xpressengine / xe-core

classes/security/htmlpurifier/library/HTMLPurifier/URIScheme/data.php

Indentation +84 added lines, -84 removed lines

@@ -5,92 +5,92 @@
  */
 class HTMLPurifier_URIScheme_data extends HTMLPurifier_URIScheme {
 
-    public $browsable = true;
-    public $allowed_types = array(
-        // you better write validation code for other types if you
-        // decide to allow them
-        'image/jpeg' => true,
-        'image/gif' => true,
-        'image/png' => true,
-        );
-    // this is actually irrelevant since we only write out the path
-    // component
-    public $may_omit_host = true;
+	public $browsable = true;
+	public $allowed_types = array(
+		// you better write validation code for other types if you
+		// decide to allow them
+		'image/jpeg' => true,
+		'image/gif' => true,
+		'image/png' => true,
+		);
+	// this is actually irrelevant since we only write out the path
+	// component
+	public $may_omit_host = true;
 
-    public function doValidate(&$uri, $config, $context) {
-        $result = explode(',', $uri->path, 2);
-        $is_base64 = false;
-        $charset = null;
-        $content_type = null;
-        if (count($result) == 2) {
-            list($metadata, $data) = $result;
-            // do some legwork on the metadata
-            $metas = explode(';', $metadata);
-            while(!empty($metas)) {
-                $cur = array_shift($metas);
-                if ($cur == 'base64') {
-                    $is_base64 = true;
-                    break;
-                }
-                if (substr($cur, 0, 8) == 'charset=') {
-                    // doesn't match if there are arbitrary spaces, but
-                    // whatever dude
-                    if ($charset !== null) continue; // garbage
-                    $charset = substr($cur, 8); // not used
-                } else {
-                    if ($content_type !== null) continue; // garbage
-                    $content_type = $cur;
-                }
-            }
-        } else {
-            $data = $result[0];
-        }
-        if ($content_type !== null && empty($this->allowed_types[$content_type])) {
-            return false;
-        }
-        if ($charset !== null) {
-            // error; we don't allow plaintext stuff
-            $charset = null;
-        }
-        $data = rawurldecode($data);
-        if ($is_base64) {
-            $raw_data = base64_decode($data);
-        } else {
-            $raw_data = $data;
-        }
-        // XXX probably want to refactor this into a general mechanism
-        // for filtering arbitrary content types
-        $file = tempnam("/tmp", "");
-        file_put_contents($file, $raw_data, LOCK_EX);
-        if (function_exists('exif_imagetype')) {
-            $image_code = exif_imagetype($file);
-        } elseif (function_exists('getimagesize')) {
-            set_error_handler(array($this, 'muteErrorHandler'));
-            $info = getimagesize($file);
-            restore_error_handler();
-            if ($info == false) return false;
-            $image_code = $info[2];
-        } else {
-            trigger_error("could not find exif_imagetype or getimagesize functions", E_USER_ERROR);
-        }
-        $real_content_type = image_type_to_mime_type($image_code);
-        if ($real_content_type != $content_type) {
-            // we're nice guys; if the content type is something else we
-            // support, change it over
-            if (empty($this->allowed_types[$real_content_type])) return false;
-            $content_type = $real_content_type;
-        }
-        // ok, it's kosher, rewrite what we need
-        $uri->userinfo = null;
-        $uri->host = null;
-        $uri->port = null;
-        $uri->fragment = null;
-        $uri->query = null;
-        $uri->path = "$content_type;base64," . base64_encode($raw_data);
-        return true;
-    }
+	public function doValidate(&$uri, $config, $context) {
+		$result = explode(',', $uri->path, 2);
+		$is_base64 = false;
+		$charset = null;
+		$content_type = null;
+		if (count($result) == 2) {
+			list($metadata, $data) = $result;
+			// do some legwork on the metadata
+			$metas = explode(';', $metadata);
+			while(!empty($metas)) {
+				$cur = array_shift($metas);
+				if ($cur == 'base64') {
+					$is_base64 = true;
+					break;
+				}
+				if (substr($cur, 0, 8) == 'charset=') {
+					// doesn't match if there are arbitrary spaces, but
+					// whatever dude
+					if ($charset !== null) continue; // garbage
+					$charset = substr($cur, 8); // not used
+				} else {
+					if ($content_type !== null) continue; // garbage
+					$content_type = $cur;
+				}
+			}
+		} else {
+			$data = $result[0];
+		}
+		if ($content_type !== null && empty($this->allowed_types[$content_type])) {
+			return false;
+		}
+		if ($charset !== null) {
+			// error; we don't allow plaintext stuff
+			$charset = null;
+		}
+		$data = rawurldecode($data);
+		if ($is_base64) {
+			$raw_data = base64_decode($data);
+		} else {
+			$raw_data = $data;
+		}
+		// XXX probably want to refactor this into a general mechanism
+		// for filtering arbitrary content types
+		$file = tempnam("/tmp", "");
+		file_put_contents($file, $raw_data, LOCK_EX);
+		if (function_exists('exif_imagetype')) {
+			$image_code = exif_imagetype($file);
+		} elseif (function_exists('getimagesize')) {
+			set_error_handler(array($this, 'muteErrorHandler'));
+			$info = getimagesize($file);
+			restore_error_handler();
+			if ($info == false) return false;
+			$image_code = $info[2];
+		} else {
+			trigger_error("could not find exif_imagetype or getimagesize functions", E_USER_ERROR);
+		}
+		$real_content_type = image_type_to_mime_type($image_code);
+		if ($real_content_type != $content_type) {
+			// we're nice guys; if the content type is something else we
+			// support, change it over
+			if (empty($this->allowed_types[$real_content_type])) return false;
+			$content_type = $real_content_type;
+		}
+		// ok, it's kosher, rewrite what we need
+		$uri->userinfo = null;
+		$uri->host = null;
+		$uri->port = null;
+		$uri->fragment = null;
+		$uri->query = null;
+		$uri->path = "$content_type;base64," . base64_encode($raw_data);
+		return true;
+	}
 
-    public function muteErrorHandler($errno, $errstr) {}
+	public function muteErrorHandler($errno, $errstr) {}
 
 }
 

Braces +14 added lines, -4 removed lines

@@ -35,10 +35,16 @@ 
                 if (substr($cur, 0, 8) == 'charset=') {
                     // doesn't match if there are arbitrary spaces, but
                     // whatever dude
-                    if ($charset !== null) continue; // garbage
+                    if ($charset !== null) {
+                    	continue;
+                    }
+                    // garbage
                     $charset = substr($cur, 8); // not used
                 } else {
-                    if ($content_type !== null) continue; // garbage
+                    if ($content_type !== null) {
+                    	continue;
+                    }
+                    // garbage
                     $content_type = $cur;
                 }
             }
@@ -68,7 +74,9 @@ 
             set_error_handler(array($this, 'muteErrorHandler'));
             $info = getimagesize($file);
             restore_error_handler();
-            if ($info == false) return false;
+            if ($info == false) {
+            	return false;
+            }
             $image_code = $info[2];
         } else {
             trigger_error("could not find exif_imagetype or getimagesize functions", E_USER_ERROR);
@@ -77,7 +85,9 @@ 
         if ($real_content_type != $content_type) {
             // we're nice guys; if the content type is something else we
             // support, change it over
-            if (empty($this->allowed_types[$real_content_type])) return false;
+            if (empty($this->allowed_types[$real_content_type])) {
+            	return false;
+            }
             $content_type = $real_content_type;
         }
         // ok, it's kosher, rewrite what we need

Spacing +2 added lines, -2 removed lines

@@ -26,7 +26,7 @@ 
             list($metadata, $data) = $result;
             // do some legwork on the metadata
             $metas = explode(';', $metadata);
-            while(!empty($metas)) {
+            while (!empty($metas)) {
                 $cur = array_shift($metas);
                 if ($cur == 'base64') {
                     $is_base64 = true;
@@ -86,7 +86,7 @@ 
         $uri->port = null;
         $uri->fragment = null;
         $uri->query = null;
-        $uri->path = "$content_type;base64," . base64_encode($raw_data);
+        $uri->path = "$content_type;base64,".base64_encode($raw_data);
         return true;
     }
 

classes/security/htmlpurifier/library/HTMLPurifier/URIScheme/file.php

Indentation +19 added lines, -19 removed lines

@@ -5,27 +5,27 @@
  */
 class HTMLPurifier_URIScheme_file extends HTMLPurifier_URIScheme {
 
-    // Generally file:// URLs are not accessible from most
-    // machines, so placing them as an img src is incorrect.
-    public $browsable = false;
+	// Generally file:// URLs are not accessible from most
+	// machines, so placing them as an img src is incorrect.
+	public $browsable = false;
 
-    // Basically the *only* URI scheme for which this is true, since
-    // accessing files on the local machine is very common.  In fact,
-    // browsers on some operating systems don't understand the
-    // authority, though I hear it is used on Windows to refer to
-    // network shares.
-    public $may_omit_host = true;
+	// Basically the *only* URI scheme for which this is true, since
+	// accessing files on the local machine is very common.  In fact,
+	// browsers on some operating systems don't understand the
+	// authority, though I hear it is used on Windows to refer to
+	// network shares.
+	public $may_omit_host = true;
 
-    public function doValidate(&$uri, $config, $context) {
-        // Authentication method is not supported
-        $uri->userinfo = null;
-        // file:// makes no provisions for accessing the resource
-        $uri->port     = null;
-        // While it seems to work on Firefox, the querystring has
-        // no possible effect and is thus stripped.
-        $uri->query    = null;
-        return true;
-    }
+	public function doValidate(&$uri, $config, $context) {
+		// Authentication method is not supported
+		$uri->userinfo = null;
+		// file:// makes no provisions for accessing the resource
+		$uri->port     = null;
+		// While it seems to work on Firefox, the querystring has
+		// no possible effect and is thus stripped.
+		$uri->query    = null;
+		return true;
+	}
 
 }
 

classes/security/htmlpurifier/library/HTMLPurifier/URIScheme/ftp.php

Indentation +28 added lines, -28 removed lines

@@ -5,37 +5,37 @@
  */
 class HTMLPurifier_URIScheme_ftp extends HTMLPurifier_URIScheme {
 
-    public $default_port = 21;
-    public $browsable = true; // usually
-    public $hierarchical = true;
+	public $default_port = 21;
+	public $browsable = true; // usually
+	public $hierarchical = true;
 
-    public function doValidate(&$uri, $config, $context) {
-        $uri->query    = null;
+	public function doValidate(&$uri, $config, $context) {
+		$uri->query    = null;
 
-        // typecode check
-        $semicolon_pos = strrpos($uri->path, ';'); // reverse
-        if ($semicolon_pos !== false) {
-            $type = substr($uri->path, $semicolon_pos + 1); // no semicolon
-            $uri->path = substr($uri->path, 0, $semicolon_pos);
-            $type_ret = '';
-            if (strpos($type, '=') !== false) {
-                // figure out whether or not the declaration is correct
-                list($key, $typecode) = explode('=', $type, 2);
-                if ($key !== 'type') {
-                    // invalid key, tack it back on encoded
-                    $uri->path .= '%3B' . $type;
-                } elseif ($typecode === 'a' || $typecode === 'i' || $typecode === 'd') {
-                    $type_ret = ";type=$typecode";
-                }
-            } else {
-                $uri->path .= '%3B' . $type;
-            }
-            $uri->path = str_replace(';', '%3B', $uri->path);
-            $uri->path .= $type_ret;
-        }
+		// typecode check
+		$semicolon_pos = strrpos($uri->path, ';'); // reverse
+		if ($semicolon_pos !== false) {
+			$type = substr($uri->path, $semicolon_pos + 1); // no semicolon
+			$uri->path = substr($uri->path, 0, $semicolon_pos);
+			$type_ret = '';
+			if (strpos($type, '=') !== false) {
+				// figure out whether or not the declaration is correct
+				list($key, $typecode) = explode('=', $type, 2);
+				if ($key !== 'type') {
+					// invalid key, tack it back on encoded
+					$uri->path .= '%3B' . $type;
+				} elseif ($typecode === 'a' || $typecode === 'i' || $typecode === 'd') {
+					$type_ret = ";type=$typecode";
+				}
+			} else {
+				$uri->path .= '%3B' . $type;
+			}
+			$uri->path = str_replace(';', '%3B', $uri->path);
+			$uri->path .= $type_ret;
+		}
 
-        return true;
-    }
+		return true;
+	}
 
 }
 

Spacing +2 added lines, -2 removed lines

@@ -23,12 +23,12 @@
                 list($key, $typecode) = explode('=', $type, 2);
                 if ($key !== 'type') {
                     // invalid key, tack it back on encoded
-                    $uri->path .= '%3B' . $type;
+                    $uri->path .= '%3B'.$type;
                 } elseif ($typecode === 'a' || $typecode === 'i' || $typecode === 'd') {
                     $type_ret = ";type=$typecode";
                 }
             } else {
-                $uri->path .= '%3B' . $type;
+                $uri->path .= '%3B'.$type;
             }
             $uri->path = str_replace(';', '%3B', $uri->path);
             $uri->path .= $type_ret;

classes/security/htmlpurifier/library/HTMLPurifier/URIScheme/http.php

Indentation +7 added lines, -7 removed lines

@@ -5,14 +5,14 @@
  */
 class HTMLPurifier_URIScheme_http extends HTMLPurifier_URIScheme {
 
-    public $default_port = 80;
-    public $browsable = true;
-    public $hierarchical = true;
+	public $default_port = 80;
+	public $browsable = true;
+	public $hierarchical = true;
 
-    public function doValidate(&$uri, $config, $context) {
-        $uri->userinfo = null;
-        return true;
-    }
+	public function doValidate(&$uri, $config, $context) {
+		$uri->userinfo = null;
+		return true;
+	}
 
 }
 

classes/security/htmlpurifier/library/HTMLPurifier/URIScheme/https.php

Indentation +2 added lines, -2 removed lines

@@ -5,8 +5,8 @@
  */
 class HTMLPurifier_URIScheme_https extends HTMLPurifier_URIScheme_http {
 
-    public $default_port = 443;
-    public $secure = true;
+	public $default_port = 443;
+	public $secure = true;
 
 }
 

classes/security/htmlpurifier/library/HTMLPurifier/URIScheme/mailto.php

Indentation +9 added lines, -9 removed lines

@@ -11,16 +11,16 @@
 
 class HTMLPurifier_URIScheme_mailto extends HTMLPurifier_URIScheme {
 
-    public $browsable = false;
-    public $may_omit_host = true;
+	public $browsable = false;
+	public $may_omit_host = true;
 
-    public function doValidate(&$uri, $config, $context) {
-        $uri->userinfo = null;
-        $uri->host     = null;
-        $uri->port     = null;
-        // we need to validate path against RFC 2368's addr-spec
-        return true;
-    }
+	public function doValidate(&$uri, $config, $context) {
+		$uri->userinfo = null;
+		$uri->host     = null;
+		$uri->port     = null;
+		// we need to validate path against RFC 2368's addr-spec
+		return true;
+	}
 
 }
 

classes/security/htmlpurifier/library/HTMLPurifier/URIScheme/news.php

Indentation +10 added lines, -10 removed lines

@@ -5,17 +5,17 @@
  */
 class HTMLPurifier_URIScheme_news extends HTMLPurifier_URIScheme {
 
-    public $browsable = false;
-    public $may_omit_host = true;
+	public $browsable = false;
+	public $may_omit_host = true;
 
-    public function doValidate(&$uri, $config, $context) {
-        $uri->userinfo = null;
-        $uri->host     = null;
-        $uri->port     = null;
-        $uri->query    = null;
-        // typecode check needed on path
-        return true;
-    }
+	public function doValidate(&$uri, $config, $context) {
+		$uri->userinfo = null;
+		$uri->host     = null;
+		$uri->port     = null;
+		$uri->query    = null;
+		// typecode check needed on path
+		return true;
+	}
 
 }
 

classes/security/htmlpurifier/library/HTMLPurifier/URIScheme/nntp.php

Indentation +7 added lines, -7 removed lines

@@ -5,14 +5,14 @@
  */
 class HTMLPurifier_URIScheme_nntp extends HTMLPurifier_URIScheme {
 
-    public $default_port = 119;
-    public $browsable = false;
+	public $default_port = 119;
+	public $browsable = false;
 
-    public function doValidate(&$uri, $config, $context) {
-        $uri->userinfo = null;
-        $uri->query    = null;
-        return true;
-    }
+	public function doValidate(&$uri, $config, $context) {
+		$uri->userinfo = null;
+		$uri->query    = null;
+		return true;
+	}
 
 }
 

classes/security/htmlpurifier/library/HTMLPurifier/URISchemeRegistry.php

Indentation +50 added lines, -50 removed lines

@@ -6,62 +6,62 @@
 class HTMLPurifier_URISchemeRegistry
 {
 
-    /**
-     * Retrieve sole instance of the registry.
-     * @param $prototype Optional prototype to overload sole instance with,
-     *                   or bool true to reset to default registry.
-     * @note Pass a registry object $prototype with a compatible interface and
-     *       the function will copy it and return it all further times.
-     */
-    public static function instance($prototype = null) {
-        static $instance = null;
-        if ($prototype !== null) {
-            $instance = $prototype;
-        } elseif ($instance === null || $prototype == true) {
-            $instance = new HTMLPurifier_URISchemeRegistry();
-        }
-        return $instance;
-    }
+	/**
+	 * Retrieve sole instance of the registry.
+	 * @param $prototype Optional prototype to overload sole instance with,
+	 *                   or bool true to reset to default registry.
+	 * @note Pass a registry object $prototype with a compatible interface and
+	 *       the function will copy it and return it all further times.
+	 */
+	public static function instance($prototype = null) {
+		static $instance = null;
+		if ($prototype !== null) {
+			$instance = $prototype;
+		} elseif ($instance === null || $prototype == true) {
+			$instance = new HTMLPurifier_URISchemeRegistry();
+		}
+		return $instance;
+	}
 
-    /**
-     * Cache of retrieved schemes.
-     */
-    protected $schemes = array();
+	/**
+	 * Cache of retrieved schemes.
+	 */
+	protected $schemes = array();
 
-    /**
-     * Retrieves a scheme validator object
-     * @param $scheme String scheme name like http or mailto
-     * @param $config HTMLPurifier_Config object
-     * @param $config HTMLPurifier_Context object
-     */
-    public function getScheme($scheme, $config, $context) {
-        if (!$config) $config = HTMLPurifier_Config::createDefault();
+	/**
+	 * Retrieves a scheme validator object
+	 * @param $scheme String scheme name like http or mailto
+	 * @param $config HTMLPurifier_Config object
+	 * @param $config HTMLPurifier_Context object
+	 */
+	public function getScheme($scheme, $config, $context) {
+		if (!$config) $config = HTMLPurifier_Config::createDefault();
 
-        // important, otherwise attacker could include arbitrary file
-        $allowed_schemes = $config->get('URI.AllowedSchemes');
-        if (!$config->get('URI.OverrideAllowedSchemes') &&
-            !isset($allowed_schemes[$scheme])
-        ) {
-            return;
-        }
+		// important, otherwise attacker could include arbitrary file
+		$allowed_schemes = $config->get('URI.AllowedSchemes');
+		if (!$config->get('URI.OverrideAllowedSchemes') &&
+			!isset($allowed_schemes[$scheme])
+		) {
+			return;
+		}
 
-        if (isset($this->schemes[$scheme])) return $this->schemes[$scheme];
-        if (!isset($allowed_schemes[$scheme])) return;
+		if (isset($this->schemes[$scheme])) return $this->schemes[$scheme];
+		if (!isset($allowed_schemes[$scheme])) return;
 
-        $class = 'HTMLPurifier_URIScheme_' . $scheme;
-        if (!class_exists($class)) return;
-        $this->schemes[$scheme] = new $class();
-        return $this->schemes[$scheme];
-    }
+		$class = 'HTMLPurifier_URIScheme_' . $scheme;
+		if (!class_exists($class)) return;
+		$this->schemes[$scheme] = new $class();
+		return $this->schemes[$scheme];
+	}
 
-    /**
-     * Registers a custom scheme to the cache, bypassing reflection.
-     * @param $scheme Scheme name
-     * @param $scheme_obj HTMLPurifier_URIScheme object
-     */
-    public function register($scheme, $scheme_obj) {
-        $this->schemes[$scheme] = $scheme_obj;
-    }
+	/**
+	 * Registers a custom scheme to the cache, bypassing reflection.
+	 * @param $scheme Scheme name
+	 * @param $scheme_obj HTMLPurifier_URIScheme object
+	 */
+	public function register($scheme, $scheme_obj) {
+		$this->schemes[$scheme] = $scheme_obj;
+	}
 
 }
 

Braces +12 added lines, -4 removed lines

@@ -35,7 +35,9 @@ 
      * @param $config HTMLPurifier_Context object
      */
     public function getScheme($scheme, $config, $context) {
-        if (!$config) $config = HTMLPurifier_Config::createDefault();
+        if (!$config) {
+        	$config = HTMLPurifier_Config::createDefault();
+        }
 
         // important, otherwise attacker could include arbitrary file
         $allowed_schemes = $config->get('URI.AllowedSchemes');
@@ -45,11 +47,17 @@ 
             return;
         }
 
-        if (isset($this->schemes[$scheme])) return $this->schemes[$scheme];
-        if (!isset($allowed_schemes[$scheme])) return;
+        if (isset($this->schemes[$scheme])) {
+        	return $this->schemes[$scheme];
+        }
+        if (!isset($allowed_schemes[$scheme])) {
+        	return;
+        }
 
         $class = 'HTMLPurifier_URIScheme_' . $scheme;
-        if (!class_exists($class)) return;
+        if (!class_exists($class)) {
+        	return;
+        }
         $this->schemes[$scheme] = new $class();
         return $this->schemes[$scheme];
     }

Spacing +1 added lines, -1 removed lines

@@ -48,7 +48,7 @@
         if (isset($this->schemes[$scheme])) return $this->schemes[$scheme];
         if (!isset($allowed_schemes[$scheme])) return;
 
-        $class = 'HTMLPurifier_URIScheme_' . $scheme;
+        $class = 'HTMLPurifier_URIScheme_'.$scheme;
         if (!class_exists($class)) return;
         $this->schemes[$scheme] = new $class();
         return $this->schemes[$scheme];