Passed
Push — master ( 36b2e2...acc358 )
by Michael
06:03 queued 11s
created

makeClickableCallbackEmailAddress()   A

Complexity

Conditions 1
Paths 1

Size

Total Lines 3
Code Lines 1

Duplication

Lines 0
Ratio 0 %

Importance

Changes 1
Bugs 0 Features 0
Metric Value
cc 1
eloc 1
c 1
b 0
f 0
nc 1
nop 1
dl 0
loc 3
rs 10
1
<?php
2
/**
3
 * XOOPS TextSanitizer extension
4
 *
5
 * You may not change or alter any portion of this comment or credits
6
 * of supporting developers from this source code or any supporting source code
7
 * which is considered copyrighted (c) material of the original comment or credit authors.
8
 * This program is distributed in the hope that it will be useful,
9
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
10
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
11
 *
12
 * @copyright       (c) 2000-2021 XOOPS Project (https://xoops.org)
13
 * @license             GNU GPL 2 (https://www.gnu.org/licenses/gpl-2.0.html)
14
 * @package             class
15
 * @since               2.0.0
16
 * @author              Kazumi Ono (http://www.myweb.ne.jp/, http://jp.xoops.org/)
17
 * @author              Goghs Cheng (http://www.eqiao.com, http://www.devbeez.com/)
18
 * @author              Taiwen Jiang <[email protected]>
19
 */
20
21
/**
22
 * Abstract class for extensions
23
 *
24
 * @author              Taiwen Jiang <[email protected]>
25
 * @copyright       (c) 2000-2021 XOOPS Project (https://xoops.org)
26
 */
27
class MyTextSanitizerExtension
28
{
29
    public $instance;
30
    public $ts;
31
    public $config;
32
    public $image_path;
33
34
    /**
35
     * Constructor
36
     *
37
     * @param MyTextSanitizer $ts
38
     */
39
    public function __construct(MyTextSanitizer $ts)
40
    {
41
        $this->ts         = $ts;
42
        $this->image_path = XOOPS_URL . '/images/form';
43
    }
44
45
    /**
46
     * loadConfig
47
     *
48
     * @param  string $path
49
     * @return string|array
50
     */
51
    public static function loadConfig($path = null)
52
    {
53
        $ts   = MyTextSanitizer::getInstance();
54
        $extensionName = (null === $path) ? '' : basename($path);
55
        $pathDist = $ts->path_basic;
56
        $pathConfig = $ts->path_config;
57
58
        if ('' !== $extensionName) {
59
            $configFileName = $pathConfig . '/config.' . $extensionName . '.php';
60
            $distFileName = $pathDist . '/' . $extensionName . '/config.' . $extensionName . '.dist.php';
61
        } else {
62
            $configFileName = $pathConfig . '/config.php';
63
            $distFileName = $pathDist . '/config.dist.php';
64
        }
65
        if (!file_exists($configFileName)) {
66
            if (false === copy($distFileName, $configFileName)) {
67
                trigger_error('Could not create textsanitizer config file ' . basename($configFileName));
68
                return $a = array();
0 ignored issues
show
Unused Code introduced by
The assignment to $a is dead and can be removed.
Loading history...
69
            }
70
        }
71
        $configs = include $configFileName;
72
        return $configs;
73
    }
74
75
    /**
76
     * Merge Config
77
     *
78
     * @param  array $config_default
79
     * @param  array $config_custom
80
     * @return array
81
     */
82
    public static function mergeConfig($config_default, $config_custom)
83
    {
84
        if (is_array($config_custom)) {
0 ignored issues
show
introduced by
The condition is_array($config_custom) is always true.
Loading history...
85
            foreach ($config_custom as $key => $val) {
86
                if (is_array($config_default[$key])) {
87
                    $config_default[$key] = self::mergeConfig($config_default[$key], $config_custom[$key]);
88
                } else {
89
                    $config_default[$key] = $val;
90
                }
91
            }
92
        }
93
94
        return $config_default;
95
    }
96
97
    /**
98
     * encode
99
     *
100
     * @param string $textarea_id id attribute of text area
101
     *
102
     * @return array
103
     */
104
    public function encode($textarea_id)
0 ignored issues
show
Unused Code introduced by
The parameter $textarea_id is not used and could be removed. ( Ignorable by Annotation )

If this is a false-positive, you can also ignore this issue in your code via the ignore-unused  annotation

104
    public function encode(/** @scrutinizer ignore-unused */ $textarea_id)

This check looks for parameters that have been defined for a function or method, but which are not used in the method body.

Loading history...
105
    {
106
        return array();
107
    }
108
109
    /**
110
     * decode
111
     *
112
     * @param string $url
113
     * @param string|integer $width
114
     * @param string|integer $height
115
     *
116
     * @return Null
117
     */
118
    public static function decode($url, $width, $height)
0 ignored issues
show
Unused Code introduced by
The parameter $height is not used and could be removed. ( Ignorable by Annotation )

If this is a false-positive, you can also ignore this issue in your code via the ignore-unused  annotation

118
    public static function decode($url, $width, /** @scrutinizer ignore-unused */ $height)

This check looks for parameters that have been defined for a function or method, but which are not used in the method body.

Loading history...
Unused Code introduced by
The parameter $width is not used and could be removed. ( Ignorable by Annotation )

If this is a false-positive, you can also ignore this issue in your code via the ignore-unused  annotation

118
    public static function decode($url, /** @scrutinizer ignore-unused */ $width, $height)

This check looks for parameters that have been defined for a function or method, but which are not used in the method body.

Loading history...
119
    {
120
        return null;
121
    }
122
}
123
124
/**
125
 * Class to "clean up" text for various uses
126
 *
127
 * <strong>Singleton</strong>
128
 *
129
 * @package       kernel
130
 * @subpackage    core
131
 * @author        Kazumi Ono <[email protected]>
132
 * @author        Taiwen Jiang <[email protected]>
133
 * @author        Goghs Cheng
134
 * @copyright (c) 2000-2021 XOOPS Project (https://xoops.org)
135
 */
136
class MyTextSanitizer
137
{
138
    /**
139
     *
140
     * @var array
141
     */
142
    public $smileys = array();
143
144
    /**
145
     */
146
    public $censorConf;
147
148
    /**
149
     *
150
     * @var string holding reference to text
151
     */
152
    public $text         = '';
153
    public $patterns     = array();
154
    public $replacements = array();
155
156
    //mb------------------------------
157
    public $callbackPatterns = array();
158
    public $callbacks        = array();
159
    //mb------------------------------
160
161
    public $path_basic;
162
    public $path_config;
163
    public $path_plugin;
164
165
    public $config;
166
167
    /**
168
     * Constructor of this class
169
     *
170
     * Gets allowed html tags from admin config settings
171
     * <br> should not be allowed since nl2br will be used
172
     * when storing data.
173
     *
174
     * @access private
175
     */
176
177
    public function __construct()
178
    {
179
        $this->path_basic  = XOOPS_ROOT_PATH . '/class/textsanitizer';
180
        $this->path_config = XOOPS_VAR_PATH . '/configs/textsanitizer';
181
        $this->path_plugin = XOOPS_ROOT_PATH . '/Frameworks/textsanitizer';
182
        $this->config      = $this->loadConfig();
183
    }
184
185
    /**
186
     * Enter description here...
187
     *
188
     * @param  string $name
189
     * @return array|string
190
     */
191
    public function loadConfig($name = null)
192
    {
193
        // NB: sending a null name results in an infinite loop
194
        if (!empty($name)) {
195
            return MyTextSanitizerExtension::loadConfig($name);
196
        }
197
198
        $configFileName = $this->path_config . '/config.php';
199
        $distFileName = $this->path_basic . '/config.dist.php';
200
201
        if (!file_exists($configFileName)) {
202
            if (false===copy($distFileName, $configFileName)) {
203
                trigger_error('Could not create textsanitizer config file ' . basename($configFileName));
204
                return array();
205
            }
206
        }
207
        return include $configFileName;
208
    }
209
210
    /**
211
     * Enter description here...
212
     *
213
     * @param  array $config_default
214
     * @param  array $config_custom
215
     * @return mixed
216
     */
217
    public function mergeConfig($config_default, $config_custom)
218
    {
219
        if (is_array($config_custom)) {
0 ignored issues
show
introduced by
The condition is_array($config_custom) is always true.
Loading history...
220
            foreach ($config_custom as $key => $val) {
221
                if (isset($config_default[$key]) && is_array($config_default[$key])) {
222
                    $config_default[$key] = $this->mergeConfig($config_default[$key], $config_custom[$key]);
223
                } else {
224
                    $config_default[$key] = $val;
225
                }
226
            }
227
        }
228
229
        return $config_default;
230
    }
231
232
    /**
233
     * Access the only instance of this class
234
     *
235
     * @return MyTextSanitizer
236
     */
237
    public static function getInstance()
238
    {
239
        static $instance;
240
        if (!isset($instance)) {
241
            $instance = new MyTextSanitizer();
242
        }
243
244
        return $instance;
245
    }
246
247
    /**
248
     * Get the smileys
249
     *
250
     * @param bool $isAll TRUE for all smileys, FALSE for smileys with display = 1
251
     *
252
     * @return array
253
     */
254
    public function getSmileys($isAll = true)
255
    {
256
        if (count($this->smileys) == 0) {
257
            /* @var XoopsMySQLDatabase $xoopsDB */
258
            $xoopsDB = XoopsDatabaseFactory::getDatabaseConnection();
259
            if ($getsmiles = $xoopsDB->query('SELECT * FROM ' . $xoopsDB->prefix('smiles'))) {
260
                while (false !== ($smiles = $xoopsDB->fetchArray($getsmiles))) {
0 ignored issues
show
Bug introduced by
It seems like $getsmiles can also be of type true; however, parameter $result of XoopsMySQLDatabase::fetchArray() does only seem to accept mysqli_result, maybe add an additional type check? ( Ignorable by Annotation )

If this is a false-positive, you can also ignore this issue in your code via the ignore-type  annotation

260
                while (false !== ($smiles = $xoopsDB->fetchArray(/** @scrutinizer ignore-type */ $getsmiles))) {
Loading history...
261
                    $this->smileys[] = $smiles;
262
                }
263
            }
264
        }
265
        if ($isAll) {
266
            return $this->smileys;
267
        }
268
269
        $smileys = array();
270
        foreach ($this->smileys as $smile) {
271
            if (empty($smile['display'])) {
272
                continue;
273
            }
274
            $smileys[] = $smile;
275
        }
276
277
        return $smileys;
278
    }
279
280
    /**
281
     * Replace emoticons in the message with smiley images
282
     *
283
     * @param  string $message
284
     * @return string
285
     */
286
    public function smiley($message)
287
    {
288
        $smileys = $this->getSmileys();
289
        foreach ($smileys as $smile) {
290
            $message = str_replace($smile['code'], '<img class="imgsmile" src="' . XOOPS_UPLOAD_URL . '/' . htmlspecialchars($smile['smile_url']) . '" alt="" />', $message);
291
        }
292
293
        return $message;
294
    }
295
296
    /**
297
     * Callback to process email address match
298
     *
299
     * @param array $match array of matched elements
300
     *
301
     * @return string
302
     */
303
    protected function makeClickableCallbackEmailAddress($match)
304
    {
305
        return $match[1] . "<a href=\"mailto:$match[2]@$match[3]\" title=\"$match[2]@$match[3]\">" . $match[2] . '@' . $match[3] . '</a>';
306
    }
307
308
    /**
309
     * Make links in the text clickable
310
     * Presently handles email addresses and http, https, ftp and sftp urls
311
     * (Note: at this time, major browsers no longer directly handle ftp/sftp urls.)
312
     *
313
     * @param  string $text
314
     * @return string
315
     */
316
    public function makeClickable($text)
317
    {
318
        $pattern = "/(^|[^]_a-z0-9-=\"'\/:\.])([-_a-z0-9\'+*$^&%=~!?{}]++(?:\.[-_a-z0-9\'+*$^&%=~!?{}]+)*+)@((?:(?![-.])[-a-z0-9.]+(?<![-.])\.[a-z]{2,6}|\d{1,3}(?:\.\d{1,3}){3})(?::\d++)?)/i";
319
        $text = preg_replace_callback($pattern, 'self::makeClickableCallbackEmailAddress', $text);
320
321
        $pattern = "%(https?://)([-A-Z0-9./_*?&:;=#\[\]\%@]+)%i";
322
        $replacement = '<a href="$1$2" target="_blank" rel="external noopener nofollow">$1$2</a>';
323
        $text = preg_replace($pattern, $replacement, $text);
324
325
        $pattern = "%(s?ftp://)([-A-Z0-9./_*?&:;=#\[\]\%@]+)%i";
326
        $replacement = '<a href="$1$2" target="_blank" rel="external">$1$2</a>';
327
        $text = preg_replace($pattern, $replacement, $text);
328
329
        return $text;
330
    }
331
332
    /**
333
     * MyTextSanitizer::truncate()
334
     *
335
     * @param  mixed $text
336
     * @return mixed|string
337
     */
338
    public function truncate($text)
339
    {
340
        $instance = MyTextSanitizer::getInstance();
341
        if (empty($text) || empty($instance->config['truncate_length']) || strlen($text) < $instance->config['truncate_length']) {
342
            return $text;
343
        }
344
        $len = floor($instance->config['truncate_length'] / 2);
345
        $ret = substr($text, 0, $len) . ' ... ' . substr($text, 5 - $len);
0 ignored issues
show
Bug introduced by
5 - $len of type double is incompatible with the type integer expected by parameter $offset of substr(). ( Ignorable by Annotation )

If this is a false-positive, you can also ignore this issue in your code via the ignore-type  annotation

345
        $ret = substr($text, 0, $len) . ' ... ' . substr($text, /** @scrutinizer ignore-type */ 5 - $len);
Loading history...
Bug introduced by
$len of type double is incompatible with the type integer|null expected by parameter $length of substr(). ( Ignorable by Annotation )

If this is a false-positive, you can also ignore this issue in your code via the ignore-type  annotation

345
        $ret = substr($text, 0, /** @scrutinizer ignore-type */ $len) . ' ... ' . substr($text, 5 - $len);
Loading history...
346
347
        return $ret;
348
    }
349
350
    /**
351
     * Replace XoopsCodes with their equivalent HTML formatting
352
     *
353
     * @param  string   $text
354
     * @param  bool|int $allowimage Allow images in the text?
355
     *                              On FALSE, uses links to images.
356
     * @return string
357
     */
358
    public function &xoopsCodeDecode(&$text, $allowimage = 1)
359
    {
360
        $patterns       = array();
361
        $replacements   = array();
362
        $patterns[]     = "/\[siteurl=(['\"]?)([^\"'<>]*)\\1](.*)\[\/siteurl\]/sU";
363
        $replacements[] = '<a href="' . XOOPS_URL . '/\\2" title="">\\3</a>';
364
        $patterns[]     = "/\[url=(['\"]?)(http[s]?:\/\/[^\"'<>]*)\\1](.*)\[\/url\]/sU";
365
        $replacements[] = '<a href="\\2" rel="noopener external" title="">\\3</a>';
366
        $patterns[]     = "/\[url=(['\"]?)(ftp?:\/\/[^\"'<>]*)\\1](.*)\[\/url\]/sU";
367
        $replacements[] = '<a href="\\2" rel="external" title="">\\3</a>';
368
        $patterns[]     = "/\[url=(['\"]?)([^'\"<>]*)\\1](.*)\[\/url\]/sU";
369
        $replacements[] = '<a href="http://\\2" rel="noopener external" title="">\\3</a>';
370
        $patterns[]     = "/\[color=(['\"]?)([a-zA-Z0-9]*)\\1](.*)\[\/color\]/sU";
371
        $replacements[] = '<span style="color: #\\2;">\\3</span>';
372
        $patterns[]     = "/\[size=(['\"]?)([a-z0-9-]*)\\1](.*)\[\/size\]/sU";
373
        $replacements[] = '<span style="font-size: \\2;">\\3</span>';
374
        $patterns[]     = "/\[font=(['\"]?)([^;<>\*\(\)\"']*)\\1](.*)\[\/font\]/sU";
375
        $replacements[] = '<span style="font-family: \\2;">\\3</span>';
376
        $patterns[]     = "/\[email]([^;<>\*\(\)\"']*)\[\/email\]/sU";
377
        $replacements[] = '<a href="mailto:\\1" title="">\\1</a>';
378
379
        $patterns[]     = "/\[b](.*)\[\/b\]/sU";
380
        $replacements[] = '<strong>\\1</strong>';
381
        $patterns[]     = "/\[i](.*)\[\/i\]/sU";
382
        $replacements[] = '<em>\\1</em>';
383
        $patterns[]     = "/\[u](.*)\[\/u\]/sU";
384
        $replacements[] = '<span style="text-decoration: underline;">\\1</span>';
385
        $patterns[]     = "/\[d](.*)\[\/d\]/sU";
386
        $replacements[] = '<del>\\1</del>';
387
        $patterns[]     = "/\[center](.*)\[\/center\]/sU";
388
        $replacements[] = '<div style="text-align: center;">\\1</div>';
389
        $patterns[]     = "/\[left](.*)\[\/left\]/sU";
390
        $replacements[] = '<div style="text-align: left;">\\1</div>';
391
        $patterns[]     = "/\[right](.*)\[\/right\]/sU";
392
        $replacements[] = '<div style="text-align: right;">\\1</div>';
393
394
        $this->text         = $text;
395
        $this->patterns     = $patterns;
396
        $this->replacements = $replacements;
397
398
        $this->config['allowimage'] = $allowimage;
399
        $this->executeExtensions();
400
401
        $text = preg_replace($this->patterns, $this->replacements, $this->text);
402
        //-------------------------------------------------------------------------------
403
        $count = count($this->callbackPatterns);
404
405
        for ($i = 0; $i < $count; ++$i) {
406
            $text = preg_replace_callback($this->callbackPatterns[$i], $this->callbacks[$i], $text);
407
        }
408
        //------------------------------------------------------------------------------
409
        $text = $this->quoteConv($text);
410
411
        return $text;
412
    }
413
414
    /**
415
     * Convert quote tags
416
     *
417
     * @param  string $text
418
     * @return string
419
     */
420
    public function quoteConv($text)
421
    {
422
        //look for both open and closing tags in the correct order
423
        $pattern     = "/\[quote](.*)\[\/quote\]/sU";
424
        $replacement = _QUOTEC . '<div class="xoopsQuote"><blockquote>\\1</blockquote></div>';
425
426
        $text = preg_replace($pattern, $replacement, $text, -1, $count);
427
        //no more matches, return now
428
        if (!$count) {
429
            return $text;
430
        }
431
432
        //new matches could have been created, keep doing it until we have no matches
433
        return $this->quoteConv($text);
434
    }
435
436
    /**
437
     * A quick solution for filtering XSS scripts
438
     *
439
     * @TODO : To be improved
440
     * @param $text
441
     * @return mixed
442
     */
443
    public function filterXss($text)
444
    {
445
        $patterns       = array();
446
        $replacements   = array();
447
        $text           = str_replace("\x00", '', $text);
448
        $c              = "[\x01-\x1f]*";
449
        $patterns[]     = "/\bj{$c}a{$c}v{$c}a{$c}s{$c}c{$c}r{$c}i{$c}p{$c}t{$c}[\s]*:/si";
450
        $replacements[] = 'javascript;';
451
        $patterns[]     = "/\ba{$c}b{$c}o{$c}u{$c}t{$c}[\s]*:/si";
452
        $replacements[] = 'about;';
453
        $patterns[]     = "/\bx{$c}s{$c}s{$c}[\s]*:/si";
454
        $replacements[] = 'xss;';
455
        $text           = preg_replace($patterns, $replacements, $text);
456
457
        return $text;
458
    }
459
460
    /**
461
     * Convert linebreaks to <br> tags
462
     *
463
     * @param  string $text
464
     * @return string
465
     */
466
    public function nl2Br($text)
467
    {
468
        return preg_replace('/(\015\012)|(\015)|(\012)/', '<br>', $text);
469
    }
470
471
    /**
472
     * Add slashes to the text if magic_quotes_gpc is turned off.
473
     *
474
     * @param  string $text
475
     * @return string
476
     */
477
    public function addSlashes($text)
478
    {
479
        if (!@get_magic_quotes_gpc()) {
480
            $text = addslashes($text);
481
        }
482
483
        return $text;
484
    }
485
486
    /**
487
     * Convert special characters to HTML entities
488
     *
489
     * @param  string $text    string being converted
490
     * @param  int|null    $quote_style
491
     * @param  string $charset character set used in conversion
492
     * @param  bool   $double_encode
493
     * @return string
494
     */
495
    public function htmlSpecialChars($text, $quote_style = NULL, $charset = null, $double_encode = true)
496
    {
497
        if ($quote_style === NULL) {
498
            $quote_style = ENT_QUOTES;
499
        }
500
        $text = (string) $text;
501
        if (version_compare(phpversion(), '5.2.3', '>=')) {
502
            $text = htmlspecialchars($text, $quote_style, $charset ?: (defined('_CHARSET') ? _CHARSET : 'UTF-8'), $double_encode);
503
        } else {
504
            $text = htmlspecialchars($text, $quote_style);
505
        }
506
507
        return preg_replace(array('/&amp;/i', '/&nbsp;/i'), array('&', '&amp;nbsp;'), $text);
508
    }
509
510
    /**
511
     * Reverses {@link htmlSpecialChars()}
512
     *
513
     * @param  string $text
514
     * @return string
515
     */
516
    public function undoHtmlSpecialChars($text)
517
    {
518
        return preg_replace(array('/&gt;/i', '/&lt;/i', '/&quot;/i', '/&#039;/i', '/&amp;nbsp;/i'), array('>', '<', '"', '\'', '&nbsp;'), $text);
519
    }
520
521
    /**
522
     * Filters textarea form data in DB for display
523
     *
524
     * @param  string   $text
525
     * @param  bool|int $html   allow html?
526
     * @param  bool|int $smiley allow smileys?
527
     * @param  bool|int $xcode  allow xoopscode?
528
     * @param  bool|int $image  allow inline images?
529
     * @param  bool|int $br     convert linebreaks?
530
     * @return string
531
     */
532
    public function &displayTarea($text, $html = 0, $smiley = 1, $xcode = 1, $image = 1, $br = 1)
533
    {
534
        $charset = (defined('_CHARSET') ? _CHARSET : 'UTF-8');
535
        if (function_exists('mb_convert_encoding')) {
536
            $text = mb_convert_encoding($text, $charset, mb_detect_encoding($text, mb_detect_order(), true));
0 ignored issues
show
Bug introduced by
It seems like mb_detect_order() can also be of type true; however, parameter $encodings of mb_detect_encoding() does only seem to accept array|null|string, maybe add an additional type check? ( Ignorable by Annotation )

If this is a false-positive, you can also ignore this issue in your code via the ignore-type  annotation

536
            $text = mb_convert_encoding($text, $charset, mb_detect_encoding($text, /** @scrutinizer ignore-type */ mb_detect_order(), true));
Loading history...
537
        }
538
        if ($html && $br) {
539
            $testText = strip_tags($text);
0 ignored issues
show
Bug introduced by
It seems like $text can also be of type array; however, parameter $string of strip_tags() does only seem to accept string, maybe add an additional type check? ( Ignorable by Annotation )

If this is a false-positive, you can also ignore this issue in your code via the ignore-type  annotation

539
            $testText = strip_tags(/** @scrutinizer ignore-type */ $text);
Loading history...
540
            if (mb_strlen($text) != mb_strlen($testText)) {
0 ignored issues
show
Bug introduced by
It seems like $text can also be of type array; however, parameter $string of mb_strlen() does only seem to accept string, maybe add an additional type check? ( Ignorable by Annotation )

If this is a false-positive, you can also ignore this issue in your code via the ignore-type  annotation

540
            if (mb_strlen(/** @scrutinizer ignore-type */ $text) != mb_strlen($testText)) {
Loading history...
541
                $br = 0;
542
            }
543
            unset($testText);
544
        }
545
        if ($html != 1) {
546
            // html not allowed
547
            $text = $this->htmlSpecialChars($text, ENT_COMPAT, $charset);
0 ignored issues
show
Bug introduced by
It seems like $text can also be of type array; however, parameter $text of MyTextSanitizer::htmlSpecialChars() does only seem to accept string, maybe add an additional type check? ( Ignorable by Annotation )

If this is a false-positive, you can also ignore this issue in your code via the ignore-type  annotation

547
            $text = $this->htmlSpecialChars(/** @scrutinizer ignore-type */ $text, ENT_COMPAT, $charset);
Loading history...
548
        }
549
        $text = $this->codePreConv($text, $xcode); // Ryuji_edit(2003-11-18)
550
        if ($smiley != 0) {
551
            // process smiley
552
            $text = $this->smiley($text);
0 ignored issues
show
Bug introduced by
It seems like $text can also be of type array; however, parameter $message of MyTextSanitizer::smiley() does only seem to accept string, maybe add an additional type check? ( Ignorable by Annotation )

If this is a false-positive, you can also ignore this issue in your code via the ignore-type  annotation

552
            $text = $this->smiley(/** @scrutinizer ignore-type */ $text);
Loading history...
553
        }
554
        if ($xcode != 0) {
555
            // decode xcode
556
            if ($image != 0) {
557
                // image allowed
558
                $text =& $this->xoopsCodeDecode($text);
0 ignored issues
show
Bug introduced by
It seems like $text can also be of type array; however, parameter $text of MyTextSanitizer::xoopsCodeDecode() does only seem to accept string, maybe add an additional type check? ( Ignorable by Annotation )

If this is a false-positive, you can also ignore this issue in your code via the ignore-type  annotation

558
                $text =& $this->xoopsCodeDecode(/** @scrutinizer ignore-type */ $text);
Loading history...
559
            } else {
560
                // image not allowed
561
                $text =& $this->xoopsCodeDecode($text, 0);
562
            }
563
        }
564
        if ($br != 0) {
565
            $text = $this->nl2Br($text);
0 ignored issues
show
Bug introduced by
It seems like $text can also be of type array; however, parameter $text of MyTextSanitizer::nl2Br() does only seem to accept string, maybe add an additional type check? ( Ignorable by Annotation )

If this is a false-positive, you can also ignore this issue in your code via the ignore-type  annotation

565
            $text = $this->nl2Br(/** @scrutinizer ignore-type */ $text);
Loading history...
566
        }
567
        $text = $this->codeConv($text, $xcode);
568
        $text = $this->makeClickable($text);
0 ignored issues
show
Bug introduced by
It seems like $text can also be of type array; however, parameter $text of MyTextSanitizer::makeClickable() does only seem to accept string, maybe add an additional type check? ( Ignorable by Annotation )

If this is a false-positive, you can also ignore this issue in your code via the ignore-type  annotation

568
        $text = $this->makeClickable(/** @scrutinizer ignore-type */ $text);
Loading history...
569
        if (!empty($this->config['filterxss_on_display'])) {
570
            $text = $this->filterXss($text);
571
        }
572
573
        return $text;
574
    }
575
576
    /**
577
     * Filters textarea form data submitted for preview
578
     *
579
     * @param  string   $text
580
     * @param  bool|int $html   allow html?
581
     * @param  bool|int $smiley allow smileys?
582
     * @param  bool|int $xcode  allow xoopscode?
583
     * @param  bool|int $image  allow inline images?
584
     * @param  bool|int $br     convert linebreaks?
585
     * @return string
586
     */
587
    public function &previewTarea($text, $html = 0, $smiley = 1, $xcode = 1, $image = 1, $br = 1)
588
    {
589
        $text = $this->stripSlashesGPC($text);
0 ignored issues
show
Deprecated Code introduced by
The function MyTextSanitizer::stripSlashesGPC() has been deprecated: as of XOOPS 2.5.11 and will be removed in next XOOPS version ( Ignorable by Annotation )

If this is a false-positive, you can also ignore this issue in your code via the ignore-deprecated  annotation

589
        $text = /** @scrutinizer ignore-deprecated */ $this->stripSlashesGPC($text);

This function has been deprecated. The supplier of the function has supplied an explanatory message.

The explanatory message should give you some clue as to whether and when the function will be removed and what other function to use instead.

Loading history...
590
        $text =& $this->displayTarea($text, $html, $smiley, $xcode, $image, $br);
591
592
        return $text;
593
    }
594
595
    /**
596
     * Replaces banned words in a string with their replacements
597
     *
598
     * @param  string $text
599
     * @return string
600
     * @deprecated
601
     */
602
    public function &censorString(&$text)
603
    {
604
        $ret = $this->executeExtension('censor', $text);
605
        if ($ret === false) {
606
            return $text;
607
        }
608
609
        return $ret;
610
    }
611
612
    /**
613
     * MyTextSanitizer::codePreConv()
614
     *
615
     * @param  mixed $text
616
     * @param  mixed $xcode
617
     * @return mixed
618
     */
619
    public function codePreConv($text, $xcode = 1)
620
    {
621
        if ($xcode != 0) {
622
            //            $patterns = "/\[code([^\]]*?)\](.*)\[\/code\]/esU";
623
            //            $replacements = "'[code\\1]'.base64_encode('\\2').'[/code]'";
624
625
            $patterns = "/\[code([^\]]*?)\](.*)\[\/code\]/sU";
626
            $text = preg_replace_callback(
627
                $patterns,
628
                function ($matches) {
629
                    return '[code'. $matches[1] . ']' . base64_encode($matches[2]) . '[/code]';
630
                },
631
                $text
632
            );
633
        }
634
635
        return $text;
636
    }
637
638
    /**
639
     * @param $match
640
     *
641
     * @return string
642
     */
643
    public function codeConvCallback($match)
644
    {
645
        return '<div class="xoopsCode">' . $this->executeExtension('syntaxhighlight', str_replace('\\\"', '\"', base64_decode($match[2])), $match[1]) . '</div>';
646
    }
647
648
    /**
649
     * MyTextSanitizer::codeConv()
650
     *
651
     * @param  mixed $text
652
     * @param  mixed $xcode
653
     * @return mixed
654
     */
655
    public function codeConv($text, $xcode = 1)
656
    {
657
        if (empty($xcode)) {
658
            return $text;
659
        }
660
        $patterns = "/\[code([^\]]*?)\](.*)\[\/code\]/sU";
661
        $text1    = preg_replace_callback($patterns, array($this, 'codeConvCallback'), $text);
662
663
        return $text1;
664
    }
665
666
    /**
667
     * MyTextSanitizer::executeExtensions()
668
     *
669
     * @return bool
670
     */
671
    public function executeExtensions()
672
    {
673
        $extensions = array_filter($this->config['extensions']);
674
        if (empty($extensions)) {
675
            return true;
676
        }
677
        foreach (array_keys($extensions) as $extension) {
678
            $this->executeExtension($extension);
679
        }
680
        return null;
681
    }
682
683
    /**
684
     * MyTextSanitizer::loadExtension()
685
     *
686
     * @param  mixed $name
687
     * @return MyTextSanitizerExtension|false
688
     */
689
    public function loadExtension($name)
690
    {
691
        if (file_exists($file = $this->path_basic . '/' . $name . '/' . $name . '.php')) {
692
            include_once $file;
693
        } elseif (file_exists($file = $this->path_plugin . '/' . $name . '/' . $name . '.php')) {
694
            include_once $file;
695
        } else {
696
            return false;
697
        }
698
        $class = 'Myts' . ucfirst($name);
699
        if (!class_exists($class)) {
700
            trigger_error("Extension '{$name}' does not exist", E_USER_WARNING);
701
702
            return false;
703
        }
704
        return new $class($this);
705
    }
706
707
    /**
708
     * MyTextSanitizer::executeExtension()
709
     *
710
     * @param  mixed $name
711
     * @return mixed
712
     */
713
    public function executeExtension($name)
714
    {
715
        $extension = $this->loadExtension($name);
716
        $args      = array_slice(func_get_args(), 1);
717
        array_unshift($args, $this);
718
719
        return call_user_func_array(array($extension, 'load'), $args);
720
    }
721
722
    /**
723
     * Filter out possible malicious text
724
     * kses project at SF could be a good solution to check
725
     *
726
     * @param  string $text  text to filter
727
     * @param  bool   $force force filtering
728
     * @return string filtered text
729
     */
730
    public function textFilter($text, $force = false)
731
    {
732
        $ret = $this->executeExtension('textfilter', $text, $force);
733
        if ($ret === false) {
734
            return $text;
735
        }
736
737
        return $ret;
738
    }
739
740
    // #################### Deprecated Methods ######################
741
742
    /**
743
     * if magic_quotes_gpc is on, strip back slashes
744
     *
745
     * @param  string $text
746
     * @return string
747
     * @deprecated as of XOOPS 2.5.11 and will be removed in next XOOPS version
748
     *
749
     * This remains here until we officially drop support for PHP 5.3 in next release
750
     */
751
    public function stripSlashesGPC($text)
752
    {
753
        if (@get_magic_quotes_gpc()) {
754
            $text = stripslashes($text);
755
        }
756
757
        return $text;
758
    }
759
760
    /**
761
     * MyTextSanitizer::codeSanitizer()
762
     *
763
     * @param  mixed $str
764
     * @param  mixed $image
765
     * @return mixed|string
766
     * @deprecated will be removed in next XOOPS version
767
     */
768
    public function codeSanitizer($str, $image = 1)
769
    {
770
        $GLOBALS['xoopsLogger']->addDeprecated(__CLASS__ . '::' . __FUNCTION__ . ' is deprecated');
771
        $str = $this->htmlSpecialChars(str_replace('\"', '"', base64_decode($str)));
772
        $str =& $this->xoopsCodeDecode($str, $image);
773
774
        return $str;
775
    }
776
777
    /**
778
     * MyTextSanitizer::sanitizeForDisplay()
779
     *
780
     * @param  mixed   $text
781
     * @param  integer $allowhtml
782
     * @param  integer $smiley
783
     * @param  mixed   $bbcode
784
     * @return mixed|string
785
     * @deprecated will be removed in next XOOPS version
786
     */
787
    public function sanitizeForDisplay($text, $allowhtml = 0, $smiley = 1, $bbcode = 1)
788
    {
789
        $GLOBALS['xoopsLogger']->addDeprecated(__CLASS__ . '::' . __FUNCTION__ . ' is deprecated');
790
        if ($allowhtml == 0) {
791
            $text = $this->htmlSpecialChars($text);
792
        } else {
793
            // $config =& $GLOBALS['xoopsConfig'];
794
            // $allowed = $config['allowed_html'];
795
            // $text = strip_tags($text, $allowed);
796
            $text = $this->makeClickable($text);
797
        }
798
        if ($smiley == 1) {
799
            $text = $this->smiley($text);
800
        }
801
        if ($bbcode == 1) {
802
            $text =& $this->xoopsCodeDecode($text);
803
        }
804
        $text = $this->nl2Br($text);
805
806
        return $text;
807
    }
808
809
    /**
810
     * MyTextSanitizer::sanitizeForPreview()
811
     *
812
     * @param  mixed   $text
813
     * @param  integer $allowhtml
814
     * @param  integer $smiley
815
     * @param  mixed   $bbcode
816
     * @return mixed|string
817
     * @deprecated will be removed in next XOOPS version
818
     */
819
    public function sanitizeForPreview($text, $allowhtml = 0, $smiley = 1, $bbcode = 1)
820
    {
821
        $GLOBALS['xoopsLogger']->addDeprecated(__CLASS__ . '::' . __FUNCTION__ . ' is deprecated');
822
        $text = $this->oopsStripSlashesGPC($text);
0 ignored issues
show
Deprecated Code introduced by
The function MyTextSanitizer::oopsStripSlashesGPC() has been deprecated: will be removed in next XOOPS version ( Ignorable by Annotation )

If this is a false-positive, you can also ignore this issue in your code via the ignore-deprecated  annotation

822
        $text = /** @scrutinizer ignore-deprecated */ $this->oopsStripSlashesGPC($text);

This function has been deprecated. The supplier of the function has supplied an explanatory message.

The explanatory message should give you some clue as to whether and when the function will be removed and what other function to use instead.

Loading history...
823
        if ($allowhtml == 0) {
824
            $text = $this->htmlSpecialChars($text);
825
        } else {
826
            // $config =& $GLOBALS['xoopsConfig'];
827
            // $allowed = $config['allowed_html'];
828
            // $text = strip_tags($text, $allowed);
829
            $text = $this->makeClickable($text);
830
        }
831
        if ($smiley == 1) {
832
            $text = $this->smiley($text);
833
        }
834
        if ($bbcode == 1) {
835
            $text =& $this->xoopsCodeDecode($text);
836
        }
837
        $text = $this->nl2Br($text);
838
839
        return $text;
840
    }
841
842
    /**
843
     * MyTextSanitizer::makeTboxData4Save()
844
     *
845
     * @param  mixed $text
846
     * @return string
847
     * @deprecated will be removed in next XOOPS version
848
     */
849
    public function makeTboxData4Save($text)
850
    {
851
        $GLOBALS['xoopsLogger']->addDeprecated(__CLASS__ . '::' . __FUNCTION__ . ' is deprecated');
852
853
        // $text = $this->undoHtmlSpecialChars($text);
854
        return $this->addSlashes($text);
855
    }
856
857
    /**
858
     * MyTextSanitizer::makeTboxData4Show()
859
     *
860
     * @param  mixed $text
861
     * @param  mixed $smiley
862
     * @return mixed|string
863
     * @deprecated will be removed in next XOOPS version
864
     */
865
    public function makeTboxData4Show($text, $smiley = 0)
0 ignored issues
show
Unused Code introduced by
The parameter $smiley is not used and could be removed. ( Ignorable by Annotation )

If this is a false-positive, you can also ignore this issue in your code via the ignore-unused  annotation

865
    public function makeTboxData4Show($text, /** @scrutinizer ignore-unused */ $smiley = 0)

This check looks for parameters that have been defined for a function or method, but which are not used in the method body.

Loading history...
866
    {
867
        $GLOBALS['xoopsLogger']->addDeprecated(__CLASS__ . '::' . __FUNCTION__ . ' is deprecated');
868
        $text = $this->htmlSpecialChars($text);
869
870
        return $text;
871
    }
872
873
    /**
874
     * MyTextSanitizer::makeTboxData4Edit()
875
     *
876
     * @param  mixed $text
877
     * @return string
878
     * @deprecated will be removed in next XOOPS version
879
     */
880
    public function makeTboxData4Edit($text)
881
    {
882
        $GLOBALS['xoopsLogger']->addDeprecated(__CLASS__ . '::' . __FUNCTION__ . ' is deprecated');
883
884
        return $this->htmlSpecialChars($text);
885
    }
886
887
    /**
888
     * MyTextSanitizer::makeTboxData4Preview()
889
     *
890
     * @param  mixed $text
891
     * @param  mixed $smiley
892
     * @return mixed|string
893
     * @deprecated will be removed in next XOOPS version
894
     */
895
    public function makeTboxData4Preview($text, $smiley = 0)
0 ignored issues
show
Unused Code introduced by
The parameter $smiley is not used and could be removed. ( Ignorable by Annotation )

If this is a false-positive, you can also ignore this issue in your code via the ignore-unused  annotation

895
    public function makeTboxData4Preview($text, /** @scrutinizer ignore-unused */ $smiley = 0)

This check looks for parameters that have been defined for a function or method, but which are not used in the method body.

Loading history...
896
    {
897
        $GLOBALS['xoopsLogger']->addDeprecated(__CLASS__ . '::' . __FUNCTION__ . ' is deprecated');
898
        $text = $this->stripSlashesGPC($text);
0 ignored issues
show
Deprecated Code introduced by
The function MyTextSanitizer::stripSlashesGPC() has been deprecated: as of XOOPS 2.5.11 and will be removed in next XOOPS version ( Ignorable by Annotation )

If this is a false-positive, you can also ignore this issue in your code via the ignore-deprecated  annotation

898
        $text = /** @scrutinizer ignore-deprecated */ $this->stripSlashesGPC($text);

This function has been deprecated. The supplier of the function has supplied an explanatory message.

The explanatory message should give you some clue as to whether and when the function will be removed and what other function to use instead.

Loading history...
899
        $text = $this->htmlSpecialChars($text);
900
901
        return $text;
902
    }
903
904
    /**
905
     * MyTextSanitizer::makeTboxData4PreviewInForm()
906
     *
907
     * @param  mixed $text
908
     * @return string
909
     * @deprecated will be removed in next XOOPS version
910
     */
911
    public function makeTboxData4PreviewInForm($text)
912
    {
913
        $GLOBALS['xoopsLogger']->addDeprecated(__CLASS__ . '::' . __FUNCTION__ . ' is deprecated');
914
        $text = $this->stripSlashesGPC($text);
0 ignored issues
show
Deprecated Code introduced by
The function MyTextSanitizer::stripSlashesGPC() has been deprecated: as of XOOPS 2.5.11 and will be removed in next XOOPS version ( Ignorable by Annotation )

If this is a false-positive, you can also ignore this issue in your code via the ignore-deprecated  annotation

914
        $text = /** @scrutinizer ignore-deprecated */ $this->stripSlashesGPC($text);

This function has been deprecated. The supplier of the function has supplied an explanatory message.

The explanatory message should give you some clue as to whether and when the function will be removed and what other function to use instead.

Loading history...
915
916
        return $this->htmlSpecialChars($text);
917
    }
918
919
    /**
920
     * MyTextSanitizer::makeTareaData4Save()
921
     *
922
     * @param  mixed $text
923
     * @return string
924
     * @deprecated will be removed in next XOOPS version
925
     */
926
    public function makeTareaData4Save($text)
927
    {
928
        $GLOBALS['xoopsLogger']->addDeprecated(__CLASS__ . '::' . __FUNCTION__ . ' is deprecated');
929
930
        return $this->addSlashes($text);
931
    }
932
933
    /**
934
     * MyTextSanitizer::makeTareaData4Show()
935
     *
936
     * @param  mixed   $text
937
     * @param  integer $html
938
     * @param  integer $smiley
939
     * @param  mixed   $xcode
940
     * @return mixed|string
941
     * @deprecated will be removed in next XOOPS version
942
     */
943
    public function &makeTareaData4Show(&$text, $html = 1, $smiley = 1, $xcode = 1)
944
    {
945
        $GLOBALS['xoopsLogger']->addDeprecated(__CLASS__ . '::' . __FUNCTION__ . ' is deprecated');
946
        $text =& $this->displayTarea($text, $html, $smiley, $xcode);
947
948
        return $text;
949
    }
950
951
    /**
952
     * MyTextSanitizer::makeTareaData4Edit()
953
     *
954
     * @param  mixed $text
955
     * @return string
956
     * @deprecated will be removed in next XOOPS version
957
     */
958
    public function makeTareaData4Edit($text)
959
    {
960
        $GLOBALS['xoopsLogger']->addDeprecated(__CLASS__ . '::' . __FUNCTION__ . ' is deprecated');
961
962
        return $this->htmlSpecialChars($text);
963
    }
964
965
    /**
966
     * MyTextSanitizer::makeTareaData4Preview()
967
     *
968
     * @param  mixed   $text
969
     * @param  integer $html
970
     * @param  integer $smiley
971
     * @param  mixed   $xcode
972
     * @return mixed|string
973
     * @deprecated will be removed in next XOOPS version
974
     */
975
    public function &makeTareaData4Preview(&$text, $html = 1, $smiley = 1, $xcode = 1)
976
    {
977
        $GLOBALS['xoopsLogger']->addDeprecated(__CLASS__ . '::' . __FUNCTION__ . ' is deprecated');
978
        $text =& $this->previewTarea($text, $html, $smiley, $xcode);
979
980
        return $text;
981
    }
982
983
    /**
984
     * MyTextSanitizer::makeTareaData4PreviewInForm()
985
     *
986
     * @param  mixed $text
987
     * @return string
988
     * @deprecated will be removed in next XOOPS version
989
     */
990
    public function makeTareaData4PreviewInForm($text)
991
    {
992
        $GLOBALS['xoopsLogger']->addDeprecated(__CLASS__ . '::' . __FUNCTION__ . ' is deprecated');
993
        // if magic_quotes_gpc is on, do stipslashes
994
        $text = $this->stripSlashesGPC($text);
0 ignored issues
show
Deprecated Code introduced by
The function MyTextSanitizer::stripSlashesGPC() has been deprecated: as of XOOPS 2.5.11 and will be removed in next XOOPS version ( Ignorable by Annotation )

If this is a false-positive, you can also ignore this issue in your code via the ignore-deprecated  annotation

994
        $text = /** @scrutinizer ignore-deprecated */ $this->stripSlashesGPC($text);

This function has been deprecated. The supplier of the function has supplied an explanatory message.

The explanatory message should give you some clue as to whether and when the function will be removed and what other function to use instead.

Loading history...
995
996
        return $this->htmlSpecialChars($text);
997
    }
998
999
    /**
1000
     * MyTextSanitizer::makeTareaData4InsideQuotes()
1001
     *
1002
     * @param  mixed $text
1003
     * @return string
1004
     * @deprecated will be removed in next XOOPS version
1005
     */
1006
    public function makeTareaData4InsideQuotes($text)
1007
    {
1008
        $GLOBALS['xoopsLogger']->addDeprecated(__CLASS__ . '::' . __FUNCTION__ . ' is deprecated');
1009
1010
        return $this->htmlSpecialChars($text);
1011
    }
1012
1013
    /**
1014
     * MyTextSanitizer::oopsStripSlashesGPC()
1015
     *
1016
     * @param  mixed $text
1017
     * @return string
1018
     * @deprecated will be removed in next XOOPS version
1019
     */
1020
    public function oopsStripSlashesGPC($text)
1021
    {
1022
        $GLOBALS['xoopsLogger']->addDeprecated(__CLASS__ . '::' . __FUNCTION__ . ' is deprecated');
1023
1024
        return $this->stripSlashesGPC($text);
0 ignored issues
show
Deprecated Code introduced by
The function MyTextSanitizer::stripSlashesGPC() has been deprecated: as of XOOPS 2.5.11 and will be removed in next XOOPS version ( Ignorable by Annotation )

If this is a false-positive, you can also ignore this issue in your code via the ignore-deprecated  annotation

1024
        return /** @scrutinizer ignore-deprecated */ $this->stripSlashesGPC($text);

This function has been deprecated. The supplier of the function has supplied an explanatory message.

The explanatory message should give you some clue as to whether and when the function will be removed and what other function to use instead.

Loading history...
1025
    }
1026
1027
    /**
1028
     * MyTextSanitizer::oopsStripSlashesRT()
1029
     *
1030
     * @param  mixed $text
1031
     * @return mixed|string
1032
     * @deprecated will be removed in next XOOPS version
1033
     */
1034
    public function oopsStripSlashesRT($text)
1035
    {
1036
        $GLOBALS['xoopsLogger']->addDeprecated(__CLASS__ . '::' . __FUNCTION__ . ' is deprecated');
1037
        if (get_magic_quotes_runtime()) {
1038
            $text = stripslashes($text);
1039
        }
1040
1041
        return $text;
1042
    }
1043
1044
    /**
1045
     * MyTextSanitizer::oopsAddSlashes()
1046
     *
1047
     * @param  mixed $text
1048
     * @return string
1049
     * @deprecated will be removed in next XOOPS version
1050
     */
1051
    public function oopsAddSlashes($text)
1052
    {
1053
        $GLOBALS['xoopsLogger']->addDeprecated(__CLASS__ . '::' . __FUNCTION__ . ' is deprecated');
1054
1055
        return $this->addSlashes($text);
1056
    }
1057
1058
    /**
1059
     * MyTextSanitizer::oopsHtmlSpecialChars()
1060
     *
1061
     * @param  mixed $text
1062
     * @return string
1063
     * @deprecated will be removed in next XOOPS version
1064
     */
1065
    public function oopsHtmlSpecialChars($text)
1066
    {
1067
        $GLOBALS['xoopsLogger']->addDeprecated(__CLASS__ . '::' . __FUNCTION__ . ' is deprecated');
1068
1069
        return $this->htmlSpecialChars($text);
1070
    }
1071
1072
    /**
1073
     * MyTextSanitizer::oopsNl2Br()
1074
     *
1075
     * @param  mixed $text
1076
     * @return string
1077
     * @deprecated will be removed in next XOOPS version
1078
     */
1079
    public function oopsNl2Br($text)
1080
    {
1081
        $GLOBALS['xoopsLogger']->addDeprecated(__CLASS__ . '::' . __FUNCTION__ . ' is deprecated');
1082
1083
        return $this->nl2Br($text);
1084
    }
1085
}
1086