 | 113 | } |
114 | 114 | |
115 | 115 | // Caching results from some API functions, for speed. |
@@ -305,7 +305,7 @@ discard block |
||
305 | 305 | static $text_direction = array(); |
306 | 306 | |
307 | 307 | if (empty($language)) { |
308 | - $language = api_get_interface_language(); |
|
308 | + $language = api_get_interface_language(); |
|
309 | 309 | } |
310 | 310 | if (!isset($text_direction[$language])) { |
311 | 311 | $text_direction[$language] = in_array(api_purify_language_id($language), |
@@ -536,24 +536,24 @@ discard block |
||
536 | 536 | case DATE_FORMAT_ONLY_DAYNAME: |
537 | 537 | $date_format = get_lang('dateFormatOnlyDayName', '', $language); |
538 | 538 | if (INTL_INSTALLED) { |
539 | - $datetype = IntlDateFormatter::SHORT; |
|
540 | - $timetype = IntlDateFormatter::NONE; |
|
541 | - } |
|
539 | + $datetype = IntlDateFormatter::SHORT; |
|
540 | + $timetype = IntlDateFormatter::NONE; |
|
541 | + } |
|
542 | 542 | break; |
543 | 543 | case DATE_FORMAT_NUMBER_NO_YEAR: |
544 | 544 | $date_format = get_lang('dateFormatShortNumberNoYear', '', $language); |
545 | - if (INTL_INSTALLED) { |
|
546 | - $datetype = IntlDateFormatter::SHORT; |
|
547 | - $timetype = IntlDateFormatter::NONE; |
|
548 | - } |
|
545 | + if (INTL_INSTALLED) { |
|
546 | + $datetype = IntlDateFormatter::SHORT; |
|
547 | + $timetype = IntlDateFormatter::NONE; |
|
548 | + } |
|
549 | + break; |
|
550 | + case DATE_FORMAT_NUMBER: |
|
551 | + $date_format = get_lang('dateFormatShortNumber', '', $language); |
|
552 | + if (INTL_INSTALLED) { |
|
553 | + $datetype = IntlDateFormatter::SHORT; |
|
554 | + $timetype = IntlDateFormatter::NONE; |
|
555 | + } |
|
549 | 556 | break; |
550 | - case DATE_FORMAT_NUMBER: |
|
551 | - $date_format = get_lang('dateFormatShortNumber', '', $language); |
|
552 | - if (INTL_INSTALLED) { |
|
553 | - $datetype = IntlDateFormatter::SHORT; |
|
554 | - $timetype = IntlDateFormatter::NONE; |
|
555 | - } |
|
556 | - break; |
|
557 | 557 | case TIME_NO_SEC_FORMAT: |
558 | 558 | $date_format = get_lang('timeNoSecFormat', '', $language); |
559 | 559 | if (INTL_INSTALLED) { |
@@ -589,14 +589,14 @@ discard block |
||
589 | 589 | $timetype = IntlDateFormatter::SHORT; |
590 | 590 | } |
591 | 591 | break; |
592 | - case DATE_TIME_FORMAT_SHORT: |
|
592 | + case DATE_TIME_FORMAT_SHORT: |
|
593 | 593 | $date_format = get_lang('dateTimeFormatShort', '', $language); |
594 | 594 | if (INTL_INSTALLED) { |
595 | 595 | $datetype = IntlDateFormatter::FULL; |
596 | 596 | $timetype = IntlDateFormatter::SHORT; |
597 | 597 | } |
598 | 598 | break; |
599 | - case DATE_TIME_FORMAT_SHORT_TIME_FIRST: |
|
599 | + case DATE_TIME_FORMAT_SHORT_TIME_FIRST: |
|
600 | 600 | $date_format = get_lang('dateTimeFormatShortTimeFirst', '', $language); |
601 | 601 | if (INTL_INSTALLED) { |
602 | 602 | $datetype = IntlDateFormatter::FULL; |
@@ -1817,7 +1817,6 @@ discard block |
||
1817 | 1817 | |
1818 | 1818 | /** |
1819 | 1819 | * Return true a date is valid |
1820 | - |
|
1821 | 1820 | * @param string $date example: 2014-06-30 13:05:05 |
1822 | 1821 | * @param string $format example: "Y-m-d H:i:s" |
1823 | 1822 | * |
@@ -105,7 +105,7 @@ discard block |
||
105 | 105 | ) { |
106 | 106 | require_once api_get_path(SYS_CODE_PATH).'/cron/lang/langstats.class.php'; |
107 | 107 | global $langstats; |
108 | - $langstats->add_use($variable,''); |
|
108 | + $langstats->add_use($variable, ''); |
|
109 | 109 | } |
110 | 110 | |
111 | 111 | if (!isset($used_lang_vars)) { |
@@ -371,7 +371,7 @@ discard block |
||
371 | 371 | if ($use_users_timezone == 'true') { |
372 | 372 | $userId = api_get_user_id(); |
373 | 373 | // Get the timezone based on user preference, if it exists |
374 | - $timezone_user = UserManager::get_extra_user_data_by_field($userId,'timezone'); |
|
374 | + $timezone_user = UserManager::get_extra_user_data_by_field($userId, 'timezone'); |
|
375 | 375 | if (isset($timezone_user['timezone']) && $timezone_user['timezone'] != null) { |
376 | 376 | $to_timezone = $timezone_user['timezone']; |
377 | 377 | } |
@@ -636,10 +636,10 @@ discard block |
||
636 | 636 | // We replace %a %A %b %B masks of date format with translated strings |
637 | 637 | $translated = &_api_get_day_month_names($language); |
638 | 638 | $date_format = str_replace(array('%A', '%a', '%B', '%b'), |
639 | - array($translated['days_long'][(int)strftime('%w', $time )], |
|
640 | - $translated['days_short'][(int)strftime('%w', $time)], |
|
641 | - $translated['months_long'][(int)strftime('%m', $time) - 1], |
|
642 | - $translated['months_short'][(int)strftime('%m', $time) - 1]), |
|
639 | + array($translated['days_long'][(int) strftime('%w', $time)], |
|
640 | + $translated['days_short'][(int) strftime('%w', $time)], |
|
641 | + $translated['months_long'][(int) strftime('%m', $time) - 1], |
|
642 | + $translated['months_short'][(int) strftime('%m', $time) - 1]), |
|
643 | 643 | $date_format); |
644 | 644 | $formatted_date = api_to_system_encoding(strftime($date_format, $time), 'UTF-8'); |
645 | 645 | } |
@@ -737,7 +737,7 @@ discard block |
||
737 | 737 | if ($seconds > $time) { |
738 | 738 | continue; |
739 | 739 | } |
740 | - $current_value = intval($time/$seconds); |
|
740 | + $current_value = intval($time / $seconds); |
|
741 | 741 | |
742 | 742 | if ($current_value != 1) { |
743 | 743 | $date_str = $sec_time_plu[$i]; |
@@ -754,7 +754,7 @@ discard block |
||
754 | 754 | } |
755 | 755 | |
756 | 756 | if (!empty($key_result)) { |
757 | - if ($key_result[0] == $min_day && $key_result[1]== $min_minute) { |
|
757 | + if ($key_result[0] == $min_day && $key_result[1] == $min_minute) { |
|
758 | 758 | $key_result[1] = ' 0 '.$min_hours; |
759 | 759 | $str_result[0] = $time_result[0].' '.$key_result[0]; |
760 | 760 | $str_result[1] = $key_result[1]; |
@@ -1687,7 +1687,7 @@ discard block |
||
1687 | 1687 | * @return string Returns the encoding identificator modified in suitable for comparison way. |
1688 | 1688 | */ |
1689 | 1689 | function api_refine_encoding_id($encoding) { |
1690 | - if (is_array($encoding)){ |
|
1690 | + if (is_array($encoding)) { |
|
1691 | 1691 | return array_map('api_refine_encoding_id', $encoding); |
1692 | 1692 | } |
1693 | 1693 | return strtoupper(str_replace('_', '-', $encoding)); |
@@ -1710,8 +1710,7 @@ |
||
1710 | 1710 | } |
1711 | 1711 | } |
1712 | 1712 | return false; |
1713 | - } |
|
1714 | - elseif (is_array($encoding2)) { |
|
1713 | + } elseif (is_array($encoding2)) { |
|
1715 | 1714 | foreach ($encoding2 as $encoding) { |
1716 | 1715 | if (api_equal_encodings($encoding1, $encoding, $strict)) { |
1717 | 1716 | return true; |
@@ -408,6 +408,9 @@ discard block |
||
408 | 408 | } # function kses_no_null |
409 | 409 | |
410 | 410 | |
411 | +/** |
|
412 | + * @return string |
|
413 | + */ |
|
411 | 414 | function kses_stripslashes($string) |
412 | 415 | ############################################################################### |
413 | 416 | # This function changes the character sequence \" to just " |
@@ -442,6 +445,9 @@ discard block |
||
442 | 445 | } # function kses_array_lc |
443 | 446 | |
444 | 447 | |
448 | +/** |
|
449 | + * @return string |
|
450 | + */ |
|
445 | 451 | function kses_js_entities($string) |
446 | 452 | ############################################################################### |
447 | 453 | # This function removes the HTML JavaScript entities found in early versions of |
@@ -506,6 +512,9 @@ discard block |
||
506 | 512 | } # function kses_bad_protocol_once2 |
507 | 513 | |
508 | 514 | |
515 | +/** |
|
516 | + * @return string |
|
517 | + */ |
|
509 | 518 | function kses_normalize_entities($string) |
510 | 519 | ############################################################################### |
511 | 520 | # This function normalizes HTML entities. It will convert "AT&T" to the correct |
@@ -31,8 +31,8 @@ discard block |
||
31 | 31 | |
32 | 32 | |
33 | 33 | function kses($string, $allowed_html, $allowed_protocols = |
34 | - array('http', 'https', 'ftp', 'news', 'nntp', 'telnet', |
|
35 | - 'gopher', 'mailto')) |
|
34 | + array('http', 'https', 'ftp', 'news', 'nntp', 'telnet', |
|
35 | + 'gopher', 'mailto')) |
|
36 | 36 | ############################################################################### |
37 | 37 | # This function makes sure that only the allowed HTML element names, attribute |
38 | 38 | # names and attribute values plus only sane HTML entities will occur in |
@@ -40,12 +40,12 @@ discard block |
||
40 | 40 | # call this function. |
41 | 41 | ############################################################################### |
42 | 42 | { |
43 | - $string = kses_no_null($string); |
|
44 | - $string = kses_js_entities($string); |
|
45 | - $string = kses_normalize_entities($string); |
|
46 | - $string = kses_hook($string); |
|
47 | - $allowed_html_fixed = kses_array_lc($allowed_html); |
|
48 | - return kses_split($string, $allowed_html_fixed, $allowed_protocols); |
|
43 | + $string = kses_no_null($string); |
|
44 | + $string = kses_js_entities($string); |
|
45 | + $string = kses_normalize_entities($string); |
|
46 | + $string = kses_hook($string); |
|
47 | + $allowed_html_fixed = kses_array_lc($allowed_html); |
|
48 | + return kses_split($string, $allowed_html_fixed, $allowed_protocols); |
|
49 | 49 | } # function kses |
50 | 50 | |
51 | 51 | |
@@ -54,7 +54,7 @@ discard block |
||
54 | 54 | # You add any kses hooks here. |
55 | 55 | ############################################################################### |
56 | 56 | { |
57 | - return $string; |
|
57 | + return $string; |
|
58 | 58 | } # function kses_hook |
59 | 59 | |
60 | 60 | |
@@ -63,7 +63,7 @@ discard block |
||
63 | 63 | # This function returns kses' version number. |
64 | 64 | ############################################################################### |
65 | 65 | { |
66 | - return '0.2.2'; |
|
66 | + return '0.2.2'; |
|
67 | 67 | } # function kses_version |
68 | 68 | |
69 | 69 | |
@@ -73,13 +73,13 @@ discard block |
||
73 | 73 | # matches stray ">" characters. |
74 | 74 | ############################################################################### |
75 | 75 | { |
76 | - return preg_replace('%(<'. # EITHER: < |
|
77 | - '[^>]*'. # things that aren't > |
|
78 | - '(>|$)'. # > or end of string |
|
79 | - '|>)%e', # OR: just a > |
|
80 | - "kses_split2('\\1', \$allowed_html, ". |
|
81 | - '$allowed_protocols)', |
|
82 | - $string); |
|
76 | + return preg_replace('%(<'. # EITHER: < |
|
77 | + '[^>]*'. # things that aren't > |
|
78 | + '(>|$)'. # > or end of string |
|
79 | + '|>)%e', # OR: just a > |
|
80 | + "kses_split2('\\1', \$allowed_html, ". |
|
81 | + '$allowed_protocols)', |
|
82 | + $string); |
|
83 | 83 | } # function kses_split |
84 | 84 | |
85 | 85 | |
@@ -91,30 +91,30 @@ discard block |
||
91 | 91 | # attribute list. |
92 | 92 | ############################################################################### |
93 | 93 | { |
94 | - $string = kses_stripslashes($string); |
|
94 | + $string = kses_stripslashes($string); |
|
95 | 95 | |
96 | - if (substr($string, 0, 1) != '<') |
|
96 | + if (substr($string, 0, 1) != '<') |
|
97 | 97 | return '>'; |
98 | 98 | # It matched a ">" character |
99 | 99 | |
100 | - if (!preg_match('%^<\s*(/\s*)?([a-zA-Z0-9]+)([^>]*)>?$%', $string, $matches)) |
|
100 | + if (!preg_match('%^<\s*(/\s*)?([a-zA-Z0-9]+)([^>]*)>?$%', $string, $matches)) |
|
101 | 101 | return ''; |
102 | 102 | # It's seriously malformed |
103 | 103 | |
104 | - $slash = trim($matches[1]); |
|
105 | - $elem = $matches[2]; |
|
106 | - $attrlist = $matches[3]; |
|
104 | + $slash = trim($matches[1]); |
|
105 | + $elem = $matches[2]; |
|
106 | + $attrlist = $matches[3]; |
|
107 | 107 | |
108 | - if (!@isset($allowed_html[strtolower($elem)])) |
|
108 | + if (!@isset($allowed_html[strtolower($elem)])) |
|
109 | 109 | return ''; |
110 | 110 | # They are using a not allowed HTML element |
111 | 111 | |
112 | - if ($slash != '') |
|
112 | + if ($slash != '') |
|
113 | 113 | return "<$slash$elem>"; |
114 | - # No attributes are allowed for closing elements |
|
114 | + # No attributes are allowed for closing elements |
|
115 | 115 | |
116 | - return kses_attr("$slash$elem", $attrlist, $allowed_html, |
|
117 | - $allowed_protocols); |
|
116 | + return kses_attr("$slash$elem", $attrlist, $allowed_html, |
|
117 | + $allowed_protocols); |
|
118 | 118 | } # function kses_split2 |
119 | 119 | |
120 | 120 | |
@@ -130,56 +130,56 @@ discard block |
||
130 | 130 | { |
131 | 131 | # Is there a closing XHTML slash at the end of the attributes? |
132 | 132 | |
133 | - $xhtml_slash = ''; |
|
134 | - if (preg_match('%\s/\s*$%', $attr)) |
|
133 | + $xhtml_slash = ''; |
|
134 | + if (preg_match('%\s/\s*$%', $attr)) |
|
135 | 135 | $xhtml_slash = ' /'; |
136 | 136 | |
137 | 137 | # Are any attributes allowed at all for this element? |
138 | 138 | |
139 | - if (@count($allowed_html[strtolower($element)]) == 0) |
|
139 | + if (@count($allowed_html[strtolower($element)]) == 0) |
|
140 | 140 | return "<$element$xhtml_slash>"; |
141 | 141 | |
142 | 142 | # Split it |
143 | 143 | |
144 | - $attrarr = kses_hair($attr, $allowed_protocols); |
|
144 | + $attrarr = kses_hair($attr, $allowed_protocols); |
|
145 | 145 | |
146 | 146 | # Go through $attrarr, and save the allowed attributes for this element |
147 | 147 | # in $attr2 |
148 | 148 | |
149 | - $attr2 = ''; |
|
149 | + $attr2 = ''; |
|
150 | 150 | |
151 | - foreach ($attrarr as $arreach) |
|
152 | - { |
|
151 | + foreach ($attrarr as $arreach) |
|
152 | + { |
|
153 | 153 | if (!@isset($allowed_html[strtolower($element)] |
154 | 154 | [strtolower($arreach['name'])])) |
155 | - continue; # the attribute is not allowed |
|
155 | + continue; # the attribute is not allowed |
|
156 | 156 | |
157 | 157 | $current = $allowed_html[strtolower($element)] |
158 | 158 | [strtolower($arreach['name'])]; |
159 | 159 | |
160 | 160 | if (!is_array($current)) |
161 | - $attr2 .= ' '.$arreach['whole']; |
|
161 | + $attr2 .= ' '.$arreach['whole']; |
|
162 | 162 | # there are no checks |
163 | 163 | |
164 | 164 | else |
165 | 165 | { |
166 | 166 | # there are some checks |
167 | - $ok = true; |
|
168 | - foreach ($current as $currkey => $currval) |
|
167 | + $ok = true; |
|
168 | + foreach ($current as $currkey => $currval) |
|
169 | 169 | if (!kses_check_attr_val($arreach['value'], $arreach['vless'], |
170 | - $currkey, $currval)) |
|
170 | + $currkey, $currval)) |
|
171 | 171 | { $ok = false; break; } |
172 | 172 | |
173 | - if ($ok) |
|
173 | + if ($ok) |
|
174 | 174 | $attr2 .= ' '.$arreach['whole']; # it passed them |
175 | 175 | } # if !is_array($current) |
176 | - } # foreach |
|
176 | + } # foreach |
|
177 | 177 | |
178 | 178 | # Remove any "<" or ">" characters |
179 | 179 | |
180 | - $attr2 = preg_replace('/[<>]/', '', $attr2); |
|
180 | + $attr2 = preg_replace('/[<>]/', '', $attr2); |
|
181 | 181 | |
182 | - return "<$element$attr2$xhtml_slash>"; |
|
182 | + return "<$element$attr2$xhtml_slash>"; |
|
183 | 183 | } # function kses_attr |
184 | 184 | |
185 | 185 | |
@@ -193,96 +193,96 @@ discard block |
||
193 | 193 | # from attribute values. |
194 | 194 | ############################################################################### |
195 | 195 | { |
196 | - $attrarr = array(); |
|
197 | - $mode = 0; |
|
198 | - $attrname = ''; |
|
196 | + $attrarr = array(); |
|
197 | + $mode = 0; |
|
198 | + $attrname = ''; |
|
199 | 199 | |
200 | 200 | # Loop through the whole attribute list |
201 | 201 | |
202 | - while (strlen($attr) != 0) |
|
203 | - { |
|
202 | + while (strlen($attr) != 0) |
|
203 | + { |
|
204 | 204 | $working = 0; # Was the last operation successful? |
205 | 205 | |
206 | 206 | switch ($mode) |
207 | 207 | { |
208 | - case 0: # attribute name, href for instance |
|
208 | + case 0: # attribute name, href for instance |
|
209 | 209 | |
210 | 210 | if (preg_match('/^([-a-zA-Z]+)/', $attr, $match)) |
211 | 211 | { |
212 | - $attrname = $match[1]; |
|
213 | - $working = $mode = 1; |
|
214 | - $attr = preg_replace('/^[-a-zA-Z]+/', '', $attr); |
|
212 | + $attrname = $match[1]; |
|
213 | + $working = $mode = 1; |
|
214 | + $attr = preg_replace('/^[-a-zA-Z]+/', '', $attr); |
|
215 | 215 | } |
216 | 216 | |
217 | 217 | break; |
218 | 218 | |
219 | - case 1: # equals sign or valueless ("selected") |
|
219 | + case 1: # equals sign or valueless ("selected") |
|
220 | 220 | |
221 | 221 | if (preg_match('/^\s*=\s*/', $attr)) # equals sign |
222 | 222 | { |
223 | - $working = 1; $mode = 2; |
|
224 | - $attr = preg_replace('/^\s*=\s*/', '', $attr); |
|
225 | - break; |
|
223 | + $working = 1; $mode = 2; |
|
224 | + $attr = preg_replace('/^\s*=\s*/', '', $attr); |
|
225 | + break; |
|
226 | 226 | } |
227 | 227 | |
228 | 228 | if (preg_match('/^\s+/', $attr)) # valueless |
229 | 229 | { |
230 | - $working = 1; $mode = 0; |
|
231 | - $attrarr[] = array |
|
230 | + $working = 1; $mode = 0; |
|
231 | + $attrarr[] = array |
|
232 | 232 | ('name' => $attrname, |
233 | - 'value' => '', |
|
234 | - 'whole' => $attrname, |
|
235 | - 'vless' => 'y'); |
|
236 | - $attr = preg_replace('/^\s+/', '', $attr); |
|
233 | + 'value' => '', |
|
234 | + 'whole' => $attrname, |
|
235 | + 'vless' => 'y'); |
|
236 | + $attr = preg_replace('/^\s+/', '', $attr); |
|
237 | 237 | } |
238 | 238 | |
239 | 239 | break; |
240 | 240 | |
241 | - case 2: # attribute value, a URL after href= for instance |
|
241 | + case 2: # attribute value, a URL after href= for instance |
|
242 | 242 | |
243 | 243 | if (preg_match('/^"([^"]*)"(\s+|$)/', $attr, $match)) |
244 | - # "value" |
|
244 | + # "value" |
|
245 | 245 | { |
246 | - $thisval = kses_bad_protocol($match[1], $allowed_protocols); |
|
246 | + $thisval = kses_bad_protocol($match[1], $allowed_protocols); |
|
247 | 247 | |
248 | - $attrarr[] = array |
|
248 | + $attrarr[] = array |
|
249 | 249 | ('name' => $attrname, |
250 | - 'value' => $thisval, |
|
251 | - 'whole' => "$attrname=\"$thisval\"", |
|
252 | - 'vless' => 'n'); |
|
253 | - $working = 1; $mode = 0; |
|
254 | - $attr = preg_replace('/^"[^"]*"(\s+|$)/', '', $attr); |
|
255 | - break; |
|
250 | + 'value' => $thisval, |
|
251 | + 'whole' => "$attrname=\"$thisval\"", |
|
252 | + 'vless' => 'n'); |
|
253 | + $working = 1; $mode = 0; |
|
254 | + $attr = preg_replace('/^"[^"]*"(\s+|$)/', '', $attr); |
|
255 | + break; |
|
256 | 256 | } |
257 | 257 | |
258 | 258 | if (preg_match("/^'([^']*)'(\s+|$)/", $attr, $match)) |
259 | - # 'value' |
|
259 | + # 'value' |
|
260 | 260 | { |
261 | - $thisval = kses_bad_protocol($match[1], $allowed_protocols); |
|
261 | + $thisval = kses_bad_protocol($match[1], $allowed_protocols); |
|
262 | 262 | |
263 | - $attrarr[] = array |
|
263 | + $attrarr[] = array |
|
264 | 264 | ('name' => $attrname, |
265 | - 'value' => $thisval, |
|
266 | - 'whole' => "$attrname='$thisval'", |
|
267 | - 'vless' => 'n'); |
|
268 | - $working = 1; $mode = 0; |
|
269 | - $attr = preg_replace("/^'[^']*'(\s+|$)/", '', $attr); |
|
270 | - break; |
|
265 | + 'value' => $thisval, |
|
266 | + 'whole' => "$attrname='$thisval'", |
|
267 | + 'vless' => 'n'); |
|
268 | + $working = 1; $mode = 0; |
|
269 | + $attr = preg_replace("/^'[^']*'(\s+|$)/", '', $attr); |
|
270 | + break; |
|
271 | 271 | } |
272 | 272 | |
273 | 273 | if (preg_match("%^([^\s\"']+)(\s+|$)%", $attr, $match)) |
274 | - # value |
|
274 | + # value |
|
275 | 275 | { |
276 | - $thisval = kses_bad_protocol($match[1], $allowed_protocols); |
|
276 | + $thisval = kses_bad_protocol($match[1], $allowed_protocols); |
|
277 | 277 | |
278 | - $attrarr[] = array |
|
278 | + $attrarr[] = array |
|
279 | 279 | ('name' => $attrname, |
280 | - 'value' => $thisval, |
|
281 | - 'whole' => "$attrname=\"$thisval\"", |
|
282 | - 'vless' => 'n'); |
|
283 | - # We add quotes to conform to W3C's HTML spec. |
|
284 | - $working = 1; $mode = 0; |
|
285 | - $attr = preg_replace("%^[^\s\"']+(\s+|$)%", '', $attr); |
|
280 | + 'value' => $thisval, |
|
281 | + 'whole' => "$attrname=\"$thisval\"", |
|
282 | + 'vless' => 'n'); |
|
283 | + # We add quotes to conform to W3C's HTML spec. |
|
284 | + $working = 1; $mode = 0; |
|
285 | + $attr = preg_replace("%^[^\s\"']+(\s+|$)%", '', $attr); |
|
286 | 286 | } |
287 | 287 | |
288 | 288 | break; |
@@ -290,21 +290,21 @@ discard block |
||
290 | 290 | |
291 | 291 | if ($working == 0) # not well formed, remove and try again |
292 | 292 | { |
293 | - $attr = kses_html_error($attr); |
|
294 | - $mode = 0; |
|
293 | + $attr = kses_html_error($attr); |
|
294 | + $mode = 0; |
|
295 | 295 | } |
296 | - } # while |
|
296 | + } # while |
|
297 | 297 | |
298 | - if ($mode == 1) |
|
299 | - # special case, for when the attribute list ends with a valueless |
|
300 | - # attribute like "selected" |
|
298 | + if ($mode == 1) |
|
299 | + # special case, for when the attribute list ends with a valueless |
|
300 | + # attribute like "selected" |
|
301 | 301 | $attrarr[] = array |
302 | - ('name' => $attrname, |
|
303 | - 'value' => '', |
|
304 | - 'whole' => $attrname, |
|
305 | - 'vless' => 'y'); |
|
302 | + ('name' => $attrname, |
|
303 | + 'value' => '', |
|
304 | + 'whole' => $attrname, |
|
305 | + 'vless' => 'y'); |
|
306 | 306 | |
307 | - return $attrarr; |
|
307 | + return $attrarr; |
|
308 | 308 | } # function kses_hair |
309 | 309 | |
310 | 310 | |
@@ -315,10 +315,10 @@ discard block |
||
315 | 315 | # with even more checks to come soon. |
316 | 316 | ############################################################################### |
317 | 317 | { |
318 | - $ok = true; |
|
318 | + $ok = true; |
|
319 | 319 | |
320 | - switch (strtolower($checkname)) |
|
321 | - { |
|
320 | + switch (strtolower($checkname)) |
|
321 | + { |
|
322 | 322 | case 'maxlen': |
323 | 323 | # The maxlen check makes sure that the attribute value has a length not |
324 | 324 | # greater than the given value. This can be used to avoid Buffer Overflows |
@@ -326,7 +326,7 @@ discard block |
||
326 | 326 | |
327 | 327 | if (strlen($value) > $checkvalue) |
328 | 328 | $ok = false; |
329 | - break; |
|
329 | + break; |
|
330 | 330 | |
331 | 331 | case 'minlen': |
332 | 332 | # The minlen check makes sure that the attribute value has a length not |
@@ -334,7 +334,7 @@ discard block |
||
334 | 334 | |
335 | 335 | if (strlen($value) < $checkvalue) |
336 | 336 | $ok = false; |
337 | - break; |
|
337 | + break; |
|
338 | 338 | |
339 | 339 | case 'maxval': |
340 | 340 | # The maxval check does two things: it checks that the attribute value is |
@@ -345,9 +345,9 @@ discard block |
||
345 | 345 | |
346 | 346 | if (!preg_match('/^\s{0,6}[0-9]{1,6}\s{0,6}$/', $value)) |
347 | 347 | $ok = false; |
348 | - if ($value > $checkvalue) |
|
348 | + if ($value > $checkvalue) |
|
349 | 349 | $ok = false; |
350 | - break; |
|
350 | + break; |
|
351 | 351 | |
352 | 352 | case 'minval': |
353 | 353 | # The minval check checks that the attribute value is a positive integer, |
@@ -355,9 +355,9 @@ discard block |
||
355 | 355 | |
356 | 356 | if (!preg_match('/^\s{0,6}[0-9]{1,6}\s{0,6}$/', $value)) |
357 | 357 | $ok = false; |
358 | - if ($value < $checkvalue) |
|
358 | + if ($value < $checkvalue) |
|
359 | 359 | $ok = false; |
360 | - break; |
|
360 | + break; |
|
361 | 361 | |
362 | 362 | case 'valueless': |
363 | 363 | # The valueless check checks if the attribute has a value |
@@ -367,10 +367,10 @@ discard block |
||
367 | 367 | |
368 | 368 | if (strtolower($checkvalue) != $vless) |
369 | 369 | $ok = false; |
370 | - break; |
|
371 | - } # switch |
|
370 | + break; |
|
371 | + } # switch |
|
372 | 372 | |
373 | - return $ok; |
|
373 | + return $ok; |
|
374 | 374 | } # function kses_check_attr_val |
375 | 375 | |
376 | 376 | |
@@ -382,17 +382,17 @@ discard block |
||
382 | 382 | # fooled by a string like "javascript:javascript:alert(57)". |
383 | 383 | ############################################################################### |
384 | 384 | { |
385 | - $string = kses_no_null($string); |
|
386 | - $string = preg_replace('/\xad+/', '', $string); # deals with Opera "feature" |
|
387 | - $string2 = $string.'a'; |
|
385 | + $string = kses_no_null($string); |
|
386 | + $string = preg_replace('/\xad+/', '', $string); # deals with Opera "feature" |
|
387 | + $string2 = $string.'a'; |
|
388 | 388 | |
389 | - while ($string != $string2) |
|
390 | - { |
|
389 | + while ($string != $string2) |
|
390 | + { |
|
391 | 391 | $string2 = $string; |
392 | 392 | $string = kses_bad_protocol_once($string, $allowed_protocols); |
393 | - } # while |
|
393 | + } # while |
|
394 | 394 | |
395 | - return $string; |
|
395 | + return $string; |
|
396 | 396 | } # function kses_bad_protocol |
397 | 397 | |
398 | 398 | |
@@ -401,10 +401,10 @@ discard block |
||
401 | 401 | # This function removes any NULL characters in $string. |
402 | 402 | ############################################################################### |
403 | 403 | { |
404 | - $string = preg_replace('/\0+/', '', $string); |
|
405 | - $string = preg_replace('/(\\\\0)+/', '', $string); |
|
404 | + $string = preg_replace('/\0+/', '', $string); |
|
405 | + $string = preg_replace('/(\\\\0)+/', '', $string); |
|
406 | 406 | |
407 | - return $string; |
|
407 | + return $string; |
|
408 | 408 | } # function kses_no_null |
409 | 409 | |
410 | 410 | |
@@ -415,7 +415,7 @@ discard block |
||
415 | 415 | # preg_replace(//e) seems to require this. |
416 | 416 | ############################################################################### |
417 | 417 | { |
418 | - return preg_replace('%\\\\"%', '"', $string); |
|
418 | + return preg_replace('%\\\\"%', '"', $string); |
|
419 | 419 | } # function kses_stripslashes |
420 | 420 | |
421 | 421 | |
@@ -424,21 +424,21 @@ discard block |
||
424 | 424 | # This function goes through an array, and changes the keys to all lower case. |
425 | 425 | ############################################################################### |
426 | 426 | { |
427 | - $outarray = array(); |
|
427 | + $outarray = array(); |
|
428 | 428 | |
429 | - foreach ($inarray as $inkey => $inval) |
|
430 | - { |
|
429 | + foreach ($inarray as $inkey => $inval) |
|
430 | + { |
|
431 | 431 | $outkey = strtolower($inkey); |
432 | 432 | $outarray[$outkey] = array(); |
433 | 433 | |
434 | 434 | foreach ($inval as $inkey2 => $inval2) |
435 | 435 | { |
436 | - $outkey2 = strtolower($inkey2); |
|
437 | - $outarray[$outkey][$outkey2] = $inval2; |
|
436 | + $outkey2 = strtolower($inkey2); |
|
437 | + $outarray[$outkey][$outkey2] = $inval2; |
|
438 | 438 | } # foreach $inval |
439 | - } # foreach $inarray |
|
439 | + } # foreach $inarray |
|
440 | 440 | |
441 | - return $outarray; |
|
441 | + return $outarray; |
|
442 | 442 | } # function kses_array_lc |
443 | 443 | |
444 | 444 | |
@@ -448,7 +448,7 @@ discard block |
||
448 | 448 | # Netscape 4. |
449 | 449 | ############################################################################### |
450 | 450 | { |
451 | - return preg_replace('%&\s*\{[^}]*(\}\s*;?|$)%', '', $string); |
|
451 | + return preg_replace('%&\s*\{[^}]*(\}\s*;?|$)%', '', $string); |
|
452 | 452 | } # function kses_js_entities |
453 | 453 | |
454 | 454 | |
@@ -459,7 +459,7 @@ discard block |
||
459 | 459 | # quotes and apostrophes as well. |
460 | 460 | ############################################################################### |
461 | 461 | { |
462 | - return preg_replace('/^("[^"]*("|$)|\'[^\']*(\'|$)|\S)*\s*/', '', $string); |
|
462 | + return preg_replace('/^("[^"]*("|$)|\'[^\']*(\'|$)|\S)*\s*/', '', $string); |
|
463 | 463 | } # function kses_html_error |
464 | 464 | |
465 | 465 | |
@@ -469,12 +469,12 @@ discard block |
||
469 | 469 | # handling whitespace and HTML entities. |
470 | 470 | ############################################################################### |
471 | 471 | { |
472 | - $string2 = preg_split('/:|:|:/i', $string, 2); |
|
473 | - if(isset($string2[1]) && !preg_match('%/\?%',$string2[0])) |
|
474 | - { |
|
475 | - $string = kses_bad_protocol_once2($string2[0],$allowed_protocols).trim($string2[1]); |
|
476 | - } |
|
477 | - return $string; |
|
472 | + $string2 = preg_split('/:|:|:/i', $string, 2); |
|
473 | + if(isset($string2[1]) && !preg_match('%/\?%',$string2[0])) |
|
474 | + { |
|
475 | + $string = kses_bad_protocol_once2($string2[0],$allowed_protocols).trim($string2[1]); |
|
476 | + } |
|
477 | + return $string; |
|
478 | 478 | } # function kses_bad_protocol_once |
479 | 479 | |
480 | 480 | |
@@ -484,24 +484,24 @@ discard block |
||
484 | 484 | # list or not, and returns different data depending on the answer. |
485 | 485 | ############################################################################### |
486 | 486 | { |
487 | - $string2 = kses_decode_entities($string); |
|
488 | - $string2 = preg_replace('/\s/', '', $string2); |
|
489 | - $string2 = kses_no_null($string2); |
|
490 | - $string2 = preg_replace('/\xad+/', '', $string2); |
|
491 | - # deals with Opera "feature" |
|
492 | - $string2 = strtolower($string2); |
|
493 | - |
|
494 | - $allowed = false; |
|
495 | - foreach ($allowed_protocols as $one_protocol) |
|
487 | + $string2 = kses_decode_entities($string); |
|
488 | + $string2 = preg_replace('/\s/', '', $string2); |
|
489 | + $string2 = kses_no_null($string2); |
|
490 | + $string2 = preg_replace('/\xad+/', '', $string2); |
|
491 | + # deals with Opera "feature" |
|
492 | + $string2 = strtolower($string2); |
|
493 | + |
|
494 | + $allowed = false; |
|
495 | + foreach ($allowed_protocols as $one_protocol) |
|
496 | 496 | if (strtolower($one_protocol) == $string2) |
497 | 497 | { |
498 | - $allowed = true; |
|
499 | - break; |
|
498 | + $allowed = true; |
|
499 | + break; |
|
500 | 500 | } |
501 | 501 | |
502 | - if ($allowed) |
|
502 | + if ($allowed) |
|
503 | 503 | return "$string2:"; |
504 | - else |
|
504 | + else |
|
505 | 505 | return ''; |
506 | 506 | } # function kses_bad_protocol_once2 |
507 | 507 | |
@@ -514,18 +514,18 @@ discard block |
||
514 | 514 | { |
515 | 515 | # Disarm all entities by converting & to & |
516 | 516 | |
517 | - $string = str_replace('&', '&', $string); |
|
517 | + $string = str_replace('&', '&', $string); |
|
518 | 518 | |
519 | 519 | # Change back the allowed entities in our entity whitelist |
520 | 520 | |
521 | - $string = preg_replace('/&([A-Za-z][A-Za-z0-9]{0,19});/', |
|
522 | - '&\\1;', $string); |
|
523 | - $string = preg_replace('/&#0*([0-9]{1,5});/e', |
|
524 | - 'kses_normalize_entities2("\\1")', $string); |
|
525 | - $string = preg_replace('/&#([Xx])0*(([0-9A-Fa-f]{2}){1,2});/', |
|
526 | - '&#\\1\\2;', $string); |
|
521 | + $string = preg_replace('/&([A-Za-z][A-Za-z0-9]{0,19});/', |
|
522 | + '&\\1;', $string); |
|
523 | + $string = preg_replace('/&#0*([0-9]{1,5});/e', |
|
524 | + 'kses_normalize_entities2("\\1")', $string); |
|
525 | + $string = preg_replace('/&#([Xx])0*(([0-9A-Fa-f]{2}){1,2});/', |
|
526 | + '&#\\1\\2;', $string); |
|
527 | 527 | |
528 | - return $string; |
|
528 | + return $string; |
|
529 | 529 | } # function kses_normalize_entities |
530 | 530 | |
531 | 531 | |
@@ -535,7 +535,7 @@ discard block |
||
535 | 535 | # and nothing more for &#number; entities. |
536 | 536 | ############################################################################### |
537 | 537 | { |
538 | - return (($i > 65535) ? "&#$i;" : "&#$i;"); |
|
538 | + return (($i > 65535) ? "&#$i;" : "&#$i;"); |
|
539 | 539 | } # function kses_normalize_entities2 |
540 | 540 | |
541 | 541 | |
@@ -546,11 +546,11 @@ discard block |
||
546 | 546 | # URL protocol whitelisting system anyway. |
547 | 547 | ############################################################################### |
548 | 548 | { |
549 | - $string = preg_replace('/&#([0-9]+);/e', 'chr("\\1")', $string); |
|
550 | - $string = preg_replace('/&#[Xx]([0-9A-Fa-f]+);/e', 'chr(hexdec("\\1"))', |
|
551 | - $string); |
|
549 | + $string = preg_replace('/&#([0-9]+);/e', 'chr("\\1")', $string); |
|
550 | + $string = preg_replace('/&#[Xx]([0-9A-Fa-f]+);/e', 'chr(hexdec("\\1"))', |
|
551 | + $string); |
|
552 | 552 | |
553 | - return $string; |
|
553 | + return $string; |
|
554 | 554 | } # function kses_decode_entities |
555 | 555 | |
556 | 556 | ?> |
@@ -73,9 +73,9 @@ discard block |
||
73 | 73 | # matches stray ">" characters. |
74 | 74 | ############################################################################### |
75 | 75 | { |
76 | - return preg_replace('%(<'. # EITHER: < |
|
77 | - '[^>]*'. # things that aren't > |
|
78 | - '(>|$)'. # > or end of string |
|
76 | + return preg_replace('%(<'.# EITHER: < |
|
77 | + '[^>]*'.# things that aren't > |
|
78 | + '(>|$)'.# > or end of string |
|
79 | 79 | '|>)%e', # OR: just a > |
80 | 80 | "kses_split2('\\1', \$allowed_html, ". |
81 | 81 | '$allowed_protocols)', |
@@ -228,8 +228,7 @@ discard block |
||
228 | 228 | if (preg_match('/^\s+/', $attr)) # valueless |
229 | 229 | { |
230 | 230 | $working = 1; $mode = 0; |
231 | - $attrarr[] = array |
|
232 | - ('name' => $attrname, |
|
231 | + $attrarr[] = array('name' => $attrname, |
|
233 | 232 | 'value' => '', |
234 | 233 | 'whole' => $attrname, |
235 | 234 | 'vless' => 'y'); |
@@ -245,8 +244,7 @@ discard block |
||
245 | 244 | { |
246 | 245 | $thisval = kses_bad_protocol($match[1], $allowed_protocols); |
247 | 246 | |
248 | - $attrarr[] = array |
|
249 | - ('name' => $attrname, |
|
247 | + $attrarr[] = array('name' => $attrname, |
|
250 | 248 | 'value' => $thisval, |
251 | 249 | 'whole' => "$attrname=\"$thisval\"", |
252 | 250 | 'vless' => 'n'); |
@@ -260,8 +258,7 @@ discard block |
||
260 | 258 | { |
261 | 259 | $thisval = kses_bad_protocol($match[1], $allowed_protocols); |
262 | 260 | |
263 | - $attrarr[] = array |
|
264 | - ('name' => $attrname, |
|
261 | + $attrarr[] = array('name' => $attrname, |
|
265 | 262 | 'value' => $thisval, |
266 | 263 | 'whole' => "$attrname='$thisval'", |
267 | 264 | 'vless' => 'n'); |
@@ -275,8 +272,7 @@ discard block |
||
275 | 272 | { |
276 | 273 | $thisval = kses_bad_protocol($match[1], $allowed_protocols); |
277 | 274 | |
278 | - $attrarr[] = array |
|
279 | - ('name' => $attrname, |
|
275 | + $attrarr[] = array('name' => $attrname, |
|
280 | 276 | 'value' => $thisval, |
281 | 277 | 'whole' => "$attrname=\"$thisval\"", |
282 | 278 | 'vless' => 'n'); |
@@ -298,8 +294,7 @@ discard block |
||
298 | 294 | if ($mode == 1) |
299 | 295 | # special case, for when the attribute list ends with a valueless |
300 | 296 | # attribute like "selected" |
301 | - $attrarr[] = array |
|
302 | - ('name' => $attrname, |
|
297 | + $attrarr[] = array('name' => $attrname, |
|
303 | 298 | 'value' => '', |
304 | 299 | 'whole' => $attrname, |
305 | 300 | 'vless' => 'y'); |
@@ -470,9 +465,9 @@ discard block |
||
470 | 465 | ############################################################################### |
471 | 466 | { |
472 | 467 | $string2 = preg_split('/:|:|:/i', $string, 2); |
473 | - if(isset($string2[1]) && !preg_match('%/\?%',$string2[0])) |
|
468 | + if (isset($string2[1]) && !preg_match('%/\?%', $string2[0])) |
|
474 | 469 | { |
475 | - $string = kses_bad_protocol_once2($string2[0],$allowed_protocols).trim($string2[1]); |
|
470 | + $string = kses_bad_protocol_once2($string2[0], $allowed_protocols).trim($string2[1]); |
|
476 | 471 | } |
477 | 472 | return $string; |
478 | 473 | } # function kses_bad_protocol_once |
@@ -93,24 +93,28 @@ discard block |
||
93 | 93 | { |
94 | 94 | $string = kses_stripslashes($string); |
95 | 95 | |
96 | - if (substr($string, 0, 1) != '<') |
|
97 | - return '>'; |
|
96 | + if (substr($string, 0, 1) != '<') { |
|
97 | + return '>'; |
|
98 | + } |
|
98 | 99 | # It matched a ">" character |
99 | 100 | |
100 | - if (!preg_match('%^<\s*(/\s*)?([a-zA-Z0-9]+)([^>]*)>?$%', $string, $matches)) |
|
101 | - return ''; |
|
101 | + if (!preg_match('%^<\s*(/\s*)?([a-zA-Z0-9]+)([^>]*)>?$%', $string, $matches)) { |
|
102 | + return ''; |
|
103 | + } |
|
102 | 104 | # It's seriously malformed |
103 | 105 | |
104 | 106 | $slash = trim($matches[1]); |
105 | 107 | $elem = $matches[2]; |
106 | 108 | $attrlist = $matches[3]; |
107 | 109 | |
108 | - if (!@isset($allowed_html[strtolower($elem)])) |
|
109 | - return ''; |
|
110 | + if (!@isset($allowed_html[strtolower($elem)])) { |
|
111 | + return ''; |
|
112 | + } |
|
110 | 113 | # They are using a not allowed HTML element |
111 | 114 | |
112 | - if ($slash != '') |
|
113 | - return "<$slash$elem>"; |
|
115 | + if ($slash != '') { |
|
116 | + return "<$slash$elem>"; |
|
117 | + } |
|
114 | 118 | # No attributes are allowed for closing elements |
115 | 119 | |
116 | 120 | return kses_attr("$slash$elem", $attrlist, $allowed_html, |
@@ -131,13 +135,15 @@ discard block |
||
131 | 135 | # Is there a closing XHTML slash at the end of the attributes? |
132 | 136 | |
133 | 137 | $xhtml_slash = ''; |
134 | - if (preg_match('%\s/\s*$%', $attr)) |
|
135 | - $xhtml_slash = ' /'; |
|
138 | + if (preg_match('%\s/\s*$%', $attr)) { |
|
139 | + $xhtml_slash = ' /'; |
|
140 | + } |
|
136 | 141 | |
137 | 142 | # Are any attributes allowed at all for this element? |
138 | 143 | |
139 | - if (@count($allowed_html[strtolower($element)]) == 0) |
|
140 | - return "<$element$xhtml_slash>"; |
|
144 | + if (@count($allowed_html[strtolower($element)]) == 0) { |
|
145 | + return "<$element$xhtml_slash>"; |
|
146 | + } |
|
141 | 147 | |
142 | 148 | # Split it |
143 | 149 | |
@@ -151,27 +157,34 @@ discard block |
||
151 | 157 | foreach ($attrarr as $arreach) |
152 | 158 | { |
153 | 159 | if (!@isset($allowed_html[strtolower($element)] |
154 | - [strtolower($arreach['name'])])) |
|
155 | - continue; # the attribute is not allowed |
|
160 | + [strtolower($arreach['name'])])) { |
|
161 | + continue; |
|
162 | + } |
|
163 | + # the attribute is not allowed |
|
156 | 164 | |
157 | 165 | $current = $allowed_html[strtolower($element)] |
158 | 166 | [strtolower($arreach['name'])]; |
159 | 167 | |
160 | - if (!is_array($current)) |
|
161 | - $attr2 .= ' '.$arreach['whole']; |
|
168 | + if (!is_array($current)) { |
|
169 | + $attr2 .= ' '.$arreach['whole']; |
|
170 | + } |
|
162 | 171 | # there are no checks |
163 | 172 | |
164 | 173 | else |
165 | 174 | { |
166 | 175 | # there are some checks |
167 | 176 | $ok = true; |
168 | - foreach ($current as $currkey => $currval) |
|
169 | - if (!kses_check_attr_val($arreach['value'], $arreach['vless'], |
|
177 | + foreach ($current as $currkey => $currval) { |
|
178 | + if (!kses_check_attr_val($arreach['value'], $arreach['vless'], |
|
170 | 179 | $currkey, $currval)) |
171 | - { $ok = false; break; } |
|
172 | - |
|
173 | - if ($ok) |
|
174 | - $attr2 .= ' '.$arreach['whole']; # it passed them |
|
180 | + { $ok = false; |
|
181 | + } |
|
182 | + break; } |
|
183 | + |
|
184 | + if ($ok) { |
|
185 | + $attr2 .= ' '.$arreach['whole']; |
|
186 | + } |
|
187 | + # it passed them |
|
175 | 188 | } # if !is_array($current) |
176 | 189 | } # foreach |
177 | 190 | |
@@ -218,16 +231,22 @@ discard block |
||
218 | 231 | |
219 | 232 | case 1: # equals sign or valueless ("selected") |
220 | 233 | |
221 | - if (preg_match('/^\s*=\s*/', $attr)) # equals sign |
|
234 | + if (preg_match('/^\s*=\s*/', $attr)) { |
|
235 | + # equals sign |
|
222 | 236 | { |
223 | - $working = 1; $mode = 2; |
|
237 | + $working = 1; |
|
238 | + } |
|
239 | + $mode = 2; |
|
224 | 240 | $attr = preg_replace('/^\s*=\s*/', '', $attr); |
225 | 241 | break; |
226 | 242 | } |
227 | 243 | |
228 | - if (preg_match('/^\s+/', $attr)) # valueless |
|
244 | + if (preg_match('/^\s+/', $attr)) { |
|
245 | + # valueless |
|
229 | 246 | { |
230 | - $working = 1; $mode = 0; |
|
247 | + $working = 1; |
|
248 | + } |
|
249 | + $mode = 0; |
|
231 | 250 | $attrarr[] = array |
232 | 251 | ('name' => $attrname, |
233 | 252 | 'value' => '', |
@@ -240,10 +259,11 @@ discard block |
||
240 | 259 | |
241 | 260 | case 2: # attribute value, a URL after href= for instance |
242 | 261 | |
243 | - if (preg_match('/^"([^"]*)"(\s+|$)/', $attr, $match)) |
|
244 | - # "value" |
|
262 | + if (preg_match('/^"([^"]*)"(\s+|$)/', $attr, $match)) { |
|
263 | + # "value" |
|
245 | 264 | { |
246 | 265 | $thisval = kses_bad_protocol($match[1], $allowed_protocols); |
266 | + } |
|
247 | 267 | |
248 | 268 | $attrarr[] = array |
249 | 269 | ('name' => $attrname, |
@@ -255,10 +275,11 @@ discard block |
||
255 | 275 | break; |
256 | 276 | } |
257 | 277 | |
258 | - if (preg_match("/^'([^']*)'(\s+|$)/", $attr, $match)) |
|
259 | - # 'value' |
|
278 | + if (preg_match("/^'([^']*)'(\s+|$)/", $attr, $match)) { |
|
279 | + # 'value' |
|
260 | 280 | { |
261 | 281 | $thisval = kses_bad_protocol($match[1], $allowed_protocols); |
282 | + } |
|
262 | 283 | |
263 | 284 | $attrarr[] = array |
264 | 285 | ('name' => $attrname, |
@@ -270,10 +291,11 @@ discard block |
||
270 | 291 | break; |
271 | 292 | } |
272 | 293 | |
273 | - if (preg_match("%^([^\s\"']+)(\s+|$)%", $attr, $match)) |
|
274 | - # value |
|
294 | + if (preg_match("%^([^\s\"']+)(\s+|$)%", $attr, $match)) { |
|
295 | + # value |
|
275 | 296 | { |
276 | 297 | $thisval = kses_bad_protocol($match[1], $allowed_protocols); |
298 | + } |
|
277 | 299 | |
278 | 300 | $attrarr[] = array |
279 | 301 | ('name' => $attrname, |
@@ -288,21 +310,24 @@ discard block |
||
288 | 310 | break; |
289 | 311 | } # switch |
290 | 312 | |
291 | - if ($working == 0) # not well formed, remove and try again |
|
313 | + if ($working == 0) { |
|
314 | + # not well formed, remove and try again |
|
292 | 315 | { |
293 | 316 | $attr = kses_html_error($attr); |
317 | + } |
|
294 | 318 | $mode = 0; |
295 | 319 | } |
296 | 320 | } # while |
297 | 321 | |
298 | - if ($mode == 1) |
|
299 | - # special case, for when the attribute list ends with a valueless |
|
322 | + if ($mode == 1) { |
|
323 | + # special case, for when the attribute list ends with a valueless |
|
300 | 324 | # attribute like "selected" |
301 | 325 | $attrarr[] = array |
302 | 326 | ('name' => $attrname, |
303 | 327 | 'value' => '', |
304 | 328 | 'whole' => $attrname, |
305 | 329 | 'vless' => 'y'); |
330 | + } |
|
306 | 331 | |
307 | 332 | return $attrarr; |
308 | 333 | } # function kses_hair |
@@ -324,16 +349,18 @@ discard block |
||
324 | 349 | # greater than the given value. This can be used to avoid Buffer Overflows |
325 | 350 | # in WWW clients and various Internet servers. |
326 | 351 | |
327 | - if (strlen($value) > $checkvalue) |
|
328 | - $ok = false; |
|
352 | + if (strlen($value) > $checkvalue) { |
|
353 | + $ok = false; |
|
354 | + } |
|
329 | 355 | break; |
330 | 356 | |
331 | 357 | case 'minlen': |
332 | 358 | # The minlen check makes sure that the attribute value has a length not |
333 | 359 | # smaller than the given value. |
334 | 360 | |
335 | - if (strlen($value) < $checkvalue) |
|
336 | - $ok = false; |
|
361 | + if (strlen($value) < $checkvalue) { |
|
362 | + $ok = false; |
|
363 | + } |
|
337 | 364 | break; |
338 | 365 | |
339 | 366 | case 'maxval': |
@@ -343,20 +370,24 @@ discard block |
||
343 | 370 | # value is not greater than the given value. |
344 | 371 | # This check can be used to avoid Denial of Service attacks. |
345 | 372 | |
346 | - if (!preg_match('/^\s{0,6}[0-9]{1,6}\s{0,6}$/', $value)) |
|
347 | - $ok = false; |
|
348 | - if ($value > $checkvalue) |
|
349 | - $ok = false; |
|
373 | + if (!preg_match('/^\s{0,6}[0-9]{1,6}\s{0,6}$/', $value)) { |
|
374 | + $ok = false; |
|
375 | + } |
|
376 | + if ($value > $checkvalue) { |
|
377 | + $ok = false; |
|
378 | + } |
|
350 | 379 | break; |
351 | 380 | |
352 | 381 | case 'minval': |
353 | 382 | # The minval check checks that the attribute value is a positive integer, |
354 | 383 | # and that it is not smaller than the given value. |
355 | 384 | |
356 | - if (!preg_match('/^\s{0,6}[0-9]{1,6}\s{0,6}$/', $value)) |
|
357 | - $ok = false; |
|
358 | - if ($value < $checkvalue) |
|
359 | - $ok = false; |
|
385 | + if (!preg_match('/^\s{0,6}[0-9]{1,6}\s{0,6}$/', $value)) { |
|
386 | + $ok = false; |
|
387 | + } |
|
388 | + if ($value < $checkvalue) { |
|
389 | + $ok = false; |
|
390 | + } |
|
360 | 391 | break; |
361 | 392 | |
362 | 393 | case 'valueless': |
@@ -365,8 +396,9 @@ discard block |
||
365 | 396 | # is a "y" or a "Y", the attribute must not have a value. |
366 | 397 | # If the given value is an "n" or an "N", the attribute must have one. |
367 | 398 | |
368 | - if (strtolower($checkvalue) != $vless) |
|
369 | - $ok = false; |
|
399 | + if (strtolower($checkvalue) != $vless) { |
|
400 | + $ok = false; |
|
401 | + } |
|
370 | 402 | break; |
371 | 403 | } # switch |
372 | 404 | |
@@ -492,18 +524,20 @@ discard block |
||
492 | 524 | $string2 = strtolower($string2); |
493 | 525 | |
494 | 526 | $allowed = false; |
495 | - foreach ($allowed_protocols as $one_protocol) |
|
496 | - if (strtolower($one_protocol) == $string2) |
|
527 | + foreach ($allowed_protocols as $one_protocol) { |
|
528 | + if (strtolower($one_protocol) == $string2) |
|
497 | 529 | { |
498 | 530 | $allowed = true; |
531 | + } |
|
499 | 532 | break; |
500 | 533 | } |
501 | 534 | |
502 | - if ($allowed) |
|
503 | - return "$string2:"; |
|
504 | - else |
|
505 | - return ''; |
|
506 | -} # function kses_bad_protocol_once2 |
|
535 | + if ($allowed) { |
|
536 | + return "$string2:"; |
|
537 | + } else { |
|
538 | + return ''; |
|
539 | + } |
|
540 | + } # function kses_bad_protocol_once2 |
|
507 | 541 | |
508 | 542 | |
509 | 543 | function kses_normalize_entities($string) |
@@ -431,7 +431,7 @@ discard block |
||
431 | 431 | * |
432 | 432 | * @access public |
433 | 433 | * @param mixed , A string or array of protocols that will be removed from the internal list of allowed protocols. |
434 | - * @return bool Status of removing valid protocols. |
|
434 | + * @return null|boolean Status of removing valid protocols. |
|
435 | 435 | * @see RemoveProtocol() |
436 | 436 | * @since PHP5 OOP 0.2.1 |
437 | 437 | */ |
@@ -579,7 +579,7 @@ discard block |
||
579 | 579 | * This method goes through an array, and changes the keys to all lower case. |
580 | 580 | * |
581 | 581 | * @access private |
582 | - * @param array $in_array Associative array |
|
582 | + * @param array $inarray Associative array |
|
583 | 583 | * @return array Modified array |
584 | 584 | * @since PHP4 OOP 0.0.1 |
585 | 585 | */ |
@@ -1129,9 +1129,7 @@ discard block |
||
1129 | 1129 | * URL protocol white listing system anyway. |
1130 | 1130 | * |
1131 | 1131 | * @access private |
1132 | - * @param string $value The entitiy to be decoded. |
|
1133 | - * @return string Decoded entity |
|
1134 | - * @since PHP4 OOP 0.0.1 |
|
1132 | + * @param string $string |
|
1135 | 1133 | */ |
1136 | 1134 | function _decode_entities($string) |
1137 | 1135 | { |
@@ -1,5 +1,5 @@ discard block |
||
1 | 1 | <?php |
2 | - /* |
|
2 | + /* |
|
3 | 3 | * ========================================================================================== |
4 | 4 | * |
5 | 5 | * This program is free software and open source software; you can redistribute |
@@ -20,1143 +20,1143 @@ discard block |
||
20 | 20 | * ========================================================================================== |
21 | 21 | */ |
22 | 22 | |
23 | - /** |
|
24 | - * Class file for PHP4 OOP version of kses |
|
25 | - * |
|
26 | - * This is an updated version of kses to work with PHP4 that works under E_STRICT. |
|
27 | - * |
|
28 | - * This upgrade provides the following: |
|
29 | - * + Version number synced to procedural version number |
|
30 | - * + PHPdoc style documentation has been added to the class. See http://www.phpdoc.org/ for more info. |
|
31 | - * + Some methods are now deprecated due to nomenclature style change. See method documentation for specifics. |
|
32 | - * + Kses4 now works in E_STRICT |
|
33 | - * + Addition of methods AddProtocols(), filterKsestextHook(), RemoveProtocol() and RemoveProtocols() |
|
34 | - * + Deprecated _hook(), Protocols() |
|
35 | - * + Integrated code from kses 0.2.2 into class. |
|
36 | - * + Added methods DumpProtocols(), DumpMethods() |
|
37 | - * |
|
38 | - * @package kses |
|
39 | - * @subpackage kses4 |
|
40 | - */ |
|
41 | - |
|
42 | - if(substr(phpversion(), 0, 1) < 4) |
|
43 | - { |
|
44 | - die("Class kses requires PHP 4 or higher."); |
|
45 | - } |
|
46 | - |
|
47 | - /** |
|
48 | - * Only install KSES4 once |
|
49 | - */ |
|
50 | - if(!defined('KSES_CLASS_PHP4')) |
|
51 | - { |
|
52 | - define('KSES_CLASS_PHP4', true); |
|
53 | - |
|
54 | - /** |
|
55 | - * Kses strips evil scripts! |
|
56 | - * |
|
57 | - * This class provides the capability for removing unwanted HTML/XHTML, attributes from |
|
58 | - * tags, and protocols contained in links. The net result is a much more powerful tool |
|
59 | - * than the PHP internal strip_tags() |
|
60 | - * |
|
61 | - * This is a fork of a slick piece of procedural code called 'kses' written by Ulf Harnhammar |
|
62 | - * The entire set of functions was wrapped in a PHP object with some internal modifications |
|
63 | - * by Richard Vasquez (http://www.chaos.org/) 7/25/2003 |
|
64 | - * |
|
65 | - * This upgrade provides the following: |
|
66 | - * + Version number synced to procedural version number |
|
67 | - * + PHPdoc style documentation has been added to the class. See http://www.phpdoc.org/ for more info. |
|
68 | - * + Some methods are now deprecated due to nomenclature style change. See method documentation for specifics. |
|
69 | - * + Kses4 now works in E_STRICT |
|
70 | - * + Addition of methods AddProtocols(), filterKsestextHook(), RemoveProtocol(), RemoveProtocols() and SetProtocols() |
|
71 | - * + Deprecated _hook(), Protocols() |
|
72 | - * + Integrated code from kses 0.2.2 into class. |
|
73 | - * |
|
74 | - * @author Richard R. V�squez, Jr. (Original procedural code by Ulf H�rnhammar) |
|
75 | - * @link http://sourceforge.net/projects/kses/ Home Page for Kses |
|
76 | - * @link http://chaos.org/contact/ Contact page with current email address for Richard Vasquez |
|
77 | - * @copyright Richard R. V�squez, Jr. 2003-2005 |
|
78 | - * @version PHP4 OOP 0.2.2 |
|
79 | - * @license http://www.gnu.org/licenses/gpl.html GNU Public License |
|
80 | - * @package kses |
|
81 | - */ |
|
82 | - class kses4 |
|
83 | - { |
|
84 | - /**#@+ |
|
23 | + /** |
|
24 | + * Class file for PHP4 OOP version of kses |
|
25 | + * |
|
26 | + * This is an updated version of kses to work with PHP4 that works under E_STRICT. |
|
27 | + * |
|
28 | + * This upgrade provides the following: |
|
29 | + * + Version number synced to procedural version number |
|
30 | + * + PHPdoc style documentation has been added to the class. See http://www.phpdoc.org/ for more info. |
|
31 | + * + Some methods are now deprecated due to nomenclature style change. See method documentation for specifics. |
|
32 | + * + Kses4 now works in E_STRICT |
|
33 | + * + Addition of methods AddProtocols(), filterKsestextHook(), RemoveProtocol() and RemoveProtocols() |
|
34 | + * + Deprecated _hook(), Protocols() |
|
35 | + * + Integrated code from kses 0.2.2 into class. |
|
36 | + * + Added methods DumpProtocols(), DumpMethods() |
|
37 | + * |
|
38 | + * @package kses |
|
39 | + * @subpackage kses4 |
|
40 | + */ |
|
41 | + |
|
42 | + if(substr(phpversion(), 0, 1) < 4) |
|
43 | + { |
|
44 | + die("Class kses requires PHP 4 or higher."); |
|
45 | + } |
|
46 | + |
|
47 | + /** |
|
48 | + * Only install KSES4 once |
|
49 | + */ |
|
50 | + if(!defined('KSES_CLASS_PHP4')) |
|
51 | + { |
|
52 | + define('KSES_CLASS_PHP4', true); |
|
53 | + |
|
54 | + /** |
|
55 | + * Kses strips evil scripts! |
|
56 | + * |
|
57 | + * This class provides the capability for removing unwanted HTML/XHTML, attributes from |
|
58 | + * tags, and protocols contained in links. The net result is a much more powerful tool |
|
59 | + * than the PHP internal strip_tags() |
|
60 | + * |
|
61 | + * This is a fork of a slick piece of procedural code called 'kses' written by Ulf Harnhammar |
|
62 | + * The entire set of functions was wrapped in a PHP object with some internal modifications |
|
63 | + * by Richard Vasquez (http://www.chaos.org/) 7/25/2003 |
|
64 | + * |
|
65 | + * This upgrade provides the following: |
|
66 | + * + Version number synced to procedural version number |
|
67 | + * + PHPdoc style documentation has been added to the class. See http://www.phpdoc.org/ for more info. |
|
68 | + * + Some methods are now deprecated due to nomenclature style change. See method documentation for specifics. |
|
69 | + * + Kses4 now works in E_STRICT |
|
70 | + * + Addition of methods AddProtocols(), filterKsestextHook(), RemoveProtocol(), RemoveProtocols() and SetProtocols() |
|
71 | + * + Deprecated _hook(), Protocols() |
|
72 | + * + Integrated code from kses 0.2.2 into class. |
|
73 | + * |
|
74 | + * @author Richard R. V�squez, Jr. (Original procedural code by Ulf H�rnhammar) |
|
75 | + * @link http://sourceforge.net/projects/kses/ Home Page for Kses |
|
76 | + * @link http://chaos.org/contact/ Contact page with current email address for Richard Vasquez |
|
77 | + * @copyright Richard R. V�squez, Jr. 2003-2005 |
|
78 | + * @version PHP4 OOP 0.2.2 |
|
79 | + * @license http://www.gnu.org/licenses/gpl.html GNU Public License |
|
80 | + * @package kses |
|
81 | + */ |
|
82 | + class kses4 |
|
83 | + { |
|
84 | + /**#@+ |
|
85 | 85 | * @access private |
86 | 86 | * @var array |
87 | 87 | */ |
88 | - var $allowed_protocols = array(); |
|
89 | - var $allowed_html = array(); |
|
90 | - /**#@-*/ |
|
91 | - |
|
92 | - /** |
|
93 | - * Constructor for kses. |
|
94 | - * |
|
95 | - * This sets a default collection of protocols allowed in links, and creates an |
|
96 | - * empty set of allowed HTML tags. |
|
97 | - * @since PHP4 OOP 0.0.1 |
|
98 | - */ |
|
99 | - function kses4() |
|
100 | - { |
|
101 | - /** |
|
102 | - * You could add protocols such as ftp, new, gopher, mailto, irc, etc. |
|
103 | - * |
|
104 | - * The base values the original kses provided were: |
|
105 | - * 'http', 'https', 'ftp', 'news', 'nntp', 'telnet', 'gopher', 'mailto' |
|
106 | - */ |
|
107 | - $this->allowed_protocols = array('http', 'ftp', 'mailto'); |
|
108 | - $this->allowed_html = array(); |
|
109 | - } |
|
110 | - |
|
111 | - /** |
|
112 | - * Basic task of kses - parses $string and strips it as required. |
|
113 | - * |
|
114 | - * This method strips all the disallowed (X)HTML tags, attributes |
|
115 | - * and protocols from the input $string. |
|
116 | - * |
|
117 | - * @access public |
|
118 | - * @param string $string String to be stripped of 'evil scripts' |
|
119 | - * @return string The stripped string |
|
120 | - * @since PHP4 OOP 0.2.1 |
|
121 | - */ |
|
122 | - function Parse($string = "") |
|
123 | - { |
|
124 | - if (get_magic_quotes_gpc()) |
|
125 | - { |
|
126 | - $string = stripslashes($string); |
|
127 | - } |
|
128 | - $string = $this->_no_null($string); |
|
129 | - $string = $this->_js_entities($string); |
|
130 | - $string = $this->_normalize_entities($string); |
|
131 | - $string = $this->filterKsesTextHook($string); |
|
132 | - return $this->_split($string); |
|
133 | - } |
|
134 | - |
|
135 | - /** |
|
136 | - * Allows for single/batch addition of protocols |
|
137 | - * |
|
138 | - * This method accepts one argument that can be either a string |
|
139 | - * or an array of strings. Invalid data will be ignored. |
|
140 | - * |
|
141 | - * The argument will be processed, and each string will be added |
|
142 | - * via AddProtocol(). |
|
143 | - * |
|
144 | - * @access public |
|
145 | - * @param mixed , A string or array of protocols that will be added to the internal list of allowed protocols. |
|
146 | - * @return bool Status of adding valid protocols. |
|
147 | - * @see AddProtocol() |
|
148 | - * @since PHP4 OOP 0.2.1 |
|
149 | - */ |
|
150 | - function AddProtocols() |
|
151 | - { |
|
152 | - $c_args = func_num_args(); |
|
153 | - if($c_args != 1) |
|
154 | - { |
|
155 | - trigger_error("kses4::AddProtocols() did not receive an argument.", E_USER_WARNING); |
|
156 | - return false; |
|
157 | - } |
|
158 | - |
|
159 | - $protocol_data = func_get_arg(0); |
|
160 | - |
|
161 | - if(is_array($protocol_data) && count($protocol_data) > 0) |
|
162 | - { |
|
163 | - foreach($protocol_data as $protocol) |
|
164 | - { |
|
165 | - $this->AddProtocol($protocol); |
|
166 | - } |
|
167 | - return true; |
|
168 | - } |
|
169 | - elseif(is_string($protocol_data)) |
|
170 | - { |
|
171 | - $this->AddProtocol($protocol_data); |
|
172 | - return true; |
|
173 | - } |
|
174 | - else |
|
175 | - { |
|
176 | - trigger_error("kses4::AddProtocols() did not receive a string or an array.", E_USER_WARNING); |
|
177 | - return false; |
|
178 | - } |
|
179 | - } |
|
180 | - |
|
181 | - /** |
|
182 | - * Allows for single/batch addition of protocols |
|
183 | - * |
|
184 | - * @deprecated Use AddProtocols() |
|
185 | - * @see AddProtocols() |
|
186 | - * @return bool |
|
187 | - * @since PHP4 OOP 0.0.1 |
|
188 | - */ |
|
189 | - function Protocols() |
|
190 | - { |
|
191 | - $c_args = func_num_args(); |
|
192 | - if($c_args != 1) |
|
193 | - { |
|
194 | - trigger_error("kses4::Protocols() did not receive an argument.", E_USER_WARNING); |
|
195 | - return false; |
|
196 | - } |
|
197 | - |
|
198 | - return $this->AddProtocols(func_get_arg(0)); |
|
199 | - } |
|
200 | - |
|
201 | - /** |
|
202 | - * Adds a single protocol to $this->allowed_protocols. |
|
203 | - * |
|
204 | - * This method accepts a string argument and adds it to |
|
205 | - * the list of allowed protocols to keep when performing |
|
206 | - * Parse(). |
|
207 | - * |
|
208 | - * @access public |
|
209 | - * @param string $protocol The name of the protocol to be added. |
|
210 | - * @return bool Status of adding valid protocol. |
|
211 | - * @since PHP4 OOP 0.0.1 |
|
212 | - */ |
|
213 | - function AddProtocol($protocol = "") |
|
214 | - { |
|
215 | - if(!is_string($protocol)) |
|
216 | - { |
|
217 | - trigger_error("kses4::AddProtocol() requires a string.", E_USER_WARNING); |
|
218 | - return false; |
|
219 | - } |
|
220 | - |
|
221 | - $protocol = strtolower(trim($protocol)); |
|
222 | - if($protocol == "") |
|
223 | - { |
|
224 | - trigger_error("kses4::AddProtocol() tried to add an empty/NULL protocol.", E_USER_WARNING); |
|
225 | - return false; |
|
226 | - } |
|
227 | - |
|
228 | - // Remove any inadvertent ':' at the end of the protocol. |
|
229 | - if(substr($protocol, strlen($protocol) - 1, 1) == ":") |
|
230 | - { |
|
231 | - $protocol = substr($protocol, 0, strlen($protocol) - 1); |
|
232 | - } |
|
233 | - |
|
234 | - if(!in_array($protocol, $this->allowed_protocols)) |
|
235 | - { |
|
236 | - array_push($this->allowed_protocols, $protocol); |
|
237 | - sort($this->allowed_protocols); |
|
238 | - } |
|
239 | - return true; |
|
240 | - } |
|
241 | - |
|
242 | - /** |
|
243 | - * Allows for single/batch replacement of protocols |
|
244 | - * |
|
245 | - * This method accepts one argument that can be either a string |
|
246 | - * or an array of strings. Invalid data will be ignored. |
|
247 | - * |
|
248 | - * Existing protocols will be removed, then the argument will be |
|
249 | - * processed, and each string will be added via AddProtocol(). |
|
250 | - * |
|
251 | - * @access public |
|
252 | - * @param mixed , A string or array of protocols that will be the new internal list of allowed protocols. |
|
253 | - * @return bool Status of replacing valid protocols. |
|
254 | - * @since PHP4 OOP 0.2.2 |
|
255 | - * @see AddProtocol() |
|
256 | - */ |
|
257 | - function SetProtocols() |
|
258 | - { |
|
259 | - $c_args = func_num_args(); |
|
260 | - if($c_args != 1) |
|
261 | - { |
|
262 | - trigger_error("kses4::SetProtocols() did not receive an argument.", E_USER_WARNING); |
|
263 | - return false; |
|
264 | - } |
|
265 | - |
|
266 | - $protocol_data = func_get_arg(0); |
|
267 | - |
|
268 | - if(is_array($protocol_data) && count($protocol_data) > 0) |
|
269 | - { |
|
270 | - $this->allowed_protocols = array(); |
|
271 | - foreach($protocol_data as $protocol) |
|
272 | - { |
|
273 | - $this->AddProtocol($protocol); |
|
274 | - } |
|
275 | - return true; |
|
276 | - } |
|
277 | - elseif(is_string($protocol_data)) |
|
278 | - { |
|
279 | - $this->allowed_protocols = array(); |
|
280 | - $this->AddProtocol($protocol_data); |
|
281 | - return true; |
|
282 | - } |
|
283 | - else |
|
284 | - { |
|
285 | - trigger_error("kses4::SetProtocols() did not receive a string or an array.", E_USER_WARNING); |
|
286 | - return false; |
|
287 | - } |
|
288 | - } |
|
289 | - |
|
290 | - /** |
|
291 | - * Raw dump of allowed protocols |
|
292 | - * |
|
293 | - * This returns an indexed array of allowed protocols for a particular KSES |
|
294 | - * instantiation. |
|
295 | - * |
|
296 | - * @access public |
|
297 | - * @return array The list of allowed protocols. |
|
298 | - * @since PHP4 OOP 0.2.2 |
|
299 | - */ |
|
300 | - function DumpProtocols() |
|
301 | - { |
|
302 | - return $this->allowed_protocols; |
|
303 | - } |
|
304 | - |
|
305 | - /** |
|
306 | - * Raw dump of allowed (X)HTML elements |
|
307 | - * |
|
308 | - * This returns an indexed array of allowed (X)HTML elements and attributes |
|
309 | - * for a particular KSES instantiation. |
|
310 | - * |
|
311 | - * @access public |
|
312 | - * @return array The list of allowed elements. |
|
313 | - * @since PHP4 OOP 0.2.2 |
|
314 | - */ |
|
315 | - function DumpElements() |
|
316 | - { |
|
317 | - return $this->allowed_html; |
|
318 | - } |
|
319 | - |
|
320 | - /** |
|
321 | - * Adds valid (X)HTML with corresponding attributes that will be kept when stripping 'evil scripts'. |
|
322 | - * |
|
323 | - * This method accepts one argument that can be either a string |
|
324 | - * or an array of strings. Invalid data will be ignored. |
|
325 | - * |
|
326 | - * @access public |
|
327 | - * @param string $tag (X)HTML tag that will be allowed after stripping text. |
|
328 | - * @param array $attribs Associative array of allowed attributes - key => attribute name - value => attribute parameter |
|
329 | - * @return bool Status of Adding (X)HTML and attributes. |
|
330 | - * @since PHP4 OOP 0.0.1 |
|
331 | - */ |
|
332 | - function AddHTML($tag = "", $attribs = array()) |
|
333 | - { |
|
334 | - if(!is_string($tag)) |
|
335 | - { |
|
336 | - trigger_error("kses4::AddHTML() requires the tag to be a string", E_USER_WARNING); |
|
337 | - return false; |
|
338 | - } |
|
339 | - |
|
340 | - $tag = strtolower(trim($tag)); |
|
341 | - if($tag == "") |
|
342 | - { |
|
343 | - trigger_error("kses4::AddHTML() tried to add an empty/NULL tag", E_USER_WARNING); |
|
344 | - return false; |
|
345 | - } |
|
346 | - |
|
347 | - if(!is_array($attribs)) |
|
348 | - { |
|
349 | - trigger_error("kses4::AddHTML() requires an array (even an empty one) of attributes for '$tag'", E_USER_WARNING); |
|
350 | - return false; |
|
351 | - } |
|
352 | - |
|
353 | - $new_attribs = array(); |
|
354 | - if(is_array($attribs) && count($attribs) > 0) |
|
355 | - { |
|
356 | - foreach($attribs as $idx1 => $val1) |
|
357 | - { |
|
358 | - $new_idx1 = strtolower($idx1); |
|
359 | - $new_val1 = $attribs[$idx1]; |
|
360 | - |
|
361 | - if(is_array($new_val1) && count($new_val1) > 0) |
|
362 | - { |
|
363 | - $tmp_val = array(); |
|
364 | - foreach($new_val1 as $idx2 => $val2) |
|
365 | - { |
|
366 | - $new_idx2 = strtolower($idx2); |
|
367 | - $tmp_val[$new_idx2] = $val2; |
|
368 | - } |
|
369 | - $new_val1 = $tmp_val; |
|
370 | - } |
|
371 | - |
|
372 | - $new_attribs[$new_idx1] = $new_val1; |
|
373 | - } |
|
374 | - } |
|
375 | - |
|
376 | - $this->allowed_html[$tag] = $new_attribs; |
|
377 | - return true; |
|
378 | - } |
|
379 | - |
|
380 | - /** |
|
381 | - * Removes a single protocol from $this->allowed_protocols. |
|
382 | - * |
|
383 | - * This method accepts a string argument and removes it from |
|
384 | - * the list of allowed protocols to keep when performing |
|
385 | - * Parse(). |
|
386 | - * |
|
387 | - * @access public |
|
388 | - * @param string $protocol The name of the protocol to be removed. |
|
389 | - * @return bool Status of removing valid protocol. |
|
390 | - * @since PHP4 OOP 0.2.1 |
|
391 | - */ |
|
392 | - function RemoveProtocol($protocol = "") |
|
393 | - { |
|
394 | - if(!is_string($protocol)) |
|
395 | - { |
|
396 | - trigger_error("kses4::RemoveProtocol() requires a string.", E_USER_WARNING); |
|
397 | - return false; |
|
398 | - } |
|
399 | - |
|
400 | - // Remove any inadvertent ':' at the end of the protocol. |
|
401 | - if(substr($protocol, strlen($protocol) - 1, 1) == ":") |
|
402 | - { |
|
403 | - $protocol = substr($protocol, 0, strlen($protocol) - 1); |
|
404 | - } |
|
405 | - |
|
406 | - $protocol = strtolower(trim($protocol)); |
|
407 | - if($protocol == "") |
|
408 | - { |
|
409 | - trigger_error("kses4::RemoveProtocol() tried to remove an empty/NULL protocol.", E_USER_WARNING); |
|
410 | - return false; |
|
411 | - } |
|
412 | - |
|
413 | - // Ensures that the protocol exists before removing it. |
|
414 | - if(in_array($protocol, $this->allowed_protocols)) |
|
415 | - { |
|
416 | - $this->allowed_protocols = array_diff($this->allowed_protocols, array($protocol)); |
|
417 | - sort($this->allowed_protocols); |
|
418 | - } |
|
419 | - |
|
420 | - return true; |
|
421 | - } |
|
422 | - |
|
423 | - /** |
|
424 | - * Allows for single/batch removal of protocols |
|
425 | - * |
|
426 | - * This method accepts one argument that can be either a string |
|
427 | - * or an array of strings. Invalid data will be ignored. |
|
428 | - * |
|
429 | - * The argument will be processed, and each string will be removed |
|
430 | - * via RemoveProtocol(). |
|
431 | - * |
|
432 | - * @access public |
|
433 | - * @param mixed , A string or array of protocols that will be removed from the internal list of allowed protocols. |
|
434 | - * @return bool Status of removing valid protocols. |
|
435 | - * @see RemoveProtocol() |
|
436 | - * @since PHP5 OOP 0.2.1 |
|
437 | - */ |
|
438 | - function RemoveProtocols() |
|
439 | - { |
|
440 | - $c_args = func_num_args(); |
|
441 | - if($c_args != 1) |
|
442 | - { |
|
443 | - return false; |
|
444 | - } |
|
445 | - |
|
446 | - $protocol_data = func_get_arg(0); |
|
447 | - |
|
448 | - if(is_array($protocol_data) && count($protocol_data) > 0) |
|
449 | - { |
|
450 | - foreach($protocol_data as $protocol) |
|
451 | - { |
|
452 | - $this->RemoveProtocol($protocol); |
|
453 | - } |
|
454 | - } |
|
455 | - elseif(is_string($protocol_data)) |
|
456 | - { |
|
457 | - $this->RemoveProtocol($protocol_data); |
|
458 | - return true; |
|
459 | - } |
|
460 | - else |
|
461 | - { |
|
462 | - trigger_error("kses4::RemoveProtocols() did not receive a string or an array.", E_USER_WARNING); |
|
463 | - return false; |
|
464 | - } |
|
465 | - } |
|
466 | - |
|
467 | - /** |
|
468 | - * This method removes any NULL or characters in $string. |
|
469 | - * |
|
470 | - * @access private |
|
471 | - * @param string $string |
|
472 | - * @return string String without any NULL/chr(173) |
|
473 | - * @since PHP4 OOP 0.0.1 |
|
474 | - */ |
|
475 | - function _no_null($string) |
|
476 | - { |
|
477 | - $string = preg_replace('/\0+/', '', $string); |
|
478 | - $string = preg_replace('/(\\\\0)+/', '', $string); |
|
479 | - return $string; |
|
480 | - } |
|
481 | - |
|
482 | - /** |
|
483 | - * This function removes the HTML JavaScript entities found in early versions of |
|
484 | - * Netscape 4. |
|
485 | - * |
|
486 | - * @access private |
|
487 | - * @param string $string |
|
488 | - * @return string String without any NULL/chr(173) |
|
489 | - * @since PHP4 OOP 0.0.1 |
|
490 | - */ |
|
491 | - function _js_entities($string) |
|
492 | - { |
|
493 | - return preg_replace('%&\s*\{[^}]*(\}\s*;?|$)%', '', $string); |
|
494 | - } |
|
495 | - |
|
496 | - /** |
|
497 | - * Normalizes HTML entities |
|
498 | - * |
|
499 | - * This function normalizes HTML entities. It will convert "AT&T" to the correct |
|
500 | - * "AT&T", ":" to ":", "&#XYZZY;" to "&#XYZZY;" and so on. |
|
501 | - * |
|
502 | - * @access private |
|
503 | - * @param string $string |
|
504 | - * @return string String with normalized entities |
|
505 | - * @since PHP4 OOP 0.0.1 |
|
506 | - */ |
|
507 | - function _normalize_entities($string) |
|
508 | - { |
|
509 | - # Disarm all entities by converting & to & |
|
510 | - $string = str_replace('&', '&', $string); |
|
511 | - |
|
512 | - # Change back the allowed entities in our entity white list |
|
513 | - |
|
514 | - $string = preg_replace('/&([A-Za-z][A-Za-z0-9]{0,19});/', '&\\1;', $string); |
|
515 | - $string = preg_replace('/&#0*([0-9]{1,5});/e', '\$this->_normalize_entities2("\\1")', $string); |
|
516 | - $string = preg_replace('/&#([Xx])0*(([0-9A-Fa-f]{2}){1,2});/', '&#\\1\\2;', $string); |
|
517 | - |
|
518 | - return $string; |
|
519 | - } |
|
520 | - |
|
521 | - /** |
|
522 | - * Helper method used by normalizeEntites() |
|
523 | - * |
|
524 | - * This method helps normalizeEntities() to only accept 16 bit values |
|
525 | - * and nothing more for &#number; entities. |
|
526 | - * |
|
527 | - * This method helps normalize_entities() during a preg_replace() |
|
528 | - * where a &#(0)*XXXXX; occurs. The '(0)*XXXXXX' value is converted to |
|
529 | - * a number and the result is returned as a numeric entity if the number |
|
530 | - * is less than 65536. Otherwise, the value is returned 'as is'. |
|
531 | - * |
|
532 | - * @access private |
|
533 | - * @param string $i |
|
534 | - * @return string Normalized numeric entity |
|
535 | - * @see _normalize_entities() |
|
536 | - * @since PHP4 OOP 0.0.1 |
|
537 | - */ |
|
538 | - function _normalize_entities2($i) |
|
539 | - { |
|
540 | - return (($i > 65535) ? "&#$i;" : "&#$i;"); |
|
541 | - } |
|
542 | - |
|
543 | - /** |
|
544 | - * Allows for additional user defined modifications to text. |
|
545 | - * |
|
546 | - * @deprecated use filterKsesTextHook() |
|
547 | - * @param string $string |
|
548 | - * @see filterKsesTextHook() |
|
549 | - * @return string |
|
550 | - * @since PHP4 OOP 0.0.1 |
|
551 | - */ |
|
552 | - function _hook($string) |
|
553 | - { |
|
554 | - return $this->filterKsesTextHook($string); |
|
555 | - } |
|
556 | - |
|
557 | - /** |
|
558 | - * Allows for additional user defined modifications to text. |
|
559 | - * |
|
560 | - * This method allows for additional modifications to be performed on |
|
561 | - * a string that's being run through Parse(). Currently, it returns the |
|
562 | - * input string 'as is'. |
|
563 | - * |
|
564 | - * This method is provided for users to extend the kses class for their own |
|
565 | - * requirements. |
|
566 | - * |
|
567 | - * @access public |
|
568 | - * @param string $string String to perfrom additional modifications on. |
|
569 | - * @return string User modified string. |
|
570 | - * @see Parse() |
|
571 | - * @since PHP5 OOP 1.0.0 |
|
572 | - */ |
|
573 | - function filterKsesTextHook($string) |
|
574 | - { |
|
575 | - return $string; |
|
576 | - } |
|
577 | - |
|
578 | - /** |
|
579 | - * This method goes through an array, and changes the keys to all lower case. |
|
580 | - * |
|
581 | - * @access private |
|
582 | - * @param array $in_array Associative array |
|
583 | - * @return array Modified array |
|
584 | - * @since PHP4 OOP 0.0.1 |
|
585 | - */ |
|
586 | - function _array_lc($inarray) |
|
587 | - { |
|
588 | - $outarray = array(); |
|
589 | - |
|
590 | - if(is_array($inarray) && count($inarray) > 0) |
|
591 | - { |
|
592 | - foreach ($inarray as $inkey => $inval) |
|
593 | - { |
|
594 | - $outkey = strtolower($inkey); |
|
595 | - $outarray[$outkey] = array(); |
|
596 | - |
|
597 | - if(is_array($inval) && count($inval) > 0) |
|
598 | - { |
|
599 | - foreach ($inval as $inkey2 => $inval2) |
|
600 | - { |
|
601 | - $outkey2 = strtolower($inkey2); |
|
602 | - $outarray[$outkey][$outkey2] = $inval2; |
|
603 | - } |
|
604 | - } |
|
605 | - } |
|
606 | - } |
|
607 | - |
|
608 | - return $outarray; |
|
609 | - } |
|
610 | - |
|
611 | - /** |
|
612 | - * This method searched for HTML tags, no matter how malformed. It also |
|
613 | - * matches stray ">" characters. |
|
614 | - * |
|
615 | - * @access private |
|
616 | - * @param string $string |
|
617 | - * @return string HTML tags |
|
618 | - * @since PHP4 OOP 0.0.1 |
|
619 | - */ |
|
620 | - function _split($string) |
|
621 | - { |
|
622 | - return preg_replace( |
|
623 | - '%(<'. # EITHER: < |
|
624 | - '[^>]*'. # things that aren't > |
|
625 | - '(>|$)'. # > or end of string |
|
626 | - '|>)%e', # OR: just a > |
|
627 | - "\$this->_split2('\\1')", |
|
628 | - $string); |
|
629 | - } |
|
630 | - |
|
631 | - /** |
|
632 | - * This method strips out disallowed and/or mangled (X)HTML tags along with assigned attributes. |
|
633 | - * |
|
634 | - * This method does a lot of work. It rejects some very malformed things |
|
635 | - * like <:::>. It returns an empty string if the element isn't allowed (look |
|
636 | - * ma, no strip_tags()!). Otherwise it splits the tag into an element and an |
|
637 | - * allowed attribute list. |
|
638 | - * |
|
639 | - * @access private |
|
640 | - * @param string $string |
|
641 | - * @return string Modified string minus disallowed/mangled (X)HTML and attributes |
|
642 | - * @since PHP4 OOP 0.0.1 |
|
643 | - */ |
|
644 | - function _split2($string) |
|
645 | - { |
|
646 | - $string = $this->_stripslashes($string); |
|
647 | - |
|
648 | - if (substr($string, 0, 1) != '<') |
|
649 | - { |
|
650 | - # It matched a ">" character |
|
651 | - return '>'; |
|
652 | - } |
|
653 | - |
|
654 | - if (!preg_match('%^<\s*(/\s*)?([a-zA-Z0-9]+)([^>]*)>?$%', $string, $matches)) |
|
655 | - { |
|
656 | - # It's seriously malformed |
|
657 | - return ''; |
|
658 | - } |
|
659 | - |
|
660 | - $slash = trim($matches[1]); |
|
661 | - $elem = $matches[2]; |
|
662 | - $attrlist = $matches[3]; |
|
663 | - |
|
664 | - if ( |
|
665 | - !isset($this->allowed_html[strtolower($elem)]) || |
|
666 | - !is_array($this->allowed_html[strtolower($elem)]) |
|
667 | - ) |
|
668 | - { |
|
669 | - # They are using a not allowed HTML element |
|
670 | - return ''; |
|
671 | - } |
|
672 | - |
|
673 | - if ($slash != '') |
|
674 | - { |
|
675 | - return "<$slash$elem>"; |
|
676 | - } |
|
677 | - # No attributes are allowed for closing elements |
|
678 | - |
|
679 | - return $this->_attr("$slash$elem", $attrlist); |
|
680 | - } |
|
681 | - |
|
682 | - /** |
|
683 | - * This method strips out disallowed attributes for (X)HTML tags. |
|
684 | - * |
|
685 | - * This method removes all attributes if none are allowed for this element. |
|
686 | - * If some are allowed it calls $this->_hair() to split them further, and then it |
|
687 | - * builds up new HTML code from the data that $this->_hair() returns. It also |
|
688 | - * removes "<" and ">" characters, if there are any left. One more thing it |
|
689 | - * does is to check if the tag has a closing XHTML slash, and if it does, |
|
690 | - * it puts one in the returned code as well. |
|
691 | - * |
|
692 | - * @access private |
|
693 | - * @param string $element (X)HTML tag to check |
|
694 | - * @param string $attr Text containing attributes to check for validity. |
|
695 | - * @return string Resulting valid (X)HTML or '' |
|
696 | - * @see _hair() |
|
697 | - * @since PHP4 OOP 0.0.1 |
|
698 | - */ |
|
699 | - function _attr($element, $attr) |
|
700 | - { |
|
701 | - # Is there a closing XHTML slash at the end of the attributes? |
|
702 | - $xhtml_slash = ''; |
|
703 | - if (preg_match('%\s/\s*$%', $attr)) |
|
704 | - { |
|
705 | - $xhtml_slash = ' /'; |
|
706 | - } |
|
707 | - |
|
708 | - # Are any attributes allowed at all for this element? |
|
709 | - if ( |
|
710 | - !isset($this->allowed_html[strtolower($element)]) || |
|
711 | - count($this->allowed_html[strtolower($element)]) == 0 |
|
712 | - ) |
|
713 | - { |
|
714 | - return "<$element$xhtml_slash>"; |
|
715 | - } |
|
716 | - |
|
717 | - # Split it |
|
718 | - $attrarr = $this->_hair($attr); |
|
719 | - |
|
720 | - # Go through $attrarr, and save the allowed attributes for this element |
|
721 | - # in $attr2 |
|
722 | - $attr2 = ''; |
|
723 | - if(is_array($attrarr) && count($attrarr) > 0) |
|
724 | - { |
|
725 | - foreach ($attrarr as $arreach) |
|
726 | - { |
|
727 | - if(!isset($this->allowed_html[strtolower($element)][strtolower($arreach['name'])])) |
|
728 | - { |
|
729 | - continue; |
|
730 | - } |
|
731 | - |
|
732 | - $current = $this->allowed_html[strtolower($element)][strtolower($arreach['name'])]; |
|
733 | - if ($current == '') |
|
734 | - { |
|
735 | - # the attribute is not allowed |
|
736 | - continue; |
|
737 | - } |
|
738 | - |
|
739 | - if (!is_array($current)) |
|
740 | - { |
|
741 | - # there are no checks |
|
742 | - $attr2 .= ' '.$arreach['whole']; |
|
743 | - } |
|
744 | - else |
|
745 | - { |
|
746 | - # there are some checks |
|
747 | - $ok = true; |
|
748 | - if(is_array($current) && count($current) > 0) |
|
749 | - { |
|
750 | - foreach ($current as $currkey => $currval) |
|
751 | - { |
|
752 | - if (!$this->_check_attr_val($arreach['value'], $arreach['vless'], $currkey, $currval)) |
|
753 | - { |
|
754 | - $ok = false; |
|
755 | - break; |
|
756 | - } |
|
757 | - } |
|
758 | - |
|
759 | - if ($ok) |
|
760 | - { |
|
761 | - # it passed them |
|
762 | - $attr2 .= ' '.$arreach['whole']; |
|
763 | - } |
|
764 | - } |
|
765 | - } |
|
766 | - } |
|
767 | - } |
|
768 | - |
|
769 | - # Remove any "<" or ">" characters |
|
770 | - $attr2 = preg_replace('/[<>]/', '', $attr2); |
|
771 | - return "<$element$attr2$xhtml_slash>"; |
|
772 | - } |
|
773 | - |
|
774 | - /** |
|
775 | - * This method combs through an attribute list string and returns an associative array of attributes and values. |
|
776 | - * |
|
777 | - * This method does a lot of work. It parses an attribute list into an array |
|
778 | - * with attribute data, and tries to do the right thing even if it gets weird |
|
779 | - * input. It will add quotes around attribute values that don't have any quotes |
|
780 | - * or apostrophes around them, to make it easier to produce HTML code that will |
|
781 | - * conform to W3C's HTML specification. It will also remove bad URL protocols |
|
782 | - * from attribute values. |
|
783 | - * |
|
784 | - * @access private |
|
785 | - * @param string $attr Text containing tag attributes for parsing |
|
786 | - * @return array Associative array containing data on attribute and value |
|
787 | - * @since PHP4 OOP 0.0.1 |
|
788 | - */ |
|
789 | - function _hair($attr) |
|
790 | - { |
|
791 | - $attrarr = array(); |
|
792 | - $mode = 0; |
|
793 | - $attrname = ''; |
|
794 | - |
|
795 | - # Loop through the whole attribute list |
|
796 | - |
|
797 | - while (strlen($attr) != 0) |
|
798 | - { |
|
799 | - # Was the last operation successful? |
|
800 | - $working = 0; |
|
801 | - |
|
802 | - switch ($mode) |
|
803 | - { |
|
804 | - case 0: # attribute name, href for instance |
|
805 | - if (preg_match('/^([-a-zA-Z]+)/', $attr, $match)) |
|
806 | - { |
|
807 | - $attrname = $match[1]; |
|
808 | - $working = $mode = 1; |
|
809 | - $attr = preg_replace('/^[-a-zA-Z]+/', '', $attr); |
|
810 | - } |
|
811 | - break; |
|
812 | - case 1: # equals sign or valueless ("selected") |
|
813 | - if (preg_match('/^\s*=\s*/', $attr)) # equals sign |
|
814 | - { |
|
815 | - $working = 1; |
|
816 | - $mode = 2; |
|
817 | - $attr = preg_replace('/^\s*=\s*/', '', $attr); |
|
818 | - break; |
|
819 | - } |
|
820 | - if (preg_match('/^\s+/', $attr)) # valueless |
|
821 | - { |
|
822 | - $working = 1; |
|
823 | - $mode = 0; |
|
824 | - $attrarr[] = array( |
|
825 | - 'name' => $attrname, |
|
826 | - 'value' => '', |
|
827 | - 'whole' => $attrname, |
|
828 | - 'vless' => 'y' |
|
829 | - ); |
|
830 | - $attr = preg_replace('/^\s+/', '', $attr); |
|
831 | - } |
|
832 | - break; |
|
833 | - case 2: # attribute value, a URL after href= for instance |
|
834 | - if (preg_match('/^"([^"]*)"(\s+|$)/', $attr, $match)) # "value" |
|
835 | - { |
|
836 | - $thisval = $this->_bad_protocol($match[1]); |
|
837 | - $attrarr[] = array( |
|
838 | - 'name' => $attrname, |
|
839 | - 'value' => $thisval, |
|
840 | - 'whole' => "$attrname=\"$thisval\"", |
|
841 | - 'vless' => 'n' |
|
842 | - ); |
|
843 | - $working = 1; |
|
844 | - $mode = 0; |
|
845 | - $attr = preg_replace('/^"[^"]*"(\s+|$)/', '', $attr); |
|
846 | - break; |
|
847 | - } |
|
848 | - if (preg_match("/^'([^']*)'(\s+|$)/", $attr, $match)) # 'value' |
|
849 | - { |
|
850 | - $thisval = $this->_bad_protocol($match[1]); |
|
851 | - $attrarr[] = array( |
|
852 | - 'name' => $attrname, |
|
853 | - 'value' => $thisval, |
|
854 | - 'whole' => "$attrname='$thisval'", |
|
855 | - 'vless' => 'n' |
|
856 | - ); |
|
857 | - $working = 1; |
|
858 | - $mode = 0; |
|
859 | - $attr = preg_replace("/^'[^']*'(\s+|$)/", '', $attr); |
|
860 | - break; |
|
861 | - } |
|
862 | - if (preg_match("%^([^\s\"']+)(\s+|$)%", $attr, $match)) # value |
|
863 | - { |
|
864 | - $thisval = $this->_bad_protocol($match[1]); |
|
865 | - $attrarr[] = array( |
|
866 | - 'name' => $attrname, |
|
867 | - 'value' => $thisval, |
|
868 | - 'whole' => "$attrname=\"$thisval\"", |
|
869 | - 'vless' => 'n' |
|
870 | - ); |
|
871 | - # We add quotes to conform to W3C's HTML spec. |
|
872 | - $working = 1; |
|
873 | - $mode = 0; |
|
874 | - $attr = preg_replace("%^[^\s\"']+(\s+|$)%", '', $attr); |
|
875 | - } |
|
876 | - break; |
|
877 | - } |
|
878 | - |
|
879 | - if ($working == 0) # not well formed, remove and try again |
|
880 | - { |
|
881 | - $attr = $this->_html_error($attr); |
|
882 | - $mode = 0; |
|
883 | - } |
|
884 | - } |
|
885 | - |
|
886 | - # special case, for when the attribute list ends with a valueless |
|
887 | - # attribute like "selected" |
|
888 | - if ($mode == 1) |
|
889 | - { |
|
890 | - $attrarr[] = array( |
|
891 | - 'name' => $attrname, |
|
892 | - 'value' => '', |
|
893 | - 'whole' => $attrname, |
|
894 | - 'vless' => 'y' |
|
895 | - ); |
|
896 | - } |
|
897 | - |
|
898 | - return $attrarr; |
|
899 | - } |
|
900 | - |
|
901 | - /** |
|
902 | - * This method removes disallowed protocols. |
|
903 | - * |
|
904 | - * This method removes all non-allowed protocols from the beginning of |
|
905 | - * $string. It ignores whitespace and the case of the letters, and it does |
|
906 | - * understand HTML entities. It does its work in a while loop, so it won't be |
|
907 | - * fooled by a string like "javascript:javascript:alert(57)". |
|
908 | - * |
|
909 | - * @access private |
|
910 | - * @param string $string String to check for protocols |
|
911 | - * @return string String with removed protocols |
|
912 | - * @since PHP4 OOP 0.0.1 |
|
913 | - */ |
|
914 | - function _bad_protocol($string) |
|
915 | - { |
|
916 | - $string = $this->_no_null($string); |
|
917 | - $string = preg_replace('/\xad+/', '', $string); # deals with Opera "feature" |
|
918 | - $string2 = $string.'a'; |
|
919 | - |
|
920 | - while ($string != $string2) |
|
921 | - { |
|
922 | - $string2 = $string; |
|
923 | - $string = $this->_bad_protocol_once($string); |
|
924 | - } # while |
|
925 | - |
|
926 | - return $string; |
|
927 | - } |
|
928 | - |
|
929 | - /** |
|
930 | - * Helper method used by _bad_protocol() |
|
931 | - * |
|
932 | - * This function searches for URL protocols at the beginning of $string, while |
|
933 | - * handling whitespace and HTML entities. |
|
934 | - * Function updated to fix security vulnerability (see http://projects.dokeos.com/index.php?do=details&task_id=2312) |
|
935 | - * |
|
936 | - * @access private |
|
937 | - * @param string $string String to check for protocols |
|
938 | - * @return string String with removed protocols |
|
939 | - * @see _bad_protocol() |
|
940 | - * @since PHP4 OOP 0.0.1 |
|
941 | - */ |
|
942 | - function _bad_protocol_once($string) |
|
943 | - { |
|
944 | - $string2 = preg_split('/:|:|:/i', $string, 2); |
|
945 | - if(isset($string2[1]) && !preg_match('%/\?%',$string2[0])) |
|
946 | - { |
|
947 | - $string = $this->_bad_protocol_once2($string2[0]).trim($string2[1]); |
|
948 | - } |
|
949 | - return $string; |
|
950 | - } |
|
951 | - /** |
|
952 | - * Helper method used by _bad_protocol_once() regex |
|
953 | - * |
|
954 | - * This function processes URL protocols, checks to see if they're in the white- |
|
955 | - * list or not, and returns different data depending on the answer. |
|
956 | - * |
|
957 | - * @access private |
|
958 | - * @param string $string String to check for protocols |
|
959 | - * @return string String with removed protocols |
|
960 | - * @see _bad_protocol() |
|
961 | - * @see _bad_protocol_once() |
|
962 | - * @since PHP4 OOP 0.0.1 |
|
963 | - */ |
|
964 | - function _bad_protocol_once2($string) |
|
965 | - { |
|
966 | - $string = $this->_decode_entities($string); |
|
967 | - $string = preg_replace('/\s/', '', $string); |
|
968 | - $string = $this->_no_null($string); |
|
969 | - $string = preg_replace('/\xad+/', '', $string); # deals with Opera "feature" |
|
970 | - $string = strtolower($string); |
|
971 | - |
|
972 | - $allowed = false; |
|
973 | - if(is_array($this->allowed_protocols) && count($this->allowed_protocols) > 0) |
|
974 | - { |
|
975 | - foreach ($this->allowed_protocols as $one_protocol) |
|
976 | - { |
|
977 | - if (strtolower($one_protocol) == $string) |
|
978 | - { |
|
979 | - $allowed = true; |
|
980 | - break; |
|
981 | - } |
|
982 | - } |
|
983 | - } |
|
984 | - |
|
985 | - if ($allowed) |
|
986 | - { |
|
987 | - return "$string:"; |
|
988 | - } |
|
989 | - else |
|
990 | - { |
|
991 | - return ''; |
|
992 | - } |
|
993 | - } |
|
994 | - |
|
995 | - /** |
|
996 | - * This function performs different checks for attribute values. |
|
997 | - * |
|
998 | - * The currently implemented checks are "maxlen", "minlen", "maxval", |
|
999 | - * "minval" and "valueless" with even more checks to come soon. |
|
1000 | - * |
|
1001 | - * @access private |
|
1002 | - * @param string $value The value of the attribute to be checked. |
|
1003 | - * @param string $vless Indicates whether the the value is supposed to be valueless |
|
1004 | - * @param string $checkname The check to be performed |
|
1005 | - * @param string $checkvalue The value that is to be checked against |
|
1006 | - * @return bool Indicates whether the check passed or not |
|
1007 | - * @since PHP4 OOP 0.0.1 |
|
1008 | - */ |
|
1009 | - function _check_attr_val($value, $vless, $checkname, $checkvalue) |
|
1010 | - { |
|
1011 | - $ok = true; |
|
1012 | - |
|
1013 | - switch (strtolower($checkname)) |
|
1014 | - { |
|
1015 | - /** |
|
1016 | - * The maxlen check makes sure that the attribute value has a length not |
|
1017 | - * greater than the given value. This can be used to avoid Buffer Overflows |
|
1018 | - * in WWW clients and various Internet servers. |
|
1019 | - */ |
|
1020 | - case 'maxlen': |
|
1021 | - if (strlen($value) > $checkvalue) |
|
1022 | - { |
|
1023 | - $ok = false; |
|
1024 | - } |
|
1025 | - break; |
|
1026 | - |
|
1027 | - /** |
|
1028 | - * The minlen check makes sure that the attribute value has a length not |
|
1029 | - * smaller than the given value. |
|
1030 | - */ |
|
1031 | - case 'minlen': |
|
1032 | - if (strlen($value) < $checkvalue) |
|
1033 | - { |
|
1034 | - $ok = false; |
|
1035 | - } |
|
1036 | - break; |
|
1037 | - |
|
1038 | - /** |
|
1039 | - * The maxval check does two things: it checks that the attribute value is |
|
1040 | - * an integer from 0 and up, without an excessive amount of zeroes or |
|
1041 | - * whitespace (to avoid Buffer Overflows). It also checks that the attribute |
|
1042 | - * value is not greater than the given value. |
|
1043 | - * This check can be used to avoid Denial of Service attacks. |
|
1044 | - */ |
|
1045 | - case 'maxval': |
|
1046 | - if (!preg_match('/^\s{0,6}[0-9]{1,6}\s{0,6}$/', $value)) |
|
1047 | - { |
|
1048 | - $ok = false; |
|
1049 | - } |
|
1050 | - if ($value > $checkvalue) |
|
1051 | - { |
|
1052 | - $ok = false; |
|
1053 | - } |
|
1054 | - break; |
|
1055 | - |
|
1056 | - /** |
|
1057 | - * The minval check checks that the attribute value is a positive integer, |
|
1058 | - * and that it is not smaller than the given value. |
|
1059 | - */ |
|
1060 | - case 'minval': |
|
1061 | - if (!preg_match('/^\s{0,6}[0-9]{1,6}\s{0,6}$/', $value)) |
|
1062 | - { |
|
1063 | - $ok = false; |
|
1064 | - } |
|
1065 | - if ($value < $checkvalue) |
|
1066 | - { |
|
1067 | - $ok = false; |
|
1068 | - } |
|
1069 | - break; |
|
1070 | - |
|
1071 | - /** |
|
1072 | - * The valueless check checks if the attribute has a value |
|
1073 | - * (like <a href="blah">) or not (<option selected>). If the given value |
|
1074 | - * is a "y" or a "Y", the attribute must not have a value. |
|
1075 | - * If the given value is an "n" or an "N", the attribute must have one. |
|
1076 | - */ |
|
1077 | - case 'valueless': |
|
1078 | - if (strtolower($checkvalue) != $vless) |
|
1079 | - { |
|
1080 | - $ok = false; |
|
1081 | - } |
|
1082 | - break; |
|
1083 | - |
|
1084 | - } |
|
1085 | - |
|
1086 | - return $ok; |
|
1087 | - } |
|
1088 | - |
|
1089 | - /** |
|
1090 | - * Changes \" to " |
|
1091 | - * |
|
1092 | - * This function changes the character sequence \" to just " |
|
1093 | - * It leaves all other slashes alone. It's really weird, but the quoting from |
|
1094 | - * preg_replace(//e) seems to require this. |
|
1095 | - * |
|
1096 | - * @access private |
|
1097 | - * @param string $string The string to be stripped. |
|
1098 | - * @return string string stripped of \" |
|
1099 | - * @since PHP4 OOP 0.0.1 |
|
1100 | - */ |
|
1101 | - function _stripslashes($string) |
|
1102 | - { |
|
1103 | - return preg_replace('%\\\\"%', '"', $string); |
|
1104 | - } |
|
1105 | - |
|
1106 | - /** |
|
1107 | - * helper method for _hair() |
|
1108 | - * |
|
1109 | - * This function deals with parsing errors in _hair(). The general plan is |
|
1110 | - * to remove everything to and including some whitespace, but it deals with |
|
1111 | - * quotes and apostrophes as well. |
|
1112 | - * |
|
1113 | - * @access private |
|
1114 | - * @param string $string The string to be stripped. |
|
1115 | - * @return string string stripped of whitespace |
|
1116 | - * @see _hair() |
|
1117 | - * @since PHP4 OOP 0.0.1 |
|
1118 | - */ |
|
1119 | - function _html_error($string) |
|
1120 | - { |
|
1121 | - return preg_replace('/^("[^"]*("|$)|\'[^\']*(\'|$)|\S)*\s*/', '', $string); |
|
1122 | - } |
|
1123 | - |
|
1124 | - /** |
|
1125 | - * Decodes numeric HTML entities |
|
1126 | - * |
|
1127 | - * This method decodes numeric HTML entities (A and A). It doesn't |
|
1128 | - * do anything with other entities like ä, but we don't need them in the |
|
1129 | - * URL protocol white listing system anyway. |
|
1130 | - * |
|
1131 | - * @access private |
|
1132 | - * @param string $value The entitiy to be decoded. |
|
1133 | - * @return string Decoded entity |
|
1134 | - * @since PHP4 OOP 0.0.1 |
|
1135 | - */ |
|
1136 | - function _decode_entities($string) |
|
1137 | - { |
|
1138 | - $string = preg_replace('/&#([0-9]+);/e', 'chr("\\1")', $string); |
|
1139 | - $string = preg_replace('/&#[Xx]([0-9A-Fa-f]+);/e', 'chr(hexdec("\\1"))', $string); |
|
1140 | - return $string; |
|
1141 | - } |
|
1142 | - |
|
1143 | - /** |
|
1144 | - * Returns PHP4 OOP version # of kses. |
|
1145 | - * |
|
1146 | - * Since this class has been refactored and documented and proven to work, |
|
1147 | - * I'm syncing the version number to procedural kses. |
|
1148 | - * |
|
1149 | - * @access public |
|
1150 | - * @return string Version number |
|
1151 | - * @since PHP4 OOP 0.0.1 |
|
1152 | - */ |
|
1153 | - function _version() |
|
1154 | - { |
|
1155 | - return 'PHP4 0.2.2 (OOP fork of procedural kses 0.2.2)'; |
|
1156 | - } |
|
1157 | - } |
|
1158 | - |
|
1159 | - |
|
1160 | - |
|
1161 | - } |
|
88 | + var $allowed_protocols = array(); |
|
89 | + var $allowed_html = array(); |
|
90 | + /**#@-*/ |
|
91 | + |
|
92 | + /** |
|
93 | + * Constructor for kses. |
|
94 | + * |
|
95 | + * This sets a default collection of protocols allowed in links, and creates an |
|
96 | + * empty set of allowed HTML tags. |
|
97 | + * @since PHP4 OOP 0.0.1 |
|
98 | + */ |
|
99 | + function kses4() |
|
100 | + { |
|
101 | + /** |
|
102 | + * You could add protocols such as ftp, new, gopher, mailto, irc, etc. |
|
103 | + * |
|
104 | + * The base values the original kses provided were: |
|
105 | + * 'http', 'https', 'ftp', 'news', 'nntp', 'telnet', 'gopher', 'mailto' |
|
106 | + */ |
|
107 | + $this->allowed_protocols = array('http', 'ftp', 'mailto'); |
|
108 | + $this->allowed_html = array(); |
|
109 | + } |
|
110 | + |
|
111 | + /** |
|
112 | + * Basic task of kses - parses $string and strips it as required. |
|
113 | + * |
|
114 | + * This method strips all the disallowed (X)HTML tags, attributes |
|
115 | + * and protocols from the input $string. |
|
116 | + * |
|
117 | + * @access public |
|
118 | + * @param string $string String to be stripped of 'evil scripts' |
|
119 | + * @return string The stripped string |
|
120 | + * @since PHP4 OOP 0.2.1 |
|
121 | + */ |
|
122 | + function Parse($string = "") |
|
123 | + { |
|
124 | + if (get_magic_quotes_gpc()) |
|
125 | + { |
|
126 | + $string = stripslashes($string); |
|
127 | + } |
|
128 | + $string = $this->_no_null($string); |
|
129 | + $string = $this->_js_entities($string); |
|
130 | + $string = $this->_normalize_entities($string); |
|
131 | + $string = $this->filterKsesTextHook($string); |
|
132 | + return $this->_split($string); |
|
133 | + } |
|
134 | + |
|
135 | + /** |
|
136 | + * Allows for single/batch addition of protocols |
|
137 | + * |
|
138 | + * This method accepts one argument that can be either a string |
|
139 | + * or an array of strings. Invalid data will be ignored. |
|
140 | + * |
|
141 | + * The argument will be processed, and each string will be added |
|
142 | + * via AddProtocol(). |
|
143 | + * |
|
144 | + * @access public |
|
145 | + * @param mixed , A string or array of protocols that will be added to the internal list of allowed protocols. |
|
146 | + * @return bool Status of adding valid protocols. |
|
147 | + * @see AddProtocol() |
|
148 | + * @since PHP4 OOP 0.2.1 |
|
149 | + */ |
|
150 | + function AddProtocols() |
|
151 | + { |
|
152 | + $c_args = func_num_args(); |
|
153 | + if($c_args != 1) |
|
154 | + { |
|
155 | + trigger_error("kses4::AddProtocols() did not receive an argument.", E_USER_WARNING); |
|
156 | + return false; |
|
157 | + } |
|
158 | + |
|
159 | + $protocol_data = func_get_arg(0); |
|
160 | + |
|
161 | + if(is_array($protocol_data) && count($protocol_data) > 0) |
|
162 | + { |
|
163 | + foreach($protocol_data as $protocol) |
|
164 | + { |
|
165 | + $this->AddProtocol($protocol); |
|
166 | + } |
|
167 | + return true; |
|
168 | + } |
|
169 | + elseif(is_string($protocol_data)) |
|
170 | + { |
|
171 | + $this->AddProtocol($protocol_data); |
|
172 | + return true; |
|
173 | + } |
|
174 | + else |
|
175 | + { |
|
176 | + trigger_error("kses4::AddProtocols() did not receive a string or an array.", E_USER_WARNING); |
|
177 | + return false; |
|
178 | + } |
|
179 | + } |
|
180 | + |
|
181 | + /** |
|
182 | + * Allows for single/batch addition of protocols |
|
183 | + * |
|
184 | + * @deprecated Use AddProtocols() |
|
185 | + * @see AddProtocols() |
|
186 | + * @return bool |
|
187 | + * @since PHP4 OOP 0.0.1 |
|
188 | + */ |
|
189 | + function Protocols() |
|
190 | + { |
|
191 | + $c_args = func_num_args(); |
|
192 | + if($c_args != 1) |
|
193 | + { |
|
194 | + trigger_error("kses4::Protocols() did not receive an argument.", E_USER_WARNING); |
|
195 | + return false; |
|
196 | + } |
|
197 | + |
|
198 | + return $this->AddProtocols(func_get_arg(0)); |
|
199 | + } |
|
200 | + |
|
201 | + /** |
|
202 | + * Adds a single protocol to $this->allowed_protocols. |
|
203 | + * |
|
204 | + * This method accepts a string argument and adds it to |
|
205 | + * the list of allowed protocols to keep when performing |
|
206 | + * Parse(). |
|
207 | + * |
|
208 | + * @access public |
|
209 | + * @param string $protocol The name of the protocol to be added. |
|
210 | + * @return bool Status of adding valid protocol. |
|
211 | + * @since PHP4 OOP 0.0.1 |
|
212 | + */ |
|
213 | + function AddProtocol($protocol = "") |
|
214 | + { |
|
215 | + if(!is_string($protocol)) |
|
216 | + { |
|
217 | + trigger_error("kses4::AddProtocol() requires a string.", E_USER_WARNING); |
|
218 | + return false; |
|
219 | + } |
|
220 | + |
|
221 | + $protocol = strtolower(trim($protocol)); |
|
222 | + if($protocol == "") |
|
223 | + { |
|
224 | + trigger_error("kses4::AddProtocol() tried to add an empty/NULL protocol.", E_USER_WARNING); |
|
225 | + return false; |
|
226 | + } |
|
227 | + |
|
228 | + // Remove any inadvertent ':' at the end of the protocol. |
|
229 | + if(substr($protocol, strlen($protocol) - 1, 1) == ":") |
|
230 | + { |
|
231 | + $protocol = substr($protocol, 0, strlen($protocol) - 1); |
|
232 | + } |
|
233 | + |
|
234 | + if(!in_array($protocol, $this->allowed_protocols)) |
|
235 | + { |
|
236 | + array_push($this->allowed_protocols, $protocol); |
|
237 | + sort($this->allowed_protocols); |
|
238 | + } |
|
239 | + return true; |
|
240 | + } |
|
241 | + |
|
242 | + /** |
|
243 | + * Allows for single/batch replacement of protocols |
|
244 | + * |
|
245 | + * This method accepts one argument that can be either a string |
|
246 | + * or an array of strings. Invalid data will be ignored. |
|
247 | + * |
|
248 | + * Existing protocols will be removed, then the argument will be |
|
249 | + * processed, and each string will be added via AddProtocol(). |
|
250 | + * |
|
251 | + * @access public |
|
252 | + * @param mixed , A string or array of protocols that will be the new internal list of allowed protocols. |
|
253 | + * @return bool Status of replacing valid protocols. |
|
254 | + * @since PHP4 OOP 0.2.2 |
|
255 | + * @see AddProtocol() |
|
256 | + */ |
|
257 | + function SetProtocols() |
|
258 | + { |
|
259 | + $c_args = func_num_args(); |
|
260 | + if($c_args != 1) |
|
261 | + { |
|
262 | + trigger_error("kses4::SetProtocols() did not receive an argument.", E_USER_WARNING); |
|
263 | + return false; |
|
264 | + } |
|
265 | + |
|
266 | + $protocol_data = func_get_arg(0); |
|
267 | + |
|
268 | + if(is_array($protocol_data) && count($protocol_data) > 0) |
|
269 | + { |
|
270 | + $this->allowed_protocols = array(); |
|
271 | + foreach($protocol_data as $protocol) |
|
272 | + { |
|
273 | + $this->AddProtocol($protocol); |
|
274 | + } |
|
275 | + return true; |
|
276 | + } |
|
277 | + elseif(is_string($protocol_data)) |
|
278 | + { |
|
279 | + $this->allowed_protocols = array(); |
|
280 | + $this->AddProtocol($protocol_data); |
|
281 | + return true; |
|
282 | + } |
|
283 | + else |
|
284 | + { |
|
285 | + trigger_error("kses4::SetProtocols() did not receive a string or an array.", E_USER_WARNING); |
|
286 | + return false; |
|
287 | + } |
|
288 | + } |
|
289 | + |
|
290 | + /** |
|
291 | + * Raw dump of allowed protocols |
|
292 | + * |
|
293 | + * This returns an indexed array of allowed protocols for a particular KSES |
|
294 | + * instantiation. |
|
295 | + * |
|
296 | + * @access public |
|
297 | + * @return array The list of allowed protocols. |
|
298 | + * @since PHP4 OOP 0.2.2 |
|
299 | + */ |
|
300 | + function DumpProtocols() |
|
301 | + { |
|
302 | + return $this->allowed_protocols; |
|
303 | + } |
|
304 | + |
|
305 | + /** |
|
306 | + * Raw dump of allowed (X)HTML elements |
|
307 | + * |
|
308 | + * This returns an indexed array of allowed (X)HTML elements and attributes |
|
309 | + * for a particular KSES instantiation. |
|
310 | + * |
|
311 | + * @access public |
|
312 | + * @return array The list of allowed elements. |
|
313 | + * @since PHP4 OOP 0.2.2 |
|
314 | + */ |
|
315 | + function DumpElements() |
|
316 | + { |
|
317 | + return $this->allowed_html; |
|
318 | + } |
|
319 | + |
|
320 | + /** |
|
321 | + * Adds valid (X)HTML with corresponding attributes that will be kept when stripping 'evil scripts'. |
|
322 | + * |
|
323 | + * This method accepts one argument that can be either a string |
|
324 | + * or an array of strings. Invalid data will be ignored. |
|
325 | + * |
|
326 | + * @access public |
|
327 | + * @param string $tag (X)HTML tag that will be allowed after stripping text. |
|
328 | + * @param array $attribs Associative array of allowed attributes - key => attribute name - value => attribute parameter |
|
329 | + * @return bool Status of Adding (X)HTML and attributes. |
|
330 | + * @since PHP4 OOP 0.0.1 |
|
331 | + */ |
|
332 | + function AddHTML($tag = "", $attribs = array()) |
|
333 | + { |
|
334 | + if(!is_string($tag)) |
|
335 | + { |
|
336 | + trigger_error("kses4::AddHTML() requires the tag to be a string", E_USER_WARNING); |
|
337 | + return false; |
|
338 | + } |
|
339 | + |
|
340 | + $tag = strtolower(trim($tag)); |
|
341 | + if($tag == "") |
|
342 | + { |
|
343 | + trigger_error("kses4::AddHTML() tried to add an empty/NULL tag", E_USER_WARNING); |
|
344 | + return false; |
|
345 | + } |
|
346 | + |
|
347 | + if(!is_array($attribs)) |
|
348 | + { |
|
349 | + trigger_error("kses4::AddHTML() requires an array (even an empty one) of attributes for '$tag'", E_USER_WARNING); |
|
350 | + return false; |
|
351 | + } |
|
352 | + |
|
353 | + $new_attribs = array(); |
|
354 | + if(is_array($attribs) && count($attribs) > 0) |
|
355 | + { |
|
356 | + foreach($attribs as $idx1 => $val1) |
|
357 | + { |
|
358 | + $new_idx1 = strtolower($idx1); |
|
359 | + $new_val1 = $attribs[$idx1]; |
|
360 | + |
|
361 | + if(is_array($new_val1) && count($new_val1) > 0) |
|
362 | + { |
|
363 | + $tmp_val = array(); |
|
364 | + foreach($new_val1 as $idx2 => $val2) |
|
365 | + { |
|
366 | + $new_idx2 = strtolower($idx2); |
|
367 | + $tmp_val[$new_idx2] = $val2; |
|
368 | + } |
|
369 | + $new_val1 = $tmp_val; |
|
370 | + } |
|
371 | + |
|
372 | + $new_attribs[$new_idx1] = $new_val1; |
|
373 | + } |
|
374 | + } |
|
375 | + |
|
376 | + $this->allowed_html[$tag] = $new_attribs; |
|
377 | + return true; |
|
378 | + } |
|
379 | + |
|
380 | + /** |
|
381 | + * Removes a single protocol from $this->allowed_protocols. |
|
382 | + * |
|
383 | + * This method accepts a string argument and removes it from |
|
384 | + * the list of allowed protocols to keep when performing |
|
385 | + * Parse(). |
|
386 | + * |
|
387 | + * @access public |
|
388 | + * @param string $protocol The name of the protocol to be removed. |
|
389 | + * @return bool Status of removing valid protocol. |
|
390 | + * @since PHP4 OOP 0.2.1 |
|
391 | + */ |
|
392 | + function RemoveProtocol($protocol = "") |
|
393 | + { |
|
394 | + if(!is_string($protocol)) |
|
395 | + { |
|
396 | + trigger_error("kses4::RemoveProtocol() requires a string.", E_USER_WARNING); |
|
397 | + return false; |
|
398 | + } |
|
399 | + |
|
400 | + // Remove any inadvertent ':' at the end of the protocol. |
|
401 | + if(substr($protocol, strlen($protocol) - 1, 1) == ":") |
|
402 | + { |
|
403 | + $protocol = substr($protocol, 0, strlen($protocol) - 1); |
|
404 | + } |
|
405 | + |
|
406 | + $protocol = strtolower(trim($protocol)); |
|
407 | + if($protocol == "") |
|
408 | + { |
|
409 | + trigger_error("kses4::RemoveProtocol() tried to remove an empty/NULL protocol.", E_USER_WARNING); |
|
410 | + return false; |
|
411 | + } |
|
412 | + |
|
413 | + // Ensures that the protocol exists before removing it. |
|
414 | + if(in_array($protocol, $this->allowed_protocols)) |
|
415 | + { |
|
416 | + $this->allowed_protocols = array_diff($this->allowed_protocols, array($protocol)); |
|
417 | + sort($this->allowed_protocols); |
|
418 | + } |
|
419 | + |
|
420 | + return true; |
|
421 | + } |
|
422 | + |
|
423 | + /** |
|
424 | + * Allows for single/batch removal of protocols |
|
425 | + * |
|
426 | + * This method accepts one argument that can be either a string |
|
427 | + * or an array of strings. Invalid data will be ignored. |
|
428 | + * |
|
429 | + * The argument will be processed, and each string will be removed |
|
430 | + * via RemoveProtocol(). |
|
431 | + * |
|
432 | + * @access public |
|
433 | + * @param mixed , A string or array of protocols that will be removed from the internal list of allowed protocols. |
|
434 | + * @return bool Status of removing valid protocols. |
|
435 | + * @see RemoveProtocol() |
|
436 | + * @since PHP5 OOP 0.2.1 |
|
437 | + */ |
|
438 | + function RemoveProtocols() |
|
439 | + { |
|
440 | + $c_args = func_num_args(); |
|
441 | + if($c_args != 1) |
|
442 | + { |
|
443 | + return false; |
|
444 | + } |
|
445 | + |
|
446 | + $protocol_data = func_get_arg(0); |
|
447 | + |
|
448 | + if(is_array($protocol_data) && count($protocol_data) > 0) |
|
449 | + { |
|
450 | + foreach($protocol_data as $protocol) |
|
451 | + { |
|
452 | + $this->RemoveProtocol($protocol); |
|
453 | + } |
|
454 | + } |
|
455 | + elseif(is_string($protocol_data)) |
|
456 | + { |
|
457 | + $this->RemoveProtocol($protocol_data); |
|
458 | + return true; |
|
459 | + } |
|
460 | + else |
|
461 | + { |
|
462 | + trigger_error("kses4::RemoveProtocols() did not receive a string or an array.", E_USER_WARNING); |
|
463 | + return false; |
|
464 | + } |
|
465 | + } |
|
466 | + |
|
467 | + /** |
|
468 | + * This method removes any NULL or characters in $string. |
|
469 | + * |
|
470 | + * @access private |
|
471 | + * @param string $string |
|
472 | + * @return string String without any NULL/chr(173) |
|
473 | + * @since PHP4 OOP 0.0.1 |
|
474 | + */ |
|
475 | + function _no_null($string) |
|
476 | + { |
|
477 | + $string = preg_replace('/\0+/', '', $string); |
|
478 | + $string = preg_replace('/(\\\\0)+/', '', $string); |
|
479 | + return $string; |
|
480 | + } |
|
481 | + |
|
482 | + /** |
|
483 | + * This function removes the HTML JavaScript entities found in early versions of |
|
484 | + * Netscape 4. |
|
485 | + * |
|
486 | + * @access private |
|
487 | + * @param string $string |
|
488 | + * @return string String without any NULL/chr(173) |
|
489 | + * @since PHP4 OOP 0.0.1 |
|
490 | + */ |
|
491 | + function _js_entities($string) |
|
492 | + { |
|
493 | + return preg_replace('%&\s*\{[^}]*(\}\s*;?|$)%', '', $string); |
|
494 | + } |
|
495 | + |
|
496 | + /** |
|
497 | + * Normalizes HTML entities |
|
498 | + * |
|
499 | + * This function normalizes HTML entities. It will convert "AT&T" to the correct |
|
500 | + * "AT&T", ":" to ":", "&#XYZZY;" to "&#XYZZY;" and so on. |
|
501 | + * |
|
502 | + * @access private |
|
503 | + * @param string $string |
|
504 | + * @return string String with normalized entities |
|
505 | + * @since PHP4 OOP 0.0.1 |
|
506 | + */ |
|
507 | + function _normalize_entities($string) |
|
508 | + { |
|
509 | + # Disarm all entities by converting & to & |
|
510 | + $string = str_replace('&', '&', $string); |
|
511 | + |
|
512 | + # Change back the allowed entities in our entity white list |
|
513 | + |
|
514 | + $string = preg_replace('/&([A-Za-z][A-Za-z0-9]{0,19});/', '&\\1;', $string); |
|
515 | + $string = preg_replace('/&#0*([0-9]{1,5});/e', '\$this->_normalize_entities2("\\1")', $string); |
|
516 | + $string = preg_replace('/&#([Xx])0*(([0-9A-Fa-f]{2}){1,2});/', '&#\\1\\2;', $string); |
|
517 | + |
|
518 | + return $string; |
|
519 | + } |
|
520 | + |
|
521 | + /** |
|
522 | + * Helper method used by normalizeEntites() |
|
523 | + * |
|
524 | + * This method helps normalizeEntities() to only accept 16 bit values |
|
525 | + * and nothing more for &#number; entities. |
|
526 | + * |
|
527 | + * This method helps normalize_entities() during a preg_replace() |
|
528 | + * where a &#(0)*XXXXX; occurs. The '(0)*XXXXXX' value is converted to |
|
529 | + * a number and the result is returned as a numeric entity if the number |
|
530 | + * is less than 65536. Otherwise, the value is returned 'as is'. |
|
531 | + * |
|
532 | + * @access private |
|
533 | + * @param string $i |
|
534 | + * @return string Normalized numeric entity |
|
535 | + * @see _normalize_entities() |
|
536 | + * @since PHP4 OOP 0.0.1 |
|
537 | + */ |
|
538 | + function _normalize_entities2($i) |
|
539 | + { |
|
540 | + return (($i > 65535) ? "&#$i;" : "&#$i;"); |
|
541 | + } |
|
542 | + |
|
543 | + /** |
|
544 | + * Allows for additional user defined modifications to text. |
|
545 | + * |
|
546 | + * @deprecated use filterKsesTextHook() |
|
547 | + * @param string $string |
|
548 | + * @see filterKsesTextHook() |
|
549 | + * @return string |
|
550 | + * @since PHP4 OOP 0.0.1 |
|
551 | + */ |
|
552 | + function _hook($string) |
|
553 | + { |
|
554 | + return $this->filterKsesTextHook($string); |
|
555 | + } |
|
556 | + |
|
557 | + /** |
|
558 | + * Allows for additional user defined modifications to text. |
|
559 | + * |
|
560 | + * This method allows for additional modifications to be performed on |
|
561 | + * a string that's being run through Parse(). Currently, it returns the |
|
562 | + * input string 'as is'. |
|
563 | + * |
|
564 | + * This method is provided for users to extend the kses class for their own |
|
565 | + * requirements. |
|
566 | + * |
|
567 | + * @access public |
|
568 | + * @param string $string String to perfrom additional modifications on. |
|
569 | + * @return string User modified string. |
|
570 | + * @see Parse() |
|
571 | + * @since PHP5 OOP 1.0.0 |
|
572 | + */ |
|
573 | + function filterKsesTextHook($string) |
|
574 | + { |
|
575 | + return $string; |
|
576 | + } |
|
577 | + |
|
578 | + /** |
|
579 | + * This method goes through an array, and changes the keys to all lower case. |
|
580 | + * |
|
581 | + * @access private |
|
582 | + * @param array $in_array Associative array |
|
583 | + * @return array Modified array |
|
584 | + * @since PHP4 OOP 0.0.1 |
|
585 | + */ |
|
586 | + function _array_lc($inarray) |
|
587 | + { |
|
588 | + $outarray = array(); |
|
589 | + |
|
590 | + if(is_array($inarray) && count($inarray) > 0) |
|
591 | + { |
|
592 | + foreach ($inarray as $inkey => $inval) |
|
593 | + { |
|
594 | + $outkey = strtolower($inkey); |
|
595 | + $outarray[$outkey] = array(); |
|
596 | + |
|
597 | + if(is_array($inval) && count($inval) > 0) |
|
598 | + { |
|
599 | + foreach ($inval as $inkey2 => $inval2) |
|
600 | + { |
|
601 | + $outkey2 = strtolower($inkey2); |
|
602 | + $outarray[$outkey][$outkey2] = $inval2; |
|
603 | + } |
|
604 | + } |
|
605 | + } |
|
606 | + } |
|
607 | + |
|
608 | + return $outarray; |
|
609 | + } |
|
610 | + |
|
611 | + /** |
|
612 | + * This method searched for HTML tags, no matter how malformed. It also |
|
613 | + * matches stray ">" characters. |
|
614 | + * |
|
615 | + * @access private |
|
616 | + * @param string $string |
|
617 | + * @return string HTML tags |
|
618 | + * @since PHP4 OOP 0.0.1 |
|
619 | + */ |
|
620 | + function _split($string) |
|
621 | + { |
|
622 | + return preg_replace( |
|
623 | + '%(<'. # EITHER: < |
|
624 | + '[^>]*'. # things that aren't > |
|
625 | + '(>|$)'. # > or end of string |
|
626 | + '|>)%e', # OR: just a > |
|
627 | + "\$this->_split2('\\1')", |
|
628 | + $string); |
|
629 | + } |
|
630 | + |
|
631 | + /** |
|
632 | + * This method strips out disallowed and/or mangled (X)HTML tags along with assigned attributes. |
|
633 | + * |
|
634 | + * This method does a lot of work. It rejects some very malformed things |
|
635 | + * like <:::>. It returns an empty string if the element isn't allowed (look |
|
636 | + * ma, no strip_tags()!). Otherwise it splits the tag into an element and an |
|
637 | + * allowed attribute list. |
|
638 | + * |
|
639 | + * @access private |
|
640 | + * @param string $string |
|
641 | + * @return string Modified string minus disallowed/mangled (X)HTML and attributes |
|
642 | + * @since PHP4 OOP 0.0.1 |
|
643 | + */ |
|
644 | + function _split2($string) |
|
645 | + { |
|
646 | + $string = $this->_stripslashes($string); |
|
647 | + |
|
648 | + if (substr($string, 0, 1) != '<') |
|
649 | + { |
|
650 | + # It matched a ">" character |
|
651 | + return '>'; |
|
652 | + } |
|
653 | + |
|
654 | + if (!preg_match('%^<\s*(/\s*)?([a-zA-Z0-9]+)([^>]*)>?$%', $string, $matches)) |
|
655 | + { |
|
656 | + # It's seriously malformed |
|
657 | + return ''; |
|
658 | + } |
|
659 | + |
|
660 | + $slash = trim($matches[1]); |
|
661 | + $elem = $matches[2]; |
|
662 | + $attrlist = $matches[3]; |
|
663 | + |
|
664 | + if ( |
|
665 | + !isset($this->allowed_html[strtolower($elem)]) || |
|
666 | + !is_array($this->allowed_html[strtolower($elem)]) |
|
667 | + ) |
|
668 | + { |
|
669 | + # They are using a not allowed HTML element |
|
670 | + return ''; |
|
671 | + } |
|
672 | + |
|
673 | + if ($slash != '') |
|
674 | + { |
|
675 | + return "<$slash$elem>"; |
|
676 | + } |
|
677 | + # No attributes are allowed for closing elements |
|
678 | + |
|
679 | + return $this->_attr("$slash$elem", $attrlist); |
|
680 | + } |
|
681 | + |
|
682 | + /** |
|
683 | + * This method strips out disallowed attributes for (X)HTML tags. |
|
684 | + * |
|
685 | + * This method removes all attributes if none are allowed for this element. |
|
686 | + * If some are allowed it calls $this->_hair() to split them further, and then it |
|
687 | + * builds up new HTML code from the data that $this->_hair() returns. It also |
|
688 | + * removes "<" and ">" characters, if there are any left. One more thing it |
|
689 | + * does is to check if the tag has a closing XHTML slash, and if it does, |
|
690 | + * it puts one in the returned code as well. |
|
691 | + * |
|
692 | + * @access private |
|
693 | + * @param string $element (X)HTML tag to check |
|
694 | + * @param string $attr Text containing attributes to check for validity. |
|
695 | + * @return string Resulting valid (X)HTML or '' |
|
696 | + * @see _hair() |
|
697 | + * @since PHP4 OOP 0.0.1 |
|
698 | + */ |
|
699 | + function _attr($element, $attr) |
|
700 | + { |
|
701 | + # Is there a closing XHTML slash at the end of the attributes? |
|
702 | + $xhtml_slash = ''; |
|
703 | + if (preg_match('%\s/\s*$%', $attr)) |
|
704 | + { |
|
705 | + $xhtml_slash = ' /'; |
|
706 | + } |
|
707 | + |
|
708 | + # Are any attributes allowed at all for this element? |
|
709 | + if ( |
|
710 | + !isset($this->allowed_html[strtolower($element)]) || |
|
711 | + count($this->allowed_html[strtolower($element)]) == 0 |
|
712 | + ) |
|
713 | + { |
|
714 | + return "<$element$xhtml_slash>"; |
|
715 | + } |
|
716 | + |
|
717 | + # Split it |
|
718 | + $attrarr = $this->_hair($attr); |
|
719 | + |
|
720 | + # Go through $attrarr, and save the allowed attributes for this element |
|
721 | + # in $attr2 |
|
722 | + $attr2 = ''; |
|
723 | + if(is_array($attrarr) && count($attrarr) > 0) |
|
724 | + { |
|
725 | + foreach ($attrarr as $arreach) |
|
726 | + { |
|
727 | + if(!isset($this->allowed_html[strtolower($element)][strtolower($arreach['name'])])) |
|
728 | + { |
|
729 | + continue; |
|
730 | + } |
|
731 | + |
|
732 | + $current = $this->allowed_html[strtolower($element)][strtolower($arreach['name'])]; |
|
733 | + if ($current == '') |
|
734 | + { |
|
735 | + # the attribute is not allowed |
|
736 | + continue; |
|
737 | + } |
|
738 | + |
|
739 | + if (!is_array($current)) |
|
740 | + { |
|
741 | + # there are no checks |
|
742 | + $attr2 .= ' '.$arreach['whole']; |
|
743 | + } |
|
744 | + else |
|
745 | + { |
|
746 | + # there are some checks |
|
747 | + $ok = true; |
|
748 | + if(is_array($current) && count($current) > 0) |
|
749 | + { |
|
750 | + foreach ($current as $currkey => $currval) |
|
751 | + { |
|
752 | + if (!$this->_check_attr_val($arreach['value'], $arreach['vless'], $currkey, $currval)) |
|
753 | + { |
|
754 | + $ok = false; |
|
755 | + break; |
|
756 | + } |
|
757 | + } |
|
758 | + |
|
759 | + if ($ok) |
|
760 | + { |
|
761 | + # it passed them |
|
762 | + $attr2 .= ' '.$arreach['whole']; |
|
763 | + } |
|
764 | + } |
|
765 | + } |
|
766 | + } |
|
767 | + } |
|
768 | + |
|
769 | + # Remove any "<" or ">" characters |
|
770 | + $attr2 = preg_replace('/[<>]/', '', $attr2); |
|
771 | + return "<$element$attr2$xhtml_slash>"; |
|
772 | + } |
|
773 | + |
|
774 | + /** |
|
775 | + * This method combs through an attribute list string and returns an associative array of attributes and values. |
|
776 | + * |
|
777 | + * This method does a lot of work. It parses an attribute list into an array |
|
778 | + * with attribute data, and tries to do the right thing even if it gets weird |
|
779 | + * input. It will add quotes around attribute values that don't have any quotes |
|
780 | + * or apostrophes around them, to make it easier to produce HTML code that will |
|
781 | + * conform to W3C's HTML specification. It will also remove bad URL protocols |
|
782 | + * from attribute values. |
|
783 | + * |
|
784 | + * @access private |
|
785 | + * @param string $attr Text containing tag attributes for parsing |
|
786 | + * @return array Associative array containing data on attribute and value |
|
787 | + * @since PHP4 OOP 0.0.1 |
|
788 | + */ |
|
789 | + function _hair($attr) |
|
790 | + { |
|
791 | + $attrarr = array(); |
|
792 | + $mode = 0; |
|
793 | + $attrname = ''; |
|
794 | + |
|
795 | + # Loop through the whole attribute list |
|
796 | + |
|
797 | + while (strlen($attr) != 0) |
|
798 | + { |
|
799 | + # Was the last operation successful? |
|
800 | + $working = 0; |
|
801 | + |
|
802 | + switch ($mode) |
|
803 | + { |
|
804 | + case 0: # attribute name, href for instance |
|
805 | + if (preg_match('/^([-a-zA-Z]+)/', $attr, $match)) |
|
806 | + { |
|
807 | + $attrname = $match[1]; |
|
808 | + $working = $mode = 1; |
|
809 | + $attr = preg_replace('/^[-a-zA-Z]+/', '', $attr); |
|
810 | + } |
|
811 | + break; |
|
812 | + case 1: # equals sign or valueless ("selected") |
|
813 | + if (preg_match('/^\s*=\s*/', $attr)) # equals sign |
|
814 | + { |
|
815 | + $working = 1; |
|
816 | + $mode = 2; |
|
817 | + $attr = preg_replace('/^\s*=\s*/', '', $attr); |
|
818 | + break; |
|
819 | + } |
|
820 | + if (preg_match('/^\s+/', $attr)) # valueless |
|
821 | + { |
|
822 | + $working = 1; |
|
823 | + $mode = 0; |
|
824 | + $attrarr[] = array( |
|
825 | + 'name' => $attrname, |
|
826 | + 'value' => '', |
|
827 | + 'whole' => $attrname, |
|
828 | + 'vless' => 'y' |
|
829 | + ); |
|
830 | + $attr = preg_replace('/^\s+/', '', $attr); |
|
831 | + } |
|
832 | + break; |
|
833 | + case 2: # attribute value, a URL after href= for instance |
|
834 | + if (preg_match('/^"([^"]*)"(\s+|$)/', $attr, $match)) # "value" |
|
835 | + { |
|
836 | + $thisval = $this->_bad_protocol($match[1]); |
|
837 | + $attrarr[] = array( |
|
838 | + 'name' => $attrname, |
|
839 | + 'value' => $thisval, |
|
840 | + 'whole' => "$attrname=\"$thisval\"", |
|
841 | + 'vless' => 'n' |
|
842 | + ); |
|
843 | + $working = 1; |
|
844 | + $mode = 0; |
|
845 | + $attr = preg_replace('/^"[^"]*"(\s+|$)/', '', $attr); |
|
846 | + break; |
|
847 | + } |
|
848 | + if (preg_match("/^'([^']*)'(\s+|$)/", $attr, $match)) # 'value' |
|
849 | + { |
|
850 | + $thisval = $this->_bad_protocol($match[1]); |
|
851 | + $attrarr[] = array( |
|
852 | + 'name' => $attrname, |
|
853 | + 'value' => $thisval, |
|
854 | + 'whole' => "$attrname='$thisval'", |
|
855 | + 'vless' => 'n' |
|
856 | + ); |
|
857 | + $working = 1; |
|
858 | + $mode = 0; |
|
859 | + $attr = preg_replace("/^'[^']*'(\s+|$)/", '', $attr); |
|
860 | + break; |
|
861 | + } |
|
862 | + if (preg_match("%^([^\s\"']+)(\s+|$)%", $attr, $match)) # value |
|
863 | + { |
|
864 | + $thisval = $this->_bad_protocol($match[1]); |
|
865 | + $attrarr[] = array( |
|
866 | + 'name' => $attrname, |
|
867 | + 'value' => $thisval, |
|
868 | + 'whole' => "$attrname=\"$thisval\"", |
|
869 | + 'vless' => 'n' |
|
870 | + ); |
|
871 | + # We add quotes to conform to W3C's HTML spec. |
|
872 | + $working = 1; |
|
873 | + $mode = 0; |
|
874 | + $attr = preg_replace("%^[^\s\"']+(\s+|$)%", '', $attr); |
|
875 | + } |
|
876 | + break; |
|
877 | + } |
|
878 | + |
|
879 | + if ($working == 0) # not well formed, remove and try again |
|
880 | + { |
|
881 | + $attr = $this->_html_error($attr); |
|
882 | + $mode = 0; |
|
883 | + } |
|
884 | + } |
|
885 | + |
|
886 | + # special case, for when the attribute list ends with a valueless |
|
887 | + # attribute like "selected" |
|
888 | + if ($mode == 1) |
|
889 | + { |
|
890 | + $attrarr[] = array( |
|
891 | + 'name' => $attrname, |
|
892 | + 'value' => '', |
|
893 | + 'whole' => $attrname, |
|
894 | + 'vless' => 'y' |
|
895 | + ); |
|
896 | + } |
|
897 | + |
|
898 | + return $attrarr; |
|
899 | + } |
|
900 | + |
|
901 | + /** |
|
902 | + * This method removes disallowed protocols. |
|
903 | + * |
|
904 | + * This method removes all non-allowed protocols from the beginning of |
|
905 | + * $string. It ignores whitespace and the case of the letters, and it does |
|
906 | + * understand HTML entities. It does its work in a while loop, so it won't be |
|
907 | + * fooled by a string like "javascript:javascript:alert(57)". |
|
908 | + * |
|
909 | + * @access private |
|
910 | + * @param string $string String to check for protocols |
|
911 | + * @return string String with removed protocols |
|
912 | + * @since PHP4 OOP 0.0.1 |
|
913 | + */ |
|
914 | + function _bad_protocol($string) |
|
915 | + { |
|
916 | + $string = $this->_no_null($string); |
|
917 | + $string = preg_replace('/\xad+/', '', $string); # deals with Opera "feature" |
|
918 | + $string2 = $string.'a'; |
|
919 | + |
|
920 | + while ($string != $string2) |
|
921 | + { |
|
922 | + $string2 = $string; |
|
923 | + $string = $this->_bad_protocol_once($string); |
|
924 | + } # while |
|
925 | + |
|
926 | + return $string; |
|
927 | + } |
|
928 | + |
|
929 | + /** |
|
930 | + * Helper method used by _bad_protocol() |
|
931 | + * |
|
932 | + * This function searches for URL protocols at the beginning of $string, while |
|
933 | + * handling whitespace and HTML entities. |
|
934 | + * Function updated to fix security vulnerability (see http://projects.dokeos.com/index.php?do=details&task_id=2312) |
|
935 | + * |
|
936 | + * @access private |
|
937 | + * @param string $string String to check for protocols |
|
938 | + * @return string String with removed protocols |
|
939 | + * @see _bad_protocol() |
|
940 | + * @since PHP4 OOP 0.0.1 |
|
941 | + */ |
|
942 | + function _bad_protocol_once($string) |
|
943 | + { |
|
944 | + $string2 = preg_split('/:|:|:/i', $string, 2); |
|
945 | + if(isset($string2[1]) && !preg_match('%/\?%',$string2[0])) |
|
946 | + { |
|
947 | + $string = $this->_bad_protocol_once2($string2[0]).trim($string2[1]); |
|
948 | + } |
|
949 | + return $string; |
|
950 | + } |
|
951 | + /** |
|
952 | + * Helper method used by _bad_protocol_once() regex |
|
953 | + * |
|
954 | + * This function processes URL protocols, checks to see if they're in the white- |
|
955 | + * list or not, and returns different data depending on the answer. |
|
956 | + * |
|
957 | + * @access private |
|
958 | + * @param string $string String to check for protocols |
|
959 | + * @return string String with removed protocols |
|
960 | + * @see _bad_protocol() |
|
961 | + * @see _bad_protocol_once() |
|
962 | + * @since PHP4 OOP 0.0.1 |
|
963 | + */ |
|
964 | + function _bad_protocol_once2($string) |
|
965 | + { |
|
966 | + $string = $this->_decode_entities($string); |
|
967 | + $string = preg_replace('/\s/', '', $string); |
|
968 | + $string = $this->_no_null($string); |
|
969 | + $string = preg_replace('/\xad+/', '', $string); # deals with Opera "feature" |
|
970 | + $string = strtolower($string); |
|
971 | + |
|
972 | + $allowed = false; |
|
973 | + if(is_array($this->allowed_protocols) && count($this->allowed_protocols) > 0) |
|
974 | + { |
|
975 | + foreach ($this->allowed_protocols as $one_protocol) |
|
976 | + { |
|
977 | + if (strtolower($one_protocol) == $string) |
|
978 | + { |
|
979 | + $allowed = true; |
|
980 | + break; |
|
981 | + } |
|
982 | + } |
|
983 | + } |
|
984 | + |
|
985 | + if ($allowed) |
|
986 | + { |
|
987 | + return "$string:"; |
|
988 | + } |
|
989 | + else |
|
990 | + { |
|
991 | + return ''; |
|
992 | + } |
|
993 | + } |
|
994 | + |
|
995 | + /** |
|
996 | + * This function performs different checks for attribute values. |
|
997 | + * |
|
998 | + * The currently implemented checks are "maxlen", "minlen", "maxval", |
|
999 | + * "minval" and "valueless" with even more checks to come soon. |
|
1000 | + * |
|
1001 | + * @access private |
|
1002 | + * @param string $value The value of the attribute to be checked. |
|
1003 | + * @param string $vless Indicates whether the the value is supposed to be valueless |
|
1004 | + * @param string $checkname The check to be performed |
|
1005 | + * @param string $checkvalue The value that is to be checked against |
|
1006 | + * @return bool Indicates whether the check passed or not |
|
1007 | + * @since PHP4 OOP 0.0.1 |
|
1008 | + */ |
|
1009 | + function _check_attr_val($value, $vless, $checkname, $checkvalue) |
|
1010 | + { |
|
1011 | + $ok = true; |
|
1012 | + |
|
1013 | + switch (strtolower($checkname)) |
|
1014 | + { |
|
1015 | + /** |
|
1016 | + * The maxlen check makes sure that the attribute value has a length not |
|
1017 | + * greater than the given value. This can be used to avoid Buffer Overflows |
|
1018 | + * in WWW clients and various Internet servers. |
|
1019 | + */ |
|
1020 | + case 'maxlen': |
|
1021 | + if (strlen($value) > $checkvalue) |
|
1022 | + { |
|
1023 | + $ok = false; |
|
1024 | + } |
|
1025 | + break; |
|
1026 | + |
|
1027 | + /** |
|
1028 | + * The minlen check makes sure that the attribute value has a length not |
|
1029 | + * smaller than the given value. |
|
1030 | + */ |
|
1031 | + case 'minlen': |
|
1032 | + if (strlen($value) < $checkvalue) |
|
1033 | + { |
|
1034 | + $ok = false; |
|
1035 | + } |
|
1036 | + break; |
|
1037 | + |
|
1038 | + /** |
|
1039 | + * The maxval check does two things: it checks that the attribute value is |
|
1040 | + * an integer from 0 and up, without an excessive amount of zeroes or |
|
1041 | + * whitespace (to avoid Buffer Overflows). It also checks that the attribute |
|
1042 | + * value is not greater than the given value. |
|
1043 | + * This check can be used to avoid Denial of Service attacks. |
|
1044 | + */ |
|
1045 | + case 'maxval': |
|
1046 | + if (!preg_match('/^\s{0,6}[0-9]{1,6}\s{0,6}$/', $value)) |
|
1047 | + { |
|
1048 | + $ok = false; |
|
1049 | + } |
|
1050 | + if ($value > $checkvalue) |
|
1051 | + { |
|
1052 | + $ok = false; |
|
1053 | + } |
|
1054 | + break; |
|
1055 | + |
|
1056 | + /** |
|
1057 | + * The minval check checks that the attribute value is a positive integer, |
|
1058 | + * and that it is not smaller than the given value. |
|
1059 | + */ |
|
1060 | + case 'minval': |
|
1061 | + if (!preg_match('/^\s{0,6}[0-9]{1,6}\s{0,6}$/', $value)) |
|
1062 | + { |
|
1063 | + $ok = false; |
|
1064 | + } |
|
1065 | + if ($value < $checkvalue) |
|
1066 | + { |
|
1067 | + $ok = false; |
|
1068 | + } |
|
1069 | + break; |
|
1070 | + |
|
1071 | + /** |
|
1072 | + * The valueless check checks if the attribute has a value |
|
1073 | + * (like <a href="blah">) or not (<option selected>). If the given value |
|
1074 | + * is a "y" or a "Y", the attribute must not have a value. |
|
1075 | + * If the given value is an "n" or an "N", the attribute must have one. |
|
1076 | + */ |
|
1077 | + case 'valueless': |
|
1078 | + if (strtolower($checkvalue) != $vless) |
|
1079 | + { |
|
1080 | + $ok = false; |
|
1081 | + } |
|
1082 | + break; |
|
1083 | + |
|
1084 | + } |
|
1085 | + |
|
1086 | + return $ok; |
|
1087 | + } |
|
1088 | + |
|
1089 | + /** |
|
1090 | + * Changes \" to " |
|
1091 | + * |
|
1092 | + * This function changes the character sequence \" to just " |
|
1093 | + * It leaves all other slashes alone. It's really weird, but the quoting from |
|
1094 | + * preg_replace(//e) seems to require this. |
|
1095 | + * |
|
1096 | + * @access private |
|
1097 | + * @param string $string The string to be stripped. |
|
1098 | + * @return string string stripped of \" |
|
1099 | + * @since PHP4 OOP 0.0.1 |
|
1100 | + */ |
|
1101 | + function _stripslashes($string) |
|
1102 | + { |
|
1103 | + return preg_replace('%\\\\"%', '"', $string); |
|
1104 | + } |
|
1105 | + |
|
1106 | + /** |
|
1107 | + * helper method for _hair() |
|
1108 | + * |
|
1109 | + * This function deals with parsing errors in _hair(). The general plan is |
|
1110 | + * to remove everything to and including some whitespace, but it deals with |
|
1111 | + * quotes and apostrophes as well. |
|
1112 | + * |
|
1113 | + * @access private |
|
1114 | + * @param string $string The string to be stripped. |
|
1115 | + * @return string string stripped of whitespace |
|
1116 | + * @see _hair() |
|
1117 | + * @since PHP4 OOP 0.0.1 |
|
1118 | + */ |
|
1119 | + function _html_error($string) |
|
1120 | + { |
|
1121 | + return preg_replace('/^("[^"]*("|$)|\'[^\']*(\'|$)|\S)*\s*/', '', $string); |
|
1122 | + } |
|
1123 | + |
|
1124 | + /** |
|
1125 | + * Decodes numeric HTML entities |
|
1126 | + * |
|
1127 | + * This method decodes numeric HTML entities (A and A). It doesn't |
|
1128 | + * do anything with other entities like ä, but we don't need them in the |
|
1129 | + * URL protocol white listing system anyway. |
|
1130 | + * |
|
1131 | + * @access private |
|
1132 | + * @param string $value The entitiy to be decoded. |
|
1133 | + * @return string Decoded entity |
|
1134 | + * @since PHP4 OOP 0.0.1 |
|
1135 | + */ |
|
1136 | + function _decode_entities($string) |
|
1137 | + { |
|
1138 | + $string = preg_replace('/&#([0-9]+);/e', 'chr("\\1")', $string); |
|
1139 | + $string = preg_replace('/&#[Xx]([0-9A-Fa-f]+);/e', 'chr(hexdec("\\1"))', $string); |
|
1140 | + return $string; |
|
1141 | + } |
|
1142 | + |
|
1143 | + /** |
|
1144 | + * Returns PHP4 OOP version # of kses. |
|
1145 | + * |
|
1146 | + * Since this class has been refactored and documented and proven to work, |
|
1147 | + * I'm syncing the version number to procedural kses. |
|
1148 | + * |
|
1149 | + * @access public |
|
1150 | + * @return string Version number |
|
1151 | + * @since PHP4 OOP 0.0.1 |
|
1152 | + */ |
|
1153 | + function _version() |
|
1154 | + { |
|
1155 | + return 'PHP4 0.2.2 (OOP fork of procedural kses 0.2.2)'; |
|
1156 | + } |
|
1157 | + } |
|
1158 | + |
|
1159 | + |
|
1160 | + |
|
1161 | + } |
|
1162 | 1162 | ?> |
1163 | 1163 | \ No newline at end of file |
@@ -39,7 +39,7 @@ discard block |
||
39 | 39 | * @subpackage kses4 |
40 | 40 | */ |
41 | 41 | |
42 | - if(substr(phpversion(), 0, 1) < 4) |
|
42 | + if (substr(phpversion(), 0, 1) < 4) |
|
43 | 43 | { |
44 | 44 | die("Class kses requires PHP 4 or higher."); |
45 | 45 | } |
@@ -47,7 +47,7 @@ discard block |
||
47 | 47 | /** |
48 | 48 | * Only install KSES4 once |
49 | 49 | */ |
50 | - if(!defined('KSES_CLASS_PHP4')) |
|
50 | + if (!defined('KSES_CLASS_PHP4')) |
|
51 | 51 | { |
52 | 52 | define('KSES_CLASS_PHP4', true); |
53 | 53 | |
@@ -150,7 +150,7 @@ discard block |
||
150 | 150 | function AddProtocols() |
151 | 151 | { |
152 | 152 | $c_args = func_num_args(); |
153 | - if($c_args != 1) |
|
153 | + if ($c_args != 1) |
|
154 | 154 | { |
155 | 155 | trigger_error("kses4::AddProtocols() did not receive an argument.", E_USER_WARNING); |
156 | 156 | return false; |
@@ -158,15 +158,15 @@ discard block |
||
158 | 158 | |
159 | 159 | $protocol_data = func_get_arg(0); |
160 | 160 | |
161 | - if(is_array($protocol_data) && count($protocol_data) > 0) |
|
161 | + if (is_array($protocol_data) && count($protocol_data) > 0) |
|
162 | 162 | { |
163 | - foreach($protocol_data as $protocol) |
|
163 | + foreach ($protocol_data as $protocol) |
|
164 | 164 | { |
165 | 165 | $this->AddProtocol($protocol); |
166 | 166 | } |
167 | 167 | return true; |
168 | 168 | } |
169 | - elseif(is_string($protocol_data)) |
|
169 | + elseif (is_string($protocol_data)) |
|
170 | 170 | { |
171 | 171 | $this->AddProtocol($protocol_data); |
172 | 172 | return true; |
@@ -189,7 +189,7 @@ discard block |
||
189 | 189 | function Protocols() |
190 | 190 | { |
191 | 191 | $c_args = func_num_args(); |
192 | - if($c_args != 1) |
|
192 | + if ($c_args != 1) |
|
193 | 193 | { |
194 | 194 | trigger_error("kses4::Protocols() did not receive an argument.", E_USER_WARNING); |
195 | 195 | return false; |
@@ -212,26 +212,26 @@ discard block |
||
212 | 212 | */ |
213 | 213 | function AddProtocol($protocol = "") |
214 | 214 | { |
215 | - if(!is_string($protocol)) |
|
215 | + if (!is_string($protocol)) |
|
216 | 216 | { |
217 | 217 | trigger_error("kses4::AddProtocol() requires a string.", E_USER_WARNING); |
218 | 218 | return false; |
219 | 219 | } |
220 | 220 | |
221 | 221 | $protocol = strtolower(trim($protocol)); |
222 | - if($protocol == "") |
|
222 | + if ($protocol == "") |
|
223 | 223 | { |
224 | 224 | trigger_error("kses4::AddProtocol() tried to add an empty/NULL protocol.", E_USER_WARNING); |
225 | 225 | return false; |
226 | 226 | } |
227 | 227 | |
228 | 228 | // Remove any inadvertent ':' at the end of the protocol. |
229 | - if(substr($protocol, strlen($protocol) - 1, 1) == ":") |
|
229 | + if (substr($protocol, strlen($protocol) - 1, 1) == ":") |
|
230 | 230 | { |
231 | 231 | $protocol = substr($protocol, 0, strlen($protocol) - 1); |
232 | 232 | } |
233 | 233 | |
234 | - if(!in_array($protocol, $this->allowed_protocols)) |
|
234 | + if (!in_array($protocol, $this->allowed_protocols)) |
|
235 | 235 | { |
236 | 236 | array_push($this->allowed_protocols, $protocol); |
237 | 237 | sort($this->allowed_protocols); |
@@ -257,7 +257,7 @@ discard block |
||
257 | 257 | function SetProtocols() |
258 | 258 | { |
259 | 259 | $c_args = func_num_args(); |
260 | - if($c_args != 1) |
|
260 | + if ($c_args != 1) |
|
261 | 261 | { |
262 | 262 | trigger_error("kses4::SetProtocols() did not receive an argument.", E_USER_WARNING); |
263 | 263 | return false; |
@@ -265,16 +265,16 @@ discard block |
||
265 | 265 | |
266 | 266 | $protocol_data = func_get_arg(0); |
267 | 267 | |
268 | - if(is_array($protocol_data) && count($protocol_data) > 0) |
|
268 | + if (is_array($protocol_data) && count($protocol_data) > 0) |
|
269 | 269 | { |
270 | 270 | $this->allowed_protocols = array(); |
271 | - foreach($protocol_data as $protocol) |
|
271 | + foreach ($protocol_data as $protocol) |
|
272 | 272 | { |
273 | 273 | $this->AddProtocol($protocol); |
274 | 274 | } |
275 | 275 | return true; |
276 | 276 | } |
277 | - elseif(is_string($protocol_data)) |
|
277 | + elseif (is_string($protocol_data)) |
|
278 | 278 | { |
279 | 279 | $this->allowed_protocols = array(); |
280 | 280 | $this->AddProtocol($protocol_data); |
@@ -331,37 +331,37 @@ discard block |
||
331 | 331 | */ |
332 | 332 | function AddHTML($tag = "", $attribs = array()) |
333 | 333 | { |
334 | - if(!is_string($tag)) |
|
334 | + if (!is_string($tag)) |
|
335 | 335 | { |
336 | 336 | trigger_error("kses4::AddHTML() requires the tag to be a string", E_USER_WARNING); |
337 | 337 | return false; |
338 | 338 | } |
339 | 339 | |
340 | 340 | $tag = strtolower(trim($tag)); |
341 | - if($tag == "") |
|
341 | + if ($tag == "") |
|
342 | 342 | { |
343 | 343 | trigger_error("kses4::AddHTML() tried to add an empty/NULL tag", E_USER_WARNING); |
344 | 344 | return false; |
345 | 345 | } |
346 | 346 | |
347 | - if(!is_array($attribs)) |
|
347 | + if (!is_array($attribs)) |
|
348 | 348 | { |
349 | 349 | trigger_error("kses4::AddHTML() requires an array (even an empty one) of attributes for '$tag'", E_USER_WARNING); |
350 | 350 | return false; |
351 | 351 | } |
352 | 352 | |
353 | 353 | $new_attribs = array(); |
354 | - if(is_array($attribs) && count($attribs) > 0) |
|
354 | + if (is_array($attribs) && count($attribs) > 0) |
|
355 | 355 | { |
356 | - foreach($attribs as $idx1 => $val1) |
|
356 | + foreach ($attribs as $idx1 => $val1) |
|
357 | 357 | { |
358 | 358 | $new_idx1 = strtolower($idx1); |
359 | 359 | $new_val1 = $attribs[$idx1]; |
360 | 360 | |
361 | - if(is_array($new_val1) && count($new_val1) > 0) |
|
361 | + if (is_array($new_val1) && count($new_val1) > 0) |
|
362 | 362 | { |
363 | 363 | $tmp_val = array(); |
364 | - foreach($new_val1 as $idx2 => $val2) |
|
364 | + foreach ($new_val1 as $idx2 => $val2) |
|
365 | 365 | { |
366 | 366 | $new_idx2 = strtolower($idx2); |
367 | 367 | $tmp_val[$new_idx2] = $val2; |
@@ -391,27 +391,27 @@ discard block |
||
391 | 391 | */ |
392 | 392 | function RemoveProtocol($protocol = "") |
393 | 393 | { |
394 | - if(!is_string($protocol)) |
|
394 | + if (!is_string($protocol)) |
|
395 | 395 | { |
396 | 396 | trigger_error("kses4::RemoveProtocol() requires a string.", E_USER_WARNING); |
397 | 397 | return false; |
398 | 398 | } |
399 | 399 | |
400 | 400 | // Remove any inadvertent ':' at the end of the protocol. |
401 | - if(substr($protocol, strlen($protocol) - 1, 1) == ":") |
|
401 | + if (substr($protocol, strlen($protocol) - 1, 1) == ":") |
|
402 | 402 | { |
403 | 403 | $protocol = substr($protocol, 0, strlen($protocol) - 1); |
404 | 404 | } |
405 | 405 | |
406 | 406 | $protocol = strtolower(trim($protocol)); |
407 | - if($protocol == "") |
|
407 | + if ($protocol == "") |
|
408 | 408 | { |
409 | 409 | trigger_error("kses4::RemoveProtocol() tried to remove an empty/NULL protocol.", E_USER_WARNING); |
410 | 410 | return false; |
411 | 411 | } |
412 | 412 | |
413 | 413 | // Ensures that the protocol exists before removing it. |
414 | - if(in_array($protocol, $this->allowed_protocols)) |
|
414 | + if (in_array($protocol, $this->allowed_protocols)) |
|
415 | 415 | { |
416 | 416 | $this->allowed_protocols = array_diff($this->allowed_protocols, array($protocol)); |
417 | 417 | sort($this->allowed_protocols); |
@@ -438,21 +438,21 @@ discard block |
||
438 | 438 | function RemoveProtocols() |
439 | 439 | { |
440 | 440 | $c_args = func_num_args(); |
441 | - if($c_args != 1) |
|
441 | + if ($c_args != 1) |
|
442 | 442 | { |
443 | 443 | return false; |
444 | 444 | } |
445 | 445 | |
446 | 446 | $protocol_data = func_get_arg(0); |
447 | 447 | |
448 | - if(is_array($protocol_data) && count($protocol_data) > 0) |
|
448 | + if (is_array($protocol_data) && count($protocol_data) > 0) |
|
449 | 449 | { |
450 | - foreach($protocol_data as $protocol) |
|
450 | + foreach ($protocol_data as $protocol) |
|
451 | 451 | { |
452 | 452 | $this->RemoveProtocol($protocol); |
453 | 453 | } |
454 | 454 | } |
455 | - elseif(is_string($protocol_data)) |
|
455 | + elseif (is_string($protocol_data)) |
|
456 | 456 | { |
457 | 457 | $this->RemoveProtocol($protocol_data); |
458 | 458 | return true; |
@@ -587,14 +587,14 @@ discard block |
||
587 | 587 | { |
588 | 588 | $outarray = array(); |
589 | 589 | |
590 | - if(is_array($inarray) && count($inarray) > 0) |
|
590 | + if (is_array($inarray) && count($inarray) > 0) |
|
591 | 591 | { |
592 | 592 | foreach ($inarray as $inkey => $inval) |
593 | 593 | { |
594 | 594 | $outkey = strtolower($inkey); |
595 | 595 | $outarray[$outkey] = array(); |
596 | 596 | |
597 | - if(is_array($inval) && count($inval) > 0) |
|
597 | + if (is_array($inval) && count($inval) > 0) |
|
598 | 598 | { |
599 | 599 | foreach ($inval as $inkey2 => $inval2) |
600 | 600 | { |
@@ -620,9 +620,9 @@ discard block |
||
620 | 620 | function _split($string) |
621 | 621 | { |
622 | 622 | return preg_replace( |
623 | - '%(<'. # EITHER: < |
|
624 | - '[^>]*'. # things that aren't > |
|
625 | - '(>|$)'. # > or end of string |
|
623 | + '%(<'.# EITHER: < |
|
624 | + '[^>]*'.# things that aren't > |
|
625 | + '(>|$)'.# > or end of string |
|
626 | 626 | '|>)%e', # OR: just a > |
627 | 627 | "\$this->_split2('\\1')", |
628 | 628 | $string); |
@@ -720,11 +720,11 @@ discard block |
||
720 | 720 | # Go through $attrarr, and save the allowed attributes for this element |
721 | 721 | # in $attr2 |
722 | 722 | $attr2 = ''; |
723 | - if(is_array($attrarr) && count($attrarr) > 0) |
|
723 | + if (is_array($attrarr) && count($attrarr) > 0) |
|
724 | 724 | { |
725 | 725 | foreach ($attrarr as $arreach) |
726 | 726 | { |
727 | - if(!isset($this->allowed_html[strtolower($element)][strtolower($arreach['name'])])) |
|
727 | + if (!isset($this->allowed_html[strtolower($element)][strtolower($arreach['name'])])) |
|
728 | 728 | { |
729 | 729 | continue; |
730 | 730 | } |
@@ -745,7 +745,7 @@ discard block |
||
745 | 745 | { |
746 | 746 | # there are some checks |
747 | 747 | $ok = true; |
748 | - if(is_array($current) && count($current) > 0) |
|
748 | + if (is_array($current) && count($current) > 0) |
|
749 | 749 | { |
750 | 750 | foreach ($current as $currkey => $currval) |
751 | 751 | { |
@@ -827,7 +827,7 @@ discard block |
||
827 | 827 | 'whole' => $attrname, |
828 | 828 | 'vless' => 'y' |
829 | 829 | ); |
830 | - $attr = preg_replace('/^\s+/', '', $attr); |
|
830 | + $attr = preg_replace('/^\s+/', '', $attr); |
|
831 | 831 | } |
832 | 832 | break; |
833 | 833 | case 2: # attribute value, a URL after href= for instance |
@@ -942,7 +942,7 @@ discard block |
||
942 | 942 | function _bad_protocol_once($string) |
943 | 943 | { |
944 | 944 | $string2 = preg_split('/:|:|:/i', $string, 2); |
945 | - if(isset($string2[1]) && !preg_match('%/\?%',$string2[0])) |
|
945 | + if (isset($string2[1]) && !preg_match('%/\?%', $string2[0])) |
|
946 | 946 | { |
947 | 947 | $string = $this->_bad_protocol_once2($string2[0]).trim($string2[1]); |
948 | 948 | } |
@@ -970,7 +970,7 @@ discard block |
||
970 | 970 | $string = strtolower($string); |
971 | 971 | |
972 | 972 | $allowed = false; |
973 | - if(is_array($this->allowed_protocols) && count($this->allowed_protocols) > 0) |
|
973 | + if (is_array($this->allowed_protocols) && count($this->allowed_protocols) > 0) |
|
974 | 974 | { |
975 | 975 | foreach ($this->allowed_protocols as $one_protocol) |
976 | 976 | { |
@@ -165,13 +165,11 @@ discard block |
||
165 | 165 | $this->AddProtocol($protocol); |
166 | 166 | } |
167 | 167 | return true; |
168 | - } |
|
169 | - elseif(is_string($protocol_data)) |
|
168 | + } elseif(is_string($protocol_data)) |
|
170 | 169 | { |
171 | 170 | $this->AddProtocol($protocol_data); |
172 | 171 | return true; |
173 | - } |
|
174 | - else |
|
172 | + } else |
|
175 | 173 | { |
176 | 174 | trigger_error("kses4::AddProtocols() did not receive a string or an array.", E_USER_WARNING); |
177 | 175 | return false; |
@@ -273,14 +271,12 @@ discard block |
||
273 | 271 | $this->AddProtocol($protocol); |
274 | 272 | } |
275 | 273 | return true; |
276 | - } |
|
277 | - elseif(is_string($protocol_data)) |
|
274 | + } elseif(is_string($protocol_data)) |
|
278 | 275 | { |
279 | 276 | $this->allowed_protocols = array(); |
280 | 277 | $this->AddProtocol($protocol_data); |
281 | 278 | return true; |
282 | - } |
|
283 | - else |
|
279 | + } else |
|
284 | 280 | { |
285 | 281 | trigger_error("kses4::SetProtocols() did not receive a string or an array.", E_USER_WARNING); |
286 | 282 | return false; |
@@ -451,13 +447,11 @@ discard block |
||
451 | 447 | { |
452 | 448 | $this->RemoveProtocol($protocol); |
453 | 449 | } |
454 | - } |
|
455 | - elseif(is_string($protocol_data)) |
|
450 | + } elseif(is_string($protocol_data)) |
|
456 | 451 | { |
457 | 452 | $this->RemoveProtocol($protocol_data); |
458 | 453 | return true; |
459 | - } |
|
460 | - else |
|
454 | + } else |
|
461 | 455 | { |
462 | 456 | trigger_error("kses4::RemoveProtocols() did not receive a string or an array.", E_USER_WARNING); |
463 | 457 | return false; |
@@ -740,8 +734,7 @@ discard block |
||
740 | 734 | { |
741 | 735 | # there are no checks |
742 | 736 | $attr2 .= ' '.$arreach['whole']; |
743 | - } |
|
744 | - else |
|
737 | + } else |
|
745 | 738 | { |
746 | 739 | # there are some checks |
747 | 740 | $ok = true; |
@@ -810,16 +803,20 @@ discard block |
||
810 | 803 | } |
811 | 804 | break; |
812 | 805 | case 1: # equals sign or valueless ("selected") |
813 | - if (preg_match('/^\s*=\s*/', $attr)) # equals sign |
|
806 | + if (preg_match('/^\s*=\s*/', $attr)) { |
|
807 | + # equals sign |
|
814 | 808 | { |
815 | 809 | $working = 1; |
810 | + } |
|
816 | 811 | $mode = 2; |
817 | 812 | $attr = preg_replace('/^\s*=\s*/', '', $attr); |
818 | 813 | break; |
819 | 814 | } |
820 | - if (preg_match('/^\s+/', $attr)) # valueless |
|
815 | + if (preg_match('/^\s+/', $attr)) { |
|
816 | + # valueless |
|
821 | 817 | { |
822 | 818 | $working = 1; |
819 | + } |
|
823 | 820 | $mode = 0; |
824 | 821 | $attrarr[] = array( |
825 | 822 | 'name' => $attrname, |
@@ -831,9 +828,11 @@ discard block |
||
831 | 828 | } |
832 | 829 | break; |
833 | 830 | case 2: # attribute value, a URL after href= for instance |
834 | - if (preg_match('/^"([^"]*)"(\s+|$)/', $attr, $match)) # "value" |
|
831 | + if (preg_match('/^"([^"]*)"(\s+|$)/', $attr, $match)) { |
|
832 | + # "value" |
|
835 | 833 | { |
836 | 834 | $thisval = $this->_bad_protocol($match[1]); |
835 | + } |
|
837 | 836 | $attrarr[] = array( |
838 | 837 | 'name' => $attrname, |
839 | 838 | 'value' => $thisval, |
@@ -845,9 +844,11 @@ discard block |
||
845 | 844 | $attr = preg_replace('/^"[^"]*"(\s+|$)/', '', $attr); |
846 | 845 | break; |
847 | 846 | } |
848 | - if (preg_match("/^'([^']*)'(\s+|$)/", $attr, $match)) # 'value' |
|
847 | + if (preg_match("/^'([^']*)'(\s+|$)/", $attr, $match)) { |
|
848 | + # 'value' |
|
849 | 849 | { |
850 | 850 | $thisval = $this->_bad_protocol($match[1]); |
851 | + } |
|
851 | 852 | $attrarr[] = array( |
852 | 853 | 'name' => $attrname, |
853 | 854 | 'value' => $thisval, |
@@ -859,9 +860,11 @@ discard block |
||
859 | 860 | $attr = preg_replace("/^'[^']*'(\s+|$)/", '', $attr); |
860 | 861 | break; |
861 | 862 | } |
862 | - if (preg_match("%^([^\s\"']+)(\s+|$)%", $attr, $match)) # value |
|
863 | + if (preg_match("%^([^\s\"']+)(\s+|$)%", $attr, $match)) { |
|
864 | + # value |
|
863 | 865 | { |
864 | 866 | $thisval = $this->_bad_protocol($match[1]); |
867 | + } |
|
865 | 868 | $attrarr[] = array( |
866 | 869 | 'name' => $attrname, |
867 | 870 | 'value' => $thisval, |
@@ -876,9 +879,11 @@ discard block |
||
876 | 879 | break; |
877 | 880 | } |
878 | 881 | |
879 | - if ($working == 0) # not well formed, remove and try again |
|
882 | + if ($working == 0) { |
|
883 | + # not well formed, remove and try again |
|
880 | 884 | { |
881 | 885 | $attr = $this->_html_error($attr); |
886 | + } |
|
882 | 887 | $mode = 0; |
883 | 888 | } |
884 | 889 | } |
@@ -985,8 +990,7 @@ discard block |
||
985 | 990 | if ($allowed) |
986 | 991 | { |
987 | 992 | return "$string:"; |
988 | - } |
|
989 | - else |
|
993 | + } else |
|
990 | 994 | { |
991 | 995 | return ''; |
992 | 996 | } |
@@ -321,7 +321,7 @@ discard block |
||
321 | 321 | * |
322 | 322 | * @access public |
323 | 323 | * @param mixed , A string or array of protocols that will be removed from the internal list of allowed protocols. |
324 | - * @return bool Status of removing valid protocols. |
|
324 | + * @return null|boolean Status of removing valid protocols. |
|
325 | 325 | * @see RemoveProtocol() |
326 | 326 | * @since PHP5 OOP 1.0.0 |
327 | 327 | */ |
@@ -1133,9 +1133,7 @@ discard block |
||
1133 | 1133 | * URL protocol white listing system anyway. |
1134 | 1134 | * |
1135 | 1135 | * @access private |
1136 | - * @param string $value The entitiy to be decoded. |
|
1137 | - * @return string Decoded entity |
|
1138 | - * @since PHP4 OOP 0.0.1 |
|
1136 | + * @param string $string |
|
1139 | 1137 | */ |
1140 | 1138 | private function decodeEntities($string) |
1141 | 1139 | { |
@@ -1,6 +1,6 @@ discard block |
||
1 | 1 | <?php |
2 | 2 | |
3 | - /* |
|
3 | + /* |
|
4 | 4 | * ========================================================================================== |
5 | 5 | * |
6 | 6 | * This program is free software and open source software; you can redistribute |
@@ -21,1146 +21,1146 @@ discard block |
||
21 | 21 | * ========================================================================================== |
22 | 22 | */ |
23 | 23 | |
24 | - /** |
|
25 | - * Class file for PHP5 OOP version of kses |
|
26 | - * |
|
27 | - * This is an updated version of kses to work with PHP5 that works under E_STRICT. |
|
28 | - * |
|
29 | - * This version is a bit of a rewrite to match my own coding style and use some of the |
|
30 | - * capabilities allowed in PHP5. Since this was a significant rewrite, but it still |
|
31 | - * maintains backward compatibility syntax-wise, the version number is now 1.0.0. Any |
|
32 | - * minor changes that do not break compatibility will be indicated in the second or third |
|
33 | - * digits. Anything that breaks compatibility will change the major version number. |
|
34 | - * |
|
35 | - * PHP5 specific changes: |
|
36 | - * + Private methods are now in place |
|
37 | - * + __construct() is now used rather then the standard class name 'kses()' |
|
38 | - * + Kses will not load in any version less that PHP5 |
|
39 | - * Other modifications: |
|
40 | - * + PHPdoc style documentation has been added to the class. See http://www.phpdoc.org/ for more info. |
|
41 | - * + Method names have been changed to reflect status as verbs |
|
42 | - * + One line methods have been folded into the code |
|
43 | - * + Some methods are now deprecated due to nomenclature style change. See method documentation for specifics. |
|
44 | - * + Kses5 now works in E_STRICT |
|
45 | - * + Version number is 1.0.0 to reflect serious code changes |
|
46 | - * + Addition of methods AddProtocols(), filterKsestextHook(), RemoveProtocol(), RemoveProtocols() and SetProtocols() |
|
47 | - * + Deprecated _hook(), Protocols() |
|
48 | - * |
|
49 | - * @package kses |
|
50 | - * @subpackage kses5 |
|
51 | - */ |
|
52 | - |
|
53 | - if(substr(phpversion(), 0, 1) < 5) |
|
54 | - { |
|
55 | - die("Class kses requires PHP 5 or higher."); |
|
56 | - } |
|
57 | - |
|
58 | - /** |
|
59 | - * Only install KSES5 once |
|
60 | - */ |
|
61 | - if(!defined('KSES_CLASS_PHP5')) |
|
62 | - { |
|
63 | - define('KSES_CLASS_PHP5', true); |
|
64 | - |
|
65 | - /** |
|
66 | - * Kses strips evil scripts! |
|
67 | - * |
|
68 | - * This class provides the capability for removing unwanted HTML/XHTML, attributes from |
|
69 | - * tags, and protocols contained in links. The net result is a much more powerful tool |
|
70 | - * than the PHP internal strip_tags() |
|
71 | - * |
|
72 | - * This is a fork of a slick piece of procedural code called 'kses' written by Ulf Harnhammar. |
|
73 | - * |
|
74 | - * The original class for PHP4 was basically a wrapper around all of the functions in |
|
75 | - * the procedural code written by Ulf, and was released 7/25/2003. |
|
76 | - * |
|
77 | - * This version is a bit of a rewrite to match my own coding style and use some of the |
|
78 | - * capabilities allowed in PHP5. Since this was a significant rewrite, but it still |
|
79 | - * maintains backward compatibility syntax-wise, the version number is now 1.0.0. Any |
|
80 | - * minor changes that do not break compatibility will be indicated in the second or third |
|
81 | - * digits. Anything that breaks compatibility will change the major version number. |
|
82 | - * |
|
83 | - * PHP5 specific changes: |
|
84 | - * + Private methods are now in place |
|
85 | - * + __construct() is now used rather then the standard class name 'kses()' |
|
86 | - * + Kses5 will not load in any version less that PHP5 |
|
87 | - * Other modifications: |
|
88 | - * + PHPdoc style documentation has been added to the class. See http://www.phpdoc.org/ for more info. |
|
89 | - * + Method names have been changed to reflect status as verbs |
|
90 | - * + One line methods have been folded into the code |
|
91 | - * + Some methods are now deprecated due to nomenclature style change. See method documentation for specifics. |
|
92 | - * + Kses now works in E_STRICT |
|
93 | - * + Initial Version number set to 1.0.0 to reflect serious code changes |
|
94 | - * + Addition of methods AddProtocols(), filterKsestextHook(), RemoveProtocol(), RemoveProtocols() and SetProtocols() |
|
95 | - * + Deprecated _hook(), Protocols() |
|
96 | - * + Integrated code from kses 0.2.2 into class. |
|
97 | - * + Added methods DumpProtocols(), DumpMethods() |
|
98 | - * |
|
99 | - * @author Richard R. V�squez, Jr. (Original procedural code by Ulf H�rnhammar) |
|
100 | - * @link http://sourceforge.net/projects/kses/ Home Page for Kses |
|
101 | - * @link http://chaos.org/contact/ Contact page with current email address for Richard Vasquez |
|
102 | - * @copyright Richard R. V�squez, Jr. 2005 |
|
103 | - * @version PHP5 OOP 1.0.2 |
|
104 | - * @license http://www.gnu.org/licenses/gpl.html GNU Public License |
|
105 | - * @package kses |
|
106 | - */ |
|
107 | - class kses5 |
|
108 | - { |
|
109 | - /**#@+ |
|
24 | + /** |
|
25 | + * Class file for PHP5 OOP version of kses |
|
26 | + * |
|
27 | + * This is an updated version of kses to work with PHP5 that works under E_STRICT. |
|
28 | + * |
|
29 | + * This version is a bit of a rewrite to match my own coding style and use some of the |
|
30 | + * capabilities allowed in PHP5. Since this was a significant rewrite, but it still |
|
31 | + * maintains backward compatibility syntax-wise, the version number is now 1.0.0. Any |
|
32 | + * minor changes that do not break compatibility will be indicated in the second or third |
|
33 | + * digits. Anything that breaks compatibility will change the major version number. |
|
34 | + * |
|
35 | + * PHP5 specific changes: |
|
36 | + * + Private methods are now in place |
|
37 | + * + __construct() is now used rather then the standard class name 'kses()' |
|
38 | + * + Kses will not load in any version less that PHP5 |
|
39 | + * Other modifications: |
|
40 | + * + PHPdoc style documentation has been added to the class. See http://www.phpdoc.org/ for more info. |
|
41 | + * + Method names have been changed to reflect status as verbs |
|
42 | + * + One line methods have been folded into the code |
|
43 | + * + Some methods are now deprecated due to nomenclature style change. See method documentation for specifics. |
|
44 | + * + Kses5 now works in E_STRICT |
|
45 | + * + Version number is 1.0.0 to reflect serious code changes |
|
46 | + * + Addition of methods AddProtocols(), filterKsestextHook(), RemoveProtocol(), RemoveProtocols() and SetProtocols() |
|
47 | + * + Deprecated _hook(), Protocols() |
|
48 | + * |
|
49 | + * @package kses |
|
50 | + * @subpackage kses5 |
|
51 | + */ |
|
52 | + |
|
53 | + if(substr(phpversion(), 0, 1) < 5) |
|
54 | + { |
|
55 | + die("Class kses requires PHP 5 or higher."); |
|
56 | + } |
|
57 | + |
|
58 | + /** |
|
59 | + * Only install KSES5 once |
|
60 | + */ |
|
61 | + if(!defined('KSES_CLASS_PHP5')) |
|
62 | + { |
|
63 | + define('KSES_CLASS_PHP5', true); |
|
64 | + |
|
65 | + /** |
|
66 | + * Kses strips evil scripts! |
|
67 | + * |
|
68 | + * This class provides the capability for removing unwanted HTML/XHTML, attributes from |
|
69 | + * tags, and protocols contained in links. The net result is a much more powerful tool |
|
70 | + * than the PHP internal strip_tags() |
|
71 | + * |
|
72 | + * This is a fork of a slick piece of procedural code called 'kses' written by Ulf Harnhammar. |
|
73 | + * |
|
74 | + * The original class for PHP4 was basically a wrapper around all of the functions in |
|
75 | + * the procedural code written by Ulf, and was released 7/25/2003. |
|
76 | + * |
|
77 | + * This version is a bit of a rewrite to match my own coding style and use some of the |
|
78 | + * capabilities allowed in PHP5. Since this was a significant rewrite, but it still |
|
79 | + * maintains backward compatibility syntax-wise, the version number is now 1.0.0. Any |
|
80 | + * minor changes that do not break compatibility will be indicated in the second or third |
|
81 | + * digits. Anything that breaks compatibility will change the major version number. |
|
82 | + * |
|
83 | + * PHP5 specific changes: |
|
84 | + * + Private methods are now in place |
|
85 | + * + __construct() is now used rather then the standard class name 'kses()' |
|
86 | + * + Kses5 will not load in any version less that PHP5 |
|
87 | + * Other modifications: |
|
88 | + * + PHPdoc style documentation has been added to the class. See http://www.phpdoc.org/ for more info. |
|
89 | + * + Method names have been changed to reflect status as verbs |
|
90 | + * + One line methods have been folded into the code |
|
91 | + * + Some methods are now deprecated due to nomenclature style change. See method documentation for specifics. |
|
92 | + * + Kses now works in E_STRICT |
|
93 | + * + Initial Version number set to 1.0.0 to reflect serious code changes |
|
94 | + * + Addition of methods AddProtocols(), filterKsestextHook(), RemoveProtocol(), RemoveProtocols() and SetProtocols() |
|
95 | + * + Deprecated _hook(), Protocols() |
|
96 | + * + Integrated code from kses 0.2.2 into class. |
|
97 | + * + Added methods DumpProtocols(), DumpMethods() |
|
98 | + * |
|
99 | + * @author Richard R. V�squez, Jr. (Original procedural code by Ulf H�rnhammar) |
|
100 | + * @link http://sourceforge.net/projects/kses/ Home Page for Kses |
|
101 | + * @link http://chaos.org/contact/ Contact page with current email address for Richard Vasquez |
|
102 | + * @copyright Richard R. V�squez, Jr. 2005 |
|
103 | + * @version PHP5 OOP 1.0.2 |
|
104 | + * @license http://www.gnu.org/licenses/gpl.html GNU Public License |
|
105 | + * @package kses |
|
106 | + */ |
|
107 | + class kses5 |
|
108 | + { |
|
109 | + /**#@+ |
|
110 | 110 | * @access private |
111 | 111 | * @var array |
112 | 112 | */ |
113 | - private $allowed_protocols; |
|
114 | - private $allowed_html; |
|
115 | - /**#@-*/ |
|
116 | - |
|
117 | - /** |
|
118 | - * Constructor for kses. |
|
119 | - * |
|
120 | - * This sets a default collection of protocols allowed in links, and creates an |
|
121 | - * empty set of allowed HTML tags. |
|
122 | - * @since PHP5 OOP 1.0.0 |
|
123 | - */ |
|
124 | - public function __construct() |
|
125 | - { |
|
126 | - /** |
|
127 | - * You could add protocols such as ftp, new, gopher, mailto, irc, etc. |
|
128 | - * |
|
129 | - * The base values the original kses provided were: |
|
130 | - * 'http', 'https', 'ftp', 'news', 'nntp', 'telnet', 'gopher', 'mailto' |
|
131 | - */ |
|
132 | - $this->allowed_protocols = array('http', 'ftp', 'mailto'); |
|
133 | - $this->allowed_html = array(); |
|
134 | - } |
|
135 | - |
|
136 | - /** |
|
137 | - * Basic task of kses - parses $string and strips it as required. |
|
138 | - * |
|
139 | - * This method strips all the disallowed (X)HTML tags, attributes |
|
140 | - * and protocols from the input $string. |
|
141 | - * |
|
142 | - * @access public |
|
143 | - * @param string $string String to be stripped of 'evil scripts' |
|
144 | - * @return string The stripped string |
|
145 | - * @since PHP4 OOP 0.0.1 |
|
146 | - */ |
|
147 | - public function Parse($string = "") |
|
148 | - { |
|
149 | - if (get_magic_quotes_gpc()) |
|
150 | - { |
|
151 | - $string = stripslashes($string); |
|
152 | - } |
|
153 | - $string = $this->removeNulls($string); |
|
154 | - // Remove JavaScript entities from early Netscape 4 versions |
|
155 | - $string = preg_replace('%&\s*\{[^}]*(\}\s*;?|$)%', '', $string); |
|
156 | - $string = $this->normalizeEntities($string); |
|
157 | - $string = $this->filterKsesTextHook($string); |
|
158 | - $string = preg_replace('%(<' . '[^>]*' . '(>|$)' . '|>)%e', "\$this->stripTags('\\1')", $string); |
|
159 | - return $string; |
|
160 | - } |
|
161 | - |
|
162 | - /** |
|
163 | - * Allows for single/batch addition of protocols |
|
164 | - * |
|
165 | - * This method accepts one argument that can be either a string |
|
166 | - * or an array of strings. Invalid data will be ignored. |
|
167 | - * |
|
168 | - * The argument will be processed, and each string will be added |
|
169 | - * via AddProtocol(). |
|
170 | - * |
|
171 | - * @access public |
|
172 | - * @param mixed , A string or array of protocols that will be added to the internal list of allowed protocols. |
|
173 | - * @return bool Status of adding valid protocols. |
|
174 | - * @see AddProtocol() |
|
175 | - * @since PHP5 OOP 1.0.0 |
|
176 | - */ |
|
177 | - public function AddProtocols() |
|
178 | - { |
|
179 | - $c_args = func_num_args(); |
|
180 | - if($c_args != 1) |
|
181 | - { |
|
182 | - trigger_error("kses5::AddProtocols() did not receive an argument.", E_USER_WARNING); |
|
183 | - return false; |
|
184 | - } |
|
185 | - |
|
186 | - $protocol_data = func_get_arg(0); |
|
187 | - |
|
188 | - if(is_array($protocol_data) && count($protocol_data) > 0) |
|
189 | - { |
|
190 | - foreach($protocol_data as $protocol) |
|
191 | - { |
|
192 | - $this->AddProtocol($protocol); |
|
193 | - } |
|
194 | - return true; |
|
195 | - } |
|
196 | - elseif(is_string($protocol_data)) |
|
197 | - { |
|
198 | - $this->AddProtocol($protocol_data); |
|
199 | - return true; |
|
200 | - } |
|
201 | - else |
|
202 | - { |
|
203 | - trigger_error("kses5::AddProtocols() did not receive a string or an array.", E_USER_WARNING); |
|
204 | - return false; |
|
205 | - } |
|
206 | - } |
|
207 | - |
|
208 | - /** |
|
209 | - * Allows for single/batch addition of protocols |
|
210 | - * |
|
211 | - * @deprecated Use AddProtocols() |
|
212 | - * @see AddProtocols() |
|
213 | - * @return bool |
|
214 | - * @since PHP4 OOP 0.0.1 |
|
215 | - */ |
|
216 | - public function Protocols() |
|
217 | - { |
|
218 | - $c_args = func_num_args(); |
|
219 | - if($c_args != 1) |
|
220 | - { |
|
221 | - trigger_error("kses5::Protocols() did not receive an argument.", E_USER_WARNING); |
|
222 | - return false; |
|
223 | - } |
|
224 | - |
|
225 | - return $this->AddProtocols(func_get_arg(0)); |
|
226 | - } |
|
227 | - |
|
228 | - /** |
|
229 | - * Adds a single protocol to $this->allowed_protocols. |
|
230 | - * |
|
231 | - * This method accepts a string argument and adds it to |
|
232 | - * the list of allowed protocols to keep when performing |
|
233 | - * Parse(). |
|
234 | - * |
|
235 | - * @access public |
|
236 | - * @param string $protocol The name of the protocol to be added. |
|
237 | - * @return bool Status of adding valid protocol. |
|
238 | - * @since PHP4 OOP 0.0.1 |
|
239 | - */ |
|
240 | - public function AddProtocol($protocol = "") |
|
241 | - { |
|
242 | - if(!is_string($protocol)) |
|
243 | - { |
|
244 | - trigger_error("kses5::AddProtocol() requires a string.", E_USER_WARNING); |
|
245 | - return false; |
|
246 | - } |
|
247 | - |
|
248 | - // Remove any inadvertent ':' at the end of the protocol. |
|
249 | - if(substr($protocol, strlen($protocol) - 1, 1) == ":") |
|
250 | - { |
|
251 | - $protocol = substr($protocol, 0, strlen($protocol) - 1); |
|
252 | - } |
|
253 | - |
|
254 | - $protocol = strtolower(trim($protocol)); |
|
255 | - if($protocol == "") |
|
256 | - { |
|
257 | - trigger_error("kses5::AddProtocol() tried to add an empty/NULL protocol.", E_USER_WARNING); |
|
258 | - return false; |
|
259 | - } |
|
260 | - |
|
261 | - // prevent duplicate protocols from being added. |
|
262 | - if(!in_array($protocol, $this->allowed_protocols)) |
|
263 | - { |
|
264 | - array_push($this->allowed_protocols, $protocol); |
|
265 | - sort($this->allowed_protocols); |
|
266 | - } |
|
267 | - return true; |
|
268 | - } |
|
269 | - |
|
270 | - /** |
|
271 | - * Removes a single protocol from $this->allowed_protocols. |
|
272 | - * |
|
273 | - * This method accepts a string argument and removes it from |
|
274 | - * the list of allowed protocols to keep when performing |
|
275 | - * Parse(). |
|
276 | - * |
|
277 | - * @access public |
|
278 | - * @param string $protocol The name of the protocol to be removed. |
|
279 | - * @return bool Status of removing valid protocol. |
|
280 | - * @since PHP5 OOP 1.0.0 |
|
281 | - */ |
|
282 | - public function RemoveProtocol($protocol = "") |
|
283 | - { |
|
284 | - if(!is_string($protocol)) |
|
285 | - { |
|
286 | - trigger_error("kses5::RemoveProtocol() requires a string.", E_USER_WARNING); |
|
287 | - return false; |
|
288 | - } |
|
289 | - |
|
290 | - // Remove any inadvertent ':' at the end of the protocol. |
|
291 | - if(substr($protocol, strlen($protocol) - 1, 1) == ":") |
|
292 | - { |
|
293 | - $protocol = substr($protocol, 0, strlen($protocol) - 1); |
|
294 | - } |
|
295 | - |
|
296 | - $protocol = strtolower(trim($protocol)); |
|
297 | - if($protocol == "") |
|
298 | - { |
|
299 | - trigger_error("kses5::RemoveProtocol() tried to remove an empty/NULL protocol.", E_USER_WARNING); |
|
300 | - return false; |
|
301 | - } |
|
302 | - |
|
303 | - // Ensures that the protocol exists before removing it. |
|
304 | - if(in_array($protocol, $this->allowed_protocols)) |
|
305 | - { |
|
306 | - $this->allowed_protocols = array_diff($this->allowed_protocols, array($protocol)); |
|
307 | - sort($this->allowed_protocols); |
|
308 | - } |
|
309 | - |
|
310 | - return true; |
|
311 | - } |
|
312 | - |
|
313 | - /** |
|
314 | - * Allows for single/batch removal of protocols |
|
315 | - * |
|
316 | - * This method accepts one argument that can be either a string |
|
317 | - * or an array of strings. Invalid data will be ignored. |
|
318 | - * |
|
319 | - * The argument will be processed, and each string will be removed |
|
320 | - * via RemoveProtocol(). |
|
321 | - * |
|
322 | - * @access public |
|
323 | - * @param mixed , A string or array of protocols that will be removed from the internal list of allowed protocols. |
|
324 | - * @return bool Status of removing valid protocols. |
|
325 | - * @see RemoveProtocol() |
|
326 | - * @since PHP5 OOP 1.0.0 |
|
327 | - */ |
|
328 | - public function RemoveProtocols() |
|
329 | - { |
|
330 | - $c_args = func_num_args(); |
|
331 | - if($c_args != 1) |
|
332 | - { |
|
333 | - return false; |
|
334 | - } |
|
335 | - |
|
336 | - $protocol_data = func_get_arg(0); |
|
337 | - |
|
338 | - if(is_array($protocol_data) && count($protocol_data) > 0) |
|
339 | - { |
|
340 | - foreach($protocol_data as $protocol) |
|
341 | - { |
|
342 | - $this->RemoveProtocol($protocol); |
|
343 | - } |
|
344 | - } |
|
345 | - elseif(is_string($protocol_data)) |
|
346 | - { |
|
347 | - $this->RemoveProtocol($protocol_data); |
|
348 | - return true; |
|
349 | - } |
|
350 | - else |
|
351 | - { |
|
352 | - trigger_error("kses5::RemoveProtocols() did not receive a string or an array.", E_USER_WARNING); |
|
353 | - return false; |
|
354 | - } |
|
355 | - } |
|
356 | - |
|
357 | - /** |
|
358 | - * Allows for single/batch replacement of protocols |
|
359 | - * |
|
360 | - * This method accepts one argument that can be either a string |
|
361 | - * or an array of strings. Invalid data will be ignored. |
|
362 | - * |
|
363 | - * Existing protocols will be removed, then the argument will be |
|
364 | - * processed, and each string will be added via AddProtocol(). |
|
365 | - * |
|
366 | - * @access public |
|
367 | - * @param mixed , A string or array of protocols that will be the new internal list of allowed protocols. |
|
368 | - * @return bool Status of replacing valid protocols. |
|
369 | - * @since PHP5 OOP 1.0.1 |
|
370 | - * @see AddProtocol() |
|
371 | - */ |
|
372 | - public function SetProtocols() |
|
373 | - { |
|
374 | - $c_args = func_num_args(); |
|
375 | - if($c_args != 1) |
|
376 | - { |
|
377 | - trigger_error("kses5::SetProtocols() did not receive an argument.", E_USER_WARNING); |
|
378 | - return false; |
|
379 | - } |
|
380 | - |
|
381 | - $protocol_data = func_get_arg(0); |
|
382 | - |
|
383 | - if(is_array($protocol_data) && count($protocol_data) > 0) |
|
384 | - { |
|
385 | - $this->allowed_protocols = array(); |
|
386 | - foreach($protocol_data as $protocol) |
|
387 | - { |
|
388 | - $this->AddProtocol($protocol); |
|
389 | - } |
|
390 | - return true; |
|
391 | - } |
|
392 | - elseif(is_string($protocol_data)) |
|
393 | - { |
|
394 | - $this->allowed_protocols = array(); |
|
395 | - $this->AddProtocol($protocol_data); |
|
396 | - return true; |
|
397 | - } |
|
398 | - else |
|
399 | - { |
|
400 | - trigger_error("kses5::SetProtocols() did not receive a string or an array.", E_USER_WARNING); |
|
401 | - return false; |
|
402 | - } |
|
403 | - } |
|
404 | - |
|
405 | - /** |
|
406 | - * Raw dump of allowed protocols |
|
407 | - * |
|
408 | - * This returns an indexed array of allowed protocols for a particular KSES |
|
409 | - * instantiation. |
|
410 | - * |
|
411 | - * @access public |
|
412 | - * @return array The list of allowed protocols. |
|
413 | - * @since PHP5 OOP 1.0.2 |
|
414 | - */ |
|
415 | - public function DumpProtocols() |
|
416 | - { |
|
417 | - return $this->allowed_protocols; |
|
418 | - } |
|
419 | - |
|
420 | - /** |
|
421 | - * Raw dump of allowed (X)HTML elements |
|
422 | - * |
|
423 | - * This returns an indexed array of allowed (X)HTML elements and attributes |
|
424 | - * for a particular KSES instantiation. |
|
425 | - * |
|
426 | - * @access public |
|
427 | - * @return array The list of allowed elements. |
|
428 | - * @since PHP5 OOP 1.0.2 |
|
429 | - */ |
|
430 | - public function DumpElements() |
|
431 | - { |
|
432 | - return $this->allowed_html; |
|
433 | - } |
|
434 | - |
|
435 | - |
|
436 | - /** |
|
437 | - * Adds valid (X)HTML with corresponding attributes that will be kept when stripping 'evil scripts'. |
|
438 | - * |
|
439 | - * This method accepts one argument that can be either a string |
|
440 | - * or an array of strings. Invalid data will be ignored. |
|
441 | - * |
|
442 | - * @access public |
|
443 | - * @param string $tag (X)HTML tag that will be allowed after stripping text. |
|
444 | - * @param array $attribs Associative array of allowed attributes - key => attribute name - value => attribute parameter |
|
445 | - * @return bool Status of Adding (X)HTML and attributes. |
|
446 | - * @since PHP4 OOP 0.0.1 |
|
447 | - */ |
|
448 | - public function AddHTML($tag = "", $attribs = array()) |
|
449 | - { |
|
450 | - if(!is_string($tag)) |
|
451 | - { |
|
452 | - trigger_error("kses5::AddHTML() requires the tag to be a string", E_USER_WARNING); |
|
453 | - return false; |
|
454 | - } |
|
455 | - |
|
456 | - $tag = strtolower(trim($tag)); |
|
457 | - if($tag == "") |
|
458 | - { |
|
459 | - trigger_error("kses5::AddHTML() tried to add an empty/NULL tag", E_USER_WARNING); |
|
460 | - return false; |
|
461 | - } |
|
462 | - |
|
463 | - if(!is_array($attribs)) |
|
464 | - { |
|
465 | - trigger_error("kses5::AddHTML() requires an array (even an empty one) of attributes for '$tag'", E_USER_WARNING); |
|
466 | - return false; |
|
467 | - } |
|
468 | - |
|
469 | - $new_attribs = array(); |
|
470 | - if(is_array($attribs) && count($attribs) > 0) |
|
471 | - { |
|
472 | - foreach($attribs as $idx1 => $val1) |
|
473 | - { |
|
474 | - $new_idx1 = strtolower($idx1); |
|
475 | - $new_val1 = $attribs[$idx1]; |
|
476 | - |
|
477 | - if(is_array($new_val1) && count($attribs) > 0) |
|
478 | - { |
|
479 | - $tmp_val = array(); |
|
480 | - foreach($new_val1 as $idx2 => $val2) |
|
481 | - { |
|
482 | - $new_idx2 = strtolower($idx2); |
|
483 | - $tmp_val[$new_idx2] = $val2; |
|
484 | - } |
|
485 | - $new_val1 = $tmp_val; |
|
486 | - } |
|
487 | - |
|
488 | - $new_attribs[$new_idx1] = $new_val1; |
|
489 | - } |
|
490 | - } |
|
491 | - |
|
492 | - $this->allowed_html[$tag] = $new_attribs; |
|
493 | - return true; |
|
494 | - } |
|
495 | - |
|
496 | - /** |
|
497 | - * This method removes any NULL characters in $string. |
|
498 | - * |
|
499 | - * @access private |
|
500 | - * @param string $string |
|
501 | - * @return string String without any NULL/chr(173) |
|
502 | - * @since PHP4 OOP 0.0.1 |
|
503 | - */ |
|
504 | - private function removeNulls($string) |
|
505 | - { |
|
506 | - $string = preg_replace('/\0+/', '', $string); |
|
507 | - $string = preg_replace('/(\\\\0)+/', '', $string); |
|
508 | - return $string; |
|
509 | - } |
|
510 | - |
|
511 | - /** |
|
512 | - * Normalizes HTML entities |
|
513 | - * |
|
514 | - * This function normalizes HTML entities. It will convert "AT&T" to the correct |
|
515 | - * "AT&T", ":" to ":", "&#XYZZY;" to "&#XYZZY;" and so on. |
|
516 | - * |
|
517 | - * @access private |
|
518 | - * @param string $string |
|
519 | - * @return string String with normalized entities |
|
520 | - * @since PHP4 OOP 0.0.1 |
|
521 | - */ |
|
522 | - private function normalizeEntities($string) |
|
523 | - { |
|
524 | - # Disarm all entities by converting & to & |
|
525 | - $string = str_replace('&', '&', $string); |
|
526 | - |
|
527 | - # TODO: Change back (Keep?) the allowed entities in our entity white list |
|
528 | - |
|
529 | - # Keeps entities that start with [A-Za-z] |
|
530 | - $string = preg_replace( |
|
531 | - '/&([A-Za-z][A-Za-z0-9]{0,19});/', |
|
532 | - '&\\1;', |
|
533 | - $string |
|
534 | - ); |
|
535 | - |
|
536 | - # Change numeric entities to valid 16 bit values |
|
537 | - |
|
538 | - $string = preg_replace( |
|
539 | - '/&#0*([0-9]{1,5});/e', |
|
540 | - '\$this->normalizeEntities16bit("\\1")', |
|
541 | - $string |
|
542 | - ); |
|
543 | - |
|
544 | - # Change &XHHHHHHH (Hex digits) to 16 bit hex values |
|
545 | - $string = preg_replace( |
|
546 | - '/&#([Xx])0*(([0-9A-Fa-f]{2}){1,2});/', |
|
547 | - '&#\\1\\2;', |
|
548 | - $string |
|
549 | - ); |
|
550 | - |
|
551 | - return $string; |
|
552 | - } |
|
553 | - |
|
554 | - /** |
|
555 | - * Helper method used by normalizeEntites() |
|
556 | - * |
|
557 | - * This method helps normalizeEntities() to only accept 16 bit values |
|
558 | - * and nothing more for &#number; entities. |
|
559 | - * |
|
560 | - * This method helps normalize_entities() during a preg_replace() |
|
561 | - * where a &#(0)*XXXXX; occurs. The '(0)*XXXXXX' value is converted to |
|
562 | - * a number and the result is returned as a numeric entity if the number |
|
563 | - * is less than 65536. Otherwise, the value is returned 'as is'. |
|
564 | - * |
|
565 | - * @access private |
|
566 | - * @param string $i |
|
567 | - * @return string Normalized numeric entity |
|
568 | - * @see normalizeEntities() |
|
569 | - * @since PHP4 OOP 0.0.1 |
|
570 | - */ |
|
571 | - private function normalizeEntities16bit($i) |
|
572 | - { |
|
573 | - return (($i > 65535) ? "&#$i;" : "&#$i;"); |
|
574 | - } |
|
575 | - |
|
576 | - /** |
|
577 | - * Allows for additional user defined modifications to text. |
|
578 | - * |
|
579 | - * This method allows for additional modifications to be performed on |
|
580 | - * a string that's being run through Parse(). Currently, it returns the |
|
581 | - * input string 'as is'. |
|
582 | - * |
|
583 | - * This method is provided for users to extend the kses class for their own |
|
584 | - * requirements. |
|
585 | - * |
|
586 | - * @access public |
|
587 | - * @param string $string String to perfrom additional modifications on. |
|
588 | - * @return string User modified string. |
|
589 | - * @see Parse() |
|
590 | - * @since PHP5 OOP 1.0.0 |
|
591 | - */ |
|
592 | - private function filterKsesTextHook($string) |
|
593 | - { |
|
594 | - return $string; |
|
595 | - } |
|
596 | - |
|
597 | - /** |
|
598 | - * Allows for additional user defined modifications to text. |
|
599 | - * |
|
600 | - * @deprecated use filterKsesTextHook() |
|
601 | - * @param string $string |
|
602 | - * @return string |
|
603 | - * @see filterKsesTextHook() |
|
604 | - * @since PHP4 OOP 0.0.1 |
|
605 | - */ |
|
606 | - private function _hook($string) |
|
607 | - { |
|
608 | - return $this->filterKsesTextHook($string); |
|
609 | - } |
|
610 | - |
|
611 | - /** |
|
612 | - * This method goes through an array, and changes the keys to all lower case. |
|
613 | - * |
|
614 | - * @access private |
|
615 | - * @param array $in_array Associative array |
|
616 | - * @return array Modified array |
|
617 | - * @since PHP4 OOP 0.0.1 |
|
618 | - */ |
|
619 | - private function makeArrayKeysLowerCase($in_array) |
|
620 | - { |
|
621 | - $out_array = array(); |
|
622 | - |
|
623 | - if(is_array($in_array) && count($in_array) > 0) |
|
624 | - { |
|
625 | - foreach ($in_array as $in_key => $in_val) |
|
626 | - { |
|
627 | - $out_key = strtolower($in_key); |
|
628 | - $out_array[$out_key] = array(); |
|
629 | - |
|
630 | - if(is_array($in_val) && count($in_val) > 0) |
|
631 | - { |
|
632 | - foreach ($in_val as $in_key2 => $in_val2) |
|
633 | - { |
|
634 | - $out_key2 = strtolower($in_key2); |
|
635 | - $out_array[$out_key][$out_key2] = $in_val2; |
|
636 | - } |
|
637 | - } |
|
638 | - } |
|
639 | - } |
|
640 | - |
|
641 | - return $out_array; |
|
642 | - } |
|
643 | - |
|
644 | - /** |
|
645 | - * This method strips out disallowed and/or mangled (X)HTML tags along with assigned attributes. |
|
646 | - * |
|
647 | - * This method does a lot of work. It rejects some very malformed things |
|
648 | - * like <:::>. It returns an empty string if the element isn't allowed (look |
|
649 | - * ma, no strip_tags()!). Otherwise it splits the tag into an element and an |
|
650 | - * allowed attribute list. |
|
651 | - * |
|
652 | - * @access private |
|
653 | - * @param string $string |
|
654 | - * @return string Modified string minus disallowed/mangled (X)HTML and attributes |
|
655 | - * @since PHP4 OOP 0.0.1 |
|
656 | - */ |
|
657 | - private function stripTags($string) |
|
658 | - { |
|
659 | - $string = preg_replace('%\\\\"%', '"', $string); |
|
660 | - |
|
661 | - if (substr($string, 0, 1) != '<') |
|
662 | - { |
|
663 | - # It matched a ">" character |
|
664 | - return '>'; |
|
665 | - } |
|
666 | - |
|
667 | - if (!preg_match('%^<\s*(/\s*)?([a-zA-Z0-9]+)([^>]*)>?$%', $string, $matches)) |
|
668 | - { |
|
669 | - # It's seriously malformed |
|
670 | - return ''; |
|
671 | - } |
|
672 | - |
|
673 | - $slash = trim($matches[1]); |
|
674 | - $elem = $matches[2]; |
|
675 | - $attrlist = $matches[3]; |
|
676 | - |
|
677 | - if ( |
|
678 | - !isset($this->allowed_html[strtolower($elem)]) || |
|
679 | - !is_array($this->allowed_html[strtolower($elem)])) |
|
680 | - { |
|
681 | - # Found an HTML element not in the white list |
|
682 | - return ''; |
|
683 | - } |
|
684 | - |
|
685 | - if ($slash != '') |
|
686 | - { |
|
687 | - return "<$slash$elem>"; |
|
688 | - } |
|
689 | - # No attributes are allowed for closing elements |
|
690 | - |
|
691 | - return $this->stripAttributes("$slash$elem", $attrlist); |
|
692 | - } |
|
693 | - |
|
694 | - /** |
|
695 | - * This method strips out disallowed attributes for (X)HTML tags. |
|
696 | - * |
|
697 | - * This method removes all attributes if none are allowed for this element. |
|
698 | - * If some are allowed it calls combAttributes() to split them further, and then it |
|
699 | - * builds up new HTML code from the data that combAttributes() returns. It also |
|
700 | - * removes "<" and ">" characters, if there are any left. One more thing it |
|
701 | - * does is to check if the tag has a closing XHTML slash, and if it does, |
|
702 | - * it puts one in the returned code as well. |
|
703 | - * |
|
704 | - * @access private |
|
705 | - * @param string $element (X)HTML tag to check |
|
706 | - * @param string $attr Text containing attributes to check for validity. |
|
707 | - * @return string Resulting valid (X)HTML or '' |
|
708 | - * @see combAttributes() |
|
709 | - * @since PHP4 OOP 0.0.1 |
|
710 | - */ |
|
711 | - private function stripAttributes($element, $attr) |
|
712 | - { |
|
713 | - # Is there a closing XHTML slash at the end of the attributes? |
|
714 | - $xhtml_slash = ''; |
|
715 | - if (preg_match('%\s/\s*$%', $attr)) |
|
716 | - { |
|
717 | - $xhtml_slash = ' /'; |
|
718 | - } |
|
719 | - |
|
720 | - # Are any attributes allowed at all for this element? |
|
721 | - if ( |
|
722 | - !isset($this->allowed_html[strtolower($element)]) || |
|
723 | - count($this->allowed_html[strtolower($element)]) == 0 |
|
724 | - ) |
|
725 | - { |
|
726 | - return "<$element$xhtml_slash>"; |
|
727 | - } |
|
728 | - |
|
729 | - # Split it |
|
730 | - $attrarr = $this->combAttributes($attr); |
|
731 | - |
|
732 | - # Go through $attrarr, and save the allowed attributes for this element |
|
733 | - # in $attr2 |
|
734 | - $attr2 = ''; |
|
735 | - if(is_array($attrarr) && count($attrarr) > 0) |
|
736 | - { |
|
737 | - foreach ($attrarr as $arreach) |
|
738 | - { |
|
739 | - if(!isset($this->allowed_html[strtolower($element)][strtolower($arreach['name'])])) |
|
740 | - { |
|
741 | - continue; |
|
742 | - } |
|
743 | - |
|
744 | - $current = $this->allowed_html[strtolower($element)][strtolower($arreach['name'])]; |
|
745 | - |
|
746 | - if (!is_array($current)) |
|
747 | - { |
|
748 | - # there are no checks |
|
749 | - $attr2 .= ' '.$arreach['whole']; |
|
750 | - } |
|
751 | - else |
|
752 | - { |
|
753 | - # there are some checks |
|
754 | - $ok = true; |
|
755 | - if(is_array($current) && count($current) > 0) |
|
756 | - { |
|
757 | - foreach ($current as $currkey => $currval) |
|
758 | - { |
|
759 | - if (!$this->checkAttributeValue($arreach['value'], $arreach['vless'], $currkey, $currval)) |
|
760 | - { |
|
761 | - $ok = false; |
|
762 | - break; |
|
763 | - } |
|
764 | - } |
|
765 | - } |
|
766 | - |
|
767 | - if ($ok) |
|
768 | - { |
|
769 | - # it passed them |
|
770 | - $attr2 .= ' '.$arreach['whole']; |
|
771 | - } |
|
772 | - } |
|
773 | - } |
|
774 | - } |
|
775 | - |
|
776 | - # Remove any "<" or ">" characters |
|
777 | - $attr2 = preg_replace('/[<>]/', '', $attr2); |
|
778 | - return "<$element$attr2$xhtml_slash>"; |
|
779 | - } |
|
780 | - |
|
781 | - /** |
|
782 | - * This method combs through an attribute list string and returns an associative array of attributes and values. |
|
783 | - * |
|
784 | - * This method does a lot of work. It parses an attribute list into an array |
|
785 | - * with attribute data, and tries to do the right thing even if it gets weird |
|
786 | - * input. It will add quotes around attribute values that don't have any quotes |
|
787 | - * or apostrophes around them, to make it easier to produce HTML code that will |
|
788 | - * conform to W3C's HTML specification. It will also remove bad URL protocols |
|
789 | - * from attribute values. |
|
790 | - * |
|
791 | - * @access private |
|
792 | - * @param string $attr Text containing tag attributes for parsing |
|
793 | - * @return array Associative array containing data on attribute and value |
|
794 | - * @since PHP4 OOP 0.0.1 |
|
795 | - */ |
|
796 | - private function combAttributes($attr) |
|
797 | - { |
|
798 | - $attrarr = array(); |
|
799 | - $mode = 0; |
|
800 | - $attrname = ''; |
|
801 | - |
|
802 | - # Loop through the whole attribute list |
|
803 | - |
|
804 | - while (strlen($attr) != 0) |
|
805 | - { |
|
806 | - # Was the last operation successful? |
|
807 | - $working = 0; |
|
808 | - |
|
809 | - switch ($mode) |
|
810 | - { |
|
811 | - case 0: # attribute name, href for instance |
|
812 | - if (preg_match('/^([-a-zA-Z]+)/', $attr, $match)) |
|
813 | - { |
|
814 | - $attrname = $match[1]; |
|
815 | - $working = $mode = 1; |
|
816 | - $attr = preg_replace('/^[-a-zA-Z]+/', '', $attr); |
|
817 | - } |
|
818 | - break; |
|
819 | - case 1: # equals sign or valueless ("selected") |
|
820 | - if (preg_match('/^\s*=\s*/', $attr)) # equals sign |
|
821 | - { |
|
822 | - $working = 1; |
|
823 | - $mode = 2; |
|
824 | - $attr = preg_replace('/^\s*=\s*/', '', $attr); |
|
825 | - break; |
|
826 | - } |
|
827 | - if (preg_match('/^\s+/', $attr)) # valueless |
|
828 | - { |
|
829 | - $working = 1; |
|
830 | - $mode = 0; |
|
831 | - $attrarr[] = array( |
|
832 | - 'name' => $attrname, |
|
833 | - 'value' => '', |
|
834 | - 'whole' => $attrname, |
|
835 | - 'vless' => 'y' |
|
836 | - ); |
|
837 | - $attr = preg_replace('/^\s+/', '', $attr); |
|
838 | - } |
|
839 | - break; |
|
840 | - case 2: # attribute value, a URL after href= for instance |
|
841 | - if (preg_match('/^"([^"]*)"(\s+|$)/', $attr, $match)) # "value" |
|
842 | - { |
|
843 | - $thisval = $this->removeBadProtocols($match[1]); |
|
844 | - $attrarr[] = array( |
|
845 | - 'name' => $attrname, |
|
846 | - 'value' => $thisval, |
|
847 | - 'whole' => $attrname . '="' . $thisval . '"', |
|
848 | - 'vless' => 'n' |
|
849 | - ); |
|
850 | - $working = 1; |
|
851 | - $mode = 0; |
|
852 | - $attr = preg_replace('/^"[^"]*"(\s+|$)/', '', $attr); |
|
853 | - break; |
|
854 | - } |
|
855 | - if (preg_match("/^'([^']*)'(\s+|$)/", $attr, $match)) # 'value' |
|
856 | - { |
|
857 | - $thisval = $this->removeBadProtocols($match[1]); |
|
858 | - $attrarr[] = array( |
|
859 | - 'name' => $attrname, |
|
860 | - 'value' => $thisval, |
|
861 | - 'whole' => "$attrname='$thisval'", |
|
862 | - 'vless' => 'n' |
|
863 | - ); |
|
864 | - $working = 1; |
|
865 | - $mode = 0; |
|
866 | - $attr = preg_replace("/^'[^']*'(\s+|$)/", '', $attr); |
|
867 | - break; |
|
868 | - } |
|
869 | - if (preg_match("%^([^\s\"']+)(\s+|$)%", $attr, $match)) # value |
|
870 | - { |
|
871 | - $thisval = $this->removeBadProtocols($match[1]); |
|
872 | - $attrarr[] = array( |
|
873 | - 'name' => $attrname, |
|
874 | - 'value' => $thisval, |
|
875 | - 'whole' => $attrname . '="' . $thisval . '"', |
|
876 | - 'vless' => 'n' |
|
877 | - ); |
|
878 | - # We add quotes to conform to W3C's HTML spec. |
|
879 | - $working = 1; |
|
880 | - $mode = 0; |
|
881 | - $attr = preg_replace("%^[^\s\"']+(\s+|$)%", '', $attr); |
|
882 | - } |
|
883 | - break; |
|
884 | - } |
|
885 | - |
|
886 | - if ($working == 0) # not well formed, remove and try again |
|
887 | - { |
|
888 | - $attr = preg_replace('/^("[^"]*("|$)|\'[^\']*(\'|$)|\S)*\s*/', '', $attr); |
|
889 | - $mode = 0; |
|
890 | - } |
|
891 | - } |
|
892 | - |
|
893 | - # special case, for when the attribute list ends with a valueless |
|
894 | - # attribute like "selected" |
|
895 | - if ($mode == 1) |
|
896 | - { |
|
897 | - $attrarr[] = array( |
|
898 | - 'name' => $attrname, |
|
899 | - 'value' => '', |
|
900 | - 'whole' => $attrname, |
|
901 | - 'vless' => 'y' |
|
902 | - ); |
|
903 | - } |
|
904 | - |
|
905 | - return $attrarr; |
|
906 | - } |
|
907 | - |
|
908 | - /** |
|
909 | - * This method removes disallowed protocols. |
|
910 | - * |
|
911 | - * This method removes all non-allowed protocols from the beginning of |
|
912 | - * $string. It ignores whitespace and the case of the letters, and it does |
|
913 | - * understand HTML entities. It does its work in a while loop, so it won't be |
|
914 | - * fooled by a string like "javascript:javascript:alert(57)". |
|
915 | - * |
|
916 | - * @access private |
|
917 | - * @param string $string String to check for protocols |
|
918 | - * @return string String with removed protocols |
|
919 | - * @since PHP4 OOP 0.0.1 |
|
920 | - */ |
|
921 | - private function removeBadProtocols($string) |
|
922 | - { |
|
923 | - $string = $this->RemoveNulls($string); |
|
924 | - $string = preg_replace('/\xad+/', '', $string); # deals with Opera "feature" |
|
925 | - $string2 = $string . 'a'; |
|
926 | - |
|
927 | - $string2 = preg_split('/:|:|:/i', $string, 2); |
|
928 | - if(isset($string2[1]) && !preg_match('%/\?%',$string2[0])) |
|
929 | - { |
|
930 | - $string = $this->filterProtocols($string2[0]).trim($string2[1]); |
|
931 | - } |
|
932 | - return $string; |
|
933 | - } |
|
934 | - |
|
935 | - /** |
|
936 | - * Helper method used by removeBadProtocols() |
|
937 | - * |
|
938 | - * This function processes URL protocols, checks to see if they're in the white- |
|
939 | - * list or not, and returns different data depending on the answer. |
|
940 | - * |
|
941 | - * @access private |
|
942 | - * @param string $string String to check for protocols |
|
943 | - * @return string String with removed protocols |
|
944 | - * @see removeBadProtocols() |
|
945 | - * @since PHP4 OOP 0.0.1 |
|
946 | - */ |
|
947 | - private function filterProtocols($string) |
|
948 | - { |
|
949 | - $string = $this->decodeEntities($string); |
|
950 | - $string = preg_replace('/\s/', '', $string); |
|
951 | - $string = $this->removeNulls($string); |
|
952 | - $string = preg_replace('/\xad+/', '', $string2); # deals with Opera "feature" |
|
953 | - $string = strtolower($string); |
|
954 | - |
|
955 | - if(is_array($this->allowed_protocols) && count($this->allowed_protocols) > 0) |
|
956 | - { |
|
957 | - foreach ($this->allowed_protocols as $one_protocol) |
|
958 | - { |
|
959 | - if (strtolower($one_protocol) == $string) |
|
960 | - { |
|
961 | - return "$string:"; |
|
962 | - } |
|
963 | - } |
|
964 | - } |
|
965 | - |
|
966 | - return ''; |
|
967 | - } |
|
968 | - |
|
969 | - /** |
|
970 | - * Controller method for performing checks on attribute values. |
|
971 | - * |
|
972 | - * This method calls the appropriate method as specified by $checkname with |
|
973 | - * the parameters $value, $vless, and $checkvalue, and returns the result |
|
974 | - * of the call. |
|
975 | - * |
|
976 | - * This method's functionality can be expanded by creating new methods |
|
977 | - * that would match checkAttributeValue[$checkname]. |
|
978 | - * |
|
979 | - * Current checks implemented are: "maxlen", "minlen", "maxval", "minval" and "valueless" |
|
980 | - * |
|
981 | - * @access private |
|
982 | - * @param string $value The value of the attribute to be checked. |
|
983 | - * @param string $vless Indicates whether the the value is supposed to be valueless |
|
984 | - * @param string $checkname The check to be performed |
|
985 | - * @param string $checkvalue The value that is to be checked against |
|
986 | - * @return bool Indicates whether the check passed or not |
|
987 | - * @since PHP5 OOP 1.0.0 |
|
988 | - */ |
|
989 | - private function checkAttributeValue($value, $vless, $checkname, $checkvalue) |
|
990 | - { |
|
991 | - $ok = true; |
|
992 | - $check_attribute_method_name = 'checkAttributeValue' . ucfirst(strtolower($checkname)); |
|
993 | - if(method_exists($this, $check_attribute_method_name)) |
|
994 | - { |
|
995 | - $ok = $this->$check_attribute_method_name($value, $checkvalue, $vless); |
|
996 | - } |
|
997 | - |
|
998 | - return $ok; |
|
999 | - } |
|
1000 | - |
|
1001 | - /** |
|
1002 | - * Helper method invoked by checkAttributeValue(). |
|
1003 | - * |
|
1004 | - * The maxlen check makes sure that the attribute value has a length not |
|
1005 | - * greater than the given value. This can be used to avoid Buffer Overflows |
|
1006 | - * in WWW clients and various Internet servers. |
|
1007 | - * |
|
1008 | - * @access private |
|
1009 | - * @param string $value The value of the attribute to be checked. |
|
1010 | - * @param int $checkvalue The maximum value allowed |
|
1011 | - * @return bool Indicates whether the check passed or not |
|
1012 | - * @see checkAttributeValue() |
|
1013 | - * @since PHP5 OOP 1.0.0 |
|
1014 | - */ |
|
1015 | - private function checkAttributeValueMaxlen($value, $checkvalue) |
|
1016 | - { |
|
1017 | - if (strlen($value) > intval($checkvalue)) |
|
1018 | - { |
|
1019 | - return false; |
|
1020 | - } |
|
1021 | - return true; |
|
1022 | - } |
|
1023 | - |
|
1024 | - /** |
|
1025 | - * Helper method invoked by checkAttributeValue(). |
|
1026 | - * |
|
1027 | - * The minlen check makes sure that the attribute value has a length not |
|
1028 | - * smaller than the given value. |
|
1029 | - * |
|
1030 | - * @access private |
|
1031 | - * @param string $value The value of the attribute to be checked. |
|
1032 | - * @param int $checkvalue The minimum value allowed |
|
1033 | - * @return bool Indicates whether the check passed or not |
|
1034 | - * @see checkAttributeValue() |
|
1035 | - * @since PHP5 OOP 1.0.0 |
|
1036 | - */ |
|
1037 | - private function checkAttributeValueMinlen($value, $checkvalue) |
|
1038 | - { |
|
1039 | - if (strlen($value) < intval($checkvalue)) |
|
1040 | - { |
|
1041 | - return false; |
|
1042 | - } |
|
1043 | - return true; |
|
1044 | - } |
|
1045 | - |
|
1046 | - /** |
|
1047 | - * Helper method invoked by checkAttributeValue(). |
|
1048 | - * |
|
1049 | - * The maxval check does two things: it checks that the attribute value is |
|
1050 | - * an integer from 0 and up, without an excessive amount of zeroes or |
|
1051 | - * whitespace (to avoid Buffer Overflows). It also checks that the attribute |
|
1052 | - * value is not greater than the given value. |
|
1053 | - * |
|
1054 | - * This check can be used to avoid Denial of Service attacks. |
|
1055 | - * |
|
1056 | - * @access private |
|
1057 | - * @param int $value The value of the attribute to be checked. |
|
1058 | - * @param int $checkvalue The maximum numeric value allowed |
|
1059 | - * @return bool Indicates whether the check passed or not |
|
1060 | - * @see checkAttributeValue() |
|
1061 | - * @since PHP5 OOP 1.0.0 |
|
1062 | - */ |
|
1063 | - private function checkAttributeValueMaxval($value, $checkvalue) |
|
1064 | - { |
|
1065 | - if (!preg_match('/^\s{0,6}[0-9]{1,6}\s{0,6}$/', $value)) |
|
1066 | - { |
|
1067 | - return false; |
|
1068 | - } |
|
1069 | - if (intval($value) > intval($checkvalue)) |
|
1070 | - { |
|
1071 | - return false; |
|
1072 | - } |
|
1073 | - return true; |
|
1074 | - } |
|
1075 | - |
|
1076 | - /** |
|
1077 | - * Helper method invoked by checkAttributeValue(). |
|
1078 | - * |
|
1079 | - * The minval check checks that the attribute value is a positive integer, |
|
1080 | - * and that it is not smaller than the given value. |
|
1081 | - * |
|
1082 | - * @access private |
|
1083 | - * @param int $value The value of the attribute to be checked. |
|
1084 | - * @param int $checkvalue The minimum numeric value allowed |
|
1085 | - * @return bool Indicates whether the check passed or not |
|
1086 | - * @see checkAttributeValue() |
|
1087 | - * @since PHP5 OOP 1.0.0 |
|
1088 | - */ |
|
1089 | - private function checkAttributeValueMinval($value, $checkvalue) |
|
1090 | - { |
|
1091 | - if (!preg_match('/^\s{0,6}[0-9]{1,6}\s{0,6}$/', $value)) |
|
1092 | - { |
|
1093 | - return false; |
|
1094 | - } |
|
1095 | - if (intval($value) < ($checkvalue)) |
|
1096 | - { |
|
1097 | - return false; |
|
1098 | - } |
|
1099 | - return true; |
|
1100 | - } |
|
1101 | - |
|
1102 | - /** |
|
1103 | - * Helper method invoked by checkAttributeValue(). |
|
1104 | - * |
|
1105 | - * The valueless check checks if the attribute has a value |
|
1106 | - * (like <a href="blah">) or not (<option selected>). If the given value |
|
1107 | - * is a "y" or a "Y", the attribute must not have a value. |
|
1108 | - * |
|
1109 | - * If the given value is an "n" or an "N", the attribute must have one. |
|
1110 | - * |
|
1111 | - * @access private |
|
1112 | - * @param int $value The value of the attribute to be checked. |
|
1113 | - * @param mixed $checkvalue This variable is ignored for this test |
|
1114 | - * @param string $vless Flag indicating if this attribute is not supposed to have an attribute |
|
1115 | - * @return bool Indicates whether the check passed or not |
|
1116 | - * @see checkAttributeValue() |
|
1117 | - * @since PHP5 OOP 1.0.0 |
|
1118 | - */ |
|
1119 | - private function checkAttributeValueValueless($value, $checkvalue, $vless) |
|
1120 | - { |
|
1121 | - if (strtolower($checkvalue) != $vless) |
|
1122 | - { |
|
1123 | - return false; |
|
1124 | - } |
|
1125 | - return true; |
|
1126 | - } |
|
1127 | - |
|
1128 | - /** |
|
1129 | - * Decodes numeric HTML entities |
|
1130 | - * |
|
1131 | - * This method decodes numeric HTML entities (A and A). It doesn't |
|
1132 | - * do anything with other entities like ä, but we don't need them in the |
|
1133 | - * URL protocol white listing system anyway. |
|
1134 | - * |
|
1135 | - * @access private |
|
1136 | - * @param string $value The entitiy to be decoded. |
|
1137 | - * @return string Decoded entity |
|
1138 | - * @since PHP4 OOP 0.0.1 |
|
1139 | - */ |
|
1140 | - private function decodeEntities($string) |
|
1141 | - { |
|
1142 | - $string = preg_replace('/&#([0-9]+);/e', 'chr("\\1")', $string); |
|
1143 | - $string = preg_replace('/&#[Xx]([0-9A-Fa-f]+);/e', 'chr(hexdec("\\1"))', $string); |
|
1144 | - return $string; |
|
1145 | - } |
|
1146 | - |
|
1147 | - /** |
|
1148 | - * Returns PHP5 OOP version # of kses. |
|
1149 | - * |
|
1150 | - * Since this class has been refactored and documented and proven to work, |
|
1151 | - * I'm fixing the version number at 1.0.0. |
|
1152 | - * |
|
1153 | - * This version is syntax compatible with the PHP4 OOP version 0.0.2. Future |
|
1154 | - * versions may not be syntax compatible. |
|
1155 | - * |
|
1156 | - * @access public |
|
1157 | - * @return string Version number |
|
1158 | - * @since PHP4 OOP 0.0.1 |
|
1159 | - */ |
|
1160 | - public function Version() |
|
1161 | - { |
|
1162 | - return 'PHP5 OOP 1.0.2'; |
|
1163 | - } |
|
1164 | - } |
|
1165 | - } |
|
113 | + private $allowed_protocols; |
|
114 | + private $allowed_html; |
|
115 | + /**#@-*/ |
|
116 | + |
|
117 | + /** |
|
118 | + * Constructor for kses. |
|
119 | + * |
|
120 | + * This sets a default collection of protocols allowed in links, and creates an |
|
121 | + * empty set of allowed HTML tags. |
|
122 | + * @since PHP5 OOP 1.0.0 |
|
123 | + */ |
|
124 | + public function __construct() |
|
125 | + { |
|
126 | + /** |
|
127 | + * You could add protocols such as ftp, new, gopher, mailto, irc, etc. |
|
128 | + * |
|
129 | + * The base values the original kses provided were: |
|
130 | + * 'http', 'https', 'ftp', 'news', 'nntp', 'telnet', 'gopher', 'mailto' |
|
131 | + */ |
|
132 | + $this->allowed_protocols = array('http', 'ftp', 'mailto'); |
|
133 | + $this->allowed_html = array(); |
|
134 | + } |
|
135 | + |
|
136 | + /** |
|
137 | + * Basic task of kses - parses $string and strips it as required. |
|
138 | + * |
|
139 | + * This method strips all the disallowed (X)HTML tags, attributes |
|
140 | + * and protocols from the input $string. |
|
141 | + * |
|
142 | + * @access public |
|
143 | + * @param string $string String to be stripped of 'evil scripts' |
|
144 | + * @return string The stripped string |
|
145 | + * @since PHP4 OOP 0.0.1 |
|
146 | + */ |
|
147 | + public function Parse($string = "") |
|
148 | + { |
|
149 | + if (get_magic_quotes_gpc()) |
|
150 | + { |
|
151 | + $string = stripslashes($string); |
|
152 | + } |
|
153 | + $string = $this->removeNulls($string); |
|
154 | + // Remove JavaScript entities from early Netscape 4 versions |
|
155 | + $string = preg_replace('%&\s*\{[^}]*(\}\s*;?|$)%', '', $string); |
|
156 | + $string = $this->normalizeEntities($string); |
|
157 | + $string = $this->filterKsesTextHook($string); |
|
158 | + $string = preg_replace('%(<' . '[^>]*' . '(>|$)' . '|>)%e', "\$this->stripTags('\\1')", $string); |
|
159 | + return $string; |
|
160 | + } |
|
161 | + |
|
162 | + /** |
|
163 | + * Allows for single/batch addition of protocols |
|
164 | + * |
|
165 | + * This method accepts one argument that can be either a string |
|
166 | + * or an array of strings. Invalid data will be ignored. |
|
167 | + * |
|
168 | + * The argument will be processed, and each string will be added |
|
169 | + * via AddProtocol(). |
|
170 | + * |
|
171 | + * @access public |
|
172 | + * @param mixed , A string or array of protocols that will be added to the internal list of allowed protocols. |
|
173 | + * @return bool Status of adding valid protocols. |
|
174 | + * @see AddProtocol() |
|
175 | + * @since PHP5 OOP 1.0.0 |
|
176 | + */ |
|
177 | + public function AddProtocols() |
|
178 | + { |
|
179 | + $c_args = func_num_args(); |
|
180 | + if($c_args != 1) |
|
181 | + { |
|
182 | + trigger_error("kses5::AddProtocols() did not receive an argument.", E_USER_WARNING); |
|
183 | + return false; |
|
184 | + } |
|
185 | + |
|
186 | + $protocol_data = func_get_arg(0); |
|
187 | + |
|
188 | + if(is_array($protocol_data) && count($protocol_data) > 0) |
|
189 | + { |
|
190 | + foreach($protocol_data as $protocol) |
|
191 | + { |
|
192 | + $this->AddProtocol($protocol); |
|
193 | + } |
|
194 | + return true; |
|
195 | + } |
|
196 | + elseif(is_string($protocol_data)) |
|
197 | + { |
|
198 | + $this->AddProtocol($protocol_data); |
|
199 | + return true; |
|
200 | + } |
|
201 | + else |
|
202 | + { |
|
203 | + trigger_error("kses5::AddProtocols() did not receive a string or an array.", E_USER_WARNING); |
|
204 | + return false; |
|
205 | + } |
|
206 | + } |
|
207 | + |
|
208 | + /** |
|
209 | + * Allows for single/batch addition of protocols |
|
210 | + * |
|
211 | + * @deprecated Use AddProtocols() |
|
212 | + * @see AddProtocols() |
|
213 | + * @return bool |
|
214 | + * @since PHP4 OOP 0.0.1 |
|
215 | + */ |
|
216 | + public function Protocols() |
|
217 | + { |
|
218 | + $c_args = func_num_args(); |
|
219 | + if($c_args != 1) |
|
220 | + { |
|
221 | + trigger_error("kses5::Protocols() did not receive an argument.", E_USER_WARNING); |
|
222 | + return false; |
|
223 | + } |
|
224 | + |
|
225 | + return $this->AddProtocols(func_get_arg(0)); |
|
226 | + } |
|
227 | + |
|
228 | + /** |
|
229 | + * Adds a single protocol to $this->allowed_protocols. |
|
230 | + * |
|
231 | + * This method accepts a string argument and adds it to |
|
232 | + * the list of allowed protocols to keep when performing |
|
233 | + * Parse(). |
|
234 | + * |
|
235 | + * @access public |
|
236 | + * @param string $protocol The name of the protocol to be added. |
|
237 | + * @return bool Status of adding valid protocol. |
|
238 | + * @since PHP4 OOP 0.0.1 |
|
239 | + */ |
|
240 | + public function AddProtocol($protocol = "") |
|
241 | + { |
|
242 | + if(!is_string($protocol)) |
|
243 | + { |
|
244 | + trigger_error("kses5::AddProtocol() requires a string.", E_USER_WARNING); |
|
245 | + return false; |
|
246 | + } |
|
247 | + |
|
248 | + // Remove any inadvertent ':' at the end of the protocol. |
|
249 | + if(substr($protocol, strlen($protocol) - 1, 1) == ":") |
|
250 | + { |
|
251 | + $protocol = substr($protocol, 0, strlen($protocol) - 1); |
|
252 | + } |
|
253 | + |
|
254 | + $protocol = strtolower(trim($protocol)); |
|
255 | + if($protocol == "") |
|
256 | + { |
|
257 | + trigger_error("kses5::AddProtocol() tried to add an empty/NULL protocol.", E_USER_WARNING); |
|
258 | + return false; |
|
259 | + } |
|
260 | + |
|
261 | + // prevent duplicate protocols from being added. |
|
262 | + if(!in_array($protocol, $this->allowed_protocols)) |
|
263 | + { |
|
264 | + array_push($this->allowed_protocols, $protocol); |
|
265 | + sort($this->allowed_protocols); |
|
266 | + } |
|
267 | + return true; |
|
268 | + } |
|
269 | + |
|
270 | + /** |
|
271 | + * Removes a single protocol from $this->allowed_protocols. |
|
272 | + * |
|
273 | + * This method accepts a string argument and removes it from |
|
274 | + * the list of allowed protocols to keep when performing |
|
275 | + * Parse(). |
|
276 | + * |
|
277 | + * @access public |
|
278 | + * @param string $protocol The name of the protocol to be removed. |
|
279 | + * @return bool Status of removing valid protocol. |
|
280 | + * @since PHP5 OOP 1.0.0 |
|
281 | + */ |
|
282 | + public function RemoveProtocol($protocol = "") |
|
283 | + { |
|
284 | + if(!is_string($protocol)) |
|
285 | + { |
|
286 | + trigger_error("kses5::RemoveProtocol() requires a string.", E_USER_WARNING); |
|
287 | + return false; |
|
288 | + } |
|
289 | + |
|
290 | + // Remove any inadvertent ':' at the end of the protocol. |
|
291 | + if(substr($protocol, strlen($protocol) - 1, 1) == ":") |
|
292 | + { |
|
293 | + $protocol = substr($protocol, 0, strlen($protocol) - 1); |
|
294 | + } |
|
295 | + |
|
296 | + $protocol = strtolower(trim($protocol)); |
|
297 | + if($protocol == "") |
|
298 | + { |
|
299 | + trigger_error("kses5::RemoveProtocol() tried to remove an empty/NULL protocol.", E_USER_WARNING); |
|
300 | + return false; |
|
301 | + } |
|
302 | + |
|
303 | + // Ensures that the protocol exists before removing it. |
|
304 | + if(in_array($protocol, $this->allowed_protocols)) |
|
305 | + { |
|
306 | + $this->allowed_protocols = array_diff($this->allowed_protocols, array($protocol)); |
|
307 | + sort($this->allowed_protocols); |
|
308 | + } |
|
309 | + |
|
310 | + return true; |
|
311 | + } |
|
312 | + |
|
313 | + /** |
|
314 | + * Allows for single/batch removal of protocols |
|
315 | + * |
|
316 | + * This method accepts one argument that can be either a string |
|
317 | + * or an array of strings. Invalid data will be ignored. |
|
318 | + * |
|
319 | + * The argument will be processed, and each string will be removed |
|
320 | + * via RemoveProtocol(). |
|
321 | + * |
|
322 | + * @access public |
|
323 | + * @param mixed , A string or array of protocols that will be removed from the internal list of allowed protocols. |
|
324 | + * @return bool Status of removing valid protocols. |
|
325 | + * @see RemoveProtocol() |
|
326 | + * @since PHP5 OOP 1.0.0 |
|
327 | + */ |
|
328 | + public function RemoveProtocols() |
|
329 | + { |
|
330 | + $c_args = func_num_args(); |
|
331 | + if($c_args != 1) |
|
332 | + { |
|
333 | + return false; |
|
334 | + } |
|
335 | + |
|
336 | + $protocol_data = func_get_arg(0); |
|
337 | + |
|
338 | + if(is_array($protocol_data) && count($protocol_data) > 0) |
|
339 | + { |
|
340 | + foreach($protocol_data as $protocol) |
|
341 | + { |
|
342 | + $this->RemoveProtocol($protocol); |
|
343 | + } |
|
344 | + } |
|
345 | + elseif(is_string($protocol_data)) |
|
346 | + { |
|
347 | + $this->RemoveProtocol($protocol_data); |
|
348 | + return true; |
|
349 | + } |
|
350 | + else |
|
351 | + { |
|
352 | + trigger_error("kses5::RemoveProtocols() did not receive a string or an array.", E_USER_WARNING); |
|
353 | + return false; |
|
354 | + } |
|
355 | + } |
|
356 | + |
|
357 | + /** |
|
358 | + * Allows for single/batch replacement of protocols |
|
359 | + * |
|
360 | + * This method accepts one argument that can be either a string |
|
361 | + * or an array of strings. Invalid data will be ignored. |
|
362 | + * |
|
363 | + * Existing protocols will be removed, then the argument will be |
|
364 | + * processed, and each string will be added via AddProtocol(). |
|
365 | + * |
|
366 | + * @access public |
|
367 | + * @param mixed , A string or array of protocols that will be the new internal list of allowed protocols. |
|
368 | + * @return bool Status of replacing valid protocols. |
|
369 | + * @since PHP5 OOP 1.0.1 |
|
370 | + * @see AddProtocol() |
|
371 | + */ |
|
372 | + public function SetProtocols() |
|
373 | + { |
|
374 | + $c_args = func_num_args(); |
|
375 | + if($c_args != 1) |
|
376 | + { |
|
377 | + trigger_error("kses5::SetProtocols() did not receive an argument.", E_USER_WARNING); |
|
378 | + return false; |
|
379 | + } |
|
380 | + |
|
381 | + $protocol_data = func_get_arg(0); |
|
382 | + |
|
383 | + if(is_array($protocol_data) && count($protocol_data) > 0) |
|
384 | + { |
|
385 | + $this->allowed_protocols = array(); |
|
386 | + foreach($protocol_data as $protocol) |
|
387 | + { |
|
388 | + $this->AddProtocol($protocol); |
|
389 | + } |
|
390 | + return true; |
|
391 | + } |
|
392 | + elseif(is_string($protocol_data)) |
|
393 | + { |
|
394 | + $this->allowed_protocols = array(); |
|
395 | + $this->AddProtocol($protocol_data); |
|
396 | + return true; |
|
397 | + } |
|
398 | + else |
|
399 | + { |
|
400 | + trigger_error("kses5::SetProtocols() did not receive a string or an array.", E_USER_WARNING); |
|
401 | + return false; |
|
402 | + } |
|
403 | + } |
|
404 | + |
|
405 | + /** |
|
406 | + * Raw dump of allowed protocols |
|
407 | + * |
|
408 | + * This returns an indexed array of allowed protocols for a particular KSES |
|
409 | + * instantiation. |
|
410 | + * |
|
411 | + * @access public |
|
412 | + * @return array The list of allowed protocols. |
|
413 | + * @since PHP5 OOP 1.0.2 |
|
414 | + */ |
|
415 | + public function DumpProtocols() |
|
416 | + { |
|
417 | + return $this->allowed_protocols; |
|
418 | + } |
|
419 | + |
|
420 | + /** |
|
421 | + * Raw dump of allowed (X)HTML elements |
|
422 | + * |
|
423 | + * This returns an indexed array of allowed (X)HTML elements and attributes |
|
424 | + * for a particular KSES instantiation. |
|
425 | + * |
|
426 | + * @access public |
|
427 | + * @return array The list of allowed elements. |
|
428 | + * @since PHP5 OOP 1.0.2 |
|
429 | + */ |
|
430 | + public function DumpElements() |
|
431 | + { |
|
432 | + return $this->allowed_html; |
|
433 | + } |
|
434 | + |
|
435 | + |
|
436 | + /** |
|
437 | + * Adds valid (X)HTML with corresponding attributes that will be kept when stripping 'evil scripts'. |
|
438 | + * |
|
439 | + * This method accepts one argument that can be either a string |
|
440 | + * or an array of strings. Invalid data will be ignored. |
|
441 | + * |
|
442 | + * @access public |
|
443 | + * @param string $tag (X)HTML tag that will be allowed after stripping text. |
|
444 | + * @param array $attribs Associative array of allowed attributes - key => attribute name - value => attribute parameter |
|
445 | + * @return bool Status of Adding (X)HTML and attributes. |
|
446 | + * @since PHP4 OOP 0.0.1 |
|
447 | + */ |
|
448 | + public function AddHTML($tag = "", $attribs = array()) |
|
449 | + { |
|
450 | + if(!is_string($tag)) |
|
451 | + { |
|
452 | + trigger_error("kses5::AddHTML() requires the tag to be a string", E_USER_WARNING); |
|
453 | + return false; |
|
454 | + } |
|
455 | + |
|
456 | + $tag = strtolower(trim($tag)); |
|
457 | + if($tag == "") |
|
458 | + { |
|
459 | + trigger_error("kses5::AddHTML() tried to add an empty/NULL tag", E_USER_WARNING); |
|
460 | + return false; |
|
461 | + } |
|
462 | + |
|
463 | + if(!is_array($attribs)) |
|
464 | + { |
|
465 | + trigger_error("kses5::AddHTML() requires an array (even an empty one) of attributes for '$tag'", E_USER_WARNING); |
|
466 | + return false; |
|
467 | + } |
|
468 | + |
|
469 | + $new_attribs = array(); |
|
470 | + if(is_array($attribs) && count($attribs) > 0) |
|
471 | + { |
|
472 | + foreach($attribs as $idx1 => $val1) |
|
473 | + { |
|
474 | + $new_idx1 = strtolower($idx1); |
|
475 | + $new_val1 = $attribs[$idx1]; |
|
476 | + |
|
477 | + if(is_array($new_val1) && count($attribs) > 0) |
|
478 | + { |
|
479 | + $tmp_val = array(); |
|
480 | + foreach($new_val1 as $idx2 => $val2) |
|
481 | + { |
|
482 | + $new_idx2 = strtolower($idx2); |
|
483 | + $tmp_val[$new_idx2] = $val2; |
|
484 | + } |
|
485 | + $new_val1 = $tmp_val; |
|
486 | + } |
|
487 | + |
|
488 | + $new_attribs[$new_idx1] = $new_val1; |
|
489 | + } |
|
490 | + } |
|
491 | + |
|
492 | + $this->allowed_html[$tag] = $new_attribs; |
|
493 | + return true; |
|
494 | + } |
|
495 | + |
|
496 | + /** |
|
497 | + * This method removes any NULL characters in $string. |
|
498 | + * |
|
499 | + * @access private |
|
500 | + * @param string $string |
|
501 | + * @return string String without any NULL/chr(173) |
|
502 | + * @since PHP4 OOP 0.0.1 |
|
503 | + */ |
|
504 | + private function removeNulls($string) |
|
505 | + { |
|
506 | + $string = preg_replace('/\0+/', '', $string); |
|
507 | + $string = preg_replace('/(\\\\0)+/', '', $string); |
|
508 | + return $string; |
|
509 | + } |
|
510 | + |
|
511 | + /** |
|
512 | + * Normalizes HTML entities |
|
513 | + * |
|
514 | + * This function normalizes HTML entities. It will convert "AT&T" to the correct |
|
515 | + * "AT&T", ":" to ":", "&#XYZZY;" to "&#XYZZY;" and so on. |
|
516 | + * |
|
517 | + * @access private |
|
518 | + * @param string $string |
|
519 | + * @return string String with normalized entities |
|
520 | + * @since PHP4 OOP 0.0.1 |
|
521 | + */ |
|
522 | + private function normalizeEntities($string) |
|
523 | + { |
|
524 | + # Disarm all entities by converting & to & |
|
525 | + $string = str_replace('&', '&', $string); |
|
526 | + |
|
527 | + # TODO: Change back (Keep?) the allowed entities in our entity white list |
|
528 | + |
|
529 | + # Keeps entities that start with [A-Za-z] |
|
530 | + $string = preg_replace( |
|
531 | + '/&([A-Za-z][A-Za-z0-9]{0,19});/', |
|
532 | + '&\\1;', |
|
533 | + $string |
|
534 | + ); |
|
535 | + |
|
536 | + # Change numeric entities to valid 16 bit values |
|
537 | + |
|
538 | + $string = preg_replace( |
|
539 | + '/&#0*([0-9]{1,5});/e', |
|
540 | + '\$this->normalizeEntities16bit("\\1")', |
|
541 | + $string |
|
542 | + ); |
|
543 | + |
|
544 | + # Change &XHHHHHHH (Hex digits) to 16 bit hex values |
|
545 | + $string = preg_replace( |
|
546 | + '/&#([Xx])0*(([0-9A-Fa-f]{2}){1,2});/', |
|
547 | + '&#\\1\\2;', |
|
548 | + $string |
|
549 | + ); |
|
550 | + |
|
551 | + return $string; |
|
552 | + } |
|
553 | + |
|
554 | + /** |
|
555 | + * Helper method used by normalizeEntites() |
|
556 | + * |
|
557 | + * This method helps normalizeEntities() to only accept 16 bit values |
|
558 | + * and nothing more for &#number; entities. |
|
559 | + * |
|
560 | + * This method helps normalize_entities() during a preg_replace() |
|
561 | + * where a &#(0)*XXXXX; occurs. The '(0)*XXXXXX' value is converted to |
|
562 | + * a number and the result is returned as a numeric entity if the number |
|
563 | + * is less than 65536. Otherwise, the value is returned 'as is'. |
|
564 | + * |
|
565 | + * @access private |
|
566 | + * @param string $i |
|
567 | + * @return string Normalized numeric entity |
|
568 | + * @see normalizeEntities() |
|
569 | + * @since PHP4 OOP 0.0.1 |
|
570 | + */ |
|
571 | + private function normalizeEntities16bit($i) |
|
572 | + { |
|
573 | + return (($i > 65535) ? "&#$i;" : "&#$i;"); |
|
574 | + } |
|
575 | + |
|
576 | + /** |
|
577 | + * Allows for additional user defined modifications to text. |
|
578 | + * |
|
579 | + * This method allows for additional modifications to be performed on |
|
580 | + * a string that's being run through Parse(). Currently, it returns the |
|
581 | + * input string 'as is'. |
|
582 | + * |
|
583 | + * This method is provided for users to extend the kses class for their own |
|
584 | + * requirements. |
|
585 | + * |
|
586 | + * @access public |
|
587 | + * @param string $string String to perfrom additional modifications on. |
|
588 | + * @return string User modified string. |
|
589 | + * @see Parse() |
|
590 | + * @since PHP5 OOP 1.0.0 |
|
591 | + */ |
|
592 | + private function filterKsesTextHook($string) |
|
593 | + { |
|
594 | + return $string; |
|
595 | + } |
|
596 | + |
|
597 | + /** |
|
598 | + * Allows for additional user defined modifications to text. |
|
599 | + * |
|
600 | + * @deprecated use filterKsesTextHook() |
|
601 | + * @param string $string |
|
602 | + * @return string |
|
603 | + * @see filterKsesTextHook() |
|
604 | + * @since PHP4 OOP 0.0.1 |
|
605 | + */ |
|
606 | + private function _hook($string) |
|
607 | + { |
|
608 | + return $this->filterKsesTextHook($string); |
|
609 | + } |
|
610 | + |
|
611 | + /** |
|
612 | + * This method goes through an array, and changes the keys to all lower case. |
|
613 | + * |
|
614 | + * @access private |
|
615 | + * @param array $in_array Associative array |
|
616 | + * @return array Modified array |
|
617 | + * @since PHP4 OOP 0.0.1 |
|
618 | + */ |
|
619 | + private function makeArrayKeysLowerCase($in_array) |
|
620 | + { |
|
621 | + $out_array = array(); |
|
622 | + |
|
623 | + if(is_array($in_array) && count($in_array) > 0) |
|
624 | + { |
|
625 | + foreach ($in_array as $in_key => $in_val) |
|
626 | + { |
|
627 | + $out_key = strtolower($in_key); |
|
628 | + $out_array[$out_key] = array(); |
|
629 | + |
|
630 | + if(is_array($in_val) && count($in_val) > 0) |
|
631 | + { |
|
632 | + foreach ($in_val as $in_key2 => $in_val2) |
|
633 | + { |
|
634 | + $out_key2 = strtolower($in_key2); |
|
635 | + $out_array[$out_key][$out_key2] = $in_val2; |
|
636 | + } |
|
637 | + } |
|
638 | + } |
|
639 | + } |
|
640 | + |
|
641 | + return $out_array; |
|
642 | + } |
|
643 | + |
|
644 | + /** |
|
645 | + * This method strips out disallowed and/or mangled (X)HTML tags along with assigned attributes. |
|
646 | + * |
|
647 | + * This method does a lot of work. It rejects some very malformed things |
|
648 | + * like <:::>. It returns an empty string if the element isn't allowed (look |
|
649 | + * ma, no strip_tags()!). Otherwise it splits the tag into an element and an |
|
650 | + * allowed attribute list. |
|
651 | + * |
|
652 | + * @access private |
|
653 | + * @param string $string |
|
654 | + * @return string Modified string minus disallowed/mangled (X)HTML and attributes |
|
655 | + * @since PHP4 OOP 0.0.1 |
|
656 | + */ |
|
657 | + private function stripTags($string) |
|
658 | + { |
|
659 | + $string = preg_replace('%\\\\"%', '"', $string); |
|
660 | + |
|
661 | + if (substr($string, 0, 1) != '<') |
|
662 | + { |
|
663 | + # It matched a ">" character |
|
664 | + return '>'; |
|
665 | + } |
|
666 | + |
|
667 | + if (!preg_match('%^<\s*(/\s*)?([a-zA-Z0-9]+)([^>]*)>?$%', $string, $matches)) |
|
668 | + { |
|
669 | + # It's seriously malformed |
|
670 | + return ''; |
|
671 | + } |
|
672 | + |
|
673 | + $slash = trim($matches[1]); |
|
674 | + $elem = $matches[2]; |
|
675 | + $attrlist = $matches[3]; |
|
676 | + |
|
677 | + if ( |
|
678 | + !isset($this->allowed_html[strtolower($elem)]) || |
|
679 | + !is_array($this->allowed_html[strtolower($elem)])) |
|
680 | + { |
|
681 | + # Found an HTML element not in the white list |
|
682 | + return ''; |
|
683 | + } |
|
684 | + |
|
685 | + if ($slash != '') |
|
686 | + { |
|
687 | + return "<$slash$elem>"; |
|
688 | + } |
|
689 | + # No attributes are allowed for closing elements |
|
690 | + |
|
691 | + return $this->stripAttributes("$slash$elem", $attrlist); |
|
692 | + } |
|
693 | + |
|
694 | + /** |
|
695 | + * This method strips out disallowed attributes for (X)HTML tags. |
|
696 | + * |
|
697 | + * This method removes all attributes if none are allowed for this element. |
|
698 | + * If some are allowed it calls combAttributes() to split them further, and then it |
|
699 | + * builds up new HTML code from the data that combAttributes() returns. It also |
|
700 | + * removes "<" and ">" characters, if there are any left. One more thing it |
|
701 | + * does is to check if the tag has a closing XHTML slash, and if it does, |
|
702 | + * it puts one in the returned code as well. |
|
703 | + * |
|
704 | + * @access private |
|
705 | + * @param string $element (X)HTML tag to check |
|
706 | + * @param string $attr Text containing attributes to check for validity. |
|
707 | + * @return string Resulting valid (X)HTML or '' |
|
708 | + * @see combAttributes() |
|
709 | + * @since PHP4 OOP 0.0.1 |
|
710 | + */ |
|
711 | + private function stripAttributes($element, $attr) |
|
712 | + { |
|
713 | + # Is there a closing XHTML slash at the end of the attributes? |
|
714 | + $xhtml_slash = ''; |
|
715 | + if (preg_match('%\s/\s*$%', $attr)) |
|
716 | + { |
|
717 | + $xhtml_slash = ' /'; |
|
718 | + } |
|
719 | + |
|
720 | + # Are any attributes allowed at all for this element? |
|
721 | + if ( |
|
722 | + !isset($this->allowed_html[strtolower($element)]) || |
|
723 | + count($this->allowed_html[strtolower($element)]) == 0 |
|
724 | + ) |
|
725 | + { |
|
726 | + return "<$element$xhtml_slash>"; |
|
727 | + } |
|
728 | + |
|
729 | + # Split it |
|
730 | + $attrarr = $this->combAttributes($attr); |
|
731 | + |
|
732 | + # Go through $attrarr, and save the allowed attributes for this element |
|
733 | + # in $attr2 |
|
734 | + $attr2 = ''; |
|
735 | + if(is_array($attrarr) && count($attrarr) > 0) |
|
736 | + { |
|
737 | + foreach ($attrarr as $arreach) |
|
738 | + { |
|
739 | + if(!isset($this->allowed_html[strtolower($element)][strtolower($arreach['name'])])) |
|
740 | + { |
|
741 | + continue; |
|
742 | + } |
|
743 | + |
|
744 | + $current = $this->allowed_html[strtolower($element)][strtolower($arreach['name'])]; |
|
745 | + |
|
746 | + if (!is_array($current)) |
|
747 | + { |
|
748 | + # there are no checks |
|
749 | + $attr2 .= ' '.$arreach['whole']; |
|
750 | + } |
|
751 | + else |
|
752 | + { |
|
753 | + # there are some checks |
|
754 | + $ok = true; |
|
755 | + if(is_array($current) && count($current) > 0) |
|
756 | + { |
|
757 | + foreach ($current as $currkey => $currval) |
|
758 | + { |
|
759 | + if (!$this->checkAttributeValue($arreach['value'], $arreach['vless'], $currkey, $currval)) |
|
760 | + { |
|
761 | + $ok = false; |
|
762 | + break; |
|
763 | + } |
|
764 | + } |
|
765 | + } |
|
766 | + |
|
767 | + if ($ok) |
|
768 | + { |
|
769 | + # it passed them |
|
770 | + $attr2 .= ' '.$arreach['whole']; |
|
771 | + } |
|
772 | + } |
|
773 | + } |
|
774 | + } |
|
775 | + |
|
776 | + # Remove any "<" or ">" characters |
|
777 | + $attr2 = preg_replace('/[<>]/', '', $attr2); |
|
778 | + return "<$element$attr2$xhtml_slash>"; |
|
779 | + } |
|
780 | + |
|
781 | + /** |
|
782 | + * This method combs through an attribute list string and returns an associative array of attributes and values. |
|
783 | + * |
|
784 | + * This method does a lot of work. It parses an attribute list into an array |
|
785 | + * with attribute data, and tries to do the right thing even if it gets weird |
|
786 | + * input. It will add quotes around attribute values that don't have any quotes |
|
787 | + * or apostrophes around them, to make it easier to produce HTML code that will |
|
788 | + * conform to W3C's HTML specification. It will also remove bad URL protocols |
|
789 | + * from attribute values. |
|
790 | + * |
|
791 | + * @access private |
|
792 | + * @param string $attr Text containing tag attributes for parsing |
|
793 | + * @return array Associative array containing data on attribute and value |
|
794 | + * @since PHP4 OOP 0.0.1 |
|
795 | + */ |
|
796 | + private function combAttributes($attr) |
|
797 | + { |
|
798 | + $attrarr = array(); |
|
799 | + $mode = 0; |
|
800 | + $attrname = ''; |
|
801 | + |
|
802 | + # Loop through the whole attribute list |
|
803 | + |
|
804 | + while (strlen($attr) != 0) |
|
805 | + { |
|
806 | + # Was the last operation successful? |
|
807 | + $working = 0; |
|
808 | + |
|
809 | + switch ($mode) |
|
810 | + { |
|
811 | + case 0: # attribute name, href for instance |
|
812 | + if (preg_match('/^([-a-zA-Z]+)/', $attr, $match)) |
|
813 | + { |
|
814 | + $attrname = $match[1]; |
|
815 | + $working = $mode = 1; |
|
816 | + $attr = preg_replace('/^[-a-zA-Z]+/', '', $attr); |
|
817 | + } |
|
818 | + break; |
|
819 | + case 1: # equals sign or valueless ("selected") |
|
820 | + if (preg_match('/^\s*=\s*/', $attr)) # equals sign |
|
821 | + { |
|
822 | + $working = 1; |
|
823 | + $mode = 2; |
|
824 | + $attr = preg_replace('/^\s*=\s*/', '', $attr); |
|
825 | + break; |
|
826 | + } |
|
827 | + if (preg_match('/^\s+/', $attr)) # valueless |
|
828 | + { |
|
829 | + $working = 1; |
|
830 | + $mode = 0; |
|
831 | + $attrarr[] = array( |
|
832 | + 'name' => $attrname, |
|
833 | + 'value' => '', |
|
834 | + 'whole' => $attrname, |
|
835 | + 'vless' => 'y' |
|
836 | + ); |
|
837 | + $attr = preg_replace('/^\s+/', '', $attr); |
|
838 | + } |
|
839 | + break; |
|
840 | + case 2: # attribute value, a URL after href= for instance |
|
841 | + if (preg_match('/^"([^"]*)"(\s+|$)/', $attr, $match)) # "value" |
|
842 | + { |
|
843 | + $thisval = $this->removeBadProtocols($match[1]); |
|
844 | + $attrarr[] = array( |
|
845 | + 'name' => $attrname, |
|
846 | + 'value' => $thisval, |
|
847 | + 'whole' => $attrname . '="' . $thisval . '"', |
|
848 | + 'vless' => 'n' |
|
849 | + ); |
|
850 | + $working = 1; |
|
851 | + $mode = 0; |
|
852 | + $attr = preg_replace('/^"[^"]*"(\s+|$)/', '', $attr); |
|
853 | + break; |
|
854 | + } |
|
855 | + if (preg_match("/^'([^']*)'(\s+|$)/", $attr, $match)) # 'value' |
|
856 | + { |
|
857 | + $thisval = $this->removeBadProtocols($match[1]); |
|
858 | + $attrarr[] = array( |
|
859 | + 'name' => $attrname, |
|
860 | + 'value' => $thisval, |
|
861 | + 'whole' => "$attrname='$thisval'", |
|
862 | + 'vless' => 'n' |
|
863 | + ); |
|
864 | + $working = 1; |
|
865 | + $mode = 0; |
|
866 | + $attr = preg_replace("/^'[^']*'(\s+|$)/", '', $attr); |
|
867 | + break; |
|
868 | + } |
|
869 | + if (preg_match("%^([^\s\"']+)(\s+|$)%", $attr, $match)) # value |
|
870 | + { |
|
871 | + $thisval = $this->removeBadProtocols($match[1]); |
|
872 | + $attrarr[] = array( |
|
873 | + 'name' => $attrname, |
|
874 | + 'value' => $thisval, |
|
875 | + 'whole' => $attrname . '="' . $thisval . '"', |
|
876 | + 'vless' => 'n' |
|
877 | + ); |
|
878 | + # We add quotes to conform to W3C's HTML spec. |
|
879 | + $working = 1; |
|
880 | + $mode = 0; |
|
881 | + $attr = preg_replace("%^[^\s\"']+(\s+|$)%", '', $attr); |
|
882 | + } |
|
883 | + break; |
|
884 | + } |
|
885 | + |
|
886 | + if ($working == 0) # not well formed, remove and try again |
|
887 | + { |
|
888 | + $attr = preg_replace('/^("[^"]*("|$)|\'[^\']*(\'|$)|\S)*\s*/', '', $attr); |
|
889 | + $mode = 0; |
|
890 | + } |
|
891 | + } |
|
892 | + |
|
893 | + # special case, for when the attribute list ends with a valueless |
|
894 | + # attribute like "selected" |
|
895 | + if ($mode == 1) |
|
896 | + { |
|
897 | + $attrarr[] = array( |
|
898 | + 'name' => $attrname, |
|
899 | + 'value' => '', |
|
900 | + 'whole' => $attrname, |
|
901 | + 'vless' => 'y' |
|
902 | + ); |
|
903 | + } |
|
904 | + |
|
905 | + return $attrarr; |
|
906 | + } |
|
907 | + |
|
908 | + /** |
|
909 | + * This method removes disallowed protocols. |
|
910 | + * |
|
911 | + * This method removes all non-allowed protocols from the beginning of |
|
912 | + * $string. It ignores whitespace and the case of the letters, and it does |
|
913 | + * understand HTML entities. It does its work in a while loop, so it won't be |
|
914 | + * fooled by a string like "javascript:javascript:alert(57)". |
|
915 | + * |
|
916 | + * @access private |
|
917 | + * @param string $string String to check for protocols |
|
918 | + * @return string String with removed protocols |
|
919 | + * @since PHP4 OOP 0.0.1 |
|
920 | + */ |
|
921 | + private function removeBadProtocols($string) |
|
922 | + { |
|
923 | + $string = $this->RemoveNulls($string); |
|
924 | + $string = preg_replace('/\xad+/', '', $string); # deals with Opera "feature" |
|
925 | + $string2 = $string . 'a'; |
|
926 | + |
|
927 | + $string2 = preg_split('/:|:|:/i', $string, 2); |
|
928 | + if(isset($string2[1]) && !preg_match('%/\?%',$string2[0])) |
|
929 | + { |
|
930 | + $string = $this->filterProtocols($string2[0]).trim($string2[1]); |
|
931 | + } |
|
932 | + return $string; |
|
933 | + } |
|
934 | + |
|
935 | + /** |
|
936 | + * Helper method used by removeBadProtocols() |
|
937 | + * |
|
938 | + * This function processes URL protocols, checks to see if they're in the white- |
|
939 | + * list or not, and returns different data depending on the answer. |
|
940 | + * |
|
941 | + * @access private |
|
942 | + * @param string $string String to check for protocols |
|
943 | + * @return string String with removed protocols |
|
944 | + * @see removeBadProtocols() |
|
945 | + * @since PHP4 OOP 0.0.1 |
|
946 | + */ |
|
947 | + private function filterProtocols($string) |
|
948 | + { |
|
949 | + $string = $this->decodeEntities($string); |
|
950 | + $string = preg_replace('/\s/', '', $string); |
|
951 | + $string = $this->removeNulls($string); |
|
952 | + $string = preg_replace('/\xad+/', '', $string2); # deals with Opera "feature" |
|
953 | + $string = strtolower($string); |
|
954 | + |
|
955 | + if(is_array($this->allowed_protocols) && count($this->allowed_protocols) > 0) |
|
956 | + { |
|
957 | + foreach ($this->allowed_protocols as $one_protocol) |
|
958 | + { |
|
959 | + if (strtolower($one_protocol) == $string) |
|
960 | + { |
|
961 | + return "$string:"; |
|
962 | + } |
|
963 | + } |
|
964 | + } |
|
965 | + |
|
966 | + return ''; |
|
967 | + } |
|
968 | + |
|
969 | + /** |
|
970 | + * Controller method for performing checks on attribute values. |
|
971 | + * |
|
972 | + * This method calls the appropriate method as specified by $checkname with |
|
973 | + * the parameters $value, $vless, and $checkvalue, and returns the result |
|
974 | + * of the call. |
|
975 | + * |
|
976 | + * This method's functionality can be expanded by creating new methods |
|
977 | + * that would match checkAttributeValue[$checkname]. |
|
978 | + * |
|
979 | + * Current checks implemented are: "maxlen", "minlen", "maxval", "minval" and "valueless" |
|
980 | + * |
|
981 | + * @access private |
|
982 | + * @param string $value The value of the attribute to be checked. |
|
983 | + * @param string $vless Indicates whether the the value is supposed to be valueless |
|
984 | + * @param string $checkname The check to be performed |
|
985 | + * @param string $checkvalue The value that is to be checked against |
|
986 | + * @return bool Indicates whether the check passed or not |
|
987 | + * @since PHP5 OOP 1.0.0 |
|
988 | + */ |
|
989 | + private function checkAttributeValue($value, $vless, $checkname, $checkvalue) |
|
990 | + { |
|
991 | + $ok = true; |
|
992 | + $check_attribute_method_name = 'checkAttributeValue' . ucfirst(strtolower($checkname)); |
|
993 | + if(method_exists($this, $check_attribute_method_name)) |
|
994 | + { |
|
995 | + $ok = $this->$check_attribute_method_name($value, $checkvalue, $vless); |
|
996 | + } |
|
997 | + |
|
998 | + return $ok; |
|
999 | + } |
|
1000 | + |
|
1001 | + /** |
|
1002 | + * Helper method invoked by checkAttributeValue(). |
|
1003 | + * |
|
1004 | + * The maxlen check makes sure that the attribute value has a length not |
|
1005 | + * greater than the given value. This can be used to avoid Buffer Overflows |
|
1006 | + * in WWW clients and various Internet servers. |
|
1007 | + * |
|
1008 | + * @access private |
|
1009 | + * @param string $value The value of the attribute to be checked. |
|
1010 | + * @param int $checkvalue The maximum value allowed |
|
1011 | + * @return bool Indicates whether the check passed or not |
|
1012 | + * @see checkAttributeValue() |
|
1013 | + * @since PHP5 OOP 1.0.0 |
|
1014 | + */ |
|
1015 | + private function checkAttributeValueMaxlen($value, $checkvalue) |
|
1016 | + { |
|
1017 | + if (strlen($value) > intval($checkvalue)) |
|
1018 | + { |
|
1019 | + return false; |
|
1020 | + } |
|
1021 | + return true; |
|
1022 | + } |
|
1023 | + |
|
1024 | + /** |
|
1025 | + * Helper method invoked by checkAttributeValue(). |
|
1026 | + * |
|
1027 | + * The minlen check makes sure that the attribute value has a length not |
|
1028 | + * smaller than the given value. |
|
1029 | + * |
|
1030 | + * @access private |
|
1031 | + * @param string $value The value of the attribute to be checked. |
|
1032 | + * @param int $checkvalue The minimum value allowed |
|
1033 | + * @return bool Indicates whether the check passed or not |
|
1034 | + * @see checkAttributeValue() |
|
1035 | + * @since PHP5 OOP 1.0.0 |
|
1036 | + */ |
|
1037 | + private function checkAttributeValueMinlen($value, $checkvalue) |
|
1038 | + { |
|
1039 | + if (strlen($value) < intval($checkvalue)) |
|
1040 | + { |
|
1041 | + return false; |
|
1042 | + } |
|
1043 | + return true; |
|
1044 | + } |
|
1045 | + |
|
1046 | + /** |
|
1047 | + * Helper method invoked by checkAttributeValue(). |
|
1048 | + * |
|
1049 | + * The maxval check does two things: it checks that the attribute value is |
|
1050 | + * an integer from 0 and up, without an excessive amount of zeroes or |
|
1051 | + * whitespace (to avoid Buffer Overflows). It also checks that the attribute |
|
1052 | + * value is not greater than the given value. |
|
1053 | + * |
|
1054 | + * This check can be used to avoid Denial of Service attacks. |
|
1055 | + * |
|
1056 | + * @access private |
|
1057 | + * @param int $value The value of the attribute to be checked. |
|
1058 | + * @param int $checkvalue The maximum numeric value allowed |
|
1059 | + * @return bool Indicates whether the check passed or not |
|
1060 | + * @see checkAttributeValue() |
|
1061 | + * @since PHP5 OOP 1.0.0 |
|
1062 | + */ |
|
1063 | + private function checkAttributeValueMaxval($value, $checkvalue) |
|
1064 | + { |
|
1065 | + if (!preg_match('/^\s{0,6}[0-9]{1,6}\s{0,6}$/', $value)) |
|
1066 | + { |
|
1067 | + return false; |
|
1068 | + } |
|
1069 | + if (intval($value) > intval($checkvalue)) |
|
1070 | + { |
|
1071 | + return false; |
|
1072 | + } |
|
1073 | + return true; |
|
1074 | + } |
|
1075 | + |
|
1076 | + /** |
|
1077 | + * Helper method invoked by checkAttributeValue(). |
|
1078 | + * |
|
1079 | + * The minval check checks that the attribute value is a positive integer, |
|
1080 | + * and that it is not smaller than the given value. |
|
1081 | + * |
|
1082 | + * @access private |
|
1083 | + * @param int $value The value of the attribute to be checked. |
|
1084 | + * @param int $checkvalue The minimum numeric value allowed |
|
1085 | + * @return bool Indicates whether the check passed or not |
|
1086 | + * @see checkAttributeValue() |
|
1087 | + * @since PHP5 OOP 1.0.0 |
|
1088 | + */ |
|
1089 | + private function checkAttributeValueMinval($value, $checkvalue) |
|
1090 | + { |
|
1091 | + if (!preg_match('/^\s{0,6}[0-9]{1,6}\s{0,6}$/', $value)) |
|
1092 | + { |
|
1093 | + return false; |
|
1094 | + } |
|
1095 | + if (intval($value) < ($checkvalue)) |
|
1096 | + { |
|
1097 | + return false; |
|
1098 | + } |
|
1099 | + return true; |
|
1100 | + } |
|
1101 | + |
|
1102 | + /** |
|
1103 | + * Helper method invoked by checkAttributeValue(). |
|
1104 | + * |
|
1105 | + * The valueless check checks if the attribute has a value |
|
1106 | + * (like <a href="blah">) or not (<option selected>). If the given value |
|
1107 | + * is a "y" or a "Y", the attribute must not have a value. |
|
1108 | + * |
|
1109 | + * If the given value is an "n" or an "N", the attribute must have one. |
|
1110 | + * |
|
1111 | + * @access private |
|
1112 | + * @param int $value The value of the attribute to be checked. |
|
1113 | + * @param mixed $checkvalue This variable is ignored for this test |
|
1114 | + * @param string $vless Flag indicating if this attribute is not supposed to have an attribute |
|
1115 | + * @return bool Indicates whether the check passed or not |
|
1116 | + * @see checkAttributeValue() |
|
1117 | + * @since PHP5 OOP 1.0.0 |
|
1118 | + */ |
|
1119 | + private function checkAttributeValueValueless($value, $checkvalue, $vless) |
|
1120 | + { |
|
1121 | + if (strtolower($checkvalue) != $vless) |
|
1122 | + { |
|
1123 | + return false; |
|
1124 | + } |
|
1125 | + return true; |
|
1126 | + } |
|
1127 | + |
|
1128 | + /** |
|
1129 | + * Decodes numeric HTML entities |
|
1130 | + * |
|
1131 | + * This method decodes numeric HTML entities (A and A). It doesn't |
|
1132 | + * do anything with other entities like ä, but we don't need them in the |
|
1133 | + * URL protocol white listing system anyway. |
|
1134 | + * |
|
1135 | + * @access private |
|
1136 | + * @param string $value The entitiy to be decoded. |
|
1137 | + * @return string Decoded entity |
|
1138 | + * @since PHP4 OOP 0.0.1 |
|
1139 | + */ |
|
1140 | + private function decodeEntities($string) |
|
1141 | + { |
|
1142 | + $string = preg_replace('/&#([0-9]+);/e', 'chr("\\1")', $string); |
|
1143 | + $string = preg_replace('/&#[Xx]([0-9A-Fa-f]+);/e', 'chr(hexdec("\\1"))', $string); |
|
1144 | + return $string; |
|
1145 | + } |
|
1146 | + |
|
1147 | + /** |
|
1148 | + * Returns PHP5 OOP version # of kses. |
|
1149 | + * |
|
1150 | + * Since this class has been refactored and documented and proven to work, |
|
1151 | + * I'm fixing the version number at 1.0.0. |
|
1152 | + * |
|
1153 | + * This version is syntax compatible with the PHP4 OOP version 0.0.2. Future |
|
1154 | + * versions may not be syntax compatible. |
|
1155 | + * |
|
1156 | + * @access public |
|
1157 | + * @return string Version number |
|
1158 | + * @since PHP4 OOP 0.0.1 |
|
1159 | + */ |
|
1160 | + public function Version() |
|
1161 | + { |
|
1162 | + return 'PHP5 OOP 1.0.2'; |
|
1163 | + } |
|
1164 | + } |
|
1165 | + } |
|
1166 | 1166 | ?> |
1167 | 1167 | \ No newline at end of file |
@@ -50,7 +50,7 @@ discard block |
||
50 | 50 | * @subpackage kses5 |
51 | 51 | */ |
52 | 52 | |
53 | - if(substr(phpversion(), 0, 1) < 5) |
|
53 | + if (substr(phpversion(), 0, 1) < 5) |
|
54 | 54 | { |
55 | 55 | die("Class kses requires PHP 5 or higher."); |
56 | 56 | } |
@@ -58,7 +58,7 @@ discard block |
||
58 | 58 | /** |
59 | 59 | * Only install KSES5 once |
60 | 60 | */ |
61 | - if(!defined('KSES_CLASS_PHP5')) |
|
61 | + if (!defined('KSES_CLASS_PHP5')) |
|
62 | 62 | { |
63 | 63 | define('KSES_CLASS_PHP5', true); |
64 | 64 | |
@@ -155,7 +155,7 @@ discard block |
||
155 | 155 | $string = preg_replace('%&\s*\{[^}]*(\}\s*;?|$)%', '', $string); |
156 | 156 | $string = $this->normalizeEntities($string); |
157 | 157 | $string = $this->filterKsesTextHook($string); |
158 | - $string = preg_replace('%(<' . '[^>]*' . '(>|$)' . '|>)%e', "\$this->stripTags('\\1')", $string); |
|
158 | + $string = preg_replace('%(<'.'[^>]*'.'(>|$)'.'|>)%e', "\$this->stripTags('\\1')", $string); |
|
159 | 159 | return $string; |
160 | 160 | } |
161 | 161 | |
@@ -177,7 +177,7 @@ discard block |
||
177 | 177 | public function AddProtocols() |
178 | 178 | { |
179 | 179 | $c_args = func_num_args(); |
180 | - if($c_args != 1) |
|
180 | + if ($c_args != 1) |
|
181 | 181 | { |
182 | 182 | trigger_error("kses5::AddProtocols() did not receive an argument.", E_USER_WARNING); |
183 | 183 | return false; |
@@ -185,15 +185,15 @@ discard block |
||
185 | 185 | |
186 | 186 | $protocol_data = func_get_arg(0); |
187 | 187 | |
188 | - if(is_array($protocol_data) && count($protocol_data) > 0) |
|
188 | + if (is_array($protocol_data) && count($protocol_data) > 0) |
|
189 | 189 | { |
190 | - foreach($protocol_data as $protocol) |
|
190 | + foreach ($protocol_data as $protocol) |
|
191 | 191 | { |
192 | 192 | $this->AddProtocol($protocol); |
193 | 193 | } |
194 | 194 | return true; |
195 | 195 | } |
196 | - elseif(is_string($protocol_data)) |
|
196 | + elseif (is_string($protocol_data)) |
|
197 | 197 | { |
198 | 198 | $this->AddProtocol($protocol_data); |
199 | 199 | return true; |
@@ -216,7 +216,7 @@ discard block |
||
216 | 216 | public function Protocols() |
217 | 217 | { |
218 | 218 | $c_args = func_num_args(); |
219 | - if($c_args != 1) |
|
219 | + if ($c_args != 1) |
|
220 | 220 | { |
221 | 221 | trigger_error("kses5::Protocols() did not receive an argument.", E_USER_WARNING); |
222 | 222 | return false; |
@@ -239,27 +239,27 @@ discard block |
||
239 | 239 | */ |
240 | 240 | public function AddProtocol($protocol = "") |
241 | 241 | { |
242 | - if(!is_string($protocol)) |
|
242 | + if (!is_string($protocol)) |
|
243 | 243 | { |
244 | 244 | trigger_error("kses5::AddProtocol() requires a string.", E_USER_WARNING); |
245 | 245 | return false; |
246 | 246 | } |
247 | 247 | |
248 | 248 | // Remove any inadvertent ':' at the end of the protocol. |
249 | - if(substr($protocol, strlen($protocol) - 1, 1) == ":") |
|
249 | + if (substr($protocol, strlen($protocol) - 1, 1) == ":") |
|
250 | 250 | { |
251 | 251 | $protocol = substr($protocol, 0, strlen($protocol) - 1); |
252 | 252 | } |
253 | 253 | |
254 | 254 | $protocol = strtolower(trim($protocol)); |
255 | - if($protocol == "") |
|
255 | + if ($protocol == "") |
|
256 | 256 | { |
257 | 257 | trigger_error("kses5::AddProtocol() tried to add an empty/NULL protocol.", E_USER_WARNING); |
258 | 258 | return false; |
259 | 259 | } |
260 | 260 | |
261 | 261 | // prevent duplicate protocols from being added. |
262 | - if(!in_array($protocol, $this->allowed_protocols)) |
|
262 | + if (!in_array($protocol, $this->allowed_protocols)) |
|
263 | 263 | { |
264 | 264 | array_push($this->allowed_protocols, $protocol); |
265 | 265 | sort($this->allowed_protocols); |
@@ -281,27 +281,27 @@ discard block |
||
281 | 281 | */ |
282 | 282 | public function RemoveProtocol($protocol = "") |
283 | 283 | { |
284 | - if(!is_string($protocol)) |
|
284 | + if (!is_string($protocol)) |
|
285 | 285 | { |
286 | 286 | trigger_error("kses5::RemoveProtocol() requires a string.", E_USER_WARNING); |
287 | 287 | return false; |
288 | 288 | } |
289 | 289 | |
290 | 290 | // Remove any inadvertent ':' at the end of the protocol. |
291 | - if(substr($protocol, strlen($protocol) - 1, 1) == ":") |
|
291 | + if (substr($protocol, strlen($protocol) - 1, 1) == ":") |
|
292 | 292 | { |
293 | 293 | $protocol = substr($protocol, 0, strlen($protocol) - 1); |
294 | 294 | } |
295 | 295 | |
296 | 296 | $protocol = strtolower(trim($protocol)); |
297 | - if($protocol == "") |
|
297 | + if ($protocol == "") |
|
298 | 298 | { |
299 | 299 | trigger_error("kses5::RemoveProtocol() tried to remove an empty/NULL protocol.", E_USER_WARNING); |
300 | 300 | return false; |
301 | 301 | } |
302 | 302 | |
303 | 303 | // Ensures that the protocol exists before removing it. |
304 | - if(in_array($protocol, $this->allowed_protocols)) |
|
304 | + if (in_array($protocol, $this->allowed_protocols)) |
|
305 | 305 | { |
306 | 306 | $this->allowed_protocols = array_diff($this->allowed_protocols, array($protocol)); |
307 | 307 | sort($this->allowed_protocols); |
@@ -328,21 +328,21 @@ discard block |
||
328 | 328 | public function RemoveProtocols() |
329 | 329 | { |
330 | 330 | $c_args = func_num_args(); |
331 | - if($c_args != 1) |
|
331 | + if ($c_args != 1) |
|
332 | 332 | { |
333 | 333 | return false; |
334 | 334 | } |
335 | 335 | |
336 | 336 | $protocol_data = func_get_arg(0); |
337 | 337 | |
338 | - if(is_array($protocol_data) && count($protocol_data) > 0) |
|
338 | + if (is_array($protocol_data) && count($protocol_data) > 0) |
|
339 | 339 | { |
340 | - foreach($protocol_data as $protocol) |
|
340 | + foreach ($protocol_data as $protocol) |
|
341 | 341 | { |
342 | 342 | $this->RemoveProtocol($protocol); |
343 | 343 | } |
344 | 344 | } |
345 | - elseif(is_string($protocol_data)) |
|
345 | + elseif (is_string($protocol_data)) |
|
346 | 346 | { |
347 | 347 | $this->RemoveProtocol($protocol_data); |
348 | 348 | return true; |
@@ -372,7 +372,7 @@ discard block |
||
372 | 372 | public function SetProtocols() |
373 | 373 | { |
374 | 374 | $c_args = func_num_args(); |
375 | - if($c_args != 1) |
|
375 | + if ($c_args != 1) |
|
376 | 376 | { |
377 | 377 | trigger_error("kses5::SetProtocols() did not receive an argument.", E_USER_WARNING); |
378 | 378 | return false; |
@@ -380,16 +380,16 @@ discard block |
||
380 | 380 | |
381 | 381 | $protocol_data = func_get_arg(0); |
382 | 382 | |
383 | - if(is_array($protocol_data) && count($protocol_data) > 0) |
|
383 | + if (is_array($protocol_data) && count($protocol_data) > 0) |
|
384 | 384 | { |
385 | 385 | $this->allowed_protocols = array(); |
386 | - foreach($protocol_data as $protocol) |
|
386 | + foreach ($protocol_data as $protocol) |
|
387 | 387 | { |
388 | 388 | $this->AddProtocol($protocol); |
389 | 389 | } |
390 | 390 | return true; |
391 | 391 | } |
392 | - elseif(is_string($protocol_data)) |
|
392 | + elseif (is_string($protocol_data)) |
|
393 | 393 | { |
394 | 394 | $this->allowed_protocols = array(); |
395 | 395 | $this->AddProtocol($protocol_data); |
@@ -447,37 +447,37 @@ discard block |
||
447 | 447 | */ |
448 | 448 | public function AddHTML($tag = "", $attribs = array()) |
449 | 449 | { |
450 | - if(!is_string($tag)) |
|
450 | + if (!is_string($tag)) |
|
451 | 451 | { |
452 | 452 | trigger_error("kses5::AddHTML() requires the tag to be a string", E_USER_WARNING); |
453 | 453 | return false; |
454 | 454 | } |
455 | 455 | |
456 | 456 | $tag = strtolower(trim($tag)); |
457 | - if($tag == "") |
|
457 | + if ($tag == "") |
|
458 | 458 | { |
459 | 459 | trigger_error("kses5::AddHTML() tried to add an empty/NULL tag", E_USER_WARNING); |
460 | 460 | return false; |
461 | 461 | } |
462 | 462 | |
463 | - if(!is_array($attribs)) |
|
463 | + if (!is_array($attribs)) |
|
464 | 464 | { |
465 | 465 | trigger_error("kses5::AddHTML() requires an array (even an empty one) of attributes for '$tag'", E_USER_WARNING); |
466 | 466 | return false; |
467 | 467 | } |
468 | 468 | |
469 | 469 | $new_attribs = array(); |
470 | - if(is_array($attribs) && count($attribs) > 0) |
|
470 | + if (is_array($attribs) && count($attribs) > 0) |
|
471 | 471 | { |
472 | - foreach($attribs as $idx1 => $val1) |
|
472 | + foreach ($attribs as $idx1 => $val1) |
|
473 | 473 | { |
474 | 474 | $new_idx1 = strtolower($idx1); |
475 | 475 | $new_val1 = $attribs[$idx1]; |
476 | 476 | |
477 | - if(is_array($new_val1) && count($attribs) > 0) |
|
477 | + if (is_array($new_val1) && count($attribs) > 0) |
|
478 | 478 | { |
479 | 479 | $tmp_val = array(); |
480 | - foreach($new_val1 as $idx2 => $val2) |
|
480 | + foreach ($new_val1 as $idx2 => $val2) |
|
481 | 481 | { |
482 | 482 | $new_idx2 = strtolower($idx2); |
483 | 483 | $tmp_val[$new_idx2] = $val2; |
@@ -620,14 +620,14 @@ discard block |
||
620 | 620 | { |
621 | 621 | $out_array = array(); |
622 | 622 | |
623 | - if(is_array($in_array) && count($in_array) > 0) |
|
623 | + if (is_array($in_array) && count($in_array) > 0) |
|
624 | 624 | { |
625 | 625 | foreach ($in_array as $in_key => $in_val) |
626 | 626 | { |
627 | 627 | $out_key = strtolower($in_key); |
628 | 628 | $out_array[$out_key] = array(); |
629 | 629 | |
630 | - if(is_array($in_val) && count($in_val) > 0) |
|
630 | + if (is_array($in_val) && count($in_val) > 0) |
|
631 | 631 | { |
632 | 632 | foreach ($in_val as $in_key2 => $in_val2) |
633 | 633 | { |
@@ -732,11 +732,11 @@ discard block |
||
732 | 732 | # Go through $attrarr, and save the allowed attributes for this element |
733 | 733 | # in $attr2 |
734 | 734 | $attr2 = ''; |
735 | - if(is_array($attrarr) && count($attrarr) > 0) |
|
735 | + if (is_array($attrarr) && count($attrarr) > 0) |
|
736 | 736 | { |
737 | 737 | foreach ($attrarr as $arreach) |
738 | 738 | { |
739 | - if(!isset($this->allowed_html[strtolower($element)][strtolower($arreach['name'])])) |
|
739 | + if (!isset($this->allowed_html[strtolower($element)][strtolower($arreach['name'])])) |
|
740 | 740 | { |
741 | 741 | continue; |
742 | 742 | } |
@@ -752,7 +752,7 @@ discard block |
||
752 | 752 | { |
753 | 753 | # there are some checks |
754 | 754 | $ok = true; |
755 | - if(is_array($current) && count($current) > 0) |
|
755 | + if (is_array($current) && count($current) > 0) |
|
756 | 756 | { |
757 | 757 | foreach ($current as $currkey => $currval) |
758 | 758 | { |
@@ -834,7 +834,7 @@ discard block |
||
834 | 834 | 'whole' => $attrname, |
835 | 835 | 'vless' => 'y' |
836 | 836 | ); |
837 | - $attr = preg_replace('/^\s+/', '', $attr); |
|
837 | + $attr = preg_replace('/^\s+/', '', $attr); |
|
838 | 838 | } |
839 | 839 | break; |
840 | 840 | case 2: # attribute value, a URL after href= for instance |
@@ -844,7 +844,7 @@ discard block |
||
844 | 844 | $attrarr[] = array( |
845 | 845 | 'name' => $attrname, |
846 | 846 | 'value' => $thisval, |
847 | - 'whole' => $attrname . '="' . $thisval . '"', |
|
847 | + 'whole' => $attrname.'="'.$thisval.'"', |
|
848 | 848 | 'vless' => 'n' |
849 | 849 | ); |
850 | 850 | $working = 1; |
@@ -872,7 +872,7 @@ discard block |
||
872 | 872 | $attrarr[] = array( |
873 | 873 | 'name' => $attrname, |
874 | 874 | 'value' => $thisval, |
875 | - 'whole' => $attrname . '="' . $thisval . '"', |
|
875 | + 'whole' => $attrname.'="'.$thisval.'"', |
|
876 | 876 | 'vless' => 'n' |
877 | 877 | ); |
878 | 878 | # We add quotes to conform to W3C's HTML spec. |
@@ -922,10 +922,10 @@ discard block |
||
922 | 922 | { |
923 | 923 | $string = $this->RemoveNulls($string); |
924 | 924 | $string = preg_replace('/\xad+/', '', $string); # deals with Opera "feature" |
925 | - $string2 = $string . 'a'; |
|
925 | + $string2 = $string.'a'; |
|
926 | 926 | |
927 | 927 | $string2 = preg_split('/:|:|:/i', $string, 2); |
928 | - if(isset($string2[1]) && !preg_match('%/\?%',$string2[0])) |
|
928 | + if (isset($string2[1]) && !preg_match('%/\?%', $string2[0])) |
|
929 | 929 | { |
930 | 930 | $string = $this->filterProtocols($string2[0]).trim($string2[1]); |
931 | 931 | } |
@@ -952,7 +952,7 @@ discard block |
||
952 | 952 | $string = preg_replace('/\xad+/', '', $string2); # deals with Opera "feature" |
953 | 953 | $string = strtolower($string); |
954 | 954 | |
955 | - if(is_array($this->allowed_protocols) && count($this->allowed_protocols) > 0) |
|
955 | + if (is_array($this->allowed_protocols) && count($this->allowed_protocols) > 0) |
|
956 | 956 | { |
957 | 957 | foreach ($this->allowed_protocols as $one_protocol) |
958 | 958 | { |
@@ -989,8 +989,8 @@ discard block |
||
989 | 989 | private function checkAttributeValue($value, $vless, $checkname, $checkvalue) |
990 | 990 | { |
991 | 991 | $ok = true; |
992 | - $check_attribute_method_name = 'checkAttributeValue' . ucfirst(strtolower($checkname)); |
|
993 | - if(method_exists($this, $check_attribute_method_name)) |
|
992 | + $check_attribute_method_name = 'checkAttributeValue'.ucfirst(strtolower($checkname)); |
|
993 | + if (method_exists($this, $check_attribute_method_name)) |
|
994 | 994 | { |
995 | 995 | $ok = $this->$check_attribute_method_name($value, $checkvalue, $vless); |
996 | 996 | } |
@@ -192,13 +192,11 @@ discard block |
||
192 | 192 | $this->AddProtocol($protocol); |
193 | 193 | } |
194 | 194 | return true; |
195 | - } |
|
196 | - elseif(is_string($protocol_data)) |
|
195 | + } elseif(is_string($protocol_data)) |
|
197 | 196 | { |
198 | 197 | $this->AddProtocol($protocol_data); |
199 | 198 | return true; |
200 | - } |
|
201 | - else |
|
199 | + } else |
|
202 | 200 | { |
203 | 201 | trigger_error("kses5::AddProtocols() did not receive a string or an array.", E_USER_WARNING); |
204 | 202 | return false; |
@@ -341,13 +339,11 @@ discard block |
||
341 | 339 | { |
342 | 340 | $this->RemoveProtocol($protocol); |
343 | 341 | } |
344 | - } |
|
345 | - elseif(is_string($protocol_data)) |
|
342 | + } elseif(is_string($protocol_data)) |
|
346 | 343 | { |
347 | 344 | $this->RemoveProtocol($protocol_data); |
348 | 345 | return true; |
349 | - } |
|
350 | - else |
|
346 | + } else |
|
351 | 347 | { |
352 | 348 | trigger_error("kses5::RemoveProtocols() did not receive a string or an array.", E_USER_WARNING); |
353 | 349 | return false; |
@@ -388,14 +384,12 @@ discard block |
||
388 | 384 | $this->AddProtocol($protocol); |
389 | 385 | } |
390 | 386 | return true; |
391 | - } |
|
392 | - elseif(is_string($protocol_data)) |
|
387 | + } elseif(is_string($protocol_data)) |
|
393 | 388 | { |
394 | 389 | $this->allowed_protocols = array(); |
395 | 390 | $this->AddProtocol($protocol_data); |
396 | 391 | return true; |
397 | - } |
|
398 | - else |
|
392 | + } else |
|
399 | 393 | { |
400 | 394 | trigger_error("kses5::SetProtocols() did not receive a string or an array.", E_USER_WARNING); |
401 | 395 | return false; |
@@ -747,8 +741,7 @@ discard block |
||
747 | 741 | { |
748 | 742 | # there are no checks |
749 | 743 | $attr2 .= ' '.$arreach['whole']; |
750 | - } |
|
751 | - else |
|
744 | + } else |
|
752 | 745 | { |
753 | 746 | # there are some checks |
754 | 747 | $ok = true; |
@@ -817,16 +810,20 @@ discard block |
||
817 | 810 | } |
818 | 811 | break; |
819 | 812 | case 1: # equals sign or valueless ("selected") |
820 | - if (preg_match('/^\s*=\s*/', $attr)) # equals sign |
|
813 | + if (preg_match('/^\s*=\s*/', $attr)) { |
|
814 | + # equals sign |
|
821 | 815 | { |
822 | 816 | $working = 1; |
817 | + } |
|
823 | 818 | $mode = 2; |
824 | 819 | $attr = preg_replace('/^\s*=\s*/', '', $attr); |
825 | 820 | break; |
826 | 821 | } |
827 | - if (preg_match('/^\s+/', $attr)) # valueless |
|
822 | + if (preg_match('/^\s+/', $attr)) { |
|
823 | + # valueless |
|
828 | 824 | { |
829 | 825 | $working = 1; |
826 | + } |
|
830 | 827 | $mode = 0; |
831 | 828 | $attrarr[] = array( |
832 | 829 | 'name' => $attrname, |
@@ -838,9 +835,11 @@ discard block |
||
838 | 835 | } |
839 | 836 | break; |
840 | 837 | case 2: # attribute value, a URL after href= for instance |
841 | - if (preg_match('/^"([^"]*)"(\s+|$)/', $attr, $match)) # "value" |
|
838 | + if (preg_match('/^"([^"]*)"(\s+|$)/', $attr, $match)) { |
|
839 | + # "value" |
|
842 | 840 | { |
843 | 841 | $thisval = $this->removeBadProtocols($match[1]); |
842 | + } |
|
844 | 843 | $attrarr[] = array( |
845 | 844 | 'name' => $attrname, |
846 | 845 | 'value' => $thisval, |
@@ -852,9 +851,11 @@ discard block |
||
852 | 851 | $attr = preg_replace('/^"[^"]*"(\s+|$)/', '', $attr); |
853 | 852 | break; |
854 | 853 | } |
855 | - if (preg_match("/^'([^']*)'(\s+|$)/", $attr, $match)) # 'value' |
|
854 | + if (preg_match("/^'([^']*)'(\s+|$)/", $attr, $match)) { |
|
855 | + # 'value' |
|
856 | 856 | { |
857 | 857 | $thisval = $this->removeBadProtocols($match[1]); |
858 | + } |
|
858 | 859 | $attrarr[] = array( |
859 | 860 | 'name' => $attrname, |
860 | 861 | 'value' => $thisval, |
@@ -866,9 +867,11 @@ discard block |
||
866 | 867 | $attr = preg_replace("/^'[^']*'(\s+|$)/", '', $attr); |
867 | 868 | break; |
868 | 869 | } |
869 | - if (preg_match("%^([^\s\"']+)(\s+|$)%", $attr, $match)) # value |
|
870 | + if (preg_match("%^([^\s\"']+)(\s+|$)%", $attr, $match)) { |
|
871 | + # value |
|
870 | 872 | { |
871 | 873 | $thisval = $this->removeBadProtocols($match[1]); |
874 | + } |
|
872 | 875 | $attrarr[] = array( |
873 | 876 | 'name' => $attrname, |
874 | 877 | 'value' => $thisval, |
@@ -883,9 +886,11 @@ discard block |
||
883 | 886 | break; |
884 | 887 | } |
885 | 888 | |
886 | - if ($working == 0) # not well formed, remove and try again |
|
889 | + if ($working == 0) { |
|
890 | + # not well formed, remove and try again |
|
887 | 891 | { |
888 | 892 | $attr = preg_replace('/^("[^"]*("|$)|\'[^\']*(\'|$)|\S)*\s*/', '', $attr); |
893 | + } |
|
889 | 894 | $mode = 0; |
890 | 895 | } |
891 | 896 | } |
@@ -121,6 +121,9 @@ |
||
121 | 121 | return $out; |
122 | 122 | } |
123 | 123 | |
124 | + /** |
|
125 | + * @param string $text |
|
126 | + */ |
|
124 | 127 | function output_code_wrap($text) |
125 | 128 | { |
126 | 129 | if(KSESTEST_ENV == 'CLI') |
@@ -1,507 +1,507 @@ |
||
1 | 1 | <?php |
2 | 2 | |
3 | - // This is a q&d program that shows some of the results of |
|
4 | - // running KSES. If you have further questions, check the |
|
5 | - // current valid email address at http://chaos.org/contact/ |
|
6 | - |
|
7 | - // Make sure we're in a usable PHP environment |
|
8 | - if(substr(phpversion(), 0, 1) < 4) |
|
9 | - { |
|
10 | - define('KSESTEST_VER', 0); |
|
11 | - } |
|
12 | - elseif(substr(phpversion(), 0, 1) >= 5) |
|
13 | - { |
|
14 | - define('KSESTEST_VER', 5); |
|
15 | - } |
|
16 | - else |
|
17 | - { |
|
18 | - define('KSESTEST_VER', 4); |
|
19 | - } |
|
20 | - |
|
21 | - // See if we're in command line or web |
|
22 | - if($_SERVER["DOCUMENT_ROOT"] == "") |
|
23 | - { |
|
24 | - define('KSESTEST_ENV', 'CLI'); |
|
25 | - } |
|
26 | - else |
|
27 | - { |
|
28 | - define('KSESTEST_ENV', 'WEB'); |
|
29 | - } |
|
30 | - |
|
31 | - if(KSESTEST_VER == 0) |
|
32 | - { |
|
33 | - $message = array( |
|
34 | - "Error: Not using a current version of PHP!", |
|
35 | - "You are using PHP version " . phpversion() . ".", |
|
36 | - "KSES Class version requires PHP4 or better.", |
|
37 | - "KSES test program ending." |
|
38 | - ); |
|
39 | - |
|
40 | - displayPage( |
|
41 | - array("title" => "Error running KSES test", "message" => $message) |
|
42 | - ); |
|
43 | - |
|
44 | - exit(); |
|
45 | - } |
|
46 | - |
|
47 | - $include_file = "php" . KSESTEST_VER . ".class.kses.php"; |
|
48 | - if(file_exists($include_file) && is_readable($include_file)) |
|
49 | - { |
|
50 | - include_once($include_file); |
|
51 | - } |
|
52 | - else |
|
53 | - { |
|
54 | - $message = array( |
|
55 | - "Error: Unable to find '" . $include_file . "'.", |
|
56 | - "Please check your include path and make sure the file is available.", |
|
57 | - "Path: " . ini_get('include_path') |
|
58 | - ); |
|
59 | - |
|
60 | - displayPage( |
|
61 | - array('title' => 'Unable to include ' . $include_file, 'message' => $message) |
|
62 | - ); |
|
63 | - |
|
64 | - exit(); |
|
65 | - } |
|
66 | - |
|
67 | - $kses_type = "kses" . KSESTEST_VER; |
|
68 | - $myKses = new $kses_type; |
|
69 | - |
|
70 | - $test_text = array(); |
|
71 | - $test_text = test1_protocols($myKses); |
|
72 | - $test_text = array_merge($test_text, test1_html($myKses)); |
|
73 | - $test_text = array_merge($test_text, test1_kses($myKses)); |
|
74 | - |
|
75 | - displayPage( |
|
76 | - array('title' => 'New Test', 'message' => $test_text) |
|
77 | - ); |
|
78 | - |
|
79 | - function test1_kses(&$myKses) |
|
80 | - { |
|
81 | - $out = array(output_hr(), "Testing current configuration"); |
|
82 | - |
|
83 | - $test_tags = array( |
|
84 | - '<a href="http://www.chaos.org/">www.chaos.org</a>', |
|
85 | - '<a name="X">Short \'a name\' tag</a>', |
|
86 | - '<td colspan="3" rowspan="5">Foo</td>', |
|
87 | - '<td rowspan="2" class="mugwump" style="background-color: rgb(255, 204 204);">Bar</td>', |
|
88 | - '<td nowrap>Very Long String running to 1000 characters...</td>', |
|
89 | - '<td bgcolor="#00ff00" nowrap>Very Long String with a blue background</td>', |
|
90 | - '<a href="proto1://www.foo.com">New protocol test</a>', |
|
91 | - '<img src="proto2://www.foo.com" />', |
|
92 | - '<a href="javascript:javascript:javascript:javascript:javascript:alert(\'Boo!\');">bleep</a>', |
|
93 | - '<a href="proto4://abc.xyz.foo.com">Another new protocol</a>', |
|
94 | - '<a href="proto9://foo.foo.foo.foo.foo.org/">Test of "proto9"</a>', |
|
95 | - '<td width="75">Bar!</td>', |
|
96 | - '<td width="200">Long Cell</td>' |
|
97 | - ); |
|
98 | - |
|
99 | - $out_li = array(); |
|
100 | - // Keep only allowed HTML from the presumed 'form'. |
|
101 | - foreach($test_tags as $tag) |
|
102 | - { |
|
103 | - $temp = $myKses->Parse($tag); |
|
104 | - $check = ($temp == $tag) ? true : false; |
|
105 | - $text = ($temp == $tag) ? 'pass' : 'fail'; |
|
106 | - |
|
107 | - $li_text = output_testresult($check, $text) . output_newline(); |
|
108 | - $li_text .= "Input: " . output_translate($tag) . output_newline(); |
|
109 | - $li_text .= "Output: " . output_translate($temp); |
|
110 | - if(KSESTEST_ENV == 'CLI') |
|
111 | - { |
|
112 | - $li_text .= output_newline(); |
|
113 | - } |
|
114 | - |
|
115 | - array_push($out_li, output_code_wrap($li_text)); |
|
116 | - } |
|
117 | - |
|
118 | - $out = array_merge($out, array(output_ul($out_li))); |
|
119 | - array_push($out, output_hr()); |
|
120 | - array_push($out, "Testing is now finished."); |
|
121 | - return $out; |
|
122 | - } |
|
123 | - |
|
124 | - function output_code_wrap($text) |
|
125 | - { |
|
126 | - if(KSESTEST_ENV == 'CLI') |
|
127 | - { |
|
128 | - return $text; |
|
129 | - } |
|
130 | - else |
|
131 | - { |
|
132 | - return "<code>\n$text<code>\n"; |
|
133 | - } |
|
134 | - } |
|
135 | - |
|
136 | - function output_translate($text) |
|
137 | - { |
|
138 | - if(KSESTEST_ENV == 'CLI') |
|
139 | - { |
|
140 | - return $text; |
|
141 | - } |
|
142 | - else |
|
143 | - { |
|
144 | - return htmlentities($text); |
|
145 | - } |
|
146 | - } |
|
147 | - |
|
148 | - function output_testresult($pass = false, $text = "") |
|
149 | - { |
|
150 | - if(KSESTEST_ENV == 'CLI') |
|
151 | - { |
|
152 | - return '[' . $text . ']'; |
|
153 | - } |
|
154 | - else |
|
155 | - { |
|
156 | - if($pass == true) |
|
157 | - { |
|
158 | - return '<span style="color: green;">[' . $text . ']</span>'; |
|
159 | - } |
|
160 | - else |
|
161 | - { |
|
162 | - return '<span style="color: red;">[' . $text . ']</span>'; |
|
163 | - } |
|
164 | - } |
|
165 | - } |
|
166 | - |
|
167 | - function output_spaces() |
|
168 | - { |
|
169 | - if(KSESTEST_ENV == 'WEB') |
|
170 | - { |
|
171 | - $out = " "; |
|
172 | - } |
|
173 | - else |
|
174 | - { |
|
175 | - $out = " "; |
|
176 | - } |
|
177 | - |
|
178 | - return $out; |
|
179 | - } |
|
180 | - |
|
181 | - function output_newline() |
|
182 | - { |
|
183 | - if(KSESTEST_ENV == 'WEB') |
|
184 | - { |
|
185 | - $out = "<br />\n"; |
|
186 | - } |
|
187 | - else |
|
188 | - { |
|
189 | - $out = "\n"; |
|
190 | - } |
|
191 | - |
|
192 | - return $out; |
|
193 | - } |
|
194 | - |
|
195 | - function displayPage($data = array()) |
|
196 | - { |
|
197 | - $title = ($data['title'] == '') ? 'No title' : $data['title']; |
|
198 | - $message = ($data['message'] == '') ? array('No message') : $data['message']; |
|
199 | - |
|
200 | - $out = ""; |
|
201 | - |
|
202 | - foreach($message as $text) |
|
203 | - { |
|
204 | - if(KSESTEST_ENV == 'WEB') |
|
205 | - { |
|
206 | - $header = "\t\t<h1>$title</h1>\n\t\t<hr />\n"; |
|
207 | - $out .= "\t\t<p>\n"; |
|
208 | - $out .= "\t\t\t$text\n"; |
|
209 | - $out .= "\t\t</p>\n"; |
|
210 | - } |
|
211 | - else |
|
212 | - { |
|
213 | - $header = "$title\n" . str_repeat('-', 60) . "\n\n"; |
|
214 | - $out .= "\t$text\n\n"; |
|
215 | - } |
|
216 | - } |
|
217 | - |
|
218 | - if(KSESTEST_ENV == 'WEB') |
|
219 | - { |
|
220 | - echo "<html>\n"; |
|
221 | - echo "\t<head>\n"; |
|
222 | - echo "\t\t<title>$title</title>\n"; |
|
223 | - echo "\t</head>\n"; |
|
224 | - echo "\t<body>\n"; |
|
225 | - echo $header; |
|
226 | - echo $out; |
|
227 | - echo "\t</body>\n"; |
|
228 | - echo "</html>\n"; |
|
229 | - } |
|
230 | - else |
|
231 | - { |
|
232 | - echo $header; |
|
233 | - echo $out; |
|
234 | - } |
|
235 | - } |
|
236 | - |
|
237 | - function output_hr() |
|
238 | - { |
|
239 | - if(KSESTEST_ENV == 'WEB') |
|
240 | - { |
|
241 | - return "\t\t\t<hr />\n"; |
|
242 | - } |
|
243 | - else |
|
244 | - { |
|
245 | - return str_repeat(60, '-') . "\n"; |
|
246 | - } |
|
247 | - } |
|
248 | - |
|
249 | - function output_ul($data = array(), $padding = "") |
|
250 | - { |
|
251 | - if(!is_array($data) || count($data) < 1) |
|
252 | - { |
|
253 | - return ""; |
|
254 | - } |
|
255 | - |
|
256 | - $text = ""; |
|
257 | - if(KSESTEST_ENV == 'WEB') |
|
258 | - { |
|
259 | - $text = "\t\t\t<ul>\n"; |
|
260 | - foreach($data as $li) |
|
261 | - { |
|
262 | - $text .= "\t\t\t\t<li>$li</li>\n"; |
|
263 | - } |
|
264 | - $text .= "\t\t\t</ul>\n"; |
|
265 | - } |
|
266 | - else |
|
267 | - { |
|
268 | - foreach($data as $li) |
|
269 | - { |
|
270 | - $text .= $padding . " * $li\n"; |
|
271 | - } |
|
272 | - } |
|
273 | - |
|
274 | - return $text; |
|
275 | - } |
|
276 | - |
|
277 | - function test1_protocols(&$myKses) |
|
278 | - { |
|
279 | - $default_prots = $myKses->dumpProtocols(); |
|
280 | - $out_text = array(); |
|
281 | - if(count($default_prots) > 0) |
|
282 | - { |
|
283 | - array_push($out_text, "Initial protocols from KSES" . KSESTEST_VER . ":"); |
|
284 | - array_push($out_text, output_ul($default_prots)); |
|
285 | - array_push($out_text, output_hr()); |
|
286 | - } |
|
287 | - |
|
288 | - $myKses->AddProtocols(array("proto1", "proto2:", "proto3")); // Add a list of protocols |
|
289 | - $myKses->AddProtocols("proto4:"); // Add a single protocol (Note ':' is optional at end) |
|
290 | - $myKses->AddProtocol("proto9", "mystery:", "anarchy"); |
|
291 | - $myKses->AddProtocol("alpha", "beta", "gamma:"); |
|
292 | - |
|
293 | - $add_protocol = "\t\t\t<ol>\n"; |
|
294 | - $add_protocol .= "\t\t\t\t" . '<li>$myKses->AddProtocols(array("proto1", "proto2:", "proto3"));</li>' . "\n"; |
|
295 | - $add_protocol .= "\t\t\t\t" . '<li>$myKses->AddProtocols("proto4:");</li>' . "\n"; |
|
296 | - $add_protocol .= "\t\t\t\t" . '<li>$myKses->AddProtocols("proto4:");</li>' . "\n"; |
|
297 | - $add_protocol .= "\t\t\t\t" . '<li>$myKses->AddProtocol("proto9", "mystery:", "anarchy");</li>' . "\n"; |
|
298 | - $add_protocol .= "\t\t\t\t" . '<li>$myKses->AddProtocol("alpha", "beta", "gamma:");</li>' . "\n"; |
|
299 | - $add_protocol .= "\t\t\t</ol>\n"; |
|
300 | - |
|
301 | - array_push($out_text, $add_protocol); |
|
302 | - |
|
303 | - $new_prots = $myKses->dumpProtocols(); |
|
304 | - if(count($new_prots) > 0) |
|
305 | - { |
|
306 | - array_push($out_text, "New protocols from KSES" . KSESTEST_VER . " after using AddProtocol(s):"); |
|
307 | - array_push($out_text, output_ul($new_prots)); |
|
308 | - array_push($out_text, output_hr()); |
|
309 | - } |
|
310 | - |
|
311 | - $myKses->RemoveProtocols(array("mystery", "anarchy:")); |
|
312 | - $myKses->RemoveProtocols("alpha:"); |
|
313 | - $myKses->RemoveProtocol("beta:"); |
|
314 | - $myKses->RemoveProtocol("gamma"); |
|
315 | - |
|
316 | - $remove_protocol = "\t\t\t<ol>\n"; |
|
317 | - $remove_protocol .= "\t\t\t\t" . '<li>$myKses->RemoveProtocols(array("mystery", "anarchy:"));</li>' . "\n"; |
|
318 | - $remove_protocol .= "\t\t\t\t" . '<li>$myKses->RemoveProtocols("alpha:");</li>' . "\n"; |
|
319 | - $remove_protocol .= "\t\t\t\t" . '<li>$myKses->RemoveProtocol("beta:");</li>' . "\n"; |
|
320 | - $remove_protocol .= "\t\t\t\t" . '<li>$myKses->RemoveProtocol("gamma");</li>' . "\n"; |
|
321 | - $remove_protocol .= "\t\t\t</ol>\n"; |
|
322 | - array_push($out_text, $remove_protocol); |
|
323 | - |
|
324 | - $new_prots = $myKses->dumpProtocols(); |
|
325 | - if(count($new_prots) > 0) |
|
326 | - { |
|
327 | - array_push($out_text, "Resulting protocols from KSES" . KSESTEST_VER . " after using RemoveProtocol(s):"); |
|
328 | - array_push($out_text, output_ul($new_prots)); |
|
329 | - array_push($out_text, output_hr()); |
|
330 | - } |
|
331 | - |
|
332 | - $myKses->SetProtocols(array("https", "gopher", "news")); |
|
333 | - $set_protocol = "\t\t\t<ol>\n"; |
|
334 | - $set_protocol .= "\t\t\t\t" . '<li>$myKses->SetProtocols(array("https", "gopher", "news"));</li>' . "\n"; |
|
335 | - $set_protocol .= "\t\t\t</ol>\n"; |
|
336 | - array_push($out_text, $set_protocol); |
|
337 | - |
|
338 | - $new_prots = $myKses->dumpProtocols(); |
|
339 | - if(count($new_prots) > 0) |
|
340 | - { |
|
341 | - array_push($out_text, "Resulting protocols from KSES" . KSESTEST_VER . " after using SetProtocols:"); |
|
342 | - array_push($out_text, output_ul($new_prots)); |
|
343 | - array_push($out_text, output_hr()); |
|
344 | - } |
|
345 | - |
|
346 | - // Invisible reset |
|
347 | - $myKses->SetProtocols(array("http", "proto1", "proto2", "proto9")); |
|
348 | - |
|
349 | - return $out_text; |
|
350 | - } |
|
351 | - |
|
352 | - function test1_html(&$myKses) |
|
353 | - { |
|
354 | - $out = array(); |
|
355 | - |
|
356 | - // Allows <p>|</p> tag |
|
357 | - $myKses->AddHTML("p"); |
|
358 | - |
|
359 | - // Allows 'a' tag with href|name attributes, |
|
360 | - // href has minlen of 10 chars, and maxlen of 25 chars |
|
361 | - // name has minlen of 2 chars |
|
362 | - $myKses->AddHTML( |
|
363 | - "a", |
|
364 | - array( |
|
365 | - "href" => array('maxlen' => 25, 'minlen' => 10), |
|
366 | - "name" => array('minlen' => 2) |
|
367 | - ) |
|
368 | - ); |
|
369 | - |
|
370 | - // Allows 'td' tag with colspan|rowspan|class|style|width|nowrap attributes, |
|
371 | - // colspan has minval of 2 and maxval of 5 |
|
372 | - // rowspan has minval of 3 and maxval of 6 |
|
373 | - // class has minlen of 1 char and maxlen of 10 chars |
|
374 | - // style has minlen of 10 chars and maxlen of 100 chars |
|
375 | - // width has maxval of 100 |
|
376 | - // nowrap is valueless |
|
377 | - $myKses->AddHTML( |
|
378 | - "td", |
|
379 | - array( |
|
380 | - "colspan" => array('minval' => 2, 'maxval' => 5), |
|
381 | - "rowspan" => array('minval' => 3, 'maxval' => 6), |
|
382 | - "class" => array("minlen" => 1, 'maxlen' => 10), |
|
383 | - "width" => array("maxval" => 100), |
|
384 | - "style" => array('minlen' => 10, 'maxlen' => 100), |
|
385 | - "nowrap" => array('valueless' => 'y') |
|
386 | - ) |
|
387 | - ); |
|
388 | - |
|
389 | - array_push($out, "Modifying HTML Tests:"); |
|
390 | - $code_text = "<pre>\n"; |
|
391 | - $code_text .= " // Allows <p>|</p> tag\n"; |
|
392 | - $code_text .= " \$myKses->AddHTML(\"p\");\n"; |
|
393 | - $code_text .= "\n"; |
|
394 | - $code_text .= " // Allows 'a' tag with href|name attributes,\n"; |
|
395 | - $code_text .= " // href has minlen of 10 chars, and maxlen of 25 chars\n"; |
|
396 | - $code_text .= " // name has minlen of 2 chars\n"; |
|
397 | - $code_text .= " \$myKses->AddHTML(\n"; |
|
398 | - $code_text .= " \"a\",\n"; |
|
399 | - $code_text .= " array(\n"; |
|
400 | - $code_text .= " \"href\" => array('maxlen' => 25, 'minlen' => 10),\n"; |
|
401 | - $code_text .= " \"name\" => array('minlen' => 2)\n"; |
|
402 | - $code_text .= " )\n"; |
|
403 | - $code_text .= " );\n"; |
|
404 | - $code_text .= "\n"; |
|
405 | - $code_text .= " // Allows 'td' tag with colspan|rowspan|class|style|width|nowrap attributes,\n"; |
|
406 | - $code_text .= " // colspan has minval of 2 and maxval of 5\n"; |
|
407 | - $code_text .= " // rowspan has minval of 3 and maxval of 6\n"; |
|
408 | - $code_text .= " // class has minlen of 1 char and maxlen of 10 chars\n"; |
|
409 | - $code_text .= " // style has minlen of 10 chars and maxlen of 100 chars\n"; |
|
410 | - $code_text .= " // width has maxval of 100\n"; |
|
411 | - $code_text .= " // nowrap is valueless\n"; |
|
412 | - $code_text .= " \$myKses->AddHTML(\n"; |
|
413 | - $code_text .= " \"td\",\n"; |
|
414 | - $code_text .= " array(\n"; |
|
415 | - $code_text .= " \"colspan\" => array('minval' => 2, 'maxval' => 5),\n"; |
|
416 | - $code_text .= " \"rowspan\" => array('minval' => 3, 'maxval' => 6),\n"; |
|
417 | - $code_text .= " \"class\" => array(\"minlen\" => 1, 'maxlen' => 10),\n"; |
|
418 | - $code_text .= " \"width\" => array(\"maxval\" => 100),\n"; |
|
419 | - $code_text .= " \"style\" => array('minlen' => 10, 'maxlen' => 100),\n"; |
|
420 | - $code_text .= " \"nowrap\" => array('valueless' => 'y')\n"; |
|
421 | - $code_text .= " )\n"; |
|
422 | - $code_text .= " );\n"; |
|
423 | - $code_text .= "</pre>\n"; |
|
424 | - |
|
425 | - array_push($out, $code_text); |
|
426 | - array_push($out, output_hr()); |
|
427 | - array_push($out, "Net results:"); |
|
428 | - |
|
429 | - $out_elems = $myKses->DumpElements(); |
|
430 | - if(count($out_elems) > 0) |
|
431 | - { |
|
432 | - //array_push($out, "\t\t\t<ul>\n"); |
|
433 | - foreach($out_elems as $tag => $attr_data) |
|
434 | - { |
|
435 | - $out_li_elems = array(); |
|
436 | - $elem_text = "(X)HTML element $tag"; |
|
437 | - $allow = ""; |
|
438 | - if(isset($attr_data) && is_array($attr_data) && count($attr_data) > 0) |
|
439 | - { |
|
440 | - $allow = " allows attribute"; |
|
441 | - if(count($attr_data) > 1) |
|
442 | - { |
|
443 | - $allow .= "s"; |
|
444 | - } |
|
445 | - $allow .= ":\n"; |
|
446 | - } |
|
447 | - |
|
448 | - array_push($out_li_elems, "$elem_text$allow"); |
|
449 | - |
|
450 | - $attr_test_li = array(); |
|
451 | - if(isset($attr_data) && is_array($attr_data) && count($attr_data) > 0) |
|
452 | - { |
|
453 | - foreach($attr_data as $attr_name => $attr_tests) |
|
454 | - { |
|
455 | - $li_text = $attr_name; |
|
456 | - if(isset($attr_tests) && count($attr_tests) > 0) |
|
457 | - { |
|
458 | - foreach($attr_tests as $test_name => $test_val) |
|
459 | - { |
|
460 | - switch($test_name) |
|
461 | - { |
|
462 | - case "maxlen": |
|
463 | - $li_text .= " - maximum length of '" . $test_val . "' characters"; |
|
464 | - break; |
|
465 | - case "minlen": |
|
466 | - $li_text .= " - minimum length of '" . $test_val . "' characters"; |
|
467 | - break; |
|
468 | - case "minval": |
|
469 | - $li_text .= " - minimum value of '" . $test_val . "'"; |
|
470 | - break; |
|
471 | - case "maxval": |
|
472 | - $li_text .= " - maximum value of '" . $test_val . "'"; |
|
473 | - break; |
|
474 | - case "valueless": |
|
475 | - switch(strtolower($test_val)) |
|
476 | - { |
|
477 | - case 'n': |
|
478 | - $li_text .= " - must not be valueless"; |
|
479 | - break; |
|
480 | - case 'y': |
|
481 | - $li_text .= " - must be valueless"; |
|
482 | - break; |
|
483 | - default: |
|
484 | - break; |
|
485 | - } |
|
486 | - break; |
|
487 | - default: |
|
488 | - break; |
|
489 | - } |
|
490 | - } |
|
491 | - } |
|
492 | - array_push($attr_test_li, $li_text); |
|
493 | - } |
|
494 | - if(count($attr_test_li) > 0) |
|
495 | - { |
|
496 | - $attr_test_li = output_ul($attr_test_li, " "); |
|
497 | - $out_li_elems = array("$elem_text$allow$attr_test_li"); |
|
498 | - } |
|
499 | - } |
|
500 | - $out = array_merge($out, $out_li_elems); |
|
501 | - } |
|
502 | - } |
|
503 | - |
|
504 | - return $out; |
|
505 | - } |
|
3 | + // This is a q&d program that shows some of the results of |
|
4 | + // running KSES. If you have further questions, check the |
|
5 | + // current valid email address at http://chaos.org/contact/ |
|
6 | + |
|
7 | + // Make sure we're in a usable PHP environment |
|
8 | + if(substr(phpversion(), 0, 1) < 4) |
|
9 | + { |
|
10 | + define('KSESTEST_VER', 0); |
|
11 | + } |
|
12 | + elseif(substr(phpversion(), 0, 1) >= 5) |
|
13 | + { |
|
14 | + define('KSESTEST_VER', 5); |
|
15 | + } |
|
16 | + else |
|
17 | + { |
|
18 | + define('KSESTEST_VER', 4); |
|
19 | + } |
|
20 | + |
|
21 | + // See if we're in command line or web |
|
22 | + if($_SERVER["DOCUMENT_ROOT"] == "") |
|
23 | + { |
|
24 | + define('KSESTEST_ENV', 'CLI'); |
|
25 | + } |
|
26 | + else |
|
27 | + { |
|
28 | + define('KSESTEST_ENV', 'WEB'); |
|
29 | + } |
|
30 | + |
|
31 | + if(KSESTEST_VER == 0) |
|
32 | + { |
|
33 | + $message = array( |
|
34 | + "Error: Not using a current version of PHP!", |
|
35 | + "You are using PHP version " . phpversion() . ".", |
|
36 | + "KSES Class version requires PHP4 or better.", |
|
37 | + "KSES test program ending." |
|
38 | + ); |
|
39 | + |
|
40 | + displayPage( |
|
41 | + array("title" => "Error running KSES test", "message" => $message) |
|
42 | + ); |
|
43 | + |
|
44 | + exit(); |
|
45 | + } |
|
46 | + |
|
47 | + $include_file = "php" . KSESTEST_VER . ".class.kses.php"; |
|
48 | + if(file_exists($include_file) && is_readable($include_file)) |
|
49 | + { |
|
50 | + include_once($include_file); |
|
51 | + } |
|
52 | + else |
|
53 | + { |
|
54 | + $message = array( |
|
55 | + "Error: Unable to find '" . $include_file . "'.", |
|
56 | + "Please check your include path and make sure the file is available.", |
|
57 | + "Path: " . ini_get('include_path') |
|
58 | + ); |
|
59 | + |
|
60 | + displayPage( |
|
61 | + array('title' => 'Unable to include ' . $include_file, 'message' => $message) |
|
62 | + ); |
|
63 | + |
|
64 | + exit(); |
|
65 | + } |
|
66 | + |
|
67 | + $kses_type = "kses" . KSESTEST_VER; |
|
68 | + $myKses = new $kses_type; |
|
69 | + |
|
70 | + $test_text = array(); |
|
71 | + $test_text = test1_protocols($myKses); |
|
72 | + $test_text = array_merge($test_text, test1_html($myKses)); |
|
73 | + $test_text = array_merge($test_text, test1_kses($myKses)); |
|
74 | + |
|
75 | + displayPage( |
|
76 | + array('title' => 'New Test', 'message' => $test_text) |
|
77 | + ); |
|
78 | + |
|
79 | + function test1_kses(&$myKses) |
|
80 | + { |
|
81 | + $out = array(output_hr(), "Testing current configuration"); |
|
82 | + |
|
83 | + $test_tags = array( |
|
84 | + '<a href="http://www.chaos.org/">www.chaos.org</a>', |
|
85 | + '<a name="X">Short \'a name\' tag</a>', |
|
86 | + '<td colspan="3" rowspan="5">Foo</td>', |
|
87 | + '<td rowspan="2" class="mugwump" style="background-color: rgb(255, 204 204);">Bar</td>', |
|
88 | + '<td nowrap>Very Long String running to 1000 characters...</td>', |
|
89 | + '<td bgcolor="#00ff00" nowrap>Very Long String with a blue background</td>', |
|
90 | + '<a href="proto1://www.foo.com">New protocol test</a>', |
|
91 | + '<img src="proto2://www.foo.com" />', |
|
92 | + '<a href="javascript:javascript:javascript:javascript:javascript:alert(\'Boo!\');">bleep</a>', |
|
93 | + '<a href="proto4://abc.xyz.foo.com">Another new protocol</a>', |
|
94 | + '<a href="proto9://foo.foo.foo.foo.foo.org/">Test of "proto9"</a>', |
|
95 | + '<td width="75">Bar!</td>', |
|
96 | + '<td width="200">Long Cell</td>' |
|
97 | + ); |
|
98 | + |
|
99 | + $out_li = array(); |
|
100 | + // Keep only allowed HTML from the presumed 'form'. |
|
101 | + foreach($test_tags as $tag) |
|
102 | + { |
|
103 | + $temp = $myKses->Parse($tag); |
|
104 | + $check = ($temp == $tag) ? true : false; |
|
105 | + $text = ($temp == $tag) ? 'pass' : 'fail'; |
|
106 | + |
|
107 | + $li_text = output_testresult($check, $text) . output_newline(); |
|
108 | + $li_text .= "Input: " . output_translate($tag) . output_newline(); |
|
109 | + $li_text .= "Output: " . output_translate($temp); |
|
110 | + if(KSESTEST_ENV == 'CLI') |
|
111 | + { |
|
112 | + $li_text .= output_newline(); |
|
113 | + } |
|
114 | + |
|
115 | + array_push($out_li, output_code_wrap($li_text)); |
|
116 | + } |
|
117 | + |
|
118 | + $out = array_merge($out, array(output_ul($out_li))); |
|
119 | + array_push($out, output_hr()); |
|
120 | + array_push($out, "Testing is now finished."); |
|
121 | + return $out; |
|
122 | + } |
|
123 | + |
|
124 | + function output_code_wrap($text) |
|
125 | + { |
|
126 | + if(KSESTEST_ENV == 'CLI') |
|
127 | + { |
|
128 | + return $text; |
|
129 | + } |
|
130 | + else |
|
131 | + { |
|
132 | + return "<code>\n$text<code>\n"; |
|
133 | + } |
|
134 | + } |
|
135 | + |
|
136 | + function output_translate($text) |
|
137 | + { |
|
138 | + if(KSESTEST_ENV == 'CLI') |
|
139 | + { |
|
140 | + return $text; |
|
141 | + } |
|
142 | + else |
|
143 | + { |
|
144 | + return htmlentities($text); |
|
145 | + } |
|
146 | + } |
|
147 | + |
|
148 | + function output_testresult($pass = false, $text = "") |
|
149 | + { |
|
150 | + if(KSESTEST_ENV == 'CLI') |
|
151 | + { |
|
152 | + return '[' . $text . ']'; |
|
153 | + } |
|
154 | + else |
|
155 | + { |
|
156 | + if($pass == true) |
|
157 | + { |
|
158 | + return '<span style="color: green;">[' . $text . ']</span>'; |
|
159 | + } |
|
160 | + else |
|
161 | + { |
|
162 | + return '<span style="color: red;">[' . $text . ']</span>'; |
|
163 | + } |
|
164 | + } |
|
165 | + } |
|
166 | + |
|
167 | + function output_spaces() |
|
168 | + { |
|
169 | + if(KSESTEST_ENV == 'WEB') |
|
170 | + { |
|
171 | + $out = " "; |
|
172 | + } |
|
173 | + else |
|
174 | + { |
|
175 | + $out = " "; |
|
176 | + } |
|
177 | + |
|
178 | + return $out; |
|
179 | + } |
|
180 | + |
|
181 | + function output_newline() |
|
182 | + { |
|
183 | + if(KSESTEST_ENV == 'WEB') |
|
184 | + { |
|
185 | + $out = "<br />\n"; |
|
186 | + } |
|
187 | + else |
|
188 | + { |
|
189 | + $out = "\n"; |
|
190 | + } |
|
191 | + |
|
192 | + return $out; |
|
193 | + } |
|
194 | + |
|
195 | + function displayPage($data = array()) |
|
196 | + { |
|
197 | + $title = ($data['title'] == '') ? 'No title' : $data['title']; |
|
198 | + $message = ($data['message'] == '') ? array('No message') : $data['message']; |
|
199 | + |
|
200 | + $out = ""; |
|
201 | + |
|
202 | + foreach($message as $text) |
|
203 | + { |
|
204 | + if(KSESTEST_ENV == 'WEB') |
|
205 | + { |
|
206 | + $header = "\t\t<h1>$title</h1>\n\t\t<hr />\n"; |
|
207 | + $out .= "\t\t<p>\n"; |
|
208 | + $out .= "\t\t\t$text\n"; |
|
209 | + $out .= "\t\t</p>\n"; |
|
210 | + } |
|
211 | + else |
|
212 | + { |
|
213 | + $header = "$title\n" . str_repeat('-', 60) . "\n\n"; |
|
214 | + $out .= "\t$text\n\n"; |
|
215 | + } |
|
216 | + } |
|
217 | + |
|
218 | + if(KSESTEST_ENV == 'WEB') |
|
219 | + { |
|
220 | + echo "<html>\n"; |
|
221 | + echo "\t<head>\n"; |
|
222 | + echo "\t\t<title>$title</title>\n"; |
|
223 | + echo "\t</head>\n"; |
|
224 | + echo "\t<body>\n"; |
|
225 | + echo $header; |
|
226 | + echo $out; |
|
227 | + echo "\t</body>\n"; |
|
228 | + echo "</html>\n"; |
|
229 | + } |
|
230 | + else |
|
231 | + { |
|
232 | + echo $header; |
|
233 | + echo $out; |
|
234 | + } |
|
235 | + } |
|
236 | + |
|
237 | + function output_hr() |
|
238 | + { |
|
239 | + if(KSESTEST_ENV == 'WEB') |
|
240 | + { |
|
241 | + return "\t\t\t<hr />\n"; |
|
242 | + } |
|
243 | + else |
|
244 | + { |
|
245 | + return str_repeat(60, '-') . "\n"; |
|
246 | + } |
|
247 | + } |
|
248 | + |
|
249 | + function output_ul($data = array(), $padding = "") |
|
250 | + { |
|
251 | + if(!is_array($data) || count($data) < 1) |
|
252 | + { |
|
253 | + return ""; |
|
254 | + } |
|
255 | + |
|
256 | + $text = ""; |
|
257 | + if(KSESTEST_ENV == 'WEB') |
|
258 | + { |
|
259 | + $text = "\t\t\t<ul>\n"; |
|
260 | + foreach($data as $li) |
|
261 | + { |
|
262 | + $text .= "\t\t\t\t<li>$li</li>\n"; |
|
263 | + } |
|
264 | + $text .= "\t\t\t</ul>\n"; |
|
265 | + } |
|
266 | + else |
|
267 | + { |
|
268 | + foreach($data as $li) |
|
269 | + { |
|
270 | + $text .= $padding . " * $li\n"; |
|
271 | + } |
|
272 | + } |
|
273 | + |
|
274 | + return $text; |
|
275 | + } |
|
276 | + |
|
277 | + function test1_protocols(&$myKses) |
|
278 | + { |
|
279 | + $default_prots = $myKses->dumpProtocols(); |
|
280 | + $out_text = array(); |
|
281 | + if(count($default_prots) > 0) |
|
282 | + { |
|
283 | + array_push($out_text, "Initial protocols from KSES" . KSESTEST_VER . ":"); |
|
284 | + array_push($out_text, output_ul($default_prots)); |
|
285 | + array_push($out_text, output_hr()); |
|
286 | + } |
|
287 | + |
|
288 | + $myKses->AddProtocols(array("proto1", "proto2:", "proto3")); // Add a list of protocols |
|
289 | + $myKses->AddProtocols("proto4:"); // Add a single protocol (Note ':' is optional at end) |
|
290 | + $myKses->AddProtocol("proto9", "mystery:", "anarchy"); |
|
291 | + $myKses->AddProtocol("alpha", "beta", "gamma:"); |
|
292 | + |
|
293 | + $add_protocol = "\t\t\t<ol>\n"; |
|
294 | + $add_protocol .= "\t\t\t\t" . '<li>$myKses->AddProtocols(array("proto1", "proto2:", "proto3"));</li>' . "\n"; |
|
295 | + $add_protocol .= "\t\t\t\t" . '<li>$myKses->AddProtocols("proto4:");</li>' . "\n"; |
|
296 | + $add_protocol .= "\t\t\t\t" . '<li>$myKses->AddProtocols("proto4:");</li>' . "\n"; |
|
297 | + $add_protocol .= "\t\t\t\t" . '<li>$myKses->AddProtocol("proto9", "mystery:", "anarchy");</li>' . "\n"; |
|
298 | + $add_protocol .= "\t\t\t\t" . '<li>$myKses->AddProtocol("alpha", "beta", "gamma:");</li>' . "\n"; |
|
299 | + $add_protocol .= "\t\t\t</ol>\n"; |
|
300 | + |
|
301 | + array_push($out_text, $add_protocol); |
|
302 | + |
|
303 | + $new_prots = $myKses->dumpProtocols(); |
|
304 | + if(count($new_prots) > 0) |
|
305 | + { |
|
306 | + array_push($out_text, "New protocols from KSES" . KSESTEST_VER . " after using AddProtocol(s):"); |
|
307 | + array_push($out_text, output_ul($new_prots)); |
|
308 | + array_push($out_text, output_hr()); |
|
309 | + } |
|
310 | + |
|
311 | + $myKses->RemoveProtocols(array("mystery", "anarchy:")); |
|
312 | + $myKses->RemoveProtocols("alpha:"); |
|
313 | + $myKses->RemoveProtocol("beta:"); |
|
314 | + $myKses->RemoveProtocol("gamma"); |
|
315 | + |
|
316 | + $remove_protocol = "\t\t\t<ol>\n"; |
|
317 | + $remove_protocol .= "\t\t\t\t" . '<li>$myKses->RemoveProtocols(array("mystery", "anarchy:"));</li>' . "\n"; |
|
318 | + $remove_protocol .= "\t\t\t\t" . '<li>$myKses->RemoveProtocols("alpha:");</li>' . "\n"; |
|
319 | + $remove_protocol .= "\t\t\t\t" . '<li>$myKses->RemoveProtocol("beta:");</li>' . "\n"; |
|
320 | + $remove_protocol .= "\t\t\t\t" . '<li>$myKses->RemoveProtocol("gamma");</li>' . "\n"; |
|
321 | + $remove_protocol .= "\t\t\t</ol>\n"; |
|
322 | + array_push($out_text, $remove_protocol); |
|
323 | + |
|
324 | + $new_prots = $myKses->dumpProtocols(); |
|
325 | + if(count($new_prots) > 0) |
|
326 | + { |
|
327 | + array_push($out_text, "Resulting protocols from KSES" . KSESTEST_VER . " after using RemoveProtocol(s):"); |
|
328 | + array_push($out_text, output_ul($new_prots)); |
|
329 | + array_push($out_text, output_hr()); |
|
330 | + } |
|
331 | + |
|
332 | + $myKses->SetProtocols(array("https", "gopher", "news")); |
|
333 | + $set_protocol = "\t\t\t<ol>\n"; |
|
334 | + $set_protocol .= "\t\t\t\t" . '<li>$myKses->SetProtocols(array("https", "gopher", "news"));</li>' . "\n"; |
|
335 | + $set_protocol .= "\t\t\t</ol>\n"; |
|
336 | + array_push($out_text, $set_protocol); |
|
337 | + |
|
338 | + $new_prots = $myKses->dumpProtocols(); |
|
339 | + if(count($new_prots) > 0) |
|
340 | + { |
|
341 | + array_push($out_text, "Resulting protocols from KSES" . KSESTEST_VER . " after using SetProtocols:"); |
|
342 | + array_push($out_text, output_ul($new_prots)); |
|
343 | + array_push($out_text, output_hr()); |
|
344 | + } |
|
345 | + |
|
346 | + // Invisible reset |
|
347 | + $myKses->SetProtocols(array("http", "proto1", "proto2", "proto9")); |
|
348 | + |
|
349 | + return $out_text; |
|
350 | + } |
|
351 | + |
|
352 | + function test1_html(&$myKses) |
|
353 | + { |
|
354 | + $out = array(); |
|
355 | + |
|
356 | + // Allows <p>|</p> tag |
|
357 | + $myKses->AddHTML("p"); |
|
358 | + |
|
359 | + // Allows 'a' tag with href|name attributes, |
|
360 | + // href has minlen of 10 chars, and maxlen of 25 chars |
|
361 | + // name has minlen of 2 chars |
|
362 | + $myKses->AddHTML( |
|
363 | + "a", |
|
364 | + array( |
|
365 | + "href" => array('maxlen' => 25, 'minlen' => 10), |
|
366 | + "name" => array('minlen' => 2) |
|
367 | + ) |
|
368 | + ); |
|
369 | + |
|
370 | + // Allows 'td' tag with colspan|rowspan|class|style|width|nowrap attributes, |
|
371 | + // colspan has minval of 2 and maxval of 5 |
|
372 | + // rowspan has minval of 3 and maxval of 6 |
|
373 | + // class has minlen of 1 char and maxlen of 10 chars |
|
374 | + // style has minlen of 10 chars and maxlen of 100 chars |
|
375 | + // width has maxval of 100 |
|
376 | + // nowrap is valueless |
|
377 | + $myKses->AddHTML( |
|
378 | + "td", |
|
379 | + array( |
|
380 | + "colspan" => array('minval' => 2, 'maxval' => 5), |
|
381 | + "rowspan" => array('minval' => 3, 'maxval' => 6), |
|
382 | + "class" => array("minlen" => 1, 'maxlen' => 10), |
|
383 | + "width" => array("maxval" => 100), |
|
384 | + "style" => array('minlen' => 10, 'maxlen' => 100), |
|
385 | + "nowrap" => array('valueless' => 'y') |
|
386 | + ) |
|
387 | + ); |
|
388 | + |
|
389 | + array_push($out, "Modifying HTML Tests:"); |
|
390 | + $code_text = "<pre>\n"; |
|
391 | + $code_text .= " // Allows <p>|</p> tag\n"; |
|
392 | + $code_text .= " \$myKses->AddHTML(\"p\");\n"; |
|
393 | + $code_text .= "\n"; |
|
394 | + $code_text .= " // Allows 'a' tag with href|name attributes,\n"; |
|
395 | + $code_text .= " // href has minlen of 10 chars, and maxlen of 25 chars\n"; |
|
396 | + $code_text .= " // name has minlen of 2 chars\n"; |
|
397 | + $code_text .= " \$myKses->AddHTML(\n"; |
|
398 | + $code_text .= " \"a\",\n"; |
|
399 | + $code_text .= " array(\n"; |
|
400 | + $code_text .= " \"href\" => array('maxlen' => 25, 'minlen' => 10),\n"; |
|
401 | + $code_text .= " \"name\" => array('minlen' => 2)\n"; |
|
402 | + $code_text .= " )\n"; |
|
403 | + $code_text .= " );\n"; |
|
404 | + $code_text .= "\n"; |
|
405 | + $code_text .= " // Allows 'td' tag with colspan|rowspan|class|style|width|nowrap attributes,\n"; |
|
406 | + $code_text .= " // colspan has minval of 2 and maxval of 5\n"; |
|
407 | + $code_text .= " // rowspan has minval of 3 and maxval of 6\n"; |
|
408 | + $code_text .= " // class has minlen of 1 char and maxlen of 10 chars\n"; |
|
409 | + $code_text .= " // style has minlen of 10 chars and maxlen of 100 chars\n"; |
|
410 | + $code_text .= " // width has maxval of 100\n"; |
|
411 | + $code_text .= " // nowrap is valueless\n"; |
|
412 | + $code_text .= " \$myKses->AddHTML(\n"; |
|
413 | + $code_text .= " \"td\",\n"; |
|
414 | + $code_text .= " array(\n"; |
|
415 | + $code_text .= " \"colspan\" => array('minval' => 2, 'maxval' => 5),\n"; |
|
416 | + $code_text .= " \"rowspan\" => array('minval' => 3, 'maxval' => 6),\n"; |
|
417 | + $code_text .= " \"class\" => array(\"minlen\" => 1, 'maxlen' => 10),\n"; |
|
418 | + $code_text .= " \"width\" => array(\"maxval\" => 100),\n"; |
|
419 | + $code_text .= " \"style\" => array('minlen' => 10, 'maxlen' => 100),\n"; |
|
420 | + $code_text .= " \"nowrap\" => array('valueless' => 'y')\n"; |
|
421 | + $code_text .= " )\n"; |
|
422 | + $code_text .= " );\n"; |
|
423 | + $code_text .= "</pre>\n"; |
|
424 | + |
|
425 | + array_push($out, $code_text); |
|
426 | + array_push($out, output_hr()); |
|
427 | + array_push($out, "Net results:"); |
|
428 | + |
|
429 | + $out_elems = $myKses->DumpElements(); |
|
430 | + if(count($out_elems) > 0) |
|
431 | + { |
|
432 | + //array_push($out, "\t\t\t<ul>\n"); |
|
433 | + foreach($out_elems as $tag => $attr_data) |
|
434 | + { |
|
435 | + $out_li_elems = array(); |
|
436 | + $elem_text = "(X)HTML element $tag"; |
|
437 | + $allow = ""; |
|
438 | + if(isset($attr_data) && is_array($attr_data) && count($attr_data) > 0) |
|
439 | + { |
|
440 | + $allow = " allows attribute"; |
|
441 | + if(count($attr_data) > 1) |
|
442 | + { |
|
443 | + $allow .= "s"; |
|
444 | + } |
|
445 | + $allow .= ":\n"; |
|
446 | + } |
|
447 | + |
|
448 | + array_push($out_li_elems, "$elem_text$allow"); |
|
449 | + |
|
450 | + $attr_test_li = array(); |
|
451 | + if(isset($attr_data) && is_array($attr_data) && count($attr_data) > 0) |
|
452 | + { |
|
453 | + foreach($attr_data as $attr_name => $attr_tests) |
|
454 | + { |
|
455 | + $li_text = $attr_name; |
|
456 | + if(isset($attr_tests) && count($attr_tests) > 0) |
|
457 | + { |
|
458 | + foreach($attr_tests as $test_name => $test_val) |
|
459 | + { |
|
460 | + switch($test_name) |
|
461 | + { |
|
462 | + case "maxlen": |
|
463 | + $li_text .= " - maximum length of '" . $test_val . "' characters"; |
|
464 | + break; |
|
465 | + case "minlen": |
|
466 | + $li_text .= " - minimum length of '" . $test_val . "' characters"; |
|
467 | + break; |
|
468 | + case "minval": |
|
469 | + $li_text .= " - minimum value of '" . $test_val . "'"; |
|
470 | + break; |
|
471 | + case "maxval": |
|
472 | + $li_text .= " - maximum value of '" . $test_val . "'"; |
|
473 | + break; |
|
474 | + case "valueless": |
|
475 | + switch(strtolower($test_val)) |
|
476 | + { |
|
477 | + case 'n': |
|
478 | + $li_text .= " - must not be valueless"; |
|
479 | + break; |
|
480 | + case 'y': |
|
481 | + $li_text .= " - must be valueless"; |
|
482 | + break; |
|
483 | + default: |
|
484 | + break; |
|
485 | + } |
|
486 | + break; |
|
487 | + default: |
|
488 | + break; |
|
489 | + } |
|
490 | + } |
|
491 | + } |
|
492 | + array_push($attr_test_li, $li_text); |
|
493 | + } |
|
494 | + if(count($attr_test_li) > 0) |
|
495 | + { |
|
496 | + $attr_test_li = output_ul($attr_test_li, " "); |
|
497 | + $out_li_elems = array("$elem_text$allow$attr_test_li"); |
|
498 | + } |
|
499 | + } |
|
500 | + $out = array_merge($out, $out_li_elems); |
|
501 | + } |
|
502 | + } |
|
503 | + |
|
504 | + return $out; |
|
505 | + } |
|
506 | 506 | |
507 | 507 | ?> |
508 | 508 | \ No newline at end of file |
@@ -5,11 +5,11 @@ discard block |
||
5 | 5 | // current valid email address at http://chaos.org/contact/ |
6 | 6 | |
7 | 7 | // Make sure we're in a usable PHP environment |
8 | - if(substr(phpversion(), 0, 1) < 4) |
|
8 | + if (substr(phpversion(), 0, 1) < 4) |
|
9 | 9 | { |
10 | 10 | define('KSESTEST_VER', 0); |
11 | 11 | } |
12 | - elseif(substr(phpversion(), 0, 1) >= 5) |
|
12 | + elseif (substr(phpversion(), 0, 1) >= 5) |
|
13 | 13 | { |
14 | 14 | define('KSESTEST_VER', 5); |
15 | 15 | } |
@@ -19,7 +19,7 @@ discard block |
||
19 | 19 | } |
20 | 20 | |
21 | 21 | // See if we're in command line or web |
22 | - if($_SERVER["DOCUMENT_ROOT"] == "") |
|
22 | + if ($_SERVER["DOCUMENT_ROOT"] == "") |
|
23 | 23 | { |
24 | 24 | define('KSESTEST_ENV', 'CLI'); |
25 | 25 | } |
@@ -28,11 +28,11 @@ discard block |
||
28 | 28 | define('KSESTEST_ENV', 'WEB'); |
29 | 29 | } |
30 | 30 | |
31 | - if(KSESTEST_VER == 0) |
|
31 | + if (KSESTEST_VER == 0) |
|
32 | 32 | { |
33 | 33 | $message = array( |
34 | 34 | "Error: Not using a current version of PHP!", |
35 | - "You are using PHP version " . phpversion() . ".", |
|
35 | + "You are using PHP version ".phpversion().".", |
|
36 | 36 | "KSES Class version requires PHP4 or better.", |
37 | 37 | "KSES test program ending." |
38 | 38 | ); |
@@ -44,27 +44,27 @@ discard block |
||
44 | 44 | exit(); |
45 | 45 | } |
46 | 46 | |
47 | - $include_file = "php" . KSESTEST_VER . ".class.kses.php"; |
|
48 | - if(file_exists($include_file) && is_readable($include_file)) |
|
47 | + $include_file = "php".KSESTEST_VER.".class.kses.php"; |
|
48 | + if (file_exists($include_file) && is_readable($include_file)) |
|
49 | 49 | { |
50 | 50 | include_once($include_file); |
51 | 51 | } |
52 | 52 | else |
53 | 53 | { |
54 | 54 | $message = array( |
55 | - "Error: Unable to find '" . $include_file . "'.", |
|
55 | + "Error: Unable to find '".$include_file."'.", |
|
56 | 56 | "Please check your include path and make sure the file is available.", |
57 | - "Path: " . ini_get('include_path') |
|
57 | + "Path: ".ini_get('include_path') |
|
58 | 58 | ); |
59 | 59 | |
60 | 60 | displayPage( |
61 | - array('title' => 'Unable to include ' . $include_file, 'message' => $message) |
|
61 | + array('title' => 'Unable to include '.$include_file, 'message' => $message) |
|
62 | 62 | ); |
63 | 63 | |
64 | 64 | exit(); |
65 | 65 | } |
66 | 66 | |
67 | - $kses_type = "kses" . KSESTEST_VER; |
|
67 | + $kses_type = "kses".KSESTEST_VER; |
|
68 | 68 | $myKses = new $kses_type; |
69 | 69 | |
70 | 70 | $test_text = array(); |
@@ -98,16 +98,16 @@ discard block |
||
98 | 98 | |
99 | 99 | $out_li = array(); |
100 | 100 | // Keep only allowed HTML from the presumed 'form'. |
101 | - foreach($test_tags as $tag) |
|
101 | + foreach ($test_tags as $tag) |
|
102 | 102 | { |
103 | 103 | $temp = $myKses->Parse($tag); |
104 | 104 | $check = ($temp == $tag) ? true : false; |
105 | 105 | $text = ($temp == $tag) ? 'pass' : 'fail'; |
106 | 106 | |
107 | - $li_text = output_testresult($check, $text) . output_newline(); |
|
108 | - $li_text .= "Input: " . output_translate($tag) . output_newline(); |
|
109 | - $li_text .= "Output: " . output_translate($temp); |
|
110 | - if(KSESTEST_ENV == 'CLI') |
|
107 | + $li_text = output_testresult($check, $text).output_newline(); |
|
108 | + $li_text .= "Input: ".output_translate($tag).output_newline(); |
|
109 | + $li_text .= "Output: ".output_translate($temp); |
|
110 | + if (KSESTEST_ENV == 'CLI') |
|
111 | 111 | { |
112 | 112 | $li_text .= output_newline(); |
113 | 113 | } |
@@ -123,7 +123,7 @@ discard block |
||
123 | 123 | |
124 | 124 | function output_code_wrap($text) |
125 | 125 | { |
126 | - if(KSESTEST_ENV == 'CLI') |
|
126 | + if (KSESTEST_ENV == 'CLI') |
|
127 | 127 | { |
128 | 128 | return $text; |
129 | 129 | } |
@@ -135,7 +135,7 @@ discard block |
||
135 | 135 | |
136 | 136 | function output_translate($text) |
137 | 137 | { |
138 | - if(KSESTEST_ENV == 'CLI') |
|
138 | + if (KSESTEST_ENV == 'CLI') |
|
139 | 139 | { |
140 | 140 | return $text; |
141 | 141 | } |
@@ -147,26 +147,26 @@ discard block |
||
147 | 147 | |
148 | 148 | function output_testresult($pass = false, $text = "") |
149 | 149 | { |
150 | - if(KSESTEST_ENV == 'CLI') |
|
150 | + if (KSESTEST_ENV == 'CLI') |
|
151 | 151 | { |
152 | - return '[' . $text . ']'; |
|
152 | + return '['.$text.']'; |
|
153 | 153 | } |
154 | 154 | else |
155 | 155 | { |
156 | - if($pass == true) |
|
156 | + if ($pass == true) |
|
157 | 157 | { |
158 | - return '<span style="color: green;">[' . $text . ']</span>'; |
|
158 | + return '<span style="color: green;">['.$text.']</span>'; |
|
159 | 159 | } |
160 | 160 | else |
161 | 161 | { |
162 | - return '<span style="color: red;">[' . $text . ']</span>'; |
|
162 | + return '<span style="color: red;">['.$text.']</span>'; |
|
163 | 163 | } |
164 | 164 | } |
165 | 165 | } |
166 | 166 | |
167 | 167 | function output_spaces() |
168 | 168 | { |
169 | - if(KSESTEST_ENV == 'WEB') |
|
169 | + if (KSESTEST_ENV == 'WEB') |
|
170 | 170 | { |
171 | 171 | $out = " "; |
172 | 172 | } |
@@ -180,7 +180,7 @@ discard block |
||
180 | 180 | |
181 | 181 | function output_newline() |
182 | 182 | { |
183 | - if(KSESTEST_ENV == 'WEB') |
|
183 | + if (KSESTEST_ENV == 'WEB') |
|
184 | 184 | { |
185 | 185 | $out = "<br />\n"; |
186 | 186 | } |
@@ -199,9 +199,9 @@ discard block |
||
199 | 199 | |
200 | 200 | $out = ""; |
201 | 201 | |
202 | - foreach($message as $text) |
|
202 | + foreach ($message as $text) |
|
203 | 203 | { |
204 | - if(KSESTEST_ENV == 'WEB') |
|
204 | + if (KSESTEST_ENV == 'WEB') |
|
205 | 205 | { |
206 | 206 | $header = "\t\t<h1>$title</h1>\n\t\t<hr />\n"; |
207 | 207 | $out .= "\t\t<p>\n"; |
@@ -210,12 +210,12 @@ discard block |
||
210 | 210 | } |
211 | 211 | else |
212 | 212 | { |
213 | - $header = "$title\n" . str_repeat('-', 60) . "\n\n"; |
|
213 | + $header = "$title\n".str_repeat('-', 60)."\n\n"; |
|
214 | 214 | $out .= "\t$text\n\n"; |
215 | 215 | } |
216 | 216 | } |
217 | 217 | |
218 | - if(KSESTEST_ENV == 'WEB') |
|
218 | + if (KSESTEST_ENV == 'WEB') |
|
219 | 219 | { |
220 | 220 | echo "<html>\n"; |
221 | 221 | echo "\t<head>\n"; |
@@ -236,28 +236,28 @@ discard block |
||
236 | 236 | |
237 | 237 | function output_hr() |
238 | 238 | { |
239 | - if(KSESTEST_ENV == 'WEB') |
|
239 | + if (KSESTEST_ENV == 'WEB') |
|
240 | 240 | { |
241 | 241 | return "\t\t\t<hr />\n"; |
242 | 242 | } |
243 | 243 | else |
244 | 244 | { |
245 | - return str_repeat(60, '-') . "\n"; |
|
245 | + return str_repeat(60, '-')."\n"; |
|
246 | 246 | } |
247 | 247 | } |
248 | 248 | |
249 | 249 | function output_ul($data = array(), $padding = "") |
250 | 250 | { |
251 | - if(!is_array($data) || count($data) < 1) |
|
251 | + if (!is_array($data) || count($data) < 1) |
|
252 | 252 | { |
253 | 253 | return ""; |
254 | 254 | } |
255 | 255 | |
256 | 256 | $text = ""; |
257 | - if(KSESTEST_ENV == 'WEB') |
|
257 | + if (KSESTEST_ENV == 'WEB') |
|
258 | 258 | { |
259 | 259 | $text = "\t\t\t<ul>\n"; |
260 | - foreach($data as $li) |
|
260 | + foreach ($data as $li) |
|
261 | 261 | { |
262 | 262 | $text .= "\t\t\t\t<li>$li</li>\n"; |
263 | 263 | } |
@@ -265,9 +265,9 @@ discard block |
||
265 | 265 | } |
266 | 266 | else |
267 | 267 | { |
268 | - foreach($data as $li) |
|
268 | + foreach ($data as $li) |
|
269 | 269 | { |
270 | - $text .= $padding . " * $li\n"; |
|
270 | + $text .= $padding." * $li\n"; |
|
271 | 271 | } |
272 | 272 | } |
273 | 273 | |
@@ -278,32 +278,32 @@ discard block |
||
278 | 278 | { |
279 | 279 | $default_prots = $myKses->dumpProtocols(); |
280 | 280 | $out_text = array(); |
281 | - if(count($default_prots) > 0) |
|
281 | + if (count($default_prots) > 0) |
|
282 | 282 | { |
283 | - array_push($out_text, "Initial protocols from KSES" . KSESTEST_VER . ":"); |
|
283 | + array_push($out_text, "Initial protocols from KSES".KSESTEST_VER.":"); |
|
284 | 284 | array_push($out_text, output_ul($default_prots)); |
285 | 285 | array_push($out_text, output_hr()); |
286 | 286 | } |
287 | 287 | |
288 | - $myKses->AddProtocols(array("proto1", "proto2:", "proto3")); // Add a list of protocols |
|
289 | - $myKses->AddProtocols("proto4:"); // Add a single protocol (Note ':' is optional at end) |
|
288 | + $myKses->AddProtocols(array("proto1", "proto2:", "proto3")); // Add a list of protocols |
|
289 | + $myKses->AddProtocols("proto4:"); // Add a single protocol (Note ':' is optional at end) |
|
290 | 290 | $myKses->AddProtocol("proto9", "mystery:", "anarchy"); |
291 | 291 | $myKses->AddProtocol("alpha", "beta", "gamma:"); |
292 | 292 | |
293 | 293 | $add_protocol = "\t\t\t<ol>\n"; |
294 | - $add_protocol .= "\t\t\t\t" . '<li>$myKses->AddProtocols(array("proto1", "proto2:", "proto3"));</li>' . "\n"; |
|
295 | - $add_protocol .= "\t\t\t\t" . '<li>$myKses->AddProtocols("proto4:");</li>' . "\n"; |
|
296 | - $add_protocol .= "\t\t\t\t" . '<li>$myKses->AddProtocols("proto4:");</li>' . "\n"; |
|
297 | - $add_protocol .= "\t\t\t\t" . '<li>$myKses->AddProtocol("proto9", "mystery:", "anarchy");</li>' . "\n"; |
|
298 | - $add_protocol .= "\t\t\t\t" . '<li>$myKses->AddProtocol("alpha", "beta", "gamma:");</li>' . "\n"; |
|
294 | + $add_protocol .= "\t\t\t\t".'<li>$myKses->AddProtocols(array("proto1", "proto2:", "proto3"));</li>'."\n"; |
|
295 | + $add_protocol .= "\t\t\t\t".'<li>$myKses->AddProtocols("proto4:");</li>'."\n"; |
|
296 | + $add_protocol .= "\t\t\t\t".'<li>$myKses->AddProtocols("proto4:");</li>'."\n"; |
|
297 | + $add_protocol .= "\t\t\t\t".'<li>$myKses->AddProtocol("proto9", "mystery:", "anarchy");</li>'."\n"; |
|
298 | + $add_protocol .= "\t\t\t\t".'<li>$myKses->AddProtocol("alpha", "beta", "gamma:");</li>'."\n"; |
|
299 | 299 | $add_protocol .= "\t\t\t</ol>\n"; |
300 | 300 | |
301 | 301 | array_push($out_text, $add_protocol); |
302 | 302 | |
303 | 303 | $new_prots = $myKses->dumpProtocols(); |
304 | - if(count($new_prots) > 0) |
|
304 | + if (count($new_prots) > 0) |
|
305 | 305 | { |
306 | - array_push($out_text, "New protocols from KSES" . KSESTEST_VER . " after using AddProtocol(s):"); |
|
306 | + array_push($out_text, "New protocols from KSES".KSESTEST_VER." after using AddProtocol(s):"); |
|
307 | 307 | array_push($out_text, output_ul($new_prots)); |
308 | 308 | array_push($out_text, output_hr()); |
309 | 309 | } |
@@ -314,31 +314,31 @@ discard block |
||
314 | 314 | $myKses->RemoveProtocol("gamma"); |
315 | 315 | |
316 | 316 | $remove_protocol = "\t\t\t<ol>\n"; |
317 | - $remove_protocol .= "\t\t\t\t" . '<li>$myKses->RemoveProtocols(array("mystery", "anarchy:"));</li>' . "\n"; |
|
318 | - $remove_protocol .= "\t\t\t\t" . '<li>$myKses->RemoveProtocols("alpha:");</li>' . "\n"; |
|
319 | - $remove_protocol .= "\t\t\t\t" . '<li>$myKses->RemoveProtocol("beta:");</li>' . "\n"; |
|
320 | - $remove_protocol .= "\t\t\t\t" . '<li>$myKses->RemoveProtocol("gamma");</li>' . "\n"; |
|
317 | + $remove_protocol .= "\t\t\t\t".'<li>$myKses->RemoveProtocols(array("mystery", "anarchy:"));</li>'."\n"; |
|
318 | + $remove_protocol .= "\t\t\t\t".'<li>$myKses->RemoveProtocols("alpha:");</li>'."\n"; |
|
319 | + $remove_protocol .= "\t\t\t\t".'<li>$myKses->RemoveProtocol("beta:");</li>'."\n"; |
|
320 | + $remove_protocol .= "\t\t\t\t".'<li>$myKses->RemoveProtocol("gamma");</li>'."\n"; |
|
321 | 321 | $remove_protocol .= "\t\t\t</ol>\n"; |
322 | 322 | array_push($out_text, $remove_protocol); |
323 | 323 | |
324 | 324 | $new_prots = $myKses->dumpProtocols(); |
325 | - if(count($new_prots) > 0) |
|
325 | + if (count($new_prots) > 0) |
|
326 | 326 | { |
327 | - array_push($out_text, "Resulting protocols from KSES" . KSESTEST_VER . " after using RemoveProtocol(s):"); |
|
327 | + array_push($out_text, "Resulting protocols from KSES".KSESTEST_VER." after using RemoveProtocol(s):"); |
|
328 | 328 | array_push($out_text, output_ul($new_prots)); |
329 | 329 | array_push($out_text, output_hr()); |
330 | 330 | } |
331 | 331 | |
332 | 332 | $myKses->SetProtocols(array("https", "gopher", "news")); |
333 | 333 | $set_protocol = "\t\t\t<ol>\n"; |
334 | - $set_protocol .= "\t\t\t\t" . '<li>$myKses->SetProtocols(array("https", "gopher", "news"));</li>' . "\n"; |
|
334 | + $set_protocol .= "\t\t\t\t".'<li>$myKses->SetProtocols(array("https", "gopher", "news"));</li>'."\n"; |
|
335 | 335 | $set_protocol .= "\t\t\t</ol>\n"; |
336 | 336 | array_push($out_text, $set_protocol); |
337 | 337 | |
338 | 338 | $new_prots = $myKses->dumpProtocols(); |
339 | - if(count($new_prots) > 0) |
|
339 | + if (count($new_prots) > 0) |
|
340 | 340 | { |
341 | - array_push($out_text, "Resulting protocols from KSES" . KSESTEST_VER . " after using SetProtocols:"); |
|
341 | + array_push($out_text, "Resulting protocols from KSES".KSESTEST_VER." after using SetProtocols:"); |
|
342 | 342 | array_push($out_text, output_ul($new_prots)); |
343 | 343 | array_push($out_text, output_hr()); |
344 | 344 | } |
@@ -427,18 +427,18 @@ discard block |
||
427 | 427 | array_push($out, "Net results:"); |
428 | 428 | |
429 | 429 | $out_elems = $myKses->DumpElements(); |
430 | - if(count($out_elems) > 0) |
|
430 | + if (count($out_elems) > 0) |
|
431 | 431 | { |
432 | 432 | //array_push($out, "\t\t\t<ul>\n"); |
433 | - foreach($out_elems as $tag => $attr_data) |
|
433 | + foreach ($out_elems as $tag => $attr_data) |
|
434 | 434 | { |
435 | 435 | $out_li_elems = array(); |
436 | 436 | $elem_text = "(X)HTML element $tag"; |
437 | 437 | $allow = ""; |
438 | - if(isset($attr_data) && is_array($attr_data) && count($attr_data) > 0) |
|
438 | + if (isset($attr_data) && is_array($attr_data) && count($attr_data) > 0) |
|
439 | 439 | { |
440 | 440 | $allow = " allows attribute"; |
441 | - if(count($attr_data) > 1) |
|
441 | + if (count($attr_data) > 1) |
|
442 | 442 | { |
443 | 443 | $allow .= "s"; |
444 | 444 | } |
@@ -448,31 +448,31 @@ discard block |
||
448 | 448 | array_push($out_li_elems, "$elem_text$allow"); |
449 | 449 | |
450 | 450 | $attr_test_li = array(); |
451 | - if(isset($attr_data) && is_array($attr_data) && count($attr_data) > 0) |
|
451 | + if (isset($attr_data) && is_array($attr_data) && count($attr_data) > 0) |
|
452 | 452 | { |
453 | - foreach($attr_data as $attr_name => $attr_tests) |
|
453 | + foreach ($attr_data as $attr_name => $attr_tests) |
|
454 | 454 | { |
455 | 455 | $li_text = $attr_name; |
456 | - if(isset($attr_tests) && count($attr_tests) > 0) |
|
456 | + if (isset($attr_tests) && count($attr_tests) > 0) |
|
457 | 457 | { |
458 | - foreach($attr_tests as $test_name => $test_val) |
|
458 | + foreach ($attr_tests as $test_name => $test_val) |
|
459 | 459 | { |
460 | - switch($test_name) |
|
460 | + switch ($test_name) |
|
461 | 461 | { |
462 | 462 | case "maxlen": |
463 | - $li_text .= " - maximum length of '" . $test_val . "' characters"; |
|
463 | + $li_text .= " - maximum length of '".$test_val."' characters"; |
|
464 | 464 | break; |
465 | 465 | case "minlen": |
466 | - $li_text .= " - minimum length of '" . $test_val . "' characters"; |
|
466 | + $li_text .= " - minimum length of '".$test_val."' characters"; |
|
467 | 467 | break; |
468 | 468 | case "minval": |
469 | - $li_text .= " - minimum value of '" . $test_val . "'"; |
|
469 | + $li_text .= " - minimum value of '".$test_val."'"; |
|
470 | 470 | break; |
471 | 471 | case "maxval": |
472 | - $li_text .= " - maximum value of '" . $test_val . "'"; |
|
472 | + $li_text .= " - maximum value of '".$test_val."'"; |
|
473 | 473 | break; |
474 | 474 | case "valueless": |
475 | - switch(strtolower($test_val)) |
|
475 | + switch (strtolower($test_val)) |
|
476 | 476 | { |
477 | 477 | case 'n': |
478 | 478 | $li_text .= " - must not be valueless"; |
@@ -491,7 +491,7 @@ discard block |
||
491 | 491 | } |
492 | 492 | array_push($attr_test_li, $li_text); |
493 | 493 | } |
494 | - if(count($attr_test_li) > 0) |
|
494 | + if (count($attr_test_li) > 0) |
|
495 | 495 | { |
496 | 496 | $attr_test_li = output_ul($attr_test_li, " "); |
497 | 497 | $out_li_elems = array("$elem_text$allow$attr_test_li"); |
@@ -8,12 +8,10 @@ discard block |
||
8 | 8 | if(substr(phpversion(), 0, 1) < 4) |
9 | 9 | { |
10 | 10 | define('KSESTEST_VER', 0); |
11 | - } |
|
12 | - elseif(substr(phpversion(), 0, 1) >= 5) |
|
11 | + } elseif(substr(phpversion(), 0, 1) >= 5) |
|
13 | 12 | { |
14 | 13 | define('KSESTEST_VER', 5); |
15 | - } |
|
16 | - else |
|
14 | + } else |
|
17 | 15 | { |
18 | 16 | define('KSESTEST_VER', 4); |
19 | 17 | } |
@@ -22,8 +20,7 @@ discard block |
||
22 | 20 | if($_SERVER["DOCUMENT_ROOT"] == "") |
23 | 21 | { |
24 | 22 | define('KSESTEST_ENV', 'CLI'); |
25 | - } |
|
26 | - else |
|
23 | + } else |
|
27 | 24 | { |
28 | 25 | define('KSESTEST_ENV', 'WEB'); |
29 | 26 | } |
@@ -48,8 +45,7 @@ discard block |
||
48 | 45 | if(file_exists($include_file) && is_readable($include_file)) |
49 | 46 | { |
50 | 47 | include_once($include_file); |
51 | - } |
|
52 | - else |
|
48 | + } else |
|
53 | 49 | { |
54 | 50 | $message = array( |
55 | 51 | "Error: Unable to find '" . $include_file . "'.", |
@@ -126,8 +122,7 @@ discard block |
||
126 | 122 | if(KSESTEST_ENV == 'CLI') |
127 | 123 | { |
128 | 124 | return $text; |
129 | - } |
|
130 | - else |
|
125 | + } else |
|
131 | 126 | { |
132 | 127 | return "<code>\n$text<code>\n"; |
133 | 128 | } |
@@ -138,8 +133,7 @@ discard block |
||
138 | 133 | if(KSESTEST_ENV == 'CLI') |
139 | 134 | { |
140 | 135 | return $text; |
141 | - } |
|
142 | - else |
|
136 | + } else |
|
143 | 137 | { |
144 | 138 | return htmlentities($text); |
145 | 139 | } |
@@ -150,14 +144,12 @@ discard block |
||
150 | 144 | if(KSESTEST_ENV == 'CLI') |
151 | 145 | { |
152 | 146 | return '[' . $text . ']'; |
153 | - } |
|
154 | - else |
|
147 | + } else |
|
155 | 148 | { |
156 | 149 | if($pass == true) |
157 | 150 | { |
158 | 151 | return '<span style="color: green;">[' . $text . ']</span>'; |
159 | - } |
|
160 | - else |
|
152 | + } else |
|
161 | 153 | { |
162 | 154 | return '<span style="color: red;">[' . $text . ']</span>'; |
163 | 155 | } |
@@ -169,8 +161,7 @@ discard block |
||
169 | 161 | if(KSESTEST_ENV == 'WEB') |
170 | 162 | { |
171 | 163 | $out = " "; |
172 | - } |
|
173 | - else |
|
164 | + } else |
|
174 | 165 | { |
175 | 166 | $out = " "; |
176 | 167 | } |
@@ -183,8 +174,7 @@ discard block |
||
183 | 174 | if(KSESTEST_ENV == 'WEB') |
184 | 175 | { |
185 | 176 | $out = "<br />\n"; |
186 | - } |
|
187 | - else |
|
177 | + } else |
|
188 | 178 | { |
189 | 179 | $out = "\n"; |
190 | 180 | } |
@@ -207,8 +197,7 @@ discard block |
||
207 | 197 | $out .= "\t\t<p>\n"; |
208 | 198 | $out .= "\t\t\t$text\n"; |
209 | 199 | $out .= "\t\t</p>\n"; |
210 | - } |
|
211 | - else |
|
200 | + } else |
|
212 | 201 | { |
213 | 202 | $header = "$title\n" . str_repeat('-', 60) . "\n\n"; |
214 | 203 | $out .= "\t$text\n\n"; |
@@ -226,8 +215,7 @@ discard block |
||
226 | 215 | echo $out; |
227 | 216 | echo "\t</body>\n"; |
228 | 217 | echo "</html>\n"; |
229 | - } |
|
230 | - else |
|
218 | + } else |
|
231 | 219 | { |
232 | 220 | echo $header; |
233 | 221 | echo $out; |
@@ -239,8 +227,7 @@ discard block |
||
239 | 227 | if(KSESTEST_ENV == 'WEB') |
240 | 228 | { |
241 | 229 | return "\t\t\t<hr />\n"; |
242 | - } |
|
243 | - else |
|
230 | + } else |
|
244 | 231 | { |
245 | 232 | return str_repeat(60, '-') . "\n"; |
246 | 233 | } |
@@ -262,8 +249,7 @@ discard block |
||
262 | 249 | $text .= "\t\t\t\t<li>$li</li>\n"; |
263 | 250 | } |
264 | 251 | $text .= "\t\t\t</ul>\n"; |
265 | - } |
|
266 | - else |
|
252 | + } else |
|
267 | 253 | { |
268 | 254 | foreach($data as $li) |
269 | 255 | { |
@@ -266,6 +266,7 @@ discard block |
||
266 | 266 | * @global bool $is_platformAdmin |
267 | 267 | * @global bool $is_allowedCreateCourse |
268 | 268 | * @global object $_user |
269 | + * @param boolean $reset |
|
269 | 270 | */ |
270 | 271 | public static function init_user($user_id, $reset) |
271 | 272 | { |
@@ -355,7 +356,7 @@ discard block |
||
355 | 356 | * @global type $is_allowed_in_course |
356 | 357 | * |
357 | 358 | * @param type $course_id |
358 | - * @param type $reset |
|
359 | + * @param boolean $reset |
|
359 | 360 | */ |
360 | 361 | static function init_course($course_id, $reset) |
361 | 362 | { |
@@ -2,7 +2,6 @@ |
||
2 | 2 | /* For licensing terms, see /license.txt */ |
3 | 3 | |
4 | 4 | use ChamiloSession as Session; |
5 | - |
|
6 | 5 | use Chamilo\UserBundle\Entity\User; |
7 | 6 | |
8 | 7 | /** |
@@ -37,24 +37,24 @@ discard block |
||
37 | 37 | if ($by_username) { |
38 | 38 | $secret_word = self::get_secret_word($user['email']); |
39 | 39 | if ($reset) { |
40 | - $reset_link = $portal_url . "main/auth/lostPassword.php?reset=" . $secret_word . "&id=" . $user['uid']; |
|
40 | + $reset_link = $portal_url."main/auth/lostPassword.php?reset=".$secret_word."&id=".$user['uid']; |
|
41 | 41 | } else { |
42 | - $reset_link = get_lang('Pass') . " : $user[password]"; |
|
42 | + $reset_link = get_lang('Pass')." : $user[password]"; |
|
43 | 43 | } |
44 | - $user_account_list = get_lang('YourRegistrationData') . " : \n" . get_lang('UserName') . ' : ' . $user['loginName'] . "\n" . get_lang('ResetLink') . ' : ' . $reset_link . ''; |
|
44 | + $user_account_list = get_lang('YourRegistrationData')." : \n".get_lang('UserName').' : '.$user['loginName']."\n".get_lang('ResetLink').' : '.$reset_link.''; |
|
45 | 45 | |
46 | 46 | if ($user_account_list) { |
47 | - $user_account_list = "\n-----------------------------------------------\n" . $user_account_list; |
|
47 | + $user_account_list = "\n-----------------------------------------------\n".$user_account_list; |
|
48 | 48 | } |
49 | 49 | } else { |
50 | 50 | foreach ($user as $this_user) { |
51 | 51 | $secret_word = self::get_secret_word($this_user['email']); |
52 | 52 | if ($reset) { |
53 | - $reset_link = $portal_url . "main/auth/lostPassword.php?reset=" . $secret_word . "&id=" . $this_user['uid']; |
|
53 | + $reset_link = $portal_url."main/auth/lostPassword.php?reset=".$secret_word."&id=".$this_user['uid']; |
|
54 | 54 | } else { |
55 | - $reset_link = get_lang('Pass') . " : $this_user[password]"; |
|
55 | + $reset_link = get_lang('Pass')." : $this_user[password]"; |
|
56 | 56 | } |
57 | - $user_account_list[] = get_lang('YourRegistrationData') . " : \n" . get_lang('UserName') . ' : ' . $this_user['loginName'] . "\n" . get_lang('ResetLink') . ' : ' . $reset_link . ''; |
|
57 | + $user_account_list[] = get_lang('YourRegistrationData')." : \n".get_lang('UserName').' : '.$this_user['loginName']."\n".get_lang('ResetLink').' : '.$reset_link.''; |
|
58 | 58 | } |
59 | 59 | if ($user_account_list) { |
60 | 60 | $user_account_list = implode("\n-----------------------------------------------\n", $user_account_list); |
@@ -64,8 +64,8 @@ discard block |
||
64 | 64 | if (!$by_username) { |
65 | 65 | $user = $user[0]; |
66 | 66 | } |
67 | - $reset_link = get_lang('Pass') . " : $user[password]"; |
|
68 | - $user_account_list = get_lang('YourRegistrationData') . " : \n" . get_lang('UserName') . ' : ' . $user['loginName'] . "\n" . $reset_link . ''; |
|
67 | + $reset_link = get_lang('Pass')." : $user[password]"; |
|
68 | + $user_account_list = get_lang('YourRegistrationData')." : \n".get_lang('UserName').' : '.$user['loginName']."\n".$reset_link.''; |
|
69 | 69 | } |
70 | 70 | return $user_account_list; |
71 | 71 | } |
@@ -78,7 +78,7 @@ discard block |
||
78 | 78 | */ |
79 | 79 | public static function send_password_to_user($user, $by_username = false) |
80 | 80 | { |
81 | - $email_subject = "[" . api_get_setting('siteName') . "] " . get_lang('LoginRequest'); // SUBJECT |
|
81 | + $email_subject = "[".api_get_setting('siteName')."] ".get_lang('LoginRequest'); // SUBJECT |
|
82 | 82 | |
83 | 83 | if ($by_username) { // Show only for lost password |
84 | 84 | $user_account_list = self::get_user_account_list($user, false, $by_username); // BODY |
@@ -97,7 +97,7 @@ discard block |
||
97 | 97 | } |
98 | 98 | } |
99 | 99 | |
100 | - $email_body = get_lang('YourAccountParam') . " " . $portal_url . "\n\n$user_account_list"; |
|
100 | + $email_body = get_lang('YourAccountParam')." ".$portal_url."\n\n$user_account_list"; |
|
101 | 101 | // SEND MESSAGE |
102 | 102 | $sender_name = api_get_person_name(api_get_setting('administratorName'), api_get_setting('administratorSurname'), null, PERSON_NAME_EMAIL_ADDRESS); |
103 | 103 | $email_admin = api_get_setting('emailAdministrator'); |
@@ -131,7 +131,7 @@ discard block |
||
131 | 131 | */ |
132 | 132 | public static function handle_encrypted_password($user, $by_username = false) |
133 | 133 | { |
134 | - $email_subject = "[" . api_get_setting('siteName') . "] " . get_lang('LoginRequest'); // SUBJECT |
|
134 | + $email_subject = "[".api_get_setting('siteName')."] ".get_lang('LoginRequest'); // SUBJECT |
|
135 | 135 | |
136 | 136 | if ($by_username) { |
137 | 137 | // Show only for lost password |
@@ -141,11 +141,11 @@ discard block |
||
141 | 141 | $user_account_list = self::get_user_account_list($user, true); // BODY |
142 | 142 | $email_to = $user[0]['email']; |
143 | 143 | } |
144 | - $email_body = get_lang('DearUser') . " :\n" . get_lang('password_request') . "\n"; |
|
145 | - $email_body .= $user_account_list . "\n-----------------------------------------------\n\n"; |
|
144 | + $email_body = get_lang('DearUser')." :\n".get_lang('password_request')."\n"; |
|
145 | + $email_body .= $user_account_list."\n-----------------------------------------------\n\n"; |
|
146 | 146 | $email_body .= get_lang('PasswordEncryptedForSecurity'); |
147 | 147 | |
148 | - $email_body .= "\n\n" . get_lang('SignatureFormula') . ",\n" . api_get_setting('administratorName') . " " . api_get_setting('administratorSurname') . "\n" . get_lang('PlataformAdmin') . " - " . api_get_setting('siteName'); |
|
148 | + $email_body .= "\n\n".get_lang('SignatureFormula').",\n".api_get_setting('administratorName')." ".api_get_setting('administratorSurname')."\n".get_lang('PlataformAdmin')." - ".api_get_setting('siteName'); |
|
149 | 149 | |
150 | 150 | $sender_name = api_get_person_name( |
151 | 151 | api_get_setting('administratorName'), |
@@ -238,7 +238,7 @@ discard block |
||
238 | 238 | username AS loginName, |
239 | 239 | password, |
240 | 240 | |
241 | - FROM " . $tbl_user . " |
|
241 | + FROM " . $tbl_user." |
|
242 | 242 | WHERE user_id = $id"; |
243 | 243 | $result = Database::query($sql); |
244 | 244 | $num_rows = Database::num_rows($result); |
@@ -291,7 +291,7 @@ discard block |
||
291 | 291 | ON user.user_id = a.user_id |
292 | 292 | LEFT JOIN $track_e_login login |
293 | 293 | ON user.user_id = login.login_user_id |
294 | - WHERE user.user_id = '" . $_user['user_id'] . "' |
|
294 | + WHERE user.user_id = '".$_user['user_id']."' |
|
295 | 295 | ORDER BY login.login_date DESC LIMIT 1"; |
296 | 296 | |
297 | 297 | $result = Database::query($sql); |
@@ -321,7 +321,7 @@ discard block |
||
321 | 321 | Session::write('is_platformAdmin', $is_platformAdmin); |
322 | 322 | Session::write('is_allowedCreateCourse', $is_allowedCreateCourse); |
323 | 323 | } else { |
324 | - header('location:' . api_get_path(WEB_PATH)); |
|
324 | + header('location:'.api_get_path(WEB_PATH)); |
|
325 | 325 | //exit("WARNING UNDEFINED UID !! "); |
326 | 326 | } |
327 | 327 | } else { // no uid => logout or Anonymous |
@@ -368,9 +368,9 @@ discard block |
||
368 | 368 | global $_course; |
369 | 369 | global $_real_cid; |
370 | 370 | |
371 | - global $is_courseAdmin; //course teacher |
|
372 | - global $is_courseTutor; //course teacher - some rights |
|
373 | - global $is_courseCoach; //course coach |
|
371 | + global $is_courseAdmin; //course teacher |
|
372 | + global $is_courseTutor; //course teacher - some rights |
|
373 | + global $is_courseCoach; //course coach |
|
374 | 374 | global $is_courseMember; //course student |
375 | 375 | global $is_sessionAdmin; |
376 | 376 | global $is_allowed_in_course; |
@@ -427,7 +427,7 @@ discard block |
||
427 | 427 | |
428 | 428 | if (!empty($_GET['id_session'])) { |
429 | 429 | $_SESSION['id_session'] = intval($_GET['id_session']); |
430 | - $sql = 'SELECT name FROM ' . $tbl_session . ' WHERE id="' . intval($_SESSION['id_session']) . '"'; |
|
430 | + $sql = 'SELECT name FROM '.$tbl_session.' WHERE id="'.intval($_SESSION['id_session']).'"'; |
|
431 | 431 | $rs = Database::query($sql); |
432 | 432 | list($_SESSION['session_name']) = Database::fetch_array($rs); |
433 | 433 | } else { |
@@ -443,7 +443,7 @@ discard block |
||
443 | 443 | } |
444 | 444 | } else { |
445 | 445 | //exit("WARNING UNDEFINED CID !! "); |
446 | - header('location:' . api_get_path(WEB_PATH)); |
|
446 | + header('location:'.api_get_path(WEB_PATH)); |
|
447 | 447 | } |
448 | 448 | } else { |
449 | 449 | Session::erase('_cid'); |
@@ -470,7 +470,7 @@ discard block |
||
470 | 470 | } else { |
471 | 471 | // Continue with the previous values |
472 | 472 | if (empty($_SESSION['_course']) OR empty($_SESSION['_cid'])) { //no previous values... |
473 | - $_cid = -1; //set default values that will be caracteristic of being unset |
|
473 | + $_cid = -1; //set default values that will be caracteristic of being unset |
|
474 | 474 | $_course = -1; |
475 | 475 | } else { |
476 | 476 | $_cid = $_SESSION['_cid']; |
@@ -480,7 +480,7 @@ discard block |
||
480 | 480 | // Moreover, if we want to track a course with another session it can be usefull |
481 | 481 | if (!empty($_GET['id_session'])) { |
482 | 482 | $tbl_session = Database::get_main_table(TABLE_MAIN_SESSION); |
483 | - $sql = 'SELECT name FROM ' . $tbl_session . ' WHERE id="' . intval($_SESSION['id_session']) . '"'; |
|
483 | + $sql = 'SELECT name FROM '.$tbl_session.' WHERE id="'.intval($_SESSION['id_session']).'"'; |
|
484 | 484 | $rs = Database::query($sql); |
485 | 485 | list($_SESSION['session_name']) = Database::fetch_array($rs); |
486 | 486 | $_SESSION['id_session'] = intval($_GET['id_session']); |
@@ -520,9 +520,9 @@ discard block |
||
520 | 520 | //But only if the login date is < than now + max_life_time |
521 | 521 | $sql = "SELECT course_access_id FROM $course_tracking_table |
522 | 522 | WHERE |
523 | - user_id = " . intval($_user ['user_id']) . " AND |
|
523 | + user_id = ".intval($_user ['user_id'])." AND |
|
524 | 524 | c_id = '".api_get_course_int_id()."' AND |
525 | - session_id = " . api_get_session_id() . " AND |
|
525 | + session_id = " . api_get_session_id()." AND |
|
526 | 526 | login_course_date > now() - INTERVAL $session_lifetime SECOND |
527 | 527 | ORDER BY login_course_date DESC LIMIT 0,1"; |
528 | 528 | $result = Database::query($sql); |
@@ -532,11 +532,11 @@ discard block |
||
532 | 532 | //We update the course tracking table |
533 | 533 | $sql = "UPDATE $course_tracking_table |
534 | 534 | SET logout_course_date = '$time', counter = counter+1 |
535 | - WHERE course_access_id = " . intval($i_course_access_id) . " AND session_id = " . api_get_session_id(); |
|
535 | + WHERE course_access_id = ".intval($i_course_access_id)." AND session_id = ".api_get_session_id(); |
|
536 | 536 | Database::query($sql); |
537 | 537 | } else { |
538 | - $sql = "INSERT INTO $course_tracking_table (c_id, user_id, login_course_date, logout_course_date, counter, session_id)" . |
|
539 | - "VALUES('" . api_get_course_int_id() . "', '" . $_user['user_id'] . "', '$time', '$time', '1','" . api_get_session_id() . "')"; |
|
538 | + $sql = "INSERT INTO $course_tracking_table (c_id, user_id, login_course_date, logout_course_date, counter, session_id)". |
|
539 | + "VALUES('".api_get_course_int_id()."', '".$_user['user_id']."', '$time', '$time', '1','".api_get_session_id()."')"; |
|
540 | 540 | Database::query($sql); |
541 | 541 | } |
542 | 542 | } |
@@ -564,8 +564,8 @@ discard block |
||
564 | 564 | $course_user_table = Database::get_main_table(TABLE_MAIN_COURSE_USER); |
565 | 565 | $sql = "SELECT * FROM $course_user_table |
566 | 566 | WHERE |
567 | - user_id = '" . $user_id . "' AND |
|
568 | - relation_type <> " . COURSE_RELATION_TYPE_RRHH . " AND |
|
567 | + user_id = '".$user_id."' AND |
|
568 | + relation_type <> " . COURSE_RELATION_TYPE_RRHH." AND |
|
569 | 569 | course_code = '$course_id'"; |
570 | 570 | $result = Database::query($sql); |
571 | 571 | |
@@ -585,8 +585,8 @@ discard block |
||
585 | 585 | $session_id |
586 | 586 | ); |
587 | 587 | if (!$user_is_subscribed) { |
588 | - $url = api_get_path(WEB_CODE_PATH) . 'course_info/legal.php?course_code=' . $_course['code'] . '&session_id=' . $session_id; |
|
589 | - header('Location: ' . $url); |
|
588 | + $url = api_get_path(WEB_CODE_PATH).'course_info/legal.php?course_code='.$_course['code'].'&session_id='.$session_id; |
|
589 | + header('Location: '.$url); |
|
590 | 590 | exit; |
591 | 591 | } |
592 | 592 | } |
@@ -627,11 +627,11 @@ discard block |
||
627 | 627 | } else { |
628 | 628 | //Im a coach or a student? |
629 | 629 | $sql = "SELECT user_id, status |
630 | - FROM " . $tbl_session_course_user . " |
|
630 | + FROM " . $tbl_session_course_user." |
|
631 | 631 | WHERE |
632 | 632 | c_id = '$_cid' AND |
633 | - user_id = '" . $user_id . "' AND |
|
634 | - session_id = '" . $session_id . "' |
|
633 | + user_id = '".$user_id."' AND |
|
634 | + session_id = '" . $session_id."' |
|
635 | 635 | LIMIT 1"; |
636 | 636 | $result = Database::query($sql); |
637 | 637 | |
@@ -777,7 +777,7 @@ discard block |
||
777 | 777 | if ($reset) { // session data refresh requested |
778 | 778 | if ($group_id && $_cid && !empty($_course['real_id'])) { // have keys to search data |
779 | 779 | $group_table = Database::get_course_table(TABLE_GROUP); |
780 | - $sql = "SELECT * FROM $group_table WHERE c_id = " . $_course['real_id'] . " AND id = '$group_id'"; |
|
780 | + $sql = "SELECT * FROM $group_table WHERE c_id = ".$_course['real_id']." AND id = '$group_id'"; |
|
781 | 781 | $result = Database::query($sql); |
782 | 782 | if (Database::num_rows($result) > 0) { // This group has recorded status related to this course |
783 | 783 | $gpData = Database::fetch_array($result); |
@@ -830,7 +830,7 @@ discard block |
||
830 | 830 | */ |
831 | 831 | public static function get_user_accounts_by_username($username) |
832 | 832 | { |
833 | - if (strpos($username,'@')){ |
|
833 | + if (strpos($username, '@')) { |
|
834 | 834 | $username = api_strtolower($username); |
835 | 835 | $email = true; |
836 | 836 | } else { |
@@ -852,14 +852,14 @@ discard block |
||
852 | 852 | $email = false; |
853 | 853 | } |
854 | 854 | |
855 | - if ($email) { |
|
856 | - $condition = "LOWER(email) = '".Database::escape_string($username)."' "; |
|
857 | - } else { |
|
855 | + if ($email) { |
|
856 | + $condition = "LOWER(email) = '".Database::escape_string($username)."' "; |
|
857 | + } else { |
|
858 | 858 | $condition = "LOWER(username) = '".Database::escape_string($username)."'"; |
859 | 859 | } |
860 | 860 | |
861 | - $tbl_user = Database :: get_main_table(TABLE_MAIN_USER); |
|
862 | - $query = "SELECT |
|
861 | + $tbl_user = Database :: get_main_table(TABLE_MAIN_USER); |
|
862 | + $query = "SELECT |
|
863 | 863 | user_id AS uid, |
864 | 864 | lastname AS lastName, |
865 | 865 | firstname AS firstName, |
@@ -874,7 +874,7 @@ discard block |
||
874 | 874 | auth_source |
875 | 875 | FROM $tbl_user |
876 | 876 | WHERE ( $condition AND active = 1) "; |
877 | - $result = Database::query($query); |
|
877 | + $result = Database::query($query); |
|
878 | 878 | $num_rows = Database::num_rows($result); |
879 | 879 | if ($result && $num_rows > 0) { |
880 | 880 | return Database::fetch_assoc($result); |
@@ -25,6 +25,7 @@ |
||
25 | 25 | |
26 | 26 | /** |
27 | 27 | * Useful finder - experimental akelos like only use in notification.lib.php send function |
28 | + * @param string $type |
|
28 | 29 | */ |
29 | 30 | public function find($type, $options = null) |
30 | 31 | { |
@@ -634,7 +634,6 @@ discard block |
||
634 | 634 | * @param int $sessionId The session ID |
635 | 635 | * @param int $courseId The course ID |
636 | 636 | * @param int $exerciseId The quiz ID |
637 | - * @param int $answer Answer status (0 = incorrect, 1 = correct, 2 = both) |
|
638 | 637 | * @return string HTML array of results formatted for gridJS |
639 | 638 | * @author César Perales <[email protected]>, Beeznest Team |
640 | 639 | */ |
@@ -1222,6 +1221,7 @@ discard block |
||
1222 | 1221 | * @param int Number of items to select |
1223 | 1222 | * @param string Column to order on |
1224 | 1223 | * @param string Order direction |
1224 | + * @param integer $number_of_items |
|
1225 | 1225 | * @return array Results |
1226 | 1226 | */ |
1227 | 1227 | public static function get_course_data_tracking_overview($from, $number_of_items, $column, $direction) |
@@ -1556,6 +1556,7 @@ discard block |
||
1556 | 1556 | * @param int Number of items to select |
1557 | 1557 | * @param string Column to order on |
1558 | 1558 | * @param string Order direction |
1559 | + * @param integer $number_of_items |
|
1559 | 1560 | * @return array Results |
1560 | 1561 | */ |
1561 | 1562 | public static function get_session_data_tracking_overview($from, $number_of_items, $column, $direction) |
@@ -1576,7 +1577,6 @@ discard block |
||
1576 | 1577 | /** |
1577 | 1578 | * Fills in session reporting data |
1578 | 1579 | * |
1579 | - * @param integer $user_id the id of the user |
|
1580 | 1580 | * @param array $url_params additonal url parameters |
1581 | 1581 | * @param array $row the row information (the other columns) |
1582 | 1582 | * @return string html code |
@@ -2206,6 +2206,7 @@ discard block |
||
2206 | 2206 | * @author Patrick Cool <[email protected]>, Ghent University, Belgium |
2207 | 2207 | * @version Dokeos 1.8.6 |
2208 | 2208 | * @since October 2008 |
2209 | + * @param integer $number_of_items |
|
2209 | 2210 | */ |
2210 | 2211 | public static function get_user_data_tracking_overview($from, $number_of_items, $column, $direction) |
2211 | 2212 | { |
@@ -2308,7 +2309,6 @@ discard block |
||
2308 | 2309 | /** |
2309 | 2310 | * Checks if there are repeted users in a given array |
2310 | 2311 | * @param array $usernames list of the usernames in the uploaded file |
2311 | - * @param array $user_array['username'] and $user_array['sufix'] where sufix is the number part in a login i.e -> jmontoya2 |
|
2312 | 2312 | * @return array with the $usernames array and the $user_array array |
2313 | 2313 | * @author Julio Montoya Armas |
2314 | 2314 | */ |
@@ -25,7 +25,7 @@ discard block |
||
25 | 25 | array('url' => api_get_path(WEB_CODE_PATH).'mySpace/admin_view.php?display=course', 'content' => get_lang('DisplayCourseOverview')), |
26 | 26 | array('url' => api_get_path(WEB_CODE_PATH).'tracking/question_course_report.php?view=admin', 'content' => get_lang('LPQuestionListResults')), |
27 | 27 | array('url' => api_get_path(WEB_CODE_PATH).'tracking/course_session_report.php?view=admin', 'content' => get_lang('LPExerciseResultsBySession')), |
28 | - ['url' => api_get_path(WEB_CODE_PATH) . 'mySpace/admin_view.php?display=accessoverview', 'content' => get_lang('DisplayAccessOverview') . ' (' . get_lang('Beta') . ')'] |
|
28 | + ['url' => api_get_path(WEB_CODE_PATH).'mySpace/admin_view.php?display=accessoverview', 'content' => get_lang('DisplayAccessOverview').' ('.get_lang('Beta').')'] |
|
29 | 29 | ); |
30 | 30 | |
31 | 31 | return Display :: actions($actions, null); |
@@ -34,7 +34,7 @@ discard block |
||
34 | 34 | public static function getTopMenu() |
35 | 35 | { |
36 | 36 | $menu_items = array(); |
37 | - $menu_items[] = Display::url(Display::return_icon('stats.png', get_lang('MyStats'),'',ICON_SIZE_MEDIUM),api_get_path(WEB_CODE_PATH)."auth/my_progress.php" ); |
|
37 | + $menu_items[] = Display::url(Display::return_icon('stats.png', get_lang('MyStats'), '', ICON_SIZE_MEDIUM), api_get_path(WEB_CODE_PATH)."auth/my_progress.php"); |
|
38 | 38 | $menu_items[] = Display::url(Display::return_icon('teacher.png', get_lang('TeacherInterface'), array(), 32), api_get_path(WEB_CODE_PATH).'mySpace/?view=teacher'); |
39 | 39 | $menu_items[] = Display::url(Display::return_icon('star_na.png', get_lang('AdminInterface'), array(), 32), '#'); |
40 | 40 | $menu_items[] = Display::url(Display::return_icon('quiz.png', get_lang('ExamTracking'), array(), 32), api_get_path(WEB_CODE_PATH).'tracking/exams.php'); |
@@ -104,7 +104,7 @@ discard block |
||
104 | 104 | $session_id = intval($session_id); |
105 | 105 | |
106 | 106 | $sql = 'SELECT login_course_date, logout_course_date |
107 | - FROM ' . $tbl_track_course . ' |
|
107 | + FROM ' . $tbl_track_course.' |
|
108 | 108 | WHERE |
109 | 109 | user_id = '.$user_id.' AND |
110 | 110 | c_id = '.$courseId.' AND |
@@ -143,7 +143,7 @@ discard block |
||
143 | 143 | foreach ($course_list as $course_item) { |
144 | 144 | $courseInfo = api_get_course_info($course_item['code']); |
145 | 145 | $courseId = $courseInfo['real_id']; |
146 | - $new_course_list[] = '"'.$courseId.'"'; |
|
146 | + $new_course_list[] = '"'.$courseId.'"'; |
|
147 | 147 | } |
148 | 148 | $course_list = implode(', ', $new_course_list); |
149 | 149 | |
@@ -151,7 +151,7 @@ discard block |
||
151 | 151 | return false; |
152 | 152 | } |
153 | 153 | $sql = 'SELECT login_course_date, logout_course_date, c_id |
154 | - FROM ' . $tbl_track_course . ' |
|
154 | + FROM ' . $tbl_track_course.' |
|
155 | 155 | WHERE |
156 | 156 | user_id = '.$user_id.' AND |
157 | 157 | c_id IN ('.$course_list.') AND |
@@ -229,7 +229,7 @@ discard block |
||
229 | 229 | // student score |
230 | 230 | $avg_score = Tracking :: get_avg_student_score($user_id, $courseCode); |
231 | 231 | if (is_numeric($avg_score)) { |
232 | - $avg_score = round($avg_score,2); |
|
232 | + $avg_score = round($avg_score, 2); |
|
233 | 233 | } else { |
234 | 234 | $$avg_score = '-'; |
235 | 235 | } |
@@ -265,7 +265,7 @@ discard block |
||
265 | 265 | |
266 | 266 | $t_head = ' <table style="width: 100%;border:0;padding:0;border-collapse:collapse;table-layout: fixed">'; |
267 | 267 | //$t_head .= ' <caption>'.get_lang('CourseInformation').'</caption>'; |
268 | - $t_head .= '<tr>'; |
|
268 | + $t_head .= '<tr>'; |
|
269 | 269 | $t_head .= ' <th width="155px" style="border-left:0;border-bottom:0"><span>'.get_lang('Course').'</span></th>'; |
270 | 270 | $t_head .= ' <th style="padding:0;border-bottom:0"><span>'.cut(get_lang('AvgTimeSpentInTheCourse'), 6, true).'</span></th>'; |
271 | 271 | $t_head .= ' <th style="padding:0;border-bottom:0"><span>'.cut(get_lang('AvgStudentsProgress'), 6, true).'</span></th>'; |
@@ -283,7 +283,7 @@ discard block |
||
283 | 283 | |
284 | 284 | $addparams = array('view' => 'admin', 'display' => 'user'); |
285 | 285 | |
286 | - $table = new SortableTable('tracking_user_overview', array('MySpace','get_number_of_users_tracking_overview'), array('MySpace','get_user_data_tracking_overview'), 0); |
|
286 | + $table = new SortableTable('tracking_user_overview', array('MySpace', 'get_number_of_users_tracking_overview'), array('MySpace', 'get_user_data_tracking_overview'), 0); |
|
287 | 287 | $table->additional_parameters = $addparams; |
288 | 288 | |
289 | 289 | $table->set_header(0, get_lang('OfficialCode'), true, array('style' => 'font-size:8pt'), array('style' => 'font-size:8pt')); |
@@ -296,7 +296,7 @@ discard block |
||
296 | 296 | } |
297 | 297 | $table->set_header(3, get_lang('LoginName'), true, array('style' => 'font-size:8pt'), array('style' => 'font-size:8pt')); |
298 | 298 | $table->set_header(4, $t_head, false, array('style' => 'width:90%;border:0;padding:0;font-size:7.5pt;'), array('style' => 'width:90%;padding:0;font-size:7.5pt;')); |
299 | - $table->set_column_filter(4, array('MySpace','course_info_tracking_filter')); |
|
299 | + $table->set_column_filter(4, array('MySpace', 'course_info_tracking_filter')); |
|
300 | 300 | $table->display(); |
301 | 301 | } |
302 | 302 | |
@@ -341,7 +341,7 @@ discard block |
||
341 | 341 | $table -> set_header(7, get_lang('Sessions'), false); |
342 | 342 | |
343 | 343 | if ($is_western_name_order) { |
344 | - $csv_header[] = array ( |
|
344 | + $csv_header[] = array( |
|
345 | 345 | get_lang('FirstName', ''), |
346 | 346 | get_lang('LastName', ''), |
347 | 347 | get_lang('TimeSpentOnThePlatform', ''), |
@@ -351,7 +351,7 @@ discard block |
||
351 | 351 | get_lang('NumberOfSessions', '') |
352 | 352 | ); |
353 | 353 | } else { |
354 | - $csv_header[] = array ( |
|
354 | + $csv_header[] = array( |
|
355 | 355 | get_lang('LastName', ''), |
356 | 356 | get_lang('FirstName', ''), |
357 | 357 | get_lang('TimeSpentOnThePlatform', ''), |
@@ -491,9 +491,9 @@ discard block |
||
491 | 491 | |
492 | 492 | if ($tracking_column != 3) { |
493 | 493 | if ($tracking_direction == 'DESC') { |
494 | - usort($all_datas, array('MySpace','rsort_users')); |
|
494 | + usort($all_datas, array('MySpace', 'rsort_users')); |
|
495 | 495 | } else { |
496 | - usort($all_datas, array('MySpace','sort_users')); |
|
496 | + usort($all_datas, array('MySpace', 'sort_users')); |
|
497 | 497 | } |
498 | 498 | } |
499 | 499 | |
@@ -552,7 +552,7 @@ discard block |
||
552 | 552 | /** |
553 | 553 | * Column config |
554 | 554 | */ |
555 | - $column_model = array( |
|
555 | + $column_model = array( |
|
556 | 556 | array( |
557 | 557 | 'name' => 'username', |
558 | 558 | 'index' => 'username', |
@@ -593,7 +593,7 @@ discard block |
||
593 | 593 | |
594 | 594 | $action_links = ''; |
595 | 595 | // jqgrid will use this URL to do the selects |
596 | - $url = api_get_path(WEB_AJAX_PATH).'model.ajax.php?a=get_session_lp_progress&session_id=' . $sessionId . '&course_id=' . $courseId . '&date_to=' . $date_to . '&date_from=' . $date_from; |
|
596 | + $url = api_get_path(WEB_AJAX_PATH).'model.ajax.php?a=get_session_lp_progress&session_id='.$sessionId.'&course_id='.$courseId.'&date_to='.$date_to.'&date_from='.$date_from; |
|
597 | 597 | |
598 | 598 | //Table Id |
599 | 599 | $tableId = 'lpProgress'; |
@@ -615,11 +615,11 @@ discard block |
||
615 | 615 | true |
616 | 616 | ); |
617 | 617 | |
618 | - $return = '<script>$(function() {'. $table . |
|
618 | + $return = '<script>$(function() {'.$table. |
|
619 | 619 | 'jQuery("#'.$tableId.'").jqGrid("navGrid","#'.$tableId.'_pager",{view:false, edit:false, add:false, del:false, search:false, excel:true}); |
620 | 620 | jQuery("#'.$tableId.'").jqGrid("navButtonAdd","#'.$tableId.'_pager",{ |
621 | 621 | caption:"", |
622 | - title:"' . get_lang('ExportExcel') . '", |
|
622 | + title:"' . get_lang('ExportExcel').'", |
|
623 | 623 | onClickButton : function () { |
624 | 624 | jQuery("#'.$tableId.'").jqGrid("excelExport",{"url":"'.$url.'&export_format=xls"}); |
625 | 625 | } |
@@ -669,7 +669,7 @@ discard block |
||
669 | 669 | /** |
670 | 670 | * Column config |
671 | 671 | */ |
672 | - $column_model = array( |
|
672 | + $column_model = array( |
|
673 | 673 | array('name'=>'session', 'index'=>'session', 'align'=>'left', 'search' => 'true', 'wrap_cell' => "true"), |
674 | 674 | array('name'=>'exercise_id', 'index'=>'exercise_id', 'align'=>'left', 'search' => 'true'), |
675 | 675 | array('name'=>'quiz_title', 'index'=>'quiz_title', 'align'=>'left', 'search' => 'true'), |
@@ -686,7 +686,7 @@ discard block |
||
686 | 686 | //get dynamic column names |
687 | 687 | |
688 | 688 | // jqgrid will use this URL to do the selects |
689 | - $url = api_get_path(WEB_AJAX_PATH).'model.ajax.php?a=get_exercise_progress&session_id=' . $sessionId . '&course_id=' . $courseId . '&exercise_id=' . $exerciseId . '&date_to=' . $date_to . '&date_from=' . $date_from; |
|
689 | + $url = api_get_path(WEB_AJAX_PATH).'model.ajax.php?a=get_exercise_progress&session_id='.$sessionId.'&course_id='.$courseId.'&exercise_id='.$exerciseId.'&date_to='.$date_to.'&date_from='.$date_from; |
|
690 | 690 | |
691 | 691 | // Autowidth |
692 | 692 | $extra_params['autowidth'] = 'true'; |
@@ -697,11 +697,11 @@ discard block |
||
697 | 697 | $tableId = 'exerciseProgressOverview'; |
698 | 698 | $table = Display::grid_js($tableId, $url, $columns, $column_model, $extra_params, array(), '', true); |
699 | 699 | |
700 | - $return = '<script>$(function() {'. $table . |
|
700 | + $return = '<script>$(function() {'.$table. |
|
701 | 701 | 'jQuery("#'.$tableId.'").jqGrid("navGrid","#'.$tableId.'_pager",{view:false, edit:false, add:false, del:false, search:false, excel:true}); |
702 | 702 | jQuery("#'.$tableId.'").jqGrid("navButtonAdd","#'.$tableId.'_pager",{ |
703 | 703 | caption:"", |
704 | - title:"' . get_lang('ExportExcel') . '", |
|
704 | + title:"' . get_lang('ExportExcel').'", |
|
705 | 705 | onClickButton : function () { |
706 | 706 | jQuery("#'.$tableId.'").jqGrid("excelExport",{"url":"'.$url.'&export_format=xls"}); |
707 | 707 | } |
@@ -787,8 +787,8 @@ discard block |
||
787 | 787 | |
788 | 788 | $column[] = $title; |
789 | 789 | $column_model[] = array( |
790 | - 'name' => 'exer' . $i, |
|
791 | - 'index' => 'exer' . $i, |
|
790 | + 'name' => 'exer'.$i, |
|
791 | + 'index' => 'exer'.$i, |
|
792 | 792 | 'align' => 'center', |
793 | 793 | 'search' => 'true', |
794 | 794 | 'wrap_cell' => "true" |
@@ -800,7 +800,7 @@ discard block |
||
800 | 800 | |
801 | 801 | //end get dynamic column names |
802 | 802 | // jqgrid will use this URL to do the selects |
803 | - $url = api_get_path(WEB_AJAX_PATH) . 'model.ajax.php?a=get_exercise_grade&session_id=' . $sessionId . '&course_id=' . $courseId; |
|
803 | + $url = api_get_path(WEB_AJAX_PATH).'model.ajax.php?a=get_exercise_grade&session_id='.$sessionId.'&course_id='.$courseId; |
|
804 | 804 | |
805 | 805 | // Autowidth |
806 | 806 | $extra_params['autowidth'] = 'true'; |
@@ -811,13 +811,13 @@ discard block |
||
811 | 811 | $tableId = 'exerciseGradeOverview'; |
812 | 812 | $table = Display::grid_js($tableId, $url, $column, $column_model, $extra_params, array(), '', true); |
813 | 813 | |
814 | - $return = '<script>$(function() {' . $table . |
|
815 | - 'jQuery("#' . $tableId . '").jqGrid("navGrid","#' . $tableId . '_pager",{view:false, edit:false, add:false, del:false, search:false, excel:true}); |
|
816 | - jQuery("#' . $tableId . '").jqGrid("navButtonAdd","#' . $tableId . '_pager",{ |
|
814 | + $return = '<script>$(function() {'.$table. |
|
815 | + 'jQuery("#'.$tableId.'").jqGrid("navGrid","#'.$tableId.'_pager",{view:false, edit:false, add:false, del:false, search:false, excel:true}); |
|
816 | + jQuery("#' . $tableId.'").jqGrid("navButtonAdd","#'.$tableId.'_pager",{ |
|
817 | 817 | caption:"", |
818 | - title:"' . get_lang('ExportExcel') . '", |
|
818 | + title:"' . get_lang('ExportExcel').'", |
|
819 | 819 | onClickButton : function () { |
820 | - jQuery("#' . $tableId . '").jqGrid("excelExport",{"url":"' . $url . '&export_format=xls"}); |
|
820 | + jQuery("#' . $tableId.'").jqGrid("excelExport",{"url":"'.$url.'&export_format=xls"}); |
|
821 | 821 | } |
822 | 822 | }); |
823 | 823 | });</script>'; |
@@ -850,10 +850,10 @@ discard block |
||
850 | 850 | /** |
851 | 851 | * Column config |
852 | 852 | */ |
853 | - $column_model = array( |
|
854 | - array('name'=>'username', 'index'=>'username', 'align'=>'left', 'search' => 'true', 'wrap_cell' => "true"), |
|
855 | - array('name'=>'firstname', 'index'=>'firstname', 'align'=>'left', 'search' => 'true'), |
|
856 | - array('name'=>'lastname', 'index'=>'lastname', 'align'=>'left', 'search' => 'true'), |
|
853 | + $column_model = array( |
|
854 | + array('name'=>'username', 'index'=>'username', 'align'=>'left', 'search' => 'true', 'wrap_cell' => "true"), |
|
855 | + array('name'=>'firstname', 'index'=>'firstname', 'align'=>'left', 'search' => 'true'), |
|
856 | + array('name'=>'lastname', 'index'=>'lastname', 'align'=>'left', 'search' => 'true'), |
|
857 | 857 | ); |
858 | 858 | //get dinamic column names |
859 | 859 | foreach ($questions as $question_id => $question) { |
@@ -869,7 +869,7 @@ discard block |
||
869 | 869 | $action_links = ''; |
870 | 870 | |
871 | 871 | // jqgrid will use this URL to do the selects |
872 | - $url = api_get_path(WEB_AJAX_PATH).'model.ajax.php?a=get_survey_overview&session_id=' . $sessionId . '&course_id=' . $courseId . '&survey_id=' . $surveyId . '&date_to=' . $date_to . '&date_from=' . $date_from; |
|
872 | + $url = api_get_path(WEB_AJAX_PATH).'model.ajax.php?a=get_survey_overview&session_id='.$sessionId.'&course_id='.$courseId.'&survey_id='.$surveyId.'&date_to='.$date_to.'&date_from='.$date_from; |
|
873 | 873 | |
874 | 874 | // Table Id |
875 | 875 | $tableId = 'lpProgress'; |
@@ -891,11 +891,11 @@ discard block |
||
891 | 891 | true |
892 | 892 | ); |
893 | 893 | |
894 | - $return = '<script>$(function() {'. $table . |
|
894 | + $return = '<script>$(function() {'.$table. |
|
895 | 895 | 'jQuery("#'.$tableId.'").jqGrid("navGrid","#'.$tableId.'_pager",{view:false, edit:false, add:false, del:false, search:false, excel:true}); |
896 | 896 | jQuery("#'.$tableId.'").jqGrid("navButtonAdd","#'.$tableId.'_pager",{ |
897 | 897 | caption:"", |
898 | - title:"' . get_lang('ExportExcel') . '", |
|
898 | + title:"' . get_lang('ExportExcel').'", |
|
899 | 899 | onClickButton : function () { |
900 | 900 | jQuery("#'.$tableId.'").jqGrid("excelExport",{"url":"'.$url.'&export_format=xls"}); |
901 | 901 | } |
@@ -910,7 +910,7 @@ discard block |
||
910 | 910 | * Display a sortable table that contains an overview off all the progress of the user in a session |
911 | 911 | * @author César Perales <[email protected]>, Beeznest Team |
912 | 912 | */ |
913 | - static function display_tracking_progress_overview($sessionId = 0, $courseId = 0, $date_from, $date_to) |
|
913 | + static function display_tracking_progress_overview($sessionId = 0, $courseId = 0, $date_from, $date_to) |
|
914 | 914 | { |
915 | 915 | //The order is important you need to check the the $column variable in the model.ajax.php file |
916 | 916 | $columns = array( |
@@ -960,55 +960,55 @@ discard block |
||
960 | 960 | ); |
961 | 961 | |
962 | 962 | //Column config |
963 | - $column_model = array( |
|
964 | - array('name'=>'lastname', 'index'=>'lastname', 'align'=>'left'), |
|
965 | - array('name'=>'firstname', 'index'=>'firstname', 'align'=>'left'), |
|
966 | - array('name'=>'username', 'index'=>'username', 'align'=>'left'), |
|
963 | + $column_model = array( |
|
964 | + array('name'=>'lastname', 'index'=>'lastname', 'align'=>'left'), |
|
965 | + array('name'=>'firstname', 'index'=>'firstname', 'align'=>'left'), |
|
966 | + array('name'=>'username', 'index'=>'username', 'align'=>'left'), |
|
967 | 967 | #array('name'=>'profile', 'index'=>'username', 'align'=>'left'), |
968 | - array('name'=>'total', 'index'=>'total', 'align'=>'left'), |
|
969 | - array('name'=>'courses', 'index'=>'courses', 'align'=>'left', 'sortable' => 'false'), |
|
970 | - array('name'=>'lessons', 'index'=>'lessons', 'align'=>'left', 'sortable' => 'false'), |
|
971 | - array('name'=>'exercises', 'index'=>'exercises', 'align'=>'left', 'sortable' => 'false'), |
|
972 | - array('name'=>'forums', 'index'=>'forums', 'align'=>'left', 'sortable' => 'false'), |
|
973 | - array('name'=>'homeworks', 'index'=>'homeworks', 'align'=>'left', 'sortable' => 'false'), |
|
974 | - array('name'=>'wikis', 'index'=>'wikis', 'align'=>'left', 'sortable' => 'false'), |
|
975 | - array('name'=>'surveys', 'index'=>'surveys', 'align'=>'left', 'sortable' => 'false'), |
|
968 | + array('name'=>'total', 'index'=>'total', 'align'=>'left'), |
|
969 | + array('name'=>'courses', 'index'=>'courses', 'align'=>'left', 'sortable' => 'false'), |
|
970 | + array('name'=>'lessons', 'index'=>'lessons', 'align'=>'left', 'sortable' => 'false'), |
|
971 | + array('name'=>'exercises', 'index'=>'exercises', 'align'=>'left', 'sortable' => 'false'), |
|
972 | + array('name'=>'forums', 'index'=>'forums', 'align'=>'left', 'sortable' => 'false'), |
|
973 | + array('name'=>'homeworks', 'index'=>'homeworks', 'align'=>'left', 'sortable' => 'false'), |
|
974 | + array('name'=>'wikis', 'index'=>'wikis', 'align'=>'left', 'sortable' => 'false'), |
|
975 | + array('name'=>'surveys', 'index'=>'surveys', 'align'=>'left', 'sortable' => 'false'), |
|
976 | 976 | //Lessons |
977 | - array('name'=>'lessons_total', 'index'=>'lessons_total', 'align'=>'center', 'sortable' => 'false'), |
|
978 | - array('name'=>'lessons_done', 'index'=>'lessons_done', 'align'=>'center', 'sortable' => 'false'), |
|
979 | - array('name'=>'lessons_left', 'index'=>'lessons_left', 'align'=>'center', 'sortable' => 'false'), |
|
980 | - array('name'=>'lessons_progress', 'index'=>'lessons_progress', 'align'=>'center', 'sortable' => 'false'), |
|
977 | + array('name'=>'lessons_total', 'index'=>'lessons_total', 'align'=>'center', 'sortable' => 'false'), |
|
978 | + array('name'=>'lessons_done', 'index'=>'lessons_done', 'align'=>'center', 'sortable' => 'false'), |
|
979 | + array('name'=>'lessons_left', 'index'=>'lessons_left', 'align'=>'center', 'sortable' => 'false'), |
|
980 | + array('name'=>'lessons_progress', 'index'=>'lessons_progress', 'align'=>'center', 'sortable' => 'false'), |
|
981 | 981 | //Exercises |
982 | - array('name'=>'exercises_total', 'index'=>'exercises_total', 'align'=>'center', 'sortable' => 'false'), |
|
983 | - array('name'=>'exercises_done', 'index'=>'exercises_done', 'align'=>'center', 'sortable' => 'false'), |
|
984 | - array('name'=>'exercises_left', 'index'=>'exercises_left', 'align'=>'center', 'sortable' => 'false'), |
|
985 | - array('name'=>'exercises_progress', 'index'=>'exercises_progress', 'align'=>'center', 'sortable' => 'false'), |
|
982 | + array('name'=>'exercises_total', 'index'=>'exercises_total', 'align'=>'center', 'sortable' => 'false'), |
|
983 | + array('name'=>'exercises_done', 'index'=>'exercises_done', 'align'=>'center', 'sortable' => 'false'), |
|
984 | + array('name'=>'exercises_left', 'index'=>'exercises_left', 'align'=>'center', 'sortable' => 'false'), |
|
985 | + array('name'=>'exercises_progress', 'index'=>'exercises_progress', 'align'=>'center', 'sortable' => 'false'), |
|
986 | 986 | //Assignments |
987 | - array('name'=>'forums_total', 'index'=>'forums_total', 'align'=>'center', 'sortable' => 'false'), |
|
988 | - array('name'=>'forums_done', 'index'=>'forums_done', 'align'=>'center', 'sortable' => 'false'), |
|
989 | - array('name'=>'forums_left', 'index'=>'forums_left', 'align'=>'center', 'sortable' => 'false'), |
|
990 | - array('name'=>'forums_progress', 'index'=>'forums_progress', 'align'=>'center', 'sortable' => 'false'), |
|
987 | + array('name'=>'forums_total', 'index'=>'forums_total', 'align'=>'center', 'sortable' => 'false'), |
|
988 | + array('name'=>'forums_done', 'index'=>'forums_done', 'align'=>'center', 'sortable' => 'false'), |
|
989 | + array('name'=>'forums_left', 'index'=>'forums_left', 'align'=>'center', 'sortable' => 'false'), |
|
990 | + array('name'=>'forums_progress', 'index'=>'forums_progress', 'align'=>'center', 'sortable' => 'false'), |
|
991 | 991 | //Assignments |
992 | - array('name'=>'assigments_total', 'index'=>'assigments_total', 'align'=>'center', 'sortable' => 'false'), |
|
993 | - array('name'=>'assigments_done', 'index'=>'assigments_done', 'align'=>'center', 'sortable' => 'false'), |
|
994 | - array('name'=>'assigments_left', 'index'=>'assigments_left', 'align'=>'center', 'sortable' => 'false'), |
|
995 | - array('name'=>'assigments_progress', 'index'=>'assigments_progress', 'align'=>'center', 'sortable' => 'false'), |
|
992 | + array('name'=>'assigments_total', 'index'=>'assigments_total', 'align'=>'center', 'sortable' => 'false'), |
|
993 | + array('name'=>'assigments_done', 'index'=>'assigments_done', 'align'=>'center', 'sortable' => 'false'), |
|
994 | + array('name'=>'assigments_left', 'index'=>'assigments_left', 'align'=>'center', 'sortable' => 'false'), |
|
995 | + array('name'=>'assigments_progress', 'index'=>'assigments_progress', 'align'=>'center', 'sortable' => 'false'), |
|
996 | 996 | //Assignments |
997 | - array('name'=>'wiki_total', 'index'=>'wiki_total', 'align'=>'center', 'sortable' => 'false'), |
|
998 | - array('name'=>'wiki_revisions', 'index'=>'wiki_revisions', 'align'=>'center', 'sortable' => 'false'), |
|
999 | - array('name'=>'wiki_read', 'index'=>'wiki_read', 'align'=>'center', 'sortable' => 'false'), |
|
1000 | - array('name'=>'wiki_unread', 'index'=>'wiki_unread', 'align'=>'center', 'sortable' => 'false'), |
|
1001 | - array('name'=>'wiki_progress', 'index'=>'wiki_progress', 'align'=>'center', 'sortable' => 'false'), |
|
997 | + array('name'=>'wiki_total', 'index'=>'wiki_total', 'align'=>'center', 'sortable' => 'false'), |
|
998 | + array('name'=>'wiki_revisions', 'index'=>'wiki_revisions', 'align'=>'center', 'sortable' => 'false'), |
|
999 | + array('name'=>'wiki_read', 'index'=>'wiki_read', 'align'=>'center', 'sortable' => 'false'), |
|
1000 | + array('name'=>'wiki_unread', 'index'=>'wiki_unread', 'align'=>'center', 'sortable' => 'false'), |
|
1001 | + array('name'=>'wiki_progress', 'index'=>'wiki_progress', 'align'=>'center', 'sortable' => 'false'), |
|
1002 | 1002 | //Surveys |
1003 | - array('name'=>'surveys_total', 'index'=>'surveys_total', 'align'=>'center', 'sortable' => 'false'), |
|
1004 | - array('name'=>'surveys_done', 'index'=>'surveys_done', 'align'=>'center', 'sortable' => 'false'), |
|
1005 | - array('name'=>'surveys_left', 'index'=>'surveys_left', 'align'=>'center', 'sortable' => 'false'), |
|
1006 | - array('name'=>'surveys_progress', 'index'=>'surveys_progress', 'align'=>'center', 'sortable' => 'false'), |
|
1003 | + array('name'=>'surveys_total', 'index'=>'surveys_total', 'align'=>'center', 'sortable' => 'false'), |
|
1004 | + array('name'=>'surveys_done', 'index'=>'surveys_done', 'align'=>'center', 'sortable' => 'false'), |
|
1005 | + array('name'=>'surveys_left', 'index'=>'surveys_left', 'align'=>'center', 'sortable' => 'false'), |
|
1006 | + array('name'=>'surveys_progress', 'index'=>'surveys_progress', 'align'=>'center', 'sortable' => 'false'), |
|
1007 | 1007 | ); |
1008 | 1008 | |
1009 | 1009 | $action_links = ''; |
1010 | 1010 | // jqgrid will use this URL to do the selects |
1011 | - $url = api_get_path(WEB_AJAX_PATH).'model.ajax.php?a=get_session_progress&session_id=' . $sessionId . '&course_id=' . $courseId . '&date_to=' . $date_to . '&date_from=' . $date_from; |
|
1011 | + $url = api_get_path(WEB_AJAX_PATH).'model.ajax.php?a=get_session_progress&session_id='.$sessionId.'&course_id='.$courseId.'&date_to='.$date_to.'&date_from='.$date_from; |
|
1012 | 1012 | |
1013 | 1013 | //Table Id |
1014 | 1014 | $tableId = 'progressOverview'; |
@@ -1068,11 +1068,11 @@ discard block |
||
1068 | 1068 | true |
1069 | 1069 | ); |
1070 | 1070 | |
1071 | - $return = '<script>$(function() {'. $table . |
|
1071 | + $return = '<script>$(function() {'.$table. |
|
1072 | 1072 | 'jQuery("#'.$tableId.'").jqGrid("navGrid","#'.$tableId.'_pager",{view:false, edit:false, add:false, del:false, search:false, excel:true}); |
1073 | 1073 | jQuery("#'.$tableId.'").jqGrid("navButtonAdd","#'.$tableId.'_pager",{ |
1074 | 1074 | caption:"", |
1075 | - title:"' . get_lang('ExportExcel') . '", |
|
1075 | + title:"' . get_lang('ExportExcel').'", |
|
1076 | 1076 | onClickButton : function () { |
1077 | 1077 | jQuery("#'.$tableId.'").jqGrid("excelExport",{"url":"'.$url.'&export_format=xls"}); |
1078 | 1078 | } |
@@ -1132,7 +1132,7 @@ discard block |
||
1132 | 1132 | // adding the fields that are checked to the session |
1133 | 1133 | $message = ''; |
1134 | 1134 | foreach ($values as $field_ids => $value) { |
1135 | - if ($value == 1 && strstr($field_ids,'extra_export_field')) { |
|
1135 | + if ($value == 1 && strstr($field_ids, 'extra_export_field')) { |
|
1136 | 1136 | $_SESSION['additional_export_fields'][] = str_replace('extra_export_field', '', $field_ids); |
1137 | 1137 | } |
1138 | 1138 | } |
@@ -1147,7 +1147,7 @@ discard block |
||
1147 | 1147 | // Displaying a feedback message |
1148 | 1148 | if (!empty($_SESSION['additional_export_fields'])) { |
1149 | 1149 | Display::display_confirmation_message(get_lang('FollowingFieldsWillAlsoBeExported').': <br /><ul>'.$message.'</ul>', false); |
1150 | - } else { |
|
1150 | + } else { |
|
1151 | 1151 | Display::display_confirmation_message(get_lang('NoAdditionalFieldsWillBeExported'), false); |
1152 | 1152 | } |
1153 | 1153 | } else { |
@@ -1175,7 +1175,7 @@ discard block |
||
1175 | 1175 | { |
1176 | 1176 | $t_head = ' <table style="width: 100%;border:0;padding:0;border-collapse:collapse;table-layout: fixed">'; |
1177 | 1177 | //$t_head .= ' <caption>'.get_lang('CourseInformation').'</caption>'; |
1178 | - $t_head .= '<tr>'; |
|
1178 | + $t_head .= '<tr>'; |
|
1179 | 1179 | $t_head .= ' <th style="padding:0;border-bottom:0"><span>'.cut(get_lang('AvgTimeSpentInTheCourse'), 6, true).'</span></th>'; |
1180 | 1180 | $t_head .= ' <th style="padding:0;border-bottom:0"><span>'.cut(get_lang('AvgStudentsProgress'), 6, true).'</span></th>'; |
1181 | 1181 | $t_head .= ' <th style="padding:0;border-bottom:0"><span>'.cut(get_lang('AvgCourseScore'), 6, true).'</span></th>'; |
@@ -1192,13 +1192,13 @@ discard block |
||
1192 | 1192 | |
1193 | 1193 | $addparams = array('view' => 'admin', 'display' => 'courseoverview'); |
1194 | 1194 | |
1195 | - $table = new SortableTable('tracking_session_overview', array('MySpace', 'get_total_number_courses'), array('MySpace','get_course_data_tracking_overview'), 1); |
|
1195 | + $table = new SortableTable('tracking_session_overview', array('MySpace', 'get_total_number_courses'), array('MySpace', 'get_course_data_tracking_overview'), 1); |
|
1196 | 1196 | $table->additional_parameters = $addparams; |
1197 | 1197 | |
1198 | 1198 | $table->set_header(0, '', false, null, array('style' => 'display: none')); |
1199 | 1199 | $table->set_header(1, get_lang('Course'), true, array('style' => 'font-size:8pt'), array('style' => 'font-size:8pt')); |
1200 | 1200 | $table->set_header(2, $t_head, false, array('style' => 'width:90%;border:0;padding:0;font-size:7.5pt;'), array('style' => 'width:90%;padding:0;font-size:7.5pt;')); |
1201 | - $table->set_column_filter(2, array('MySpace','course_tracking_filter')); |
|
1201 | + $table->set_column_filter(2, array('MySpace', 'course_tracking_filter')); |
|
1202 | 1202 | $table->display(); |
1203 | 1203 | } |
1204 | 1204 | |
@@ -1234,7 +1234,7 @@ discard block |
||
1234 | 1234 | $sql .= " ORDER BY col$column $direction "; |
1235 | 1235 | $sql .= " LIMIT $from,$number_of_items"; |
1236 | 1236 | $result = Database::query($sql); |
1237 | - $return = array (); |
|
1237 | + $return = array(); |
|
1238 | 1238 | while ($course = Database::fetch_row($result)) { |
1239 | 1239 | $return[] = $course; |
1240 | 1240 | } |
@@ -1287,18 +1287,18 @@ discard block |
||
1287 | 1287 | $progress += $progress_tmp[0]; |
1288 | 1288 | $nb_progress_lp += $progress_tmp[1]; |
1289 | 1289 | $score_tmp = Tracking :: get_avg_student_score($row->user_id, $course_code, array(), null, true); |
1290 | - if(is_array($score_tmp)) { |
|
1290 | + if (is_array($score_tmp)) { |
|
1291 | 1291 | $score += $score_tmp[0]; |
1292 | 1292 | $nb_score_lp += $score_tmp[1]; |
1293 | 1293 | } |
1294 | 1294 | $nb_messages += Tracking::count_student_messages($row->user_id, $course_code); |
1295 | 1295 | $nb_assignments += Tracking::count_student_assignments($row->user_id, $course_code); |
1296 | 1296 | $last_login_date_tmp = Tracking :: get_last_connection_date_on_the_course($row->user_id, $courseInfo, null, false); |
1297 | - if($last_login_date_tmp != false && $last_login_date == false) { // TODO: To be cleaned |
|
1297 | + if ($last_login_date_tmp != false && $last_login_date == false) { // TODO: To be cleaned |
|
1298 | 1298 | $last_login_date = $last_login_date_tmp; |
1299 | - } else if($last_login_date_tmp != false && $last_login_date != false) { // TODO: Repeated previous condition. To be cleaned. |
|
1299 | + } else if ($last_login_date_tmp != false && $last_login_date != false) { // TODO: Repeated previous condition. To be cleaned. |
|
1300 | 1300 | // Find the max and assign it to first_login_date |
1301 | - if(strtotime($last_login_date_tmp) > strtotime($last_login_date)) { |
|
1301 | + if (strtotime($last_login_date_tmp) > strtotime($last_login_date)) { |
|
1302 | 1302 | $last_login_date = $last_login_date_tmp; |
1303 | 1303 | } |
1304 | 1304 | } |
@@ -1308,27 +1308,27 @@ discard block |
||
1308 | 1308 | $total_score_possible += $exercise_results_tmp['score_possible']; |
1309 | 1309 | $total_questions_answered += $exercise_results_tmp['questions_answered']; |
1310 | 1310 | } |
1311 | - if($nb_progress_lp > 0) { |
|
1311 | + if ($nb_progress_lp > 0) { |
|
1312 | 1312 | $avg_progress = round($progress / $nb_progress_lp, 2); |
1313 | 1313 | } else { |
1314 | 1314 | $avg_progress = 0; |
1315 | 1315 | } |
1316 | - if($nb_score_lp > 0) { |
|
1316 | + if ($nb_score_lp > 0) { |
|
1317 | 1317 | $avg_score = round($score / $nb_score_lp, 2); |
1318 | 1318 | } else { |
1319 | 1319 | $avg_score = '-'; |
1320 | 1320 | } |
1321 | - if($last_login_date) { |
|
1321 | + if ($last_login_date) { |
|
1322 | 1322 | $last_login_date = api_convert_and_format_date($last_login_date, DATE_FORMAT_SHORT, date_default_timezone_get()); |
1323 | 1323 | } else { |
1324 | 1324 | $last_login_date = '-'; |
1325 | 1325 | } |
1326 | - if($total_score_possible > 0) { |
|
1326 | + if ($total_score_possible > 0) { |
|
1327 | 1327 | $total_score_percentage = round($total_score_obtained / $total_score_possible * 100, 2); |
1328 | 1328 | } else { |
1329 | 1329 | $total_score_percentage = 0; |
1330 | 1330 | } |
1331 | - if($total_score_percentage > 0) { |
|
1331 | + if ($total_score_percentage > 0) { |
|
1332 | 1332 | $total_score = $total_score_obtained.'/'.$total_score_possible.' ('.$total_score_percentage.' %)'; |
1333 | 1333 | } else { |
1334 | 1334 | $total_score = '-'; |
@@ -1436,7 +1436,7 @@ discard block |
||
1436 | 1436 | $progress += $progress_tmp[0]; |
1437 | 1437 | $nb_progress_lp += $progress_tmp[1]; |
1438 | 1438 | $score_tmp = Tracking :: get_avg_student_score($row->user_id, $course_code, array(), null, true); |
1439 | - if(is_array($score_tmp)) { |
|
1439 | + if (is_array($score_tmp)) { |
|
1440 | 1440 | $score += $score_tmp[0]; |
1441 | 1441 | $nb_score_lp += $score_tmp[1]; |
1442 | 1442 | } |
@@ -1444,11 +1444,11 @@ discard block |
||
1444 | 1444 | $nb_assignments += Tracking::count_student_assignments($row->user_id, $course_code); |
1445 | 1445 | |
1446 | 1446 | $last_login_date_tmp = Tracking::get_last_connection_date_on_the_course($row->user_id, $courseInfo, null, false); |
1447 | - if($last_login_date_tmp != false && $last_login_date == false) { // TODO: To be cleaned. |
|
1447 | + if ($last_login_date_tmp != false && $last_login_date == false) { // TODO: To be cleaned. |
|
1448 | 1448 | $last_login_date = $last_login_date_tmp; |
1449 | - } else if($last_login_date_tmp != false && $last_login_date == false) { // TODO: Repeated previous condition. To be cleaned. |
|
1449 | + } else if ($last_login_date_tmp != false && $last_login_date == false) { // TODO: Repeated previous condition. To be cleaned. |
|
1450 | 1450 | // Find the max and assign it to first_login_date |
1451 | - if(strtotime($last_login_date_tmp) > strtotime($last_login_date)) { |
|
1451 | + if (strtotime($last_login_date_tmp) > strtotime($last_login_date)) { |
|
1452 | 1452 | $last_login_date = $last_login_date_tmp; |
1453 | 1453 | } |
1454 | 1454 | } |
@@ -1458,22 +1458,22 @@ discard block |
||
1458 | 1458 | $total_score_possible += $exercise_results_tmp['score_possible']; |
1459 | 1459 | $total_questions_answered += $exercise_results_tmp['questions_answered']; |
1460 | 1460 | } |
1461 | - if($nb_progress_lp > 0) { |
|
1461 | + if ($nb_progress_lp > 0) { |
|
1462 | 1462 | $avg_progress = round($progress / $nb_progress_lp, 2); |
1463 | 1463 | } else { |
1464 | 1464 | $avg_progress = 0; |
1465 | 1465 | } |
1466 | - if($nb_score_lp > 0) { |
|
1466 | + if ($nb_score_lp > 0) { |
|
1467 | 1467 | $avg_score = round($score / $nb_score_lp, 2); |
1468 | 1468 | } else { |
1469 | 1469 | $avg_score = '-'; |
1470 | 1470 | } |
1471 | - if($last_login_date) { |
|
1471 | + if ($last_login_date) { |
|
1472 | 1472 | $last_login_date = api_convert_and_format_date($last_login_date, DATE_FORMAT_SHORT, date_default_timezone_get()); |
1473 | 1473 | } else { |
1474 | 1474 | $last_login_date = '-'; |
1475 | 1475 | } |
1476 | - if($total_score_possible > 0) { |
|
1476 | + if ($total_score_possible > 0) { |
|
1477 | 1477 | $total_score_percentage = round($total_score_obtained / $total_score_possible * 100, 2); |
1478 | 1478 | } else { |
1479 | 1479 | $total_score_percentage = 0; |
@@ -1509,7 +1509,7 @@ discard block |
||
1509 | 1509 | { |
1510 | 1510 | $t_head = ' <table style="width: 100%;border:0;padding:0;border-collapse:collapse;table-layout: fixed">'; |
1511 | 1511 | //$t_head .= ' <caption>'.get_lang('CourseInformation').'</caption>'; |
1512 | - $t_head .= '<tr>'; |
|
1512 | + $t_head .= '<tr>'; |
|
1513 | 1513 | $t_head .= ' <th width="155px" style="border-left:0;border-bottom:0"><span>'.get_lang('Course').'</span></th>'; |
1514 | 1514 | $t_head .= ' <th style="padding:0;border-bottom:0"><span>'.cut(get_lang('AvgTimeSpentInTheCourse'), 6, true).'</span></th>'; |
1515 | 1515 | $t_head .= ' <th style="padding:0;border-bottom:0"><span>'.cut(get_lang('AvgStudentsProgress'), 6, true).'</span></th>'; |
@@ -1527,7 +1527,7 @@ discard block |
||
1527 | 1527 | |
1528 | 1528 | $addparams = array('view' => 'admin', 'display' => 'sessionoverview'); |
1529 | 1529 | |
1530 | - $table = new SortableTable('tracking_session_overview', array('MySpace','get_total_number_sessions'), array('MySpace','get_session_data_tracking_overview'), 1); |
|
1530 | + $table = new SortableTable('tracking_session_overview', array('MySpace', 'get_total_number_sessions'), array('MySpace', 'get_session_data_tracking_overview'), 1); |
|
1531 | 1531 | $table->additional_parameters = $addparams; |
1532 | 1532 | |
1533 | 1533 | $table->set_header(0, '', false, null, array('style' => 'display: none')); |
@@ -1566,7 +1566,7 @@ discard block |
||
1566 | 1566 | $sql .= " ORDER BY col$column $direction "; |
1567 | 1567 | $sql .= " LIMIT $from,$number_of_items"; |
1568 | 1568 | $result = Database::query($sql); |
1569 | - $return = array (); |
|
1569 | + $return = array(); |
|
1570 | 1570 | while ($session = Database::fetch_row($result)) { |
1571 | 1571 | $return[] = $session; |
1572 | 1572 | } |
@@ -1655,10 +1655,10 @@ discard block |
||
1655 | 1655 | if ($last_login_date_tmp != false && $last_login_date == false) { |
1656 | 1656 | // TODO: To be cleaned. |
1657 | 1657 | $last_login_date = $last_login_date_tmp; |
1658 | - } else if($last_login_date_tmp != false && $last_login_date != false) { |
|
1658 | + } else if ($last_login_date_tmp != false && $last_login_date != false) { |
|
1659 | 1659 | // TODO: Repeated previous condition! To be cleaned. |
1660 | 1660 | // Find the max and assign it to first_login_date |
1661 | - if(strtotime($last_login_date_tmp) > strtotime($last_login_date)) { |
|
1661 | + if (strtotime($last_login_date_tmp) > strtotime($last_login_date)) { |
|
1662 | 1662 | $last_login_date = $last_login_date_tmp; |
1663 | 1663 | } |
1664 | 1664 | } |
@@ -1668,27 +1668,27 @@ discard block |
||
1668 | 1668 | $total_score_possible += $exercise_results_tmp['score_possible']; |
1669 | 1669 | $total_questions_answered += $exercise_results_tmp['questions_answered']; |
1670 | 1670 | } |
1671 | - if($nb_progress_lp > 0) { |
|
1671 | + if ($nb_progress_lp > 0) { |
|
1672 | 1672 | $avg_progress = round($progress / $nb_progress_lp, 2); |
1673 | 1673 | } else { |
1674 | 1674 | $avg_progress = 0; |
1675 | 1675 | } |
1676 | - if($nb_score_lp > 0) { |
|
1676 | + if ($nb_score_lp > 0) { |
|
1677 | 1677 | $avg_score = round($score / $nb_score_lp, 2); |
1678 | 1678 | } else { |
1679 | 1679 | $avg_score = '-'; |
1680 | 1680 | } |
1681 | - if($last_login_date) { |
|
1681 | + if ($last_login_date) { |
|
1682 | 1682 | $last_login_date = api_convert_and_format_date($last_login_date, DATE_FORMAT_SHORT, date_default_timezone_get()); |
1683 | 1683 | } else { |
1684 | 1684 | $last_login_date = '-'; |
1685 | 1685 | } |
1686 | - if($total_score_possible > 0) { |
|
1686 | + if ($total_score_possible > 0) { |
|
1687 | 1687 | $total_score_percentage = round($total_score_obtained / $total_score_possible * 100, 2); |
1688 | 1688 | } else { |
1689 | 1689 | $total_score_percentage = 0; |
1690 | 1690 | } |
1691 | - if($total_score_percentage > 0) { |
|
1691 | + if ($total_score_percentage > 0) { |
|
1692 | 1692 | $total_score = $total_score_obtained.'/'.$total_score_possible.' ('.$total_score_percentage.' %)'; |
1693 | 1693 | } else { |
1694 | 1694 | $total_score = '-'; |
@@ -1799,7 +1799,7 @@ discard block |
||
1799 | 1799 | $total_score_obtained = 0; |
1800 | 1800 | $total_score_possible = 0; |
1801 | 1801 | $total_questions_answered = 0; |
1802 | - while($row_user = Database::fetch_object($result_users)) { |
|
1802 | + while ($row_user = Database::fetch_object($result_users)) { |
|
1803 | 1803 | // get time spent in the course and session |
1804 | 1804 | $time_spent += Tracking::get_time_spent_on_the_course($row_user->user_id, $courseId, $session_id); |
1805 | 1805 | $progress_tmp = Tracking::get_avg_student_progress($row_user->user_id, $row->code, array(), $session_id, true); |
@@ -1828,11 +1828,11 @@ discard block |
||
1828 | 1828 | $session_id, |
1829 | 1829 | false |
1830 | 1830 | ); |
1831 | - if($last_login_date_tmp != false && $last_login_date == false) { // TODO: To be cleaned. |
|
1831 | + if ($last_login_date_tmp != false && $last_login_date == false) { // TODO: To be cleaned. |
|
1832 | 1832 | $last_login_date = $last_login_date_tmp; |
1833 | - } else if($last_login_date_tmp != false && $last_login_date == false) { // TODO: Repeated previous condition. To be cleaned. |
|
1833 | + } else if ($last_login_date_tmp != false && $last_login_date == false) { // TODO: Repeated previous condition. To be cleaned. |
|
1834 | 1834 | // Find the max and assign it to first_login_date |
1835 | - if(strtotime($last_login_date_tmp) > strtotime($last_login_date)) { |
|
1835 | + if (strtotime($last_login_date_tmp) > strtotime($last_login_date)) { |
|
1836 | 1836 | $last_login_date = $last_login_date_tmp; |
1837 | 1837 | } |
1838 | 1838 | } |
@@ -1842,27 +1842,27 @@ discard block |
||
1842 | 1842 | $total_score_possible += $exercise_results_tmp['score_possible']; |
1843 | 1843 | $total_questions_answered += $exercise_results_tmp['questions_answered']; |
1844 | 1844 | } |
1845 | - if($nb_progress_lp > 0) { |
|
1845 | + if ($nb_progress_lp > 0) { |
|
1846 | 1846 | $avg_progress = round($progress / $nb_progress_lp, 2); |
1847 | 1847 | } else { |
1848 | 1848 | $avg_progress = 0; |
1849 | 1849 | } |
1850 | - if($nb_score_lp > 0) { |
|
1850 | + if ($nb_score_lp > 0) { |
|
1851 | 1851 | $avg_score = round($score / $nb_score_lp, 2); |
1852 | 1852 | } else { |
1853 | 1853 | $avg_score = '-'; |
1854 | 1854 | } |
1855 | - if($last_login_date) { |
|
1855 | + if ($last_login_date) { |
|
1856 | 1856 | $last_login_date = api_convert_and_format_date($last_login_date, DATE_FORMAT_SHORT, date_default_timezone_get()); |
1857 | 1857 | } else { |
1858 | 1858 | $last_login_date = '-'; |
1859 | 1859 | } |
1860 | - if($total_score_possible > 0) { |
|
1860 | + if ($total_score_possible > 0) { |
|
1861 | 1861 | $total_score_percentage = round($total_score_obtained / $total_score_possible * 100, 2); |
1862 | 1862 | } else { |
1863 | 1863 | $total_score_percentage = 0; |
1864 | 1864 | } |
1865 | - if($total_score_percentage > 0) { |
|
1865 | + if ($total_score_percentage > 0) { |
|
1866 | 1866 | $total_score = $total_score_obtained.'/'.$total_score_possible.' ('.$total_score_percentage.' %)'; |
1867 | 1867 | } else { |
1868 | 1868 | $total_score = '-'; |
@@ -1912,7 +1912,7 @@ discard block |
||
1912 | 1912 | FROM '.Database :: get_main_table(TABLE_STATISTIC_TRACK_E_EXERCISES)." |
1913 | 1913 | WHERE c_id = ' . $courseId . ' |
1914 | 1914 | AND exe_user_id = '".intval($user_id)."'"; |
1915 | - if($session_id !== false) { |
|
1915 | + if ($session_id !== false) { |
|
1916 | 1916 | $sql .= " AND session_id = '".$session_id."' "; |
1917 | 1917 | } |
1918 | 1918 | $result = Database::query($sql); |
@@ -1922,7 +1922,7 @@ discard block |
||
1922 | 1922 | while ($row = Database::fetch_array($result)) { |
1923 | 1923 | $score_obtained += $row['exe_result']; |
1924 | 1924 | $score_possible += $row['exe_weighting']; |
1925 | - $questions_answered ++; |
|
1925 | + $questions_answered++; |
|
1926 | 1926 | } |
1927 | 1927 | |
1928 | 1928 | if ($score_possible != 0) { |
@@ -2043,9 +2043,9 @@ discard block |
||
2043 | 2043 | } |
2044 | 2044 | } |
2045 | 2045 | // time spent in the course |
2046 | - $csv_row[] = api_time_to_hms(Tracking::get_time_spent_on_the_course ($user[4], $courseId)); |
|
2046 | + $csv_row[] = api_time_to_hms(Tracking::get_time_spent_on_the_course($user[4], $courseId)); |
|
2047 | 2047 | // student progress in course |
2048 | - $csv_row[] = round(Tracking::get_avg_student_progress ($user[4], $row[0]), 2); |
|
2048 | + $csv_row[] = round(Tracking::get_avg_student_progress($user[4], $row[0]), 2); |
|
2049 | 2049 | // student score |
2050 | 2050 | $csv_row[] = round(Tracking::get_avg_student_score($user[4], $row[0]), 2); |
2051 | 2051 | // student tes score |
@@ -2053,7 +2053,7 @@ discard block |
||
2053 | 2053 | // student messages |
2054 | 2054 | $csv_row[] = Tracking::count_student_messages($user[4], $row[0]); |
2055 | 2055 | // student assignments |
2056 | - $csv_row[] = Tracking::count_student_assignments ($user[4], $row[0]); |
|
2056 | + $csv_row[] = Tracking::count_student_assignments($user[4], $row[0]); |
|
2057 | 2057 | // student exercises results |
2058 | 2058 | $exercises_results = MySpace::exercises_results($user[4], $row[0]); |
2059 | 2059 | $csv_row[] = $exercises_results['score_obtained']; |
@@ -2061,7 +2061,7 @@ discard block |
||
2061 | 2061 | $csv_row[] = $exercises_results['questions_answered']; |
2062 | 2062 | $csv_row[] = $exercises_results['percentage']; |
2063 | 2063 | // first connection |
2064 | - $csv_row[] = Tracking::get_first_connection_date_on_the_course ($user[4], $courseId); |
|
2064 | + $csv_row[] = Tracking::get_first_connection_date_on_the_course($user[4], $courseId); |
|
2065 | 2065 | // last connection |
2066 | 2066 | $csv_row[] = strip_tags(Tracking::get_last_connection_date_on_the_course($user[4], $courseInfo)); |
2067 | 2067 | |
@@ -2095,9 +2095,9 @@ discard block |
||
2095 | 2095 | // get all courses with limit |
2096 | 2096 | $sql = "SELECT course.code as col1, course.title as col2 |
2097 | 2097 | FROM $tbl_course course |
2098 | - WHERE course.code IN (".implode(',',$courses_code).")"; |
|
2098 | + WHERE course.code IN (".implode(',', $courses_code).")"; |
|
2099 | 2099 | |
2100 | - if (!in_array($direction, array('ASC','DESC'))) $direction = 'ASC'; |
|
2100 | + if (!in_array($direction, array('ASC', 'DESC'))) $direction = 'ASC'; |
|
2101 | 2101 | |
2102 | 2102 | $column = intval($column); |
2103 | 2103 | $from = intval($from); |
@@ -2166,7 +2166,7 @@ discard block |
||
2166 | 2166 | $table_row[] = $avg_assignments_in_course; |
2167 | 2167 | |
2168 | 2168 | //set the "from" value to know if I access the Reporting by the chamilo tab or the course link |
2169 | - $table_row[] = '<center><a href="../../tracking/courseLog.php?cidReq=' .$course_code.'&from=myspace&id_session='.$session_id.'"> |
|
2169 | + $table_row[] = '<center><a href="../../tracking/courseLog.php?cidReq='.$course_code.'&from=myspace&id_session='.$session_id.'"> |
|
2170 | 2170 | <img src="'.api_get_path(WEB_IMG_PATH).'icons/22/2rightarrow.png" border="0" /></a> |
2171 | 2171 | </center>'; |
2172 | 2172 | $csv_content[] = array( |
@@ -2174,7 +2174,7 @@ discard block |
||
2174 | 2174 | $nb_students_in_course, |
2175 | 2175 | $avg_time_spent_in_course, |
2176 | 2176 | is_null($avg_progress_in_course) ? null : $avg_progress_in_course.'%', |
2177 | - is_null($avg_score_in_course) ? null : is_numeric($avg_score_in_course) ? $avg_score_in_course.'%' : $avg_score_in_course , |
|
2177 | + is_null($avg_score_in_course) ? null : is_numeric($avg_score_in_course) ? $avg_score_in_course.'%' : $avg_score_in_course, |
|
2178 | 2178 | is_null($avg_score_in_exercise) ? null : $avg_score_in_exercise.'%', |
2179 | 2179 | $avg_messages_in_course, |
2180 | 2180 | $avg_assignments_in_course, |
@@ -2242,7 +2242,7 @@ discard block |
||
2242 | 2242 | $sql .= " ORDER BY col$column $direction "; |
2243 | 2243 | $sql .= " LIMIT $from,$number_of_items"; |
2244 | 2244 | $result = Database::query($sql); |
2245 | - $return = array (); |
|
2245 | + $return = array(); |
|
2246 | 2246 | while ($user = Database::fetch_row($result)) { |
2247 | 2247 | $return[] = $user; |
2248 | 2248 | } |
@@ -2297,7 +2297,7 @@ discard block |
||
2297 | 2297 | $i++; |
2298 | 2298 | } |
2299 | 2299 | } |
2300 | - $username_array = array('username' => $desired_username , 'sufix' => $sufix); |
|
2300 | + $username_array = array('username' => $desired_username, 'sufix' => $sufix); |
|
2301 | 2301 | return $username_array; |
2302 | 2302 | } else { |
2303 | 2303 | $username_array = array('username' => $username, 'sufix' => ''); |
@@ -2571,7 +2571,7 @@ discard block |
||
2571 | 2571 | foreach ($users as $index => $user) { |
2572 | 2572 | $userid = $user['id']; |
2573 | 2573 | $sql_insert = "INSERT IGNORE INTO $tbl_session_rel_user(session_id, user_id, registered_at) |
2574 | - VALUES ('$id_session','$userid', '" . api_get_utc_datetime() . "')"; |
|
2574 | + VALUES ('$id_session','$userid', '".api_get_utc_datetime()."')"; |
|
2575 | 2575 | Database::query($sql_insert); |
2576 | 2576 | $user['added_at_session'] = 1; |
2577 | 2577 | $new_users[] = $user; |
@@ -2605,10 +2605,10 @@ discard block |
||
2605 | 2605 | ); |
2606 | 2606 | $userInfo = api_get_user_info($user['id']); |
2607 | 2607 | |
2608 | - if (($user['added_at_platform'] == 1 && $user['added_at_session'] == 1) || $user['added_at_session'] == 1) { |
|
2608 | + if (($user['added_at_platform'] == 1 && $user['added_at_session'] == 1) || $user['added_at_session'] == 1) { |
|
2609 | 2609 | if ($user['added_at_platform'] == 1) { |
2610 | 2610 | $addedto = get_lang('UserCreatedPlatform'); |
2611 | - } else { |
|
2611 | + } else { |
|
2612 | 2612 | $addedto = ' '; |
2613 | 2613 | } |
2614 | 2614 | |
@@ -2671,7 +2671,7 @@ discard block |
||
2671 | 2671 | global $current_tag; |
2672 | 2672 | switch ($data) { |
2673 | 2673 | case 'Contact' : |
2674 | - $user = array (); |
|
2674 | + $user = array(); |
|
2675 | 2675 | break; |
2676 | 2676 | default : |
2677 | 2677 | $current_tag = $data; |
@@ -2718,9 +2718,9 @@ discard block |
||
2718 | 2718 | global $current_value; |
2719 | 2719 | global $user; |
2720 | 2720 | global $users; |
2721 | - $users = array (); |
|
2721 | + $users = array(); |
|
2722 | 2722 | $parser = xml_parser_create('UTF-8'); |
2723 | - xml_set_element_handler($parser, array('MySpace','element_start'), array('MySpace','element_end')); |
|
2723 | + xml_set_element_handler($parser, array('MySpace', 'element_start'), array('MySpace', 'element_end')); |
|
2724 | 2724 | xml_set_character_data_handler($parser, "character_data"); |
2725 | 2725 | xml_parser_set_option($parser, XML_OPTION_CASE_FOLDING, false); |
2726 | 2726 | xml_parse($parser, api_utf8_encode_xml(file_get_contents($file))); |
@@ -2766,7 +2766,7 @@ discard block |
||
2766 | 2766 | get_lang('SearchCourse'), |
2767 | 2767 | $courseList, |
2768 | 2768 | [ |
2769 | - 'url' => api_get_path(WEB_AJAX_PATH) . 'course.ajax.php?' . http_build_query([ |
|
2769 | + 'url' => api_get_path(WEB_AJAX_PATH).'course.ajax.php?'.http_build_query([ |
|
2770 | 2770 | 'a' => 'search_course_by_session_all', |
2771 | 2771 | 'session_id' => $sessionId |
2772 | 2772 | ]) |
@@ -2785,7 +2785,7 @@ discard block |
||
2785 | 2785 | course_id: $('#course_id').val() || 0 |
2786 | 2786 | }); |
2787 | 2787 | |
2788 | - return '" . api_get_path(WEB_AJAX_PATH) . "session.ajax.php?' + params; |
|
2788 | + return '" . api_get_path(WEB_AJAX_PATH)."session.ajax.php?' + params; |
|
2789 | 2789 | } |
2790 | 2790 | " |
2791 | 2791 | ] |
@@ -2816,7 +2816,7 @@ discard block |
||
2816 | 2816 | course_id: $('#course_id').val() |
2817 | 2817 | }); |
2818 | 2818 | |
2819 | - return '" . api_get_path(WEB_AJAX_PATH) . "course.ajax.php?' + params; |
|
2819 | + return '" . api_get_path(WEB_AJAX_PATH)."course.ajax.php?' + params; |
|
2820 | 2820 | } |
2821 | 2821 | " |
2822 | 2822 | ] |
@@ -2842,8 +2842,8 @@ discard block |
||
2842 | 2842 | if ($form->validate()) { |
2843 | 2843 | $table = new SortableTable( |
2844 | 2844 | 'tracking_access_overview', |
2845 | - ['MySpace','getNumberOfRrackingAccessOverview'], |
|
2846 | - ['MySpace','getUserDataAccessTrackingOverview'], |
|
2845 | + ['MySpace', 'getNumberOfRrackingAccessOverview'], |
|
2846 | + ['MySpace', 'getUserDataAccessTrackingOverview'], |
|
2847 | 2847 | 0 |
2848 | 2848 | ); |
2849 | 2849 | $table->additional_parameters = $form->exportValues(); |
@@ -2904,7 +2904,7 @@ discard block |
||
2904 | 2904 | " : " |
2905 | 2905 | u.lastname AS col2, |
2906 | 2906 | u.firstname AS col3, |
2907 | - " ) . " |
|
2907 | + " )." |
|
2908 | 2908 | a.logout_course_date, |
2909 | 2909 | c.title, |
2910 | 2910 | c.code, |
@@ -2915,7 +2915,7 @@ discard block |
||
2915 | 2915 | |
2916 | 2916 | if (isset($_GET['session_id']) && !empty($_GET['session_id'])) { |
2917 | 2917 | $sessionId = intval($_GET['session_id']); |
2918 | - $sql .= " WHERE a.session_id = " . $sessionId; |
|
2918 | + $sql .= " WHERE a.session_id = ".$sessionId; |
|
2919 | 2919 | } |
2920 | 2920 | |
2921 | 2921 | $sql .= " ORDER BY col$column $orderDirection "; |
@@ -2976,14 +2976,14 @@ discard block |
||
2976 | 2976 | function get_stats($user_id, $courseId, $start_date = null, $end_date = null) |
2977 | 2977 | { |
2978 | 2978 | // Database table definitions |
2979 | - $tbl_track_course = Database :: get_main_table(TABLE_STATISTIC_TRACK_E_COURSE_ACCESS); |
|
2979 | + $tbl_track_course = Database :: get_main_table(TABLE_STATISTIC_TRACK_E_COURSE_ACCESS); |
|
2980 | 2980 | |
2981 | 2981 | $course_info = api_get_course_info_by_id($courseId); |
2982 | 2982 | if (!empty($course_info)) { |
2983 | 2983 | $strg_sd = ""; |
2984 | 2984 | $strg_ed = ""; |
2985 | - if ($start_date != null && $end_date != null){ |
|
2986 | - $end_date = add_day_to( $end_date ); |
|
2985 | + if ($start_date != null && $end_date != null) { |
|
2986 | + $end_date = add_day_to($end_date); |
|
2987 | 2987 | $strg_sd = "AND login_course_date BETWEEN '$start_date' AND '$end_date'"; |
2988 | 2988 | $strg_ed = "AND logout_course_date BETWEEN '$start_date' AND '$end_date'"; |
2989 | 2989 | } |
@@ -2991,10 +2991,10 @@ discard block |
||
2991 | 2991 | SEC_TO_TIME(avg(time_to_sec(timediff(logout_course_date,login_course_date)))) as avrg, |
2992 | 2992 | SEC_TO_TIME(sum(time_to_sec(timediff(logout_course_date,login_course_date)))) as total, |
2993 | 2993 | count(user_id) as times |
2994 | - FROM ' . $tbl_track_course . ' |
|
2994 | + FROM ' . $tbl_track_course.' |
|
2995 | 2995 | WHERE |
2996 | - user_id = ' . intval($user_id) . ' AND |
|
2997 | - c_id = ' . intval($courseId) . ' '.$strg_sd.' '.$strg_ed.' '.' |
|
2996 | + user_id = ' . intval($user_id).' AND |
|
2997 | + c_id = ' . intval($courseId).' '.$strg_sd.' '.$strg_ed.' '.' |
|
2998 | 2998 | ORDER BY login_course_date ASC'; |
2999 | 2999 | |
3000 | 3000 | $rs = Database::query($sql); |
@@ -3012,7 +3012,7 @@ discard block |
||
3012 | 3012 | } |
3013 | 3013 | |
3014 | 3014 | function add_day_to($end_date) { |
3015 | - $foo_date = strtotime( $end_date ); |
|
3015 | + $foo_date = strtotime($end_date); |
|
3016 | 3016 | $foo_date = strtotime(" +1 day", $foo_date); |
3017 | 3017 | $foo_date = date("Y-m-d", $foo_date); |
3018 | 3018 | return $foo_date; |
@@ -3072,7 +3072,7 @@ discard block |
||
3072 | 3072 | * @version OCT-22- 2010 |
3073 | 3073 | * @return array |
3074 | 3074 | */ |
3075 | -function convert_to_array($sql_result){ |
|
3075 | +function convert_to_array($sql_result) { |
|
3076 | 3076 | $result_to_print = '<table>'; |
3077 | 3077 | foreach ($sql_result as $key => $data) { |
3078 | 3078 | $result_to_print .= '<tr><td>'.date('d-m-Y (H:i:s)', $data['login']).'</td><td>'.api_time_to_hms($data['logout'] - $data['login']).'</tr></td>'."\n"; |
@@ -3091,7 +3091,7 @@ discard block |
||
3091 | 3091 | * @version OCT-22- 2010 |
3092 | 3092 | * @return string |
3093 | 3093 | */ |
3094 | -function convert_to_string($sql_result){ |
|
3094 | +function convert_to_string($sql_result) { |
|
3095 | 3095 | $result_to_print = '<table>'; |
3096 | 3096 | if (!empty($sql_result)) { |
3097 | 3097 | foreach ($sql_result as $key => $data) { |
@@ -3116,18 +3116,18 @@ discard block |
||
3116 | 3116 | */ |
3117 | 3117 | function grapher($sql_result, $start_date, $end_date, $type = "") |
3118 | 3118 | { |
3119 | - if (empty($start_date)) { $start_date =""; } |
|
3120 | - if (empty($end_date)) { $end_date =""; } |
|
3121 | - if ($type == ""){ $type = 'day'; } |
|
3122 | - $main_year = $main_month_year = $main_day = array(); |
|
3119 | + if (empty($start_date)) { $start_date = ""; } |
|
3120 | + if (empty($end_date)) { $end_date = ""; } |
|
3121 | + if ($type == "") { $type = 'day'; } |
|
3122 | + $main_year = $main_month_year = $main_day = array(); |
|
3123 | 3123 | // get last 8 days/months |
3124 | 3124 | $last_days = 5; |
3125 | 3125 | $last_months = 3; |
3126 | 3126 | for ($i = $last_days; $i >= 0; $i--) { |
3127 | - $main_day[date ('d-m-Y', mktime () - $i * 3600 * 24)] = 0; |
|
3127 | + $main_day[date('d-m-Y', mktime() - $i * 3600 * 24)] = 0; |
|
3128 | 3128 | } |
3129 | 3129 | for ($i = $last_months; $i >= 0; $i--) { |
3130 | - $main_month_year[date ('m-Y', mktime () - $i * 30 * 3600 * 24)] = 0; |
|
3130 | + $main_month_year[date('m-Y', mktime() - $i * 30 * 3600 * 24)] = 0; |
|
3131 | 3131 | } |
3132 | 3132 | |
3133 | 3133 | $i = 0; |
@@ -3163,7 +3163,7 @@ discard block |
||
3163 | 3163 | /* Create and populate the pData object */ |
3164 | 3164 | $myData = new pData(); |
3165 | 3165 | $myData->addPoints($main_date, 'Serie1'); |
3166 | - if (count($main_date)!= 1) { |
|
3166 | + if (count($main_date) != 1) { |
|
3167 | 3167 | $myData->addPoints($labels, 'Labels'); |
3168 | 3168 | $myData->setSerieDescription('Labels', 'Months'); |
3169 | 3169 | $myData->setAbscissa('Labels'); |
@@ -3171,7 +3171,7 @@ discard block |
||
3171 | 3171 | $myData->setSerieWeight('Serie1', 1); |
3172 | 3172 | $myData->setSerieDescription('Serie1', get_lang('MyResults')); |
3173 | 3173 | $myData->setAxisName(0, get_lang('Minutes')); |
3174 | - $myData->loadPalette(api_get_path(SYS_CODE_PATH) . 'palettes/pchart/default.color', true); |
|
3174 | + $myData->loadPalette(api_get_path(SYS_CODE_PATH).'palettes/pchart/default.color', true); |
|
3175 | 3175 | |
3176 | 3176 | // Cache definition |
3177 | 3177 | $cachePath = api_get_path(SYS_ARCHIVE_PATH); |
@@ -3180,9 +3180,9 @@ discard block |
||
3180 | 3180 | |
3181 | 3181 | if ($myCache->isInCache($chartHash)) { |
3182 | 3182 | //if we already created the img |
3183 | - $imgPath = api_get_path(SYS_ARCHIVE_PATH) . $chartHash; |
|
3183 | + $imgPath = api_get_path(SYS_ARCHIVE_PATH).$chartHash; |
|
3184 | 3184 | $myCache->saveFromCache($chartHash, $imgPath); |
3185 | - $imgPath = api_get_path(WEB_ARCHIVE_PATH) . $chartHash; |
|
3185 | + $imgPath = api_get_path(WEB_ARCHIVE_PATH).$chartHash; |
|
3186 | 3186 | } else { |
3187 | 3187 | /* Define width, height and angle */ |
3188 | 3188 | $mainWidth = 760; |
@@ -3211,7 +3211,7 @@ discard block |
||
3211 | 3211 | /* Set the default font */ |
3212 | 3212 | $myPicture->setFontProperties( |
3213 | 3213 | array( |
3214 | - "FontName" => api_get_path(SYS_FONTS_PATH) . 'opensans/OpenSans-Regular.ttf', |
|
3214 | + "FontName" => api_get_path(SYS_FONTS_PATH).'opensans/OpenSans-Regular.ttf', |
|
3215 | 3215 | "FontSize" => 10) |
3216 | 3216 | ); |
3217 | 3217 | /* Write the chart title */ |
@@ -3228,7 +3228,7 @@ discard block |
||
3228 | 3228 | /* Set the default font */ |
3229 | 3229 | $myPicture->setFontProperties( |
3230 | 3230 | array( |
3231 | - "FontName" => api_get_path(SYS_FONTS_PATH) . 'opensans/OpenSans-Regular.ttf', |
|
3231 | + "FontName" => api_get_path(SYS_FONTS_PATH).'opensans/OpenSans-Regular.ttf', |
|
3232 | 3232 | "FontSize" => 8 |
3233 | 3233 | ) |
3234 | 3234 | ); |
@@ -3270,7 +3270,7 @@ discard block |
||
3270 | 3270 | /* Draw the line chart */ |
3271 | 3271 | $myPicture->setFontProperties( |
3272 | 3272 | array( |
3273 | - "FontName" => api_get_path(SYS_FONTS_PATH) . 'opensans/OpenSans-Regular.ttf', |
|
3273 | + "FontName" => api_get_path(SYS_FONTS_PATH).'opensans/OpenSans-Regular.ttf', |
|
3274 | 3274 | "FontSize" => 10 |
3275 | 3275 | ) |
3276 | 3276 | ); |
@@ -3289,15 +3289,15 @@ discard block |
||
3289 | 3289 | |
3290 | 3290 | /* Write and save into cache */ |
3291 | 3291 | $myCache->writeToCache($chartHash, $myPicture); |
3292 | - $imgPath = api_get_path(SYS_ARCHIVE_PATH) . $chartHash; |
|
3292 | + $imgPath = api_get_path(SYS_ARCHIVE_PATH).$chartHash; |
|
3293 | 3293 | $myCache->saveFromCache($chartHash, $imgPath); |
3294 | - $imgPath = api_get_path(WEB_ARCHIVE_PATH) . $chartHash; |
|
3294 | + $imgPath = api_get_path(WEB_ARCHIVE_PATH).$chartHash; |
|
3295 | 3295 | } |
3296 | - $html = '<img src="' . $imgPath . '">'; |
|
3296 | + $html = '<img src="'.$imgPath.'">'; |
|
3297 | 3297 | |
3298 | 3298 | return $html; |
3299 | 3299 | } else { |
3300 | - $foo_img = api_convert_encoding('<div id="messages" class="warning-message">'.get_lang('GraphicNotAvailable').'</div>','UTF-8'); |
|
3300 | + $foo_img = api_convert_encoding('<div id="messages" class="warning-message">'.get_lang('GraphicNotAvailable').'</div>', 'UTF-8'); |
|
3301 | 3301 | |
3302 | 3302 | return $foo_img; |
3303 | 3303 | } |
@@ -2097,7 +2097,9 @@ |
||
2097 | 2097 | FROM $tbl_course course |
2098 | 2098 | WHERE course.code IN (".implode(',',$courses_code).")"; |
2099 | 2099 | |
2100 | - if (!in_array($direction, array('ASC','DESC'))) $direction = 'ASC'; |
|
2100 | + if (!in_array($direction, array('ASC','DESC'))) { |
|
2101 | + $direction = 'ASC'; |
|
2102 | + } |
|
2101 | 2103 | |
2102 | 2104 | $column = intval($column); |
2103 | 2105 | $from = intval($from); |