xpressengine / xe-core

classes/security/htmlpurifier/library/HTMLPurifier/URIDefinition.php

Indentation +93 added lines, -93 removed lines

@@ -3,99 +3,99 @@
 class HTMLPurifier_URIDefinition extends HTMLPurifier_Definition
 {
 
-    public $type = 'URI';
-    protected $filters = array();
-    protected $postFilters = array();
-    protected $registeredFilters = array();
-
-    /**
-     * HTMLPurifier_URI object of the base specified at %URI.Base
-     */
-    public $base;
-
-    /**
-     * String host to consider "home" base, derived off of $base
-     */
-    public $host;
-
-    /**
-     * Name of default scheme based on %URI.DefaultScheme and %URI.Base
-     */
-    public $defaultScheme;
-
-    public function __construct() {
-        $this->registerFilter(new HTMLPurifier_URIFilter_DisableExternal());
-        $this->registerFilter(new HTMLPurifier_URIFilter_DisableExternalResources());
-        $this->registerFilter(new HTMLPurifier_URIFilter_HostBlacklist());
-        $this->registerFilter(new HTMLPurifier_URIFilter_SafeIframe());
-        $this->registerFilter(new HTMLPurifier_URIFilter_MakeAbsolute());
-        $this->registerFilter(new HTMLPurifier_URIFilter_Munge());
-    }
-
-    public function registerFilter($filter) {
-        $this->registeredFilters[$filter->name] = $filter;
-    }
-
-    public function addFilter($filter, $config) {
-        $r = $filter->prepare($config);
-        if ($r === false) return; // null is ok, for backwards compat
-        if ($filter->post) {
-            $this->postFilters[$filter->name] = $filter;
-        } else {
-            $this->filters[$filter->name] = $filter;
-        }
-    }
-
-    protected function doSetup($config) {
-        $this->setupMemberVariables($config);
-        $this->setupFilters($config);
-    }
-
-    protected function setupFilters($config) {
-        foreach ($this->registeredFilters as $name => $filter) {
-            if ($filter->always_load) {
-                $this->addFilter($filter, $config);
-            } else {
-                $conf = $config->get('URI.' . $name);
-                if ($conf !== false && $conf !== null) {
-                    $this->addFilter($filter, $config);
-                }
-            }
-        }
-        unset($this->registeredFilters);
-    }
-
-    protected function setupMemberVariables($config) {
-        $this->host = $config->get('URI.Host');
-        $base_uri = $config->get('URI.Base');
-        if (!is_null($base_uri)) {
-            $parser = new HTMLPurifier_URIParser();
-            $this->base = $parser->parse($base_uri);
-            $this->defaultScheme = $this->base->scheme;
-            if (is_null($this->host)) $this->host = $this->base->host;
-        }
-        if (is_null($this->defaultScheme)) $this->defaultScheme = $config->get('URI.DefaultScheme');
-    }
-
-    public function getDefaultScheme($config, $context) {
-        return HTMLPurifier_URISchemeRegistry::instance()->getScheme($this->defaultScheme, $config, $context);
-    }
-
-    public function filter(&$uri, $config, $context) {
-        foreach ($this->filters as $name => $f) {
-            $result = $f->filter($uri, $config, $context);
-            if (!$result) return false;
-        }
-        return true;
-    }
-
-    public function postFilter(&$uri, $config, $context) {
-        foreach ($this->postFilters as $name => $f) {
-            $result = $f->filter($uri, $config, $context);
-            if (!$result) return false;
-        }
-        return true;
-    }
+	public $type = 'URI';
+	protected $filters = array();
+	protected $postFilters = array();
+	protected $registeredFilters = array();
+
+	/**
+	 * HTMLPurifier_URI object of the base specified at %URI.Base
+	 */
+	public $base;
+
+	/**
+	 * String host to consider "home" base, derived off of $base
+	 */
+	public $host;
+
+	/**
+	 * Name of default scheme based on %URI.DefaultScheme and %URI.Base
+	 */
+	public $defaultScheme;
+
+	public function __construct() {
+		$this->registerFilter(new HTMLPurifier_URIFilter_DisableExternal());
+		$this->registerFilter(new HTMLPurifier_URIFilter_DisableExternalResources());
+		$this->registerFilter(new HTMLPurifier_URIFilter_HostBlacklist());
+		$this->registerFilter(new HTMLPurifier_URIFilter_SafeIframe());
+		$this->registerFilter(new HTMLPurifier_URIFilter_MakeAbsolute());
+		$this->registerFilter(new HTMLPurifier_URIFilter_Munge());
+	}
+
+	public function registerFilter($filter) {
+		$this->registeredFilters[$filter->name] = $filter;
+	}
+
+	public function addFilter($filter, $config) {
+		$r = $filter->prepare($config);
+		if ($r === false) return; // null is ok, for backwards compat
+		if ($filter->post) {
+			$this->postFilters[$filter->name] = $filter;
+		} else {
+			$this->filters[$filter->name] = $filter;
+		}
+	}
+
+	protected function doSetup($config) {
+		$this->setupMemberVariables($config);
+		$this->setupFilters($config);
+	}
+
+	protected function setupFilters($config) {
+		foreach ($this->registeredFilters as $name => $filter) {
+			if ($filter->always_load) {
+				$this->addFilter($filter, $config);
+			} else {
+				$conf = $config->get('URI.' . $name);
+				if ($conf !== false && $conf !== null) {
+					$this->addFilter($filter, $config);
+				}
+			}
+		}
+		unset($this->registeredFilters);
+	}
+
+	protected function setupMemberVariables($config) {
+		$this->host = $config->get('URI.Host');
+		$base_uri = $config->get('URI.Base');
+		if (!is_null($base_uri)) {
+			$parser = new HTMLPurifier_URIParser();
+			$this->base = $parser->parse($base_uri);
+			$this->defaultScheme = $this->base->scheme;
+			if (is_null($this->host)) $this->host = $this->base->host;
+		}
+		if (is_null($this->defaultScheme)) $this->defaultScheme = $config->get('URI.DefaultScheme');
+	}
+
+	public function getDefaultScheme($config, $context) {
+		return HTMLPurifier_URISchemeRegistry::instance()->getScheme($this->defaultScheme, $config, $context);
+	}
+
+	public function filter(&$uri, $config, $context) {
+		foreach ($this->filters as $name => $f) {
+			$result = $f->filter($uri, $config, $context);
+			if (!$result) return false;
+		}
+		return true;
+	}
+
+	public function postFilter(&$uri, $config, $context) {
+		foreach ($this->postFilters as $name => $f) {
+			$result = $f->filter($uri, $config, $context);
+			if (!$result) return false;
+		}
+		return true;
+	}
 
 }
 

Braces +16 added lines, -5 removed lines

@@ -38,7 +38,10 @@ 
 
     public function addFilter($filter, $config) {
         $r = $filter->prepare($config);
-        if ($r === false) return; // null is ok, for backwards compat
+        if ($r === false) {
+        	return;
+        }
+        // null is ok, for backwards compat
         if ($filter->post) {
             $this->postFilters[$filter->name] = $filter;
         } else {
@@ -72,9 +75,13 @@ 
             $parser = new HTMLPurifier_URIParser();
             $this->base = $parser->parse($base_uri);
             $this->defaultScheme = $this->base->scheme;
-            if (is_null($this->host)) $this->host = $this->base->host;
+            if (is_null($this->host)) {
+            	$this->host = $this->base->host;
+            }
+        }
+        if (is_null($this->defaultScheme)) {
+        	$this->defaultScheme = $config->get('URI.DefaultScheme');
         }
-        if (is_null($this->defaultScheme)) $this->defaultScheme = $config->get('URI.DefaultScheme');
     }
 
     public function getDefaultScheme($config, $context) {
@@ -84,7 +91,9 @@ 
     public function filter(&$uri, $config, $context) {
         foreach ($this->filters as $name => $f) {
             $result = $f->filter($uri, $config, $context);
-            if (!$result) return false;
+            if (!$result) {
+            	return false;
+            }
         }
         return true;
     }
@@ -92,7 +101,9 @@ 
     public function postFilter(&$uri, $config, $context) {
         foreach ($this->postFilters as $name => $f) {
             $result = $f->filter($uri, $config, $context);
-            if (!$result) return false;
+            if (!$result) {
+            	return false;
+            }
         }
         return true;
     }

classes/security/htmlpurifier/library/HTMLPurifier/URIFilter.php

Indentation +29 added lines, -29 removed lines

@@ -28,39 +28,39 @@
 abstract class HTMLPurifier_URIFilter
 {
 
-    /**
-     * Unique identifier of filter
-     */
-    public $name;
+	/**
+	 * Unique identifier of filter
+	 */
+	public $name;
 
-    /**
-     * True if this filter should be run after scheme validation.
-     */
-    public $post = false;
+	/**
+	 * True if this filter should be run after scheme validation.
+	 */
+	public $post = false;
 
-    /**
-     * True if this filter should always be loaded (this permits
-     * a filter to be named Foo without the corresponding %URI.Foo
-     * directive existing.)
-     */
-    public $always_load = false;
+	/**
+	 * True if this filter should always be loaded (this permits
+	 * a filter to be named Foo without the corresponding %URI.Foo
+	 * directive existing.)
+	 */
+	public $always_load = false;
 
-    /**
-     * Performs initialization for the filter.  If the filter returns
-     * false, this means that it shouldn't be considered active.
-     */
-    public function prepare($config) {return true;}
+	/**
+	 * Performs initialization for the filter.  If the filter returns
+	 * false, this means that it shouldn't be considered active.
+	 */
+	public function prepare($config) {return true;}
 
-    /**
-     * Filter a URI object
-     * @param $uri Reference to URI object variable
-     * @param $config Instance of HTMLPurifier_Config
-     * @param $context Instance of HTMLPurifier_Context
-     * @return bool Whether or not to continue processing: false indicates
-     *         URL is no good, true indicates continue processing. Note that
-     *         all changes are committed directly on the URI object
-     */
-    abstract public function filter(&$uri, $config, $context);
+	/**
+	 * Filter a URI object
+	 * @param $uri Reference to URI object variable
+	 * @param $config Instance of HTMLPurifier_Config
+	 * @param $context Instance of HTMLPurifier_Context
+	 * @return bool Whether or not to continue processing: false indicates
+	 *         URL is no good, true indicates continue processing. Note that
+	 *         all changes are committed directly on the URI object
+	 */
+	abstract public function filter(&$uri, $config, $context);
 
 }
 

Spacing +1 added lines, -1 removed lines

@@ -49,7 +49,7 @@
      * Performs initialization for the filter.  If the filter returns
      * false, this means that it shouldn't be considered active.
      */
-    public function prepare($config) {return true;}
+    public function prepare($config) {return true; }
 
     /**
      * Filter a URI object

classes/security/htmlpurifier/library/HTMLPurifier/URIFilter/DisableExternal.php

Indentation +16 added lines, -16 removed lines

@@ -2,22 +2,22 @@
 
 class HTMLPurifier_URIFilter_DisableExternal extends HTMLPurifier_URIFilter
 {
-    public $name = 'DisableExternal';
-    protected $ourHostParts = false;
-    public function prepare($config) {
-        $our_host = $config->getDefinition('URI')->host;
-        if ($our_host !== null) $this->ourHostParts = array_reverse(explode('.', $our_host));
-    }
-    public function filter(&$uri, $config, $context) {
-        if (is_null($uri->host)) return true;
-        if ($this->ourHostParts === false) return false;
-        $host_parts = array_reverse(explode('.', $uri->host));
-        foreach ($this->ourHostParts as $i => $x) {
-            if (!isset($host_parts[$i])) return false;
-            if ($host_parts[$i] != $this->ourHostParts[$i]) return false;
-        }
-        return true;
-    }
+	public $name = 'DisableExternal';
+	protected $ourHostParts = false;
+	public function prepare($config) {
+		$our_host = $config->getDefinition('URI')->host;
+		if ($our_host !== null) $this->ourHostParts = array_reverse(explode('.', $our_host));
+	}
+	public function filter(&$uri, $config, $context) {
+		if (is_null($uri->host)) return true;
+		if ($this->ourHostParts === false) return false;
+		$host_parts = array_reverse(explode('.', $uri->host));
+		foreach ($this->ourHostParts as $i => $x) {
+			if (!isset($host_parts[$i])) return false;
+			if ($host_parts[$i] != $this->ourHostParts[$i]) return false;
+		}
+		return true;
+	}
 }
 
 // vim: et sw=4 sts=4

Braces +15 added lines, -5 removed lines

@@ -6,15 +6,25 @@
     protected $ourHostParts = false;
     public function prepare($config) {
         $our_host = $config->getDefinition('URI')->host;
-        if ($our_host !== null) $this->ourHostParts = array_reverse(explode('.', $our_host));
+        if ($our_host !== null) {
+        	$this->ourHostParts = array_reverse(explode('.', $our_host));
+        }
     }
     public function filter(&$uri, $config, $context) {
-        if (is_null($uri->host)) return true;
-        if ($this->ourHostParts === false) return false;
+        if (is_null($uri->host)) {
+        	return true;
+        }
+        if ($this->ourHostParts === false) {
+        	return false;
+        }
         $host_parts = array_reverse(explode('.', $uri->host));
         foreach ($this->ourHostParts as $i => $x) {
-            if (!isset($host_parts[$i])) return false;
-            if ($host_parts[$i] != $this->ourHostParts[$i]) return false;
+            if (!isset($host_parts[$i])) {
+            	return false;
+            }
+            if ($host_parts[$i] != $this->ourHostParts[$i]) {
+            	return false;
+            }
         }
         return true;
     }

classes/security/htmlpurifier/library/HTMLPurifier/URIFilter/DisableExternalResources.php

Indentation +5 added lines, -5 removed lines

@@ -2,11 +2,11 @@
 
 class HTMLPurifier_URIFilter_DisableExternalResources extends HTMLPurifier_URIFilter_DisableExternal
 {
-    public $name = 'DisableExternalResources';
-    public function filter(&$uri, $config, $context) {
-        if (!$context->get('EmbeddedURI', true)) return true;
-        return parent::filter($uri, $config, $context);
-    }
+	public $name = 'DisableExternalResources';
+	public function filter(&$uri, $config, $context) {
+		if (!$context->get('EmbeddedURI', true)) return true;
+		return parent::filter($uri, $config, $context);
+	}
 }
 
 // vim: et sw=4 sts=4

Braces +3 added lines, -1 removed lines

@@ -4,7 +4,9 @@
 {
     public $name = 'DisableExternalResources';
     public function filter(&$uri, $config, $context) {
-        if (!$context->get('EmbeddedURI', true)) return true;
+        if (!$context->get('EmbeddedURI', true)) {
+        	return true;
+        }
         return parent::filter($uri, $config, $context);
     }
 }

classes/security/htmlpurifier/library/HTMLPurifier/URIFilter/DisableResources.php

Indentation +4 added lines, -4 removed lines

@@ -2,10 +2,10 @@
 
 class HTMLPurifier_URIFilter_DisableResources extends HTMLPurifier_URIFilter
 {
-    public $name = 'DisableResources';
-    public function filter(&$uri, $config, $context) {
-        return !$context->get('EmbeddedURI', true);
-    }
+	public $name = 'DisableResources';
+	public function filter(&$uri, $config, $context) {
+		return !$context->get('EmbeddedURI', true);
+	}
 }
 
 // vim: et sw=4 sts=4

classes/security/htmlpurifier/library/HTMLPurifier/URIFilter/HostBlacklist.php

Indentation +14 added lines, -14 removed lines

@@ -6,20 +6,20 @@
 // points are involved), but I'm not 100% sure
 class HTMLPurifier_URIFilter_HostBlacklist extends HTMLPurifier_URIFilter
 {
-    public $name = 'HostBlacklist';
-    protected $blacklist = array();
-    public function prepare($config) {
-        $this->blacklist = $config->get('URI.HostBlacklist');
-        return true;
-    }
-    public function filter(&$uri, $config, $context) {
-        foreach($this->blacklist as $blacklisted_host_fragment) {
-            if (strpos($uri->host, $blacklisted_host_fragment) !== false) {
-                return false;
-            }
-        }
-        return true;
-    }
+	public $name = 'HostBlacklist';
+	protected $blacklist = array();
+	public function prepare($config) {
+		$this->blacklist = $config->get('URI.HostBlacklist');
+		return true;
+	}
+	public function filter(&$uri, $config, $context) {
+		foreach($this->blacklist as $blacklisted_host_fragment) {
+			if (strpos($uri->host, $blacklisted_host_fragment) !== false) {
+				return false;
+			}
+		}
+		return true;
+	}
 }
 
 // vim: et sw=4 sts=4

Spacing +1 added lines, -1 removed lines

@@ -13,7 +13,7 @@
         return true;
     }
     public function filter(&$uri, $config, $context) {
-        foreach($this->blacklist as $blacklisted_host_fragment) {
+        foreach ($this->blacklist as $blacklisted_host_fragment) {
             if (strpos($uri->host, $blacklisted_host_fragment) !== false) {
                 return false;
             }

classes/security/htmlpurifier/library/HTMLPurifier/URIFilter/MakeAbsolute.php

Indentation +104 added lines, -104 removed lines

@@ -4,111 +4,111 @@
 
 class HTMLPurifier_URIFilter_MakeAbsolute extends HTMLPurifier_URIFilter
 {
-    public $name = 'MakeAbsolute';
-    protected $base;
-    protected $basePathStack = array();
-    public function prepare($config) {
-        $def = $config->getDefinition('URI');
-        $this->base = $def->base;
-        if (is_null($this->base)) {
-            trigger_error('URI.MakeAbsolute is being ignored due to lack of value for URI.Base configuration', E_USER_WARNING);
-            return false;
-        }
-        $this->base->fragment = null; // fragment is invalid for base URI
-        $stack = explode('/', $this->base->path);
-        array_pop($stack); // discard last segment
-        $stack = $this->_collapseStack($stack); // do pre-parsing
-        $this->basePathStack = $stack;
-        return true;
-    }
-    public function filter(&$uri, $config, $context) {
-        if (is_null($this->base)) return true; // abort early
-        if (
-            $uri->path === '' && is_null($uri->scheme) &&
-            is_null($uri->host) && is_null($uri->query) && is_null($uri->fragment)
-        ) {
-            // reference to current document
-            $uri = clone $this->base;
-            return true;
-        }
-        if (!is_null($uri->scheme)) {
-            // absolute URI already: don't change
-            if (!is_null($uri->host)) return true;
-            $scheme_obj = $uri->getSchemeObj($config, $context);
-            if (!$scheme_obj) {
-                // scheme not recognized
-                return false;
-            }
-            if (!$scheme_obj->hierarchical) {
-                // non-hierarchal URI with explicit scheme, don't change
-                return true;
-            }
-            // special case: had a scheme but always is hierarchical and had no authority
-        }
-        if (!is_null($uri->host)) {
-            // network path, don't bother
-            return true;
-        }
-        if ($uri->path === '') {
-            $uri->path = $this->base->path;
-        } elseif ($uri->path[0] !== '/') {
-            // relative path, needs more complicated processing
-            $stack = explode('/', $uri->path);
-            $new_stack = array_merge($this->basePathStack, $stack);
-            if ($new_stack[0] !== '' && !is_null($this->base->host)) {
-                array_unshift($new_stack, '');
-            }
-            $new_stack = $this->_collapseStack($new_stack);
-            $uri->path = implode('/', $new_stack);
-        } else {
-            // absolute path, but still we should collapse
-            $uri->path = implode('/', $this->_collapseStack(explode('/', $uri->path)));
-        }
-        // re-combine
-        $uri->scheme = $this->base->scheme;
-        if (is_null($uri->userinfo)) $uri->userinfo = $this->base->userinfo;
-        if (is_null($uri->host))     $uri->host     = $this->base->host;
-        if (is_null($uri->port))     $uri->port     = $this->base->port;
-        return true;
-    }
+	public $name = 'MakeAbsolute';
+	protected $base;
+	protected $basePathStack = array();
+	public function prepare($config) {
+		$def = $config->getDefinition('URI');
+		$this->base = $def->base;
+		if (is_null($this->base)) {
+			trigger_error('URI.MakeAbsolute is being ignored due to lack of value for URI.Base configuration', E_USER_WARNING);
+			return false;
+		}
+		$this->base->fragment = null; // fragment is invalid for base URI
+		$stack = explode('/', $this->base->path);
+		array_pop($stack); // discard last segment
+		$stack = $this->_collapseStack($stack); // do pre-parsing
+		$this->basePathStack = $stack;
+		return true;
+	}
+	public function filter(&$uri, $config, $context) {
+		if (is_null($this->base)) return true; // abort early
+		if (
+			$uri->path === '' && is_null($uri->scheme) &&
+			is_null($uri->host) && is_null($uri->query) && is_null($uri->fragment)
+		) {
+			// reference to current document
+			$uri = clone $this->base;
+			return true;
+		}
+		if (!is_null($uri->scheme)) {
+			// absolute URI already: don't change
+			if (!is_null($uri->host)) return true;
+			$scheme_obj = $uri->getSchemeObj($config, $context);
+			if (!$scheme_obj) {
+				// scheme not recognized
+				return false;
+			}
+			if (!$scheme_obj->hierarchical) {
+				// non-hierarchal URI with explicit scheme, don't change
+				return true;
+			}
+			// special case: had a scheme but always is hierarchical and had no authority
+		}
+		if (!is_null($uri->host)) {
+			// network path, don't bother
+			return true;
+		}
+		if ($uri->path === '') {
+			$uri->path = $this->base->path;
+		} elseif ($uri->path[0] !== '/') {
+			// relative path, needs more complicated processing
+			$stack = explode('/', $uri->path);
+			$new_stack = array_merge($this->basePathStack, $stack);
+			if ($new_stack[0] !== '' && !is_null($this->base->host)) {
+				array_unshift($new_stack, '');
+			}
+			$new_stack = $this->_collapseStack($new_stack);
+			$uri->path = implode('/', $new_stack);
+		} else {
+			// absolute path, but still we should collapse
+			$uri->path = implode('/', $this->_collapseStack(explode('/', $uri->path)));
+		}
+		// re-combine
+		$uri->scheme = $this->base->scheme;
+		if (is_null($uri->userinfo)) $uri->userinfo = $this->base->userinfo;
+		if (is_null($uri->host))     $uri->host     = $this->base->host;
+		if (is_null($uri->port))     $uri->port     = $this->base->port;
+		return true;
+	}
 
-    /**
-     * Resolve dots and double-dots in a path stack
-     */
-    private function _collapseStack($stack) {
-        $result = array();
-        $is_folder = false;
-        for ($i = 0; isset($stack[$i]); $i++) {
-            $is_folder = false;
-            // absorb an internally duplicated slash
-            if ($stack[$i] == '' && $i && isset($stack[$i+1])) continue;
-            if ($stack[$i] == '..') {
-                if (!empty($result)) {
-                    $segment = array_pop($result);
-                    if ($segment === '' && empty($result)) {
-                        // error case: attempted to back out too far:
-                        // restore the leading slash
-                        $result[] = '';
-                    } elseif ($segment === '..') {
-                        $result[] = '..'; // cannot remove .. with ..
-                    }
-                } else {
-                    // relative path, preserve the double-dots
-                    $result[] = '..';
-                }
-                $is_folder = true;
-                continue;
-            }
-            if ($stack[$i] == '.') {
-                // silently absorb
-                $is_folder = true;
-                continue;
-            }
-            $result[] = $stack[$i];
-        }
-        if ($is_folder) $result[] = '';
-        return $result;
-    }
+	/**
+	 * Resolve dots and double-dots in a path stack
+	 */
+	private function _collapseStack($stack) {
+		$result = array();
+		$is_folder = false;
+		for ($i = 0; isset($stack[$i]); $i++) {
+			$is_folder = false;
+			// absorb an internally duplicated slash
+			if ($stack[$i] == '' && $i && isset($stack[$i+1])) continue;
+			if ($stack[$i] == '..') {
+				if (!empty($result)) {
+					$segment = array_pop($result);
+					if ($segment === '' && empty($result)) {
+						// error case: attempted to back out too far:
+						// restore the leading slash
+						$result[] = '';
+					} elseif ($segment === '..') {
+						$result[] = '..'; // cannot remove .. with ..
+					}
+				} else {
+					// relative path, preserve the double-dots
+					$result[] = '..';
+				}
+				$is_folder = true;
+				continue;
+			}
+			if ($stack[$i] == '.') {
+				// silently absorb
+				$is_folder = true;
+				continue;
+			}
+			$result[] = $stack[$i];
+		}
+		if ($is_folder) $result[] = '';
+		return $result;
+	}
 }
 
 // vim: et sw=4 sts=4

Spacing +1 added lines, -1 removed lines

@@ -81,7 +81,7 @@
         for ($i = 0; isset($stack[$i]); $i++) {
             $is_folder = false;
             // absorb an internally duplicated slash
-            if ($stack[$i] == '' && $i && isset($stack[$i+1])) continue;
+            if ($stack[$i] == '' && $i && isset($stack[$i + 1])) continue;
             if ($stack[$i] == '..') {
                 if (!empty($result)) {
                     $segment = array_pop($result);

Braces +22 added lines, -7 removed lines

@@ -22,7 +22,10 @@ 
         return true;
     }
     public function filter(&$uri, $config, $context) {
-        if (is_null($this->base)) return true; // abort early
+        if (is_null($this->base)) {
+        	return true;
+        }
+        // abort early
         if (
             $uri->path === '' && is_null($uri->scheme) &&
             is_null($uri->host) && is_null($uri->query) && is_null($uri->fragment)
@@ -33,7 +36,9 @@ 
         }
         if (!is_null($uri->scheme)) {
             // absolute URI already: don't change
-            if (!is_null($uri->host)) return true;
+            if (!is_null($uri->host)) {
+            	return true;
+            }
             $scheme_obj = $uri->getSchemeObj($config, $context);
             if (!$scheme_obj) {
                 // scheme not recognized
@@ -66,9 +71,15 @@ 
         }
         // re-combine
         $uri->scheme = $this->base->scheme;
-        if (is_null($uri->userinfo)) $uri->userinfo = $this->base->userinfo;
-        if (is_null($uri->host))     $uri->host     = $this->base->host;
-        if (is_null($uri->port))     $uri->port     = $this->base->port;
+        if (is_null($uri->userinfo)) {
+        	$uri->userinfo = $this->base->userinfo;
+        }
+        if (is_null($uri->host)) {
+        	$uri->host     = $this->base->host;
+        }
+        if (is_null($uri->port)) {
+        	$uri->port     = $this->base->port;
+        }
         return true;
     }
 
@@ -81,7 +92,9 @@ 
         for ($i = 0; isset($stack[$i]); $i++) {
             $is_folder = false;
             // absorb an internally duplicated slash
-            if ($stack[$i] == '' && $i && isset($stack[$i+1])) continue;
+            if ($stack[$i] == '' && $i && isset($stack[$i+1])) {
+            	continue;
+            }
             if ($stack[$i] == '..') {
                 if (!empty($result)) {
                     $segment = array_pop($result);
@@ -106,7 +119,9 @@ 
             }
             $result[] = $stack[$i];
         }
-        if ($is_folder) $result[] = '';
+        if ($is_folder) {
+        	$result[] = '';
+        }
         return $result;
     }
 }

classes/security/htmlpurifier/library/HTMLPurifier/URIFilter/Munge.php

Indentation +45 added lines, -45 removed lines

@@ -2,51 +2,51 @@
 
 class HTMLPurifier_URIFilter_Munge extends HTMLPurifier_URIFilter
 {
-    public $name = 'Munge';
-    public $post = true;
-    private $target, $parser, $doEmbed, $secretKey;
-
-    protected $replace = array();
-
-    public function prepare($config) {
-        $this->target    = $config->get('URI.' . $this->name);
-        $this->parser    = new HTMLPurifier_URIParser();
-        $this->doEmbed   = $config->get('URI.MungeResources');
-        $this->secretKey = $config->get('URI.MungeSecretKey');
-        return true;
-    }
-    public function filter(&$uri, $config, $context) {
-        if ($context->get('EmbeddedURI', true) && !$this->doEmbed) return true;
-
-        $scheme_obj = $uri->getSchemeObj($config, $context);
-        if (!$scheme_obj) return true; // ignore unknown schemes, maybe another postfilter did it
-        if (!$scheme_obj->browsable) return true; // ignore non-browseable schemes, since we can't munge those in a reasonable way
-        if ($uri->isBenign($config, $context)) return true; // don't redirect if a benign URL
-
-        $this->makeReplace($uri, $config, $context);
-        $this->replace = array_map('rawurlencode', $this->replace);
-
-        $new_uri = strtr($this->target, $this->replace);
-        $new_uri = $this->parser->parse($new_uri);
-        // don't redirect if the target host is the same as the
-        // starting host
-        if ($uri->host === $new_uri->host) return true;
-        $uri = $new_uri; // overwrite
-        return true;
-    }
-
-    protected function makeReplace($uri, $config, $context) {
-        $string = $uri->toString();
-        // always available
-        $this->replace['%s'] = $string;
-        $this->replace['%r'] = $context->get('EmbeddedURI', true);
-        $token = $context->get('CurrentToken', true);
-        $this->replace['%n'] = $token ? $token->name : null;
-        $this->replace['%m'] = $context->get('CurrentAttr', true);
-        $this->replace['%p'] = $context->get('CurrentCSSProperty', true);
-        // not always available
-        if ($this->secretKey) $this->replace['%t'] = sha1($this->secretKey . ':' . $string);
-    }
+	public $name = 'Munge';
+	public $post = true;
+	private $target, $parser, $doEmbed, $secretKey;
+
+	protected $replace = array();
+
+	public function prepare($config) {
+		$this->target    = $config->get('URI.' . $this->name);
+		$this->parser    = new HTMLPurifier_URIParser();
+		$this->doEmbed   = $config->get('URI.MungeResources');
+		$this->secretKey = $config->get('URI.MungeSecretKey');
+		return true;
+	}
+	public function filter(&$uri, $config, $context) {
+		if ($context->get('EmbeddedURI', true) && !$this->doEmbed) return true;
+
+		$scheme_obj = $uri->getSchemeObj($config, $context);
+		if (!$scheme_obj) return true; // ignore unknown schemes, maybe another postfilter did it
+		if (!$scheme_obj->browsable) return true; // ignore non-browseable schemes, since we can't munge those in a reasonable way
+		if ($uri->isBenign($config, $context)) return true; // don't redirect if a benign URL
+
+		$this->makeReplace($uri, $config, $context);
+		$this->replace = array_map('rawurlencode', $this->replace);
+
+		$new_uri = strtr($this->target, $this->replace);
+		$new_uri = $this->parser->parse($new_uri);
+		// don't redirect if the target host is the same as the
+		// starting host
+		if ($uri->host === $new_uri->host) return true;
+		$uri = $new_uri; // overwrite
+		return true;
+	}
+
+	protected function makeReplace($uri, $config, $context) {
+		$string = $uri->toString();
+		// always available
+		$this->replace['%s'] = $string;
+		$this->replace['%r'] = $context->get('EmbeddedURI', true);
+		$token = $context->get('CurrentToken', true);
+		$this->replace['%n'] = $token ? $token->name : null;
+		$this->replace['%m'] = $context->get('CurrentAttr', true);
+		$this->replace['%p'] = $context->get('CurrentCSSProperty', true);
+		// not always available
+		if ($this->secretKey) $this->replace['%t'] = sha1($this->secretKey . ':' . $string);
+	}
 
 }
 

Braces +21 added lines, -6 removed lines

@@ -16,12 +16,23 @@ 
         return true;
     }
     public function filter(&$uri, $config, $context) {
-        if ($context->get('EmbeddedURI', true) && !$this->doEmbed) return true;
+        if ($context->get('EmbeddedURI', true) && !$this->doEmbed) {
+        	return true;
+        }
 
         $scheme_obj = $uri->getSchemeObj($config, $context);
-        if (!$scheme_obj) return true; // ignore unknown schemes, maybe another postfilter did it
-        if (!$scheme_obj->browsable) return true; // ignore non-browseable schemes, since we can't munge those in a reasonable way
-        if ($uri->isBenign($config, $context)) return true; // don't redirect if a benign URL
+        if (!$scheme_obj) {
+        	return true;
+        }
+        // ignore unknown schemes, maybe another postfilter did it
+        if (!$scheme_obj->browsable) {
+        	return true;
+        }
+        // ignore non-browseable schemes, since we can't munge those in a reasonable way
+        if ($uri->isBenign($config, $context)) {
+        	return true;
+        }
+        // don't redirect if a benign URL
 
         $this->makeReplace($uri, $config, $context);
         $this->replace = array_map('rawurlencode', $this->replace);
@@ -30,7 +41,9 @@ 
         $new_uri = $this->parser->parse($new_uri);
         // don't redirect if the target host is the same as the
         // starting host
-        if ($uri->host === $new_uri->host) return true;
+        if ($uri->host === $new_uri->host) {
+        	return true;
+        }
         $uri = $new_uri; // overwrite
         return true;
     }
@@ -45,7 +58,9 @@ 
         $this->replace['%m'] = $context->get('CurrentAttr', true);
         $this->replace['%p'] = $context->get('CurrentCSSProperty', true);
         // not always available
-        if ($this->secretKey) $this->replace['%t'] = sha1($this->secretKey . ':' . $string);
+        if ($this->secretKey) {
+        	$this->replace['%t'] = sha1($this->secretKey . ':' . $string);
+        }
     }
 
 }

classes/security/htmlpurifier/library/HTMLPurifier/URIFilter/SafeIframe.php

Indentation +22 added lines, -22 removed lines

@@ -8,28 +8,28 @@
  */
 class HTMLPurifier_URIFilter_SafeIframe extends HTMLPurifier_URIFilter
 {
-    public $name = 'SafeIframe';
-    public $always_load = true;
-    protected $regexp = NULL;
-    // XXX: The not so good bit about how this is all setup now is we
-    // can't check HTML.SafeIframe in the 'prepare' step: we have to
-    // defer till the actual filtering.
-    public function prepare($config) {
-        $this->regexp = $config->get('URI.SafeIframeRegexp');
-        return true;
-    }
-    public function filter(&$uri, $config, $context) {
-        // check if filter not applicable
-        if (!$config->get('HTML.SafeIframe')) return true;
-        // check if the filter should actually trigger
-        if (!$context->get('EmbeddedURI', true)) return true;
-        $token = $context->get('CurrentToken', true);
-        if (!($token && $token->name == 'iframe')) return true;
-        // check if we actually have some whitelists enabled
-        if ($this->regexp === null) return false;
-        // actually check the whitelists
-        return preg_match($this->regexp, $uri->toString());
-    }
+	public $name = 'SafeIframe';
+	public $always_load = true;
+	protected $regexp = NULL;
+	// XXX: The not so good bit about how this is all setup now is we
+	// can't check HTML.SafeIframe in the 'prepare' step: we have to
+	// defer till the actual filtering.
+	public function prepare($config) {
+		$this->regexp = $config->get('URI.SafeIframeRegexp');
+		return true;
+	}
+	public function filter(&$uri, $config, $context) {
+		// check if filter not applicable
+		if (!$config->get('HTML.SafeIframe')) return true;
+		// check if the filter should actually trigger
+		if (!$context->get('EmbeddedURI', true)) return true;
+		$token = $context->get('CurrentToken', true);
+		if (!($token && $token->name == 'iframe')) return true;
+		// check if we actually have some whitelists enabled
+		if ($this->regexp === null) return false;
+		// actually check the whitelists
+		return preg_match($this->regexp, $uri->toString());
+	}
 }
 
 // vim: et sw=4 sts=4

Braces +12 added lines, -4 removed lines

@@ -20,13 +20,21 @@
     }
     public function filter(&$uri, $config, $context) {
         // check if filter not applicable
-        if (!$config->get('HTML.SafeIframe')) return true;
+        if (!$config->get('HTML.SafeIframe')) {
+        	return true;
+        }
         // check if the filter should actually trigger
-        if (!$context->get('EmbeddedURI', true)) return true;
+        if (!$context->get('EmbeddedURI', true)) {
+        	return true;
+        }
         $token = $context->get('CurrentToken', true);
-        if (!($token && $token->name == 'iframe')) return true;
+        if (!($token && $token->name == 'iframe')) {
+        	return true;
+        }
         // check if we actually have some whitelists enabled
-        if ($this->regexp === null) return false;
+        if ($this->regexp === null) {
+        	return false;
+        }
         // actually check the whitelists
         return preg_match($this->regexp, $uri->toString());
     }