xpressengine / xe-core

classes/security/htmlpurifier/library/HTMLPurifier/AttrDef/CSS/Composite.php

Indentation +18 added lines, -18 removed lines

@@ -12,26 +12,26 @@
 class HTMLPurifier_AttrDef_CSS_Composite extends HTMLPurifier_AttrDef
 {
 
-    /**
-     * List of HTMLPurifier_AttrDef objects that may process strings
-     * @todo Make protected
-     */
-    public $defs;
+	/**
+	 * List of HTMLPurifier_AttrDef objects that may process strings
+	 * @todo Make protected
+	 */
+	public $defs;
 
-    /**
-     * @param $defs List of HTMLPurifier_AttrDef objects
-     */
-    public function __construct($defs) {
-        $this->defs = $defs;
-    }
+	/**
+	 * @param $defs List of HTMLPurifier_AttrDef objects
+	 */
+	public function __construct($defs) {
+		$this->defs = $defs;
+	}
 
-    public function validate($string, $config, $context) {
-        foreach ($this->defs as $i => $def) {
-            $result = $this->defs[$i]->validate($string, $config, $context);
-            if ($result !== false) return $result;
-        }
-        return false;
-    }
+	public function validate($string, $config, $context) {
+		foreach ($this->defs as $i => $def) {
+			$result = $this->defs[$i]->validate($string, $config, $context);
+			if ($result !== false) return $result;
+		}
+		return false;
+	}
 
 }
 

Braces +3 added lines, -1 removed lines

@@ -28,7 +28,9 @@
     public function validate($string, $config, $context) {
         foreach ($this->defs as $i => $def) {
             $result = $this->defs[$i]->validate($string, $config, $context);
-            if ($result !== false) return $result;
+            if ($result !== false) {
+            	return $result;
+            }
         }
         return false;
     }

classes/security/htmlpurifier/library/HTMLPurifier/AttrDef/CSS/DenyElementDecorator.php

Indentation +17 added lines, -17 removed lines

@@ -5,24 +5,24 @@
  */
 class HTMLPurifier_AttrDef_CSS_DenyElementDecorator extends HTMLPurifier_AttrDef
 {
-    public $def, $element;
+	public $def, $element;
 
-    /**
-     * @param $def Definition to wrap
-     * @param $element Element to deny
-     */
-    public function __construct($def, $element) {
-        $this->def = $def;
-        $this->element = $element;
-    }
-    /**
-     * Checks if CurrentToken is set and equal to $this->element
-     */
-    public function validate($string, $config, $context) {
-        $token = $context->get('CurrentToken', true);
-        if ($token && $token->name == $this->element) return false;
-        return $this->def->validate($string, $config, $context);
-    }
+	/**
+	 * @param $def Definition to wrap
+	 * @param $element Element to deny
+	 */
+	public function __construct($def, $element) {
+		$this->def = $def;
+		$this->element = $element;
+	}
+	/**
+	 * Checks if CurrentToken is set and equal to $this->element
+	 */
+	public function validate($string, $config, $context) {
+		$token = $context->get('CurrentToken', true);
+		if ($token && $token->name == $this->element) return false;
+		return $this->def->validate($string, $config, $context);
+	}
 }
 
 // vim: et sw=4 sts=4

Braces +3 added lines, -1 removed lines

@@ -20,7 +20,9 @@
      */
     public function validate($string, $config, $context) {
         $token = $context->get('CurrentToken', true);
-        if ($token && $token->name == $this->element) return false;
+        if ($token && $token->name == $this->element) {
+        	return false;
+        }
         return $this->def->validate($string, $config, $context);
     }
 }

classes/security/htmlpurifier/library/HTMLPurifier/AttrDef/CSS/Filter.php

Indentation +38 added lines, -38 removed lines

@@ -8,46 +8,46 @@
 class HTMLPurifier_AttrDef_CSS_Filter extends HTMLPurifier_AttrDef
 {
 
-    protected $intValidator;
+	protected $intValidator;
 
-    public function __construct() {
-        $this->intValidator = new HTMLPurifier_AttrDef_Integer();
-    }
+	public function __construct() {
+		$this->intValidator = new HTMLPurifier_AttrDef_Integer();
+	}
 
-    public function validate($value, $config, $context) {
-        $value = $this->parseCDATA($value);
-        if ($value === 'none') return $value;
-        // if we looped this we could support multiple filters
-        $function_length = strcspn($value, '(');
-        $function = trim(substr($value, 0, $function_length));
-        if ($function !== 'alpha' &&
-            $function !== 'Alpha' &&
-            $function !== 'progid:DXImageTransform.Microsoft.Alpha'
-            ) return false;
-        $cursor = $function_length + 1;
-        $parameters_length = strcspn($value, ')', $cursor);
-        $parameters = substr($value, $cursor, $parameters_length);
-        $params = explode(',', $parameters);
-        $ret_params = array();
-        $lookup = array();
-        foreach ($params as $param) {
-            list($key, $value) = explode('=', $param);
-            $key   = trim($key);
-            $value = trim($value);
-            if (isset($lookup[$key])) continue;
-            if ($key !== 'opacity') continue;
-            $value = $this->intValidator->validate($value, $config, $context);
-            if ($value === false) continue;
-            $int = (int) $value;
-            if ($int > 100) $value = '100';
-            if ($int < 0) $value = '0';
-            $ret_params[] = "$key=$value";
-            $lookup[$key] = true;
-        }
-        $ret_parameters = implode(',', $ret_params);
-        $ret_function = "$function($ret_parameters)";
-        return $ret_function;
-    }
+	public function validate($value, $config, $context) {
+		$value = $this->parseCDATA($value);
+		if ($value === 'none') return $value;
+		// if we looped this we could support multiple filters
+		$function_length = strcspn($value, '(');
+		$function = trim(substr($value, 0, $function_length));
+		if ($function !== 'alpha' &&
+			$function !== 'Alpha' &&
+			$function !== 'progid:DXImageTransform.Microsoft.Alpha'
+			) return false;
+		$cursor = $function_length + 1;
+		$parameters_length = strcspn($value, ')', $cursor);
+		$parameters = substr($value, $cursor, $parameters_length);
+		$params = explode(',', $parameters);
+		$ret_params = array();
+		$lookup = array();
+		foreach ($params as $param) {
+			list($key, $value) = explode('=', $param);
+			$key   = trim($key);
+			$value = trim($value);
+			if (isset($lookup[$key])) continue;
+			if ($key !== 'opacity') continue;
+			$value = $this->intValidator->validate($value, $config, $context);
+			if ($value === false) continue;
+			$int = (int) $value;
+			if ($int > 100) $value = '100';
+			if ($int < 0) $value = '0';
+			$ret_params[] = "$key=$value";
+			$lookup[$key] = true;
+		}
+		$ret_parameters = implode(',', $ret_params);
+		$ret_function = "$function($ret_parameters)";
+		return $ret_function;
+	}
 
 }
 

Braces +21 added lines, -7 removed lines

@@ -16,14 +16,18 @@ 
 
     public function validate($value, $config, $context) {
         $value = $this->parseCDATA($value);
-        if ($value === 'none') return $value;
+        if ($value === 'none') {
+        	return $value;
+        }
         // if we looped this we could support multiple filters
         $function_length = strcspn($value, '(');
         $function = trim(substr($value, 0, $function_length));
         if ($function !== 'alpha' &&
             $function !== 'Alpha' &&
             $function !== 'progid:DXImageTransform.Microsoft.Alpha'
-            ) return false;
+            ) {
+        	return false;
+        }
         $cursor = $function_length + 1;
         $parameters_length = strcspn($value, ')', $cursor);
         $parameters = substr($value, $cursor, $parameters_length);
@@ -34,13 +38,23 @@ 
             list($key, $value) = explode('=', $param);
             $key   = trim($key);
             $value = trim($value);
-            if (isset($lookup[$key])) continue;
-            if ($key !== 'opacity') continue;
+            if (isset($lookup[$key])) {
+            	continue;
+            }
+            if ($key !== 'opacity') {
+            	continue;
+            }
             $value = $this->intValidator->validate($value, $config, $context);
-            if ($value === false) continue;
+            if ($value === false) {
+            	continue;
+            }
             $int = (int) $value;
-            if ($int > 100) $value = '100';
-            if ($int < 0) $value = '0';
+            if ($int > 100) {
+            	$value = '100';
+            }
+            if ($int < 0) {
+            	$value = '0';
+            }
             $ret_params[] = "$key=$value";
             $lookup[$key] = true;
         }

classes/security/htmlpurifier/library/HTMLPurifier/AttrDef/CSS/Font.php

Indentation +127 added lines, -127 removed lines

@@ -6,143 +6,143 @@
 class HTMLPurifier_AttrDef_CSS_Font extends HTMLPurifier_AttrDef
 {
 
-    /**
-     * Local copy of component validators.
-     *
-     * @note If we moved specific CSS property definitions to their own
-     *       classes instead of having them be assembled at run time by
-     *       CSSDefinition, this wouldn't be necessary.  We'd instantiate
-     *       our own copies.
-     */
-    protected $info = array();
+	/**
+	 * Local copy of component validators.
+	 *
+	 * @note If we moved specific CSS property definitions to their own
+	 *       classes instead of having them be assembled at run time by
+	 *       CSSDefinition, this wouldn't be necessary.  We'd instantiate
+	 *       our own copies.
+	 */
+	protected $info = array();
 
-    public function __construct($config) {
-        $def = $config->getCSSDefinition();
-        $this->info['font-style']   = $def->info['font-style'];
-        $this->info['font-variant'] = $def->info['font-variant'];
-        $this->info['font-weight']  = $def->info['font-weight'];
-        $this->info['font-size']    = $def->info['font-size'];
-        $this->info['line-height']  = $def->info['line-height'];
-        $this->info['font-family']  = $def->info['font-family'];
-    }
+	public function __construct($config) {
+		$def = $config->getCSSDefinition();
+		$this->info['font-style']   = $def->info['font-style'];
+		$this->info['font-variant'] = $def->info['font-variant'];
+		$this->info['font-weight']  = $def->info['font-weight'];
+		$this->info['font-size']    = $def->info['font-size'];
+		$this->info['line-height']  = $def->info['line-height'];
+		$this->info['font-family']  = $def->info['font-family'];
+	}
 
-    public function validate($string, $config, $context) {
+	public function validate($string, $config, $context) {
 
-        static $system_fonts = array(
-            'caption' => true,
-            'icon' => true,
-            'menu' => true,
-            'message-box' => true,
-            'small-caption' => true,
-            'status-bar' => true
-        );
+		static $system_fonts = array(
+			'caption' => true,
+			'icon' => true,
+			'menu' => true,
+			'message-box' => true,
+			'small-caption' => true,
+			'status-bar' => true
+		);
 
-        // regular pre-processing
-        $string = $this->parseCDATA($string);
-        if ($string === '') return false;
+		// regular pre-processing
+		$string = $this->parseCDATA($string);
+		if ($string === '') return false;
 
-        // check if it's one of the keywords
-        $lowercase_string = strtolower($string);
-        if (isset($system_fonts[$lowercase_string])) {
-            return $lowercase_string;
-        }
+		// check if it's one of the keywords
+		$lowercase_string = strtolower($string);
+		if (isset($system_fonts[$lowercase_string])) {
+			return $lowercase_string;
+		}
 
-        $bits = explode(' ', $string); // bits to process
-        $stage = 0; // this indicates what we're looking for
-        $caught = array(); // which stage 0 properties have we caught?
-        $stage_1 = array('font-style', 'font-variant', 'font-weight');
-        $final = ''; // output
+		$bits = explode(' ', $string); // bits to process
+		$stage = 0; // this indicates what we're looking for
+		$caught = array(); // which stage 0 properties have we caught?
+		$stage_1 = array('font-style', 'font-variant', 'font-weight');
+		$final = ''; // output
 
-        for ($i = 0, $size = count($bits); $i < $size; $i++) {
-            if ($bits[$i] === '') continue;
-            switch ($stage) {
+		for ($i = 0, $size = count($bits); $i < $size; $i++) {
+			if ($bits[$i] === '') continue;
+			switch ($stage) {
 
-                // attempting to catch font-style, font-variant or font-weight
-                case 0:
-                    foreach ($stage_1 as $validator_name) {
-                        if (isset($caught[$validator_name])) continue;
-                        $r = $this->info[$validator_name]->validate(
-                                                $bits[$i], $config, $context);
-                        if ($r !== false) {
-                            $final .= $r . ' ';
-                            $caught[$validator_name] = true;
-                            break;
-                        }
-                    }
-                    // all three caught, continue on
-                    if (count($caught) >= 3) $stage = 1;
-                    if ($r !== false) break;
+				// attempting to catch font-style, font-variant or font-weight
+				case 0:
+					foreach ($stage_1 as $validator_name) {
+						if (isset($caught[$validator_name])) continue;
+						$r = $this->info[$validator_name]->validate(
+												$bits[$i], $config, $context);
+						if ($r !== false) {
+							$final .= $r . ' ';
+							$caught[$validator_name] = true;
+							break;
+						}
+					}
+					// all three caught, continue on
+					if (count($caught) >= 3) $stage = 1;
+					if ($r !== false) break;
 
-                // attempting to catch font-size and perhaps line-height
-                case 1:
-                    $found_slash = false;
-                    if (strpos($bits[$i], '/') !== false) {
-                        list($font_size, $line_height) =
-                                                    explode('/', $bits[$i]);
-                        if ($line_height === '') {
-                            // ooh, there's a space after the slash!
-                            $line_height = false;
-                            $found_slash = true;
-                        }
-                    } else {
-                        $font_size = $bits[$i];
-                        $line_height = false;
-                    }
-                    $r = $this->info['font-size']->validate(
-                                              $font_size, $config, $context);
-                    if ($r !== false) {
-                        $final .= $r;
-                        // attempt to catch line-height
-                        if ($line_height === false) {
-                            // we need to scroll forward
-                            for ($j = $i + 1; $j < $size; $j++) {
-                                if ($bits[$j] === '') continue;
-                                if ($bits[$j] === '/') {
-                                    if ($found_slash) {
-                                        return false;
-                                    } else {
-                                        $found_slash = true;
-                                        continue;
-                                    }
-                                }
-                                $line_height = $bits[$j];
-                                break;
-                            }
-                        } else {
-                            // slash already found
-                            $found_slash = true;
-                            $j = $i;
-                        }
-                        if ($found_slash) {
-                            $i = $j;
-                            $r = $this->info['line-height']->validate(
-                                              $line_height, $config, $context);
-                            if ($r !== false) {
-                                $final .= '/' . $r;
-                            }
-                        }
-                        $final .= ' ';
-                        $stage = 2;
-                        break;
-                    }
-                    return false;
+				// attempting to catch font-size and perhaps line-height
+				case 1:
+					$found_slash = false;
+					if (strpos($bits[$i], '/') !== false) {
+						list($font_size, $line_height) =
+													explode('/', $bits[$i]);
+						if ($line_height === '') {
+							// ooh, there's a space after the slash!
+							$line_height = false;
+							$found_slash = true;
+						}
+					} else {
+						$font_size = $bits[$i];
+						$line_height = false;
+					}
+					$r = $this->info['font-size']->validate(
+											  $font_size, $config, $context);
+					if ($r !== false) {
+						$final .= $r;
+						// attempt to catch line-height
+						if ($line_height === false) {
+							// we need to scroll forward
+							for ($j = $i + 1; $j < $size; $j++) {
+								if ($bits[$j] === '') continue;
+								if ($bits[$j] === '/') {
+									if ($found_slash) {
+										return false;
+									} else {
+										$found_slash = true;
+										continue;
+									}
+								}
+								$line_height = $bits[$j];
+								break;
+							}
+						} else {
+							// slash already found
+							$found_slash = true;
+							$j = $i;
+						}
+						if ($found_slash) {
+							$i = $j;
+							$r = $this->info['line-height']->validate(
+											  $line_height, $config, $context);
+							if ($r !== false) {
+								$final .= '/' . $r;
+							}
+						}
+						$final .= ' ';
+						$stage = 2;
+						break;
+					}
+					return false;
 
-                // attempting to catch font-family
-                case 2:
-                    $font_family =
-                        implode(' ', array_slice($bits, $i, $size - $i));
-                    $r = $this->info['font-family']->validate(
-                                              $font_family, $config, $context);
-                    if ($r !== false) {
-                        $final .= $r . ' ';
-                        // processing completed successfully
-                        return rtrim($final);
-                    }
-                    return false;
-            }
-        }
-        return false;
-    }
+				// attempting to catch font-family
+				case 2:
+					$font_family =
+						implode(' ', array_slice($bits, $i, $size - $i));
+					$r = $this->info['font-family']->validate(
+											  $font_family, $config, $context);
+					if ($r !== false) {
+						$final .= $r . ' ';
+						// processing completed successfully
+						return rtrim($final);
+					}
+					return false;
+			}
+		}
+		return false;
+	}
 
 }
 

Braces +18 added lines, -6 removed lines

@@ -39,7 +39,9 @@ 
 
         // regular pre-processing
         $string = $this->parseCDATA($string);
-        if ($string === '') return false;
+        if ($string === '') {
+        	return false;
+        }
 
         // check if it's one of the keywords
         $lowercase_string = strtolower($string);
@@ -54,13 +56,17 @@ 
         $final = ''; // output
 
         for ($i = 0, $size = count($bits); $i < $size; $i++) {
-            if ($bits[$i] === '') continue;
+            if ($bits[$i] === '') {
+            	continue;
+            }
             switch ($stage) {
 
                 // attempting to catch font-style, font-variant or font-weight
                 case 0:
                     foreach ($stage_1 as $validator_name) {
-                        if (isset($caught[$validator_name])) continue;
+                        if (isset($caught[$validator_name])) {
+                        	continue;
+                        }
                         $r = $this->info[$validator_name]->validate(
                                                 $bits[$i], $config, $context);
                         if ($r !== false) {
@@ -70,8 +76,12 @@ 
                         }
                     }
                     // all three caught, continue on
-                    if (count($caught) >= 3) $stage = 1;
-                    if ($r !== false) break;
+                    if (count($caught) >= 3) {
+                    	$stage = 1;
+                    }
+                    if ($r !== false) {
+                    	break;
+                    }
 
                 // attempting to catch font-size and perhaps line-height
                 case 1:
@@ -96,7 +106,9 @@ 
                         if ($line_height === false) {
                             // we need to scroll forward
                             for ($j = $i + 1; $j < $size; $j++) {
-                                if ($bits[$j] === '') continue;
+                                if ($bits[$j] === '') {
+                                	continue;
+                                }
                                 if ($bits[$j] === '/') {
                                     if ($found_slash) {
                                         return false;

Spacing +3 added lines, -3 removed lines

@@ -64,7 +64,7 @@ 
                         $r = $this->info[$validator_name]->validate(
                                                 $bits[$i], $config, $context);
                         if ($r !== false) {
-                            $final .= $r . ' ';
+                            $final .= $r.' ';
                             $caught[$validator_name] = true;
                             break;
                         }
@@ -118,7 +118,7 @@ 
                             $r = $this->info['line-height']->validate(
                                               $line_height, $config, $context);
                             if ($r !== false) {
-                                $final .= '/' . $r;
+                                $final .= '/'.$r;
                             }
                         }
                         $final .= ' ';
@@ -134,7 +134,7 @@ 
                     $r = $this->info['font-family']->validate(
                                               $font_family, $config, $context);
                     if ($r !== false) {
-                        $final .= $r . ' ';
+                        $final .= $r.' ';
                         // processing completed successfully
                         return rtrim($final);
                     }

classes/security/htmlpurifier/library/HTMLPurifier/AttrDef/CSS/FontFamily.php

Indentation +171 added lines, -171 removed lines

@@ -6,22 +6,22 @@ 
 class HTMLPurifier_AttrDef_CSS_FontFamily extends HTMLPurifier_AttrDef
 {
 
-    protected $mask = null;
-
-    public function __construct() {
-        $this->mask = '- ';
-        for ($c = 'a'; $c <= 'z'; $c++) $this->mask .= $c;
-        for ($c = 'A'; $c <= 'Z'; $c++) $this->mask .= $c;
-        for ($c = '0'; $c <= '9'; $c++) $this->mask .= $c; // cast-y, but should be fine
-        // special bytes used by UTF-8
-        for ($i = 0x80; $i <= 0xFF; $i++) {
-            // We don't bother excluding invalid bytes in this range,
-            // because the our restriction of well-formed UTF-8 will
-            // prevent these from ever occurring.
-            $this->mask .= chr($i);
-        }
-
-        /*
+	protected $mask = null;
+
+	public function __construct() {
+		$this->mask = '- ';
+		for ($c = 'a'; $c <= 'z'; $c++) $this->mask .= $c;
+		for ($c = 'A'; $c <= 'Z'; $c++) $this->mask .= $c;
+		for ($c = '0'; $c <= '9'; $c++) $this->mask .= $c; // cast-y, but should be fine
+		// special bytes used by UTF-8
+		for ($i = 0x80; $i <= 0xFF; $i++) {
+			// We don't bother excluding invalid bytes in this range,
+			// because the our restriction of well-formed UTF-8 will
+			// prevent these from ever occurring.
+			$this->mask .= chr($i);
+		}
+
+		/*
             PHP's internal strcspn implementation is
             O(length of string * length of mask), making it inefficient
             for large masks.  However, it's still faster than
@@ -36,161 +36,161 @@ 
             c = *++p;
           }
          */
-        // possible optimization: invert the mask.
-    }
-
-    public function validate($string, $config, $context) {
-        static $generic_names = array(
-            'serif' => true,
-            'sans-serif' => true,
-            'monospace' => true,
-            'fantasy' => true,
-            'cursive' => true
-        );
-        $allowed_fonts = $config->get('CSS.AllowedFonts');
-
-        // assume that no font names contain commas in them
-        $fonts = explode(',', $string);
-        $final = '';
-        foreach($fonts as $font) {
-            $font = trim($font);
-            if ($font === '') continue;
-            // match a generic name
-            if (isset($generic_names[$font])) {
-                if ($allowed_fonts === null || isset($allowed_fonts[$font])) {
-                    $final .= $font . ', ';
-                }
-                continue;
-            }
-            // match a quoted name
-            if ($font[0] === '"' || $font[0] === "'") {
-                $length = strlen($font);
-                if ($length <= 2) continue;
-                $quote = $font[0];
-                if ($font[$length - 1] !== $quote) continue;
-                $font = substr($font, 1, $length - 2);
-            }
-
-            $font = $this->expandCSSEscape($font);
-
-            // $font is a pure representation of the font name
-
-            if ($allowed_fonts !== null && !isset($allowed_fonts[$font])) {
-                continue;
-            }
-
-            if (ctype_alnum($font) && $font !== '') {
-                // very simple font, allow it in unharmed
-                $final .= $font . ', ';
-                continue;
-            }
-
-            // bugger out on whitespace.  form feed (0C) really
-            // shouldn't show up regardless
-            $font = str_replace(array("\n", "\t", "\r", "\x0C"), ' ', $font);
-
-            // Here, there are various classes of characters which need
-            // to be treated differently:
-            //  - Alphanumeric characters are essentially safe.  We
-            //    handled these above.
-            //  - Spaces require quoting, though most parsers will do
-            //    the right thing if there aren't any characters that
-            //    can be misinterpreted
-            //  - Dashes rarely occur, but they fairly unproblematic
-            //    for parsing/rendering purposes.
-            //  The above characters cover the majority of Western font
-            //  names.
-            //  - Arbitrary Unicode characters not in ASCII.  Because
-            //    most parsers give little thought to Unicode, treatment
-            //    of these codepoints is basically uniform, even for
-            //    punctuation-like codepoints.  These characters can
-            //    show up in non-Western pages and are supported by most
-            //    major browsers, for example: "ＭＳ 明朝" is a
-            //    legitimate font-name
-            //    <http://ja.wikipedia.org/wiki/MS_明朝>.  See
-            //    the CSS3 spec for more examples:
-            //    <http://www.w3.org/TR/2011/WD-css3-fonts-20110324/localizedfamilynames.png>
-            //    You can see live samples of these on the Internet:
-            //    <http://www.google.co.jp/search?q=font-family+ＭＳ+明朝|ゴシック>
-            //    However, most of these fonts have ASCII equivalents:
-            //    for example, 'MS Mincho', and it's considered
-            //    professional to use ASCII font names instead of
-            //    Unicode font names.  Thanks Takeshi Terada for
-            //    providing this information.
-            //  The following characters, to my knowledge, have not been
-            //  used to name font names.
-            //  - Single quote.  While theoretically you might find a
-            //    font name that has a single quote in its name (serving
-            //    as an apostrophe, e.g. Dave's Scribble), I haven't
-            //    been able to find any actual examples of this.
-            //    Internet Explorer's cssText translation (which I
-            //    believe is invoked by innerHTML) normalizes any
-            //    quoting to single quotes, and fails to escape single
-            //    quotes.  (Note that this is not IE's behavior for all
-            //    CSS properties, just some sort of special casing for
-            //    font-family).  So a single quote *cannot* be used
-            //    safely in the font-family context if there will be an
-            //    innerHTML/cssText translation.  Note that Firefox 3.x
-            //    does this too.
-            //  - Double quote.  In IE, these get normalized to
-            //    single-quotes, no matter what the encoding.  (Fun
-            //    fact, in IE8, the 'content' CSS property gained
-            //    support, where they special cased to preserve encoded
-            //    double quotes, but still translate unadorned double
-            //    quotes into single quotes.)  So, because their
-            //    fixpoint behavior is identical to single quotes, they
-            //    cannot be allowed either.  Firefox 3.x displays
-            //    single-quote style behavior.
-            //  - Backslashes are reduced by one (so \\ -> \) every
-            //    iteration, so they cannot be used safely.  This shows
-            //    up in IE7, IE8 and FF3
-            //  - Semicolons, commas and backticks are handled properly.
-            //  - The rest of the ASCII punctuation is handled properly.
-            // We haven't checked what browsers do to unadorned
-            // versions, but this is not important as long as the
-            // browser doesn't /remove/ surrounding quotes (as IE does
-            // for HTML).
-            //
-            // With these results in hand, we conclude that there are
-            // various levels of safety:
-            //  - Paranoid: alphanumeric, spaces and dashes(?)
-            //  - International: Paranoid + non-ASCII Unicode
-            //  - Edgy: Everything except quotes, backslashes
-            //  - NoJS: Standards compliance, e.g. sod IE. Note that
-            //    with some judicious character escaping (since certain
-            //    types of escaping doesn't work) this is theoretically
-            //    OK as long as innerHTML/cssText is not called.
-            // We believe that international is a reasonable default
-            // (that we will implement now), and once we do more
-            // extensive research, we may feel comfortable with dropping
-            // it down to edgy.
-
-            // Edgy: alphanumeric, spaces, dashes and Unicode.  Use of
-            // str(c)spn assumes that the string was already well formed
-            // Unicode (which of course it is).
-            if (strspn($font, $this->mask) !== strlen($font)) {
-                continue;
-            }
-
-            // Historical:
-            // In the absence of innerHTML/cssText, these ugly
-            // transforms don't pose a security risk (as \\ and \"
-            // might--these escapes are not supported by most browsers).
-            // We could try to be clever and use single-quote wrapping
-            // when there is a double quote present, but I have choosen
-            // not to implement that.  (NOTE: you can reduce the amount
-            // of escapes by one depending on what quoting style you use)
-            // $font = str_replace('\\', '\\5C ', $font);
-            // $font = str_replace('"',  '\\22 ', $font);
-            // $font = str_replace("'",  '\\27 ', $font);
-
-            // font possibly with spaces, requires quoting
-            $final .= "'$font', ";
-        }
-        $final = rtrim($final, ', ');
-        if ($final === '') return false;
-        return $final;
-    }
+		// possible optimization: invert the mask.
+	}
+
+	public function validate($string, $config, $context) {
+		static $generic_names = array(
+			'serif' => true,
+			'sans-serif' => true,
+			'monospace' => true,
+			'fantasy' => true,
+			'cursive' => true
+		);
+		$allowed_fonts = $config->get('CSS.AllowedFonts');
+
+		// assume that no font names contain commas in them
+		$fonts = explode(',', $string);
+		$final = '';
+		foreach($fonts as $font) {
+			$font = trim($font);
+			if ($font === '') continue;
+			// match a generic name
+			if (isset($generic_names[$font])) {
+				if ($allowed_fonts === null || isset($allowed_fonts[$font])) {
+					$final .= $font . ', ';
+				}
+				continue;
+			}
+			// match a quoted name
+			if ($font[0] === '"' || $font[0] === "'") {
+				$length = strlen($font);
+				if ($length <= 2) continue;
+				$quote = $font[0];
+				if ($font[$length - 1] !== $quote) continue;
+				$font = substr($font, 1, $length - 2);
+			}
+
+			$font = $this->expandCSSEscape($font);
+
+			// $font is a pure representation of the font name
+
+			if ($allowed_fonts !== null && !isset($allowed_fonts[$font])) {
+				continue;
+			}
+
+			if (ctype_alnum($font) && $font !== '') {
+				// very simple font, allow it in unharmed
+				$final .= $font . ', ';
+				continue;
+			}
+
+			// bugger out on whitespace.  form feed (0C) really
+			// shouldn't show up regardless
+			$font = str_replace(array("\n", "\t", "\r", "\x0C"), ' ', $font);
+
+			// Here, there are various classes of characters which need
+			// to be treated differently:
+			//  - Alphanumeric characters are essentially safe.  We
+			//    handled these above.
+			//  - Spaces require quoting, though most parsers will do
+			//    the right thing if there aren't any characters that
+			//    can be misinterpreted
+			//  - Dashes rarely occur, but they fairly unproblematic
+			//    for parsing/rendering purposes.
+			//  The above characters cover the majority of Western font
+			//  names.
+			//  - Arbitrary Unicode characters not in ASCII.  Because
+			//    most parsers give little thought to Unicode, treatment
+			//    of these codepoints is basically uniform, even for
+			//    punctuation-like codepoints.  These characters can
+			//    show up in non-Western pages and are supported by most
+			//    major browsers, for example: "ＭＳ 明朝" is a
+			//    legitimate font-name
+			//    <http://ja.wikipedia.org/wiki/MS_明朝>.  See
+			//    the CSS3 spec for more examples:
+			//    <http://www.w3.org/TR/2011/WD-css3-fonts-20110324/localizedfamilynames.png>
+			//    You can see live samples of these on the Internet:
+			//    <http://www.google.co.jp/search?q=font-family+ＭＳ+明朝|ゴシック>
+			//    However, most of these fonts have ASCII equivalents:
+			//    for example, 'MS Mincho', and it's considered
+			//    professional to use ASCII font names instead of
+			//    Unicode font names.  Thanks Takeshi Terada for
+			//    providing this information.
+			//  The following characters, to my knowledge, have not been
+			//  used to name font names.
+			//  - Single quote.  While theoretically you might find a
+			//    font name that has a single quote in its name (serving
+			//    as an apostrophe, e.g. Dave's Scribble), I haven't
+			//    been able to find any actual examples of this.
+			//    Internet Explorer's cssText translation (which I
+			//    believe is invoked by innerHTML) normalizes any
+			//    quoting to single quotes, and fails to escape single
+			//    quotes.  (Note that this is not IE's behavior for all
+			//    CSS properties, just some sort of special casing for
+			//    font-family).  So a single quote *cannot* be used
+			//    safely in the font-family context if there will be an
+			//    innerHTML/cssText translation.  Note that Firefox 3.x
+			//    does this too.
+			//  - Double quote.  In IE, these get normalized to
+			//    single-quotes, no matter what the encoding.  (Fun
+			//    fact, in IE8, the 'content' CSS property gained
+			//    support, where they special cased to preserve encoded
+			//    double quotes, but still translate unadorned double
+			//    quotes into single quotes.)  So, because their
+			//    fixpoint behavior is identical to single quotes, they
+			//    cannot be allowed either.  Firefox 3.x displays
+			//    single-quote style behavior.
+			//  - Backslashes are reduced by one (so \\ -> \) every
+			//    iteration, so they cannot be used safely.  This shows
+			//    up in IE7, IE8 and FF3
+			//  - Semicolons, commas and backticks are handled properly.
+			//  - The rest of the ASCII punctuation is handled properly.
+			// We haven't checked what browsers do to unadorned
+			// versions, but this is not important as long as the
+			// browser doesn't /remove/ surrounding quotes (as IE does
+			// for HTML).
+			//
+			// With these results in hand, we conclude that there are
+			// various levels of safety:
+			//  - Paranoid: alphanumeric, spaces and dashes(?)
+			//  - International: Paranoid + non-ASCII Unicode
+			//  - Edgy: Everything except quotes, backslashes
+			//  - NoJS: Standards compliance, e.g. sod IE. Note that
+			//    with some judicious character escaping (since certain
+			//    types of escaping doesn't work) this is theoretically
+			//    OK as long as innerHTML/cssText is not called.
+			// We believe that international is a reasonable default
+			// (that we will implement now), and once we do more
+			// extensive research, we may feel comfortable with dropping
+			// it down to edgy.
+
+			// Edgy: alphanumeric, spaces, dashes and Unicode.  Use of
+			// str(c)spn assumes that the string was already well formed
+			// Unicode (which of course it is).
+			if (strspn($font, $this->mask) !== strlen($font)) {
+				continue;
+			}
+
+			// Historical:
+			// In the absence of innerHTML/cssText, these ugly
+			// transforms don't pose a security risk (as \\ and \"
+			// might--these escapes are not supported by most browsers).
+			// We could try to be clever and use single-quote wrapping
+			// when there is a double quote present, but I have choosen
+			// not to implement that.  (NOTE: you can reduce the amount
+			// of escapes by one depending on what quoting style you use)
+			// $font = str_replace('\\', '\\5C ', $font);
+			// $font = str_replace('"',  '\\22 ', $font);
+			// $font = str_replace("'",  '\\27 ', $font);
+
+			// font possibly with spaces, requires quoting
+			$final .= "'$font', ";
+		}
+		$final = rtrim($final, ', ');
+		if ($final === '') return false;
+		return $final;
+	}
 
 }
 

Braces +22 added lines, -7 removed lines

@@ -10,9 +10,16 @@ 
 
     public function __construct() {
         $this->mask = '- ';
-        for ($c = 'a'; $c <= 'z'; $c++) $this->mask .= $c;
-        for ($c = 'A'; $c <= 'Z'; $c++) $this->mask .= $c;
-        for ($c = '0'; $c <= '9'; $c++) $this->mask .= $c; // cast-y, but should be fine
+        for ($c = 'a'; $c <= 'z'; $c++) {
+        	$this->mask .= $c;
+        }
+        for ($c = 'A'; $c <= 'Z'; $c++) {
+        	$this->mask .= $c;
+        }
+        for ($c = '0'; $c <= '9'; $c++) {
+        	$this->mask .= $c;
+        }
+        // cast-y, but should be fine
         // special bytes used by UTF-8
         for ($i = 0x80; $i <= 0xFF; $i++) {
             // We don't bother excluding invalid bytes in this range,
@@ -54,7 +61,9 @@ 
         $final = '';
         foreach($fonts as $font) {
             $font = trim($font);
-            if ($font === '') continue;
+            if ($font === '') {
+            	continue;
+            }
             // match a generic name
             if (isset($generic_names[$font])) {
                 if ($allowed_fonts === null || isset($allowed_fonts[$font])) {
@@ -65,9 +74,13 @@ 
             // match a quoted name
             if ($font[0] === '"' || $font[0] === "'") {
                 $length = strlen($font);
-                if ($length <= 2) continue;
+                if ($length <= 2) {
+                	continue;
+                }
                 $quote = $font[0];
-                if ($font[$length - 1] !== $quote) continue;
+                if ($font[$length - 1] !== $quote) {
+                	continue;
+                }
                 $font = substr($font, 1, $length - 2);
             }
 
@@ -188,7 +201,9 @@ 
             $final .= "'$font', ";
         }
         $final = rtrim($final, ', ');
-        if ($final === '') return false;
+        if ($final === '') {
+        	return false;
+        }
         return $final;
     }
 

Spacing +3 added lines, -3 removed lines

@@ -52,13 +52,13 @@ 
         // assume that no font names contain commas in them
         $fonts = explode(',', $string);
         $final = '';
-        foreach($fonts as $font) {
+        foreach ($fonts as $font) {
             $font = trim($font);
             if ($font === '') continue;
             // match a generic name
             if (isset($generic_names[$font])) {
                 if ($allowed_fonts === null || isset($allowed_fonts[$font])) {
-                    $final .= $font . ', ';
+                    $final .= $font.', ';
                 }
                 continue;
             }
@@ -81,7 +81,7 @@ 
 
             if (ctype_alnum($font) && $font !== '') {
                 // very simple font, allow it in unharmed
-                $final .= $font . ', ';
+                $final .= $font.', ';
                 continue;
             }
 

classes/security/htmlpurifier/library/HTMLPurifier/AttrDef/CSS/Ident.php

Indentation +8 added lines, -8 removed lines

@@ -6,18 +6,18 @@
 class HTMLPurifier_AttrDef_CSS_Ident extends HTMLPurifier_AttrDef
 {
 
-    public function validate($string, $config, $context) {
+	public function validate($string, $config, $context) {
 
-        $string = trim($string);
+		$string = trim($string);
 
-        // early abort: '' and '0' (strings that convert to false) are invalid
-        if (!$string) return false;
+		// early abort: '' and '0' (strings that convert to false) are invalid
+		if (!$string) return false;
 
-        $pattern = '/^(-?[A-Za-z_][A-Za-z_\-0-9]*)$/';
-        if (!preg_match($pattern, $string)) return false;
-        return $string;
+		$pattern = '/^(-?[A-Za-z_][A-Za-z_\-0-9]*)$/';
+		if (!preg_match($pattern, $string)) return false;
+		return $string;
 
-    }
+	}
 
 }
 

Braces +6 added lines, -2 removed lines

@@ -11,10 +11,14 @@
         $string = trim($string);
 
         // early abort: '' and '0' (strings that convert to false) are invalid
-        if (!$string) return false;
+        if (!$string) {
+        	return false;
+        }
 
         $pattern = '/^(-?[A-Za-z_][A-Za-z_\-0-9]*)$/';
-        if (!preg_match($pattern, $string)) return false;
+        if (!preg_match($pattern, $string)) {
+        	return false;
+        }
         return $string;
 
     }

classes/security/htmlpurifier/library/HTMLPurifier/AttrDef/CSS/ImportantDecorator.php

Indentation +29 added lines, -29 removed lines

@@ -5,36 +5,36 @@
  */
 class HTMLPurifier_AttrDef_CSS_ImportantDecorator extends HTMLPurifier_AttrDef
 {
-    public $def, $allow;
+	public $def, $allow;
 
-    /**
-     * @param $def Definition to wrap
-     * @param $allow Whether or not to allow !important
-     */
-    public function __construct($def, $allow = false) {
-        $this->def = $def;
-        $this->allow = $allow;
-    }
-    /**
-     * Intercepts and removes !important if necessary
-     */
-    public function validate($string, $config, $context) {
-        // test for ! and important tokens
-        $string = trim($string);
-        $is_important = false;
-        // :TODO: optimization: test directly for !important and ! important
-        if (strlen($string) >= 9 && substr($string, -9) === 'important') {
-            $temp = rtrim(substr($string, 0, -9));
-            // use a temp, because we might want to restore important
-            if (strlen($temp) >= 1 && substr($temp, -1) === '!') {
-                $string = rtrim(substr($temp, 0, -1));
-                $is_important = true;
-            }
-        }
-        $string = $this->def->validate($string, $config, $context);
-        if ($this->allow && $is_important) $string .= ' !important';
-        return $string;
-    }
+	/**
+	 * @param $def Definition to wrap
+	 * @param $allow Whether or not to allow !important
+	 */
+	public function __construct($def, $allow = false) {
+		$this->def = $def;
+		$this->allow = $allow;
+	}
+	/**
+	 * Intercepts and removes !important if necessary
+	 */
+	public function validate($string, $config, $context) {
+		// test for ! and important tokens
+		$string = trim($string);
+		$is_important = false;
+		// :TODO: optimization: test directly for !important and ! important
+		if (strlen($string) >= 9 && substr($string, -9) === 'important') {
+			$temp = rtrim(substr($string, 0, -9));
+			// use a temp, because we might want to restore important
+			if (strlen($temp) >= 1 && substr($temp, -1) === '!') {
+				$string = rtrim(substr($temp, 0, -1));
+				$is_important = true;
+			}
+		}
+		$string = $this->def->validate($string, $config, $context);
+		if ($this->allow && $is_important) $string .= ' !important';
+		return $string;
+	}
 }
 
 // vim: et sw=4 sts=4

Braces +3 added lines, -1 removed lines

@@ -32,7 +32,9 @@
             }
         }
         $string = $this->def->validate($string, $config, $context);
-        if ($this->allow && $is_important) $string .= ' !important';
+        if ($this->allow && $is_important) {
+        	$string .= ' !important';
+        }
         return $string;
     }
 }

classes/security/htmlpurifier/library/HTMLPurifier/AttrDef/CSS/ListStyle.php

Indentation +65 added lines, -65 removed lines

@@ -7,71 +7,71 @@
 class HTMLPurifier_AttrDef_CSS_ListStyle extends HTMLPurifier_AttrDef
 {
 
-    /**
-     * Local copy of component validators.
-     * @note See HTMLPurifier_AttrDef_CSS_Font::$info for a similar impl.
-     */
-    protected $info;
-
-    public function __construct($config) {
-        $def = $config->getCSSDefinition();
-        $this->info['list-style-type']     = $def->info['list-style-type'];
-        $this->info['list-style-position'] = $def->info['list-style-position'];
-        $this->info['list-style-image'] = $def->info['list-style-image'];
-    }
-
-    public function validate($string, $config, $context) {
-
-        // regular pre-processing
-        $string = $this->parseCDATA($string);
-        if ($string === '') return false;
-
-        // assumes URI doesn't have spaces in it
-        $bits = explode(' ', strtolower($string)); // bits to process
-
-        $caught = array();
-        $caught['type']     = false;
-        $caught['position'] = false;
-        $caught['image']    = false;
-
-        $i = 0; // number of catches
-        $none = false;
-
-        foreach ($bits as $bit) {
-            if ($i >= 3) return; // optimization bit
-            if ($bit === '') continue;
-            foreach ($caught as $key => $status) {
-                if ($status !== false) continue;
-                $r = $this->info['list-style-' . $key]->validate($bit, $config, $context);
-                if ($r === false) continue;
-                if ($r === 'none') {
-                    if ($none) continue;
-                    else $none = true;
-                    if ($key == 'image') continue;
-                }
-                $caught[$key] = $r;
-                $i++;
-                break;
-            }
-        }
-
-        if (!$i) return false;
-
-        $ret = array();
-
-        // construct type
-        if ($caught['type']) $ret[] = $caught['type'];
-
-        // construct image
-        if ($caught['image']) $ret[] = $caught['image'];
-
-        // construct position
-        if ($caught['position']) $ret[] = $caught['position'];
-
-        if (empty($ret)) return false;
-        return implode(' ', $ret);
-
-    }
+	/**
+	 * Local copy of component validators.
+	 * @note See HTMLPurifier_AttrDef_CSS_Font::$info for a similar impl.
+	 */
+	protected $info;
+
+	public function __construct($config) {
+		$def = $config->getCSSDefinition();
+		$this->info['list-style-type']     = $def->info['list-style-type'];
+		$this->info['list-style-position'] = $def->info['list-style-position'];
+		$this->info['list-style-image'] = $def->info['list-style-image'];
+	}
+
+	public function validate($string, $config, $context) {
+
+		// regular pre-processing
+		$string = $this->parseCDATA($string);
+		if ($string === '') return false;
+
+		// assumes URI doesn't have spaces in it
+		$bits = explode(' ', strtolower($string)); // bits to process
+
+		$caught = array();
+		$caught['type']     = false;
+		$caught['position'] = false;
+		$caught['image']    = false;
+
+		$i = 0; // number of catches
+		$none = false;
+
+		foreach ($bits as $bit) {
+			if ($i >= 3) return; // optimization bit
+			if ($bit === '') continue;
+			foreach ($caught as $key => $status) {
+				if ($status !== false) continue;
+				$r = $this->info['list-style-' . $key]->validate($bit, $config, $context);
+				if ($r === false) continue;
+				if ($r === 'none') {
+					if ($none) continue;
+					else $none = true;
+					if ($key == 'image') continue;
+				}
+				$caught[$key] = $r;
+				$i++;
+				break;
+			}
+		}
+
+		if (!$i) return false;
+
+		$ret = array();
+
+		// construct type
+		if ($caught['type']) $ret[] = $caught['type'];
+
+		// construct image
+		if ($caught['image']) $ret[] = $caught['image'];
+
+		// construct position
+		if ($caught['position']) $ret[] = $caught['position'];
+
+		if (empty($ret)) return false;
+		return implode(' ', $ret);
+
+	}
 
 }
 

Braces +39 added lines, -13 removed lines

@@ -24,7 +24,9 @@ 
 
         // regular pre-processing
         $string = $this->parseCDATA($string);
-        if ($string === '') return false;
+        if ($string === '') {
+        	return false;
+        }
 
         // assumes URI doesn't have spaces in it
         $bits = explode(' ', strtolower($string)); // bits to process
@@ -38,16 +40,30 @@ 
         $none = false;
 
         foreach ($bits as $bit) {
-            if ($i >= 3) return; // optimization bit
-            if ($bit === '') continue;
+            if ($i >= 3) {
+            	return;
+            }
+            // optimization bit
+            if ($bit === '') {
+            	continue;
+            }
             foreach ($caught as $key => $status) {
-                if ($status !== false) continue;
+                if ($status !== false) {
+                	continue;
+                }
                 $r = $this->info['list-style-' . $key]->validate($bit, $config, $context);
-                if ($r === false) continue;
+                if ($r === false) {
+                	continue;
+                }
                 if ($r === 'none') {
-                    if ($none) continue;
-                    else $none = true;
-                    if ($key == 'image') continue;
+                    if ($none) {
+                    	continue;
+                    } else {
+                    	$none = true;
+                    }
+                    if ($key == 'image') {
+                    	continue;
+                    }
                 }
                 $caught[$key] = $r;
                 $i++;
@@ -55,20 +71,30 @@ 
             }
         }
 
-        if (!$i) return false;
+        if (!$i) {
+        	return false;
+        }
 
         $ret = array();
 
         // construct type
-        if ($caught['type']) $ret[] = $caught['type'];
+        if ($caught['type']) {
+        	$ret[] = $caught['type'];
+        }
 
         // construct image
-        if ($caught['image']) $ret[] = $caught['image'];
+        if ($caught['image']) {
+        	$ret[] = $caught['image'];
+        }
 
         // construct position
-        if ($caught['position']) $ret[] = $caught['position'];
+        if ($caught['position']) {
+        	$ret[] = $caught['position'];
+        }
 
-        if (empty($ret)) return false;
+        if (empty($ret)) {
+        	return false;
+        }
         return implode(' ', $ret);
 
     }

Spacing +1 added lines, -1 removed lines

@@ -42,7 +42,7 @@
             if ($bit === '') continue;
             foreach ($caught as $key => $status) {
                 if ($status !== false) continue;
-                $r = $this->info['list-style-' . $key]->validate($bit, $config, $context);
+                $r = $this->info['list-style-'.$key]->validate($bit, $config, $context);
                 if ($r === false) continue;
                 if ($r === 'none') {
                     if ($none) continue;

classes/security/htmlpurifier/library/HTMLPurifier/AttrDef/CSS/Multiple.php

Indentation +35 added lines, -35 removed lines

@@ -14,44 +14,44 @@
 class HTMLPurifier_AttrDef_CSS_Multiple extends HTMLPurifier_AttrDef
 {
 
-    /**
-     * Instance of component definition to defer validation to.
-     * @todo Make protected
-     */
-    public $single;
+	/**
+	 * Instance of component definition to defer validation to.
+	 * @todo Make protected
+	 */
+	public $single;
 
-    /**
-     * Max number of values allowed.
-     * @todo Make protected
-     */
-    public $max;
+	/**
+	 * Max number of values allowed.
+	 * @todo Make protected
+	 */
+	public $max;
 
-    /**
-     * @param $single HTMLPurifier_AttrDef to multiply
-     * @param $max Max number of values allowed (usually four)
-     */
-    public function __construct($single, $max = 4) {
-        $this->single = $single;
-        $this->max = $max;
-    }
+	/**
+	 * @param $single HTMLPurifier_AttrDef to multiply
+	 * @param $max Max number of values allowed (usually four)
+	 */
+	public function __construct($single, $max = 4) {
+		$this->single = $single;
+		$this->max = $max;
+	}
 
-    public function validate($string, $config, $context) {
-        $string = $this->parseCDATA($string);
-        if ($string === '') return false;
-        $parts = explode(' ', $string); // parseCDATA replaced \r, \t and \n
-        $length = count($parts);
-        $final = '';
-        for ($i = 0, $num = 0; $i < $length && $num < $this->max; $i++) {
-            if (ctype_space($parts[$i])) continue;
-            $result = $this->single->validate($parts[$i], $config, $context);
-            if ($result !== false) {
-                $final .= $result . ' ';
-                $num++;
-            }
-        }
-        if ($final === '') return false;
-        return rtrim($final);
-    }
+	public function validate($string, $config, $context) {
+		$string = $this->parseCDATA($string);
+		if ($string === '') return false;
+		$parts = explode(' ', $string); // parseCDATA replaced \r, \t and \n
+		$length = count($parts);
+		$final = '';
+		for ($i = 0, $num = 0; $i < $length && $num < $this->max; $i++) {
+			if (ctype_space($parts[$i])) continue;
+			$result = $this->single->validate($parts[$i], $config, $context);
+			if ($result !== false) {
+				$final .= $result . ' ';
+				$num++;
+			}
+		}
+		if ($final === '') return false;
+		return rtrim($final);
+	}
 
 }
 

Braces +9 added lines, -3 removed lines

@@ -37,19 +37,25 @@
 
     public function validate($string, $config, $context) {
         $string = $this->parseCDATA($string);
-        if ($string === '') return false;
+        if ($string === '') {
+        	return false;
+        }
         $parts = explode(' ', $string); // parseCDATA replaced \r, \t and \n
         $length = count($parts);
         $final = '';
         for ($i = 0, $num = 0; $i < $length && $num < $this->max; $i++) {
-            if (ctype_space($parts[$i])) continue;
+            if (ctype_space($parts[$i])) {
+            	continue;
+            }
             $result = $this->single->validate($parts[$i], $config, $context);
             if ($result !== false) {
                 $final .= $result . ' ';
                 $num++;
             }
         }
-        if ($final === '') return false;
+        if ($final === '') {
+        	return false;
+        }
         return rtrim($final);
     }
 

Spacing +1 added lines, -1 removed lines

@@ -45,7 +45,7 @@
             if (ctype_space($parts[$i])) continue;
             $result = $this->single->validate($parts[$i], $config, $context);
             if ($result !== false) {
-                $final .= $result . ' ';
+                $final .= $result.' ';
                 $num++;
             }
         }