fernando/luos
1
0
Fork 0
Code Releases Activity

Merge branch 'master' of bitbucket.org:colosa/processmaker into CONSOLIDATED

Browse Source
This commit is contained in:
Brayan Pereyra
2015-03-23 14:45:52 -04:00
parent 60184faa5d 4256226ad4
commit a446bb6eac
543 changed files with 41770 additions and 1325 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
framework/src/Maveriks/WebApplication.php
View File

@@ -337,7 +337,6 @@ class WebApplication
$this->rest->addAPIClass($namespace);
}
}
// adding aliases for Restler
if (array_key_exists('alias', $config)) {
foreach ($config['alias'] as $alias => $aliasData) {

11
gulliver/bin/tasks/pakeGulliver.php
View File

@@ -920,6 +920,8 @@ function run_create_poedit_file($task, $args) {
G::LoadSystem('xmlform');
G::LoadSystem('xmlformExtension');
G::LoadSystem('form');
G::LoadSystem('inputfilter');
$filter = new InputFilter();
$langIdOut = $langId; //the output language, later we'll include the country too.
$exceptionFields = array (
@@ -993,18 +995,25 @@ function run_create_poedit_file($task, $args) {
}
else {
$xmlfile = $filter->xssFilterHard($xmlfile);
$exceptionFields = $filter->xssFilterHard($exceptionFields);
if( is_object($node) && ! in_array($node->type, $exceptionFields) ) {
if( isset($node->value) && strpos($node->value, 'G::LoadTranslation') !== false ) {
$exceptIndex ++;
//print ($node->value);
} else {
$node->name = $filter->xssFilterHard($node->name);
$node->type = $filter->xssFilterHard($node->type);
printf("Error: xmlform %s has no english definition for %s [%s]\n", pakeColor::colorize($xmlfile, 'ERROR'), pakeColor::colorize($node->name, 'INFO'), pakeColor::colorize($node->type, 'INFO'));
$xmlError ++;
}
} else {
$exceptIndex ++;
if( $verboseFlag )
if( $verboseFlag ){
$node->name = $filter->xssFilterHard($node->name);
$node->type = $filter->xssFilterHard($node->type);
printf("%s %s in %s\n", $node->type, pakeColor::colorize($node->name, 'INFO'), pakeColor::colorize($xmlfile, 'INFO'));
}
}
}
}

2
gulliver/js/codemirror/addon/hint/php-hint.js vendored
View File

@@ -264,4 +264,4 @@
}
return found;
}
})();
})();

2
gulliver/js/tinymce/jscripts/tiny_mce/plugins/inlinepopups/skins/clearlooks2/window.css vendored
View File

@@ -4,7 +4,7 @@
.clearlooks2, .clearlooks2 div, .clearlooks2 span, .clearlooks2 a {vertical-align:baseline; text-align:left; position:absolute; border:0; padding:0; margin:0; background:transparent; font-family:Arial,Verdana; font-size:11px; color:#000; text-decoration:none; font-weight:normal; width:auto; height:auto; overflow:hidden; display:block}
/* General */
.clearlooks2 {position:absolute; direction:ltr}
.clearlooks2 {position:fixed !important; direction:ltr; top:20px !important;height:552px !important;}
.clearlooks2 .mceWrapper {position:static}
.mceEventBlocker {position:fixed; left:0; top:0; background:url(img/horizontal.gif) no-repeat 0 -75px; width:100%; height:100%}
.clearlooks2 .mcePlaceHolder {border:1px solid #000; background:#888; top:0; left:0; opacity:0.5; -ms-filter:'alpha(opacity=50)'; filter:alpha(opacity=50)}

77
gulliver/js/tinymce/jscripts/tiny_mce/plugins/pmSimpleUploader/uploader.php vendored
View File

@@ -1,12 +1,49 @@
<html>
<head>
<title>Upload an Output Document</title>
<script type="text/javascript" src="../../tiny_mce_popup.js" ></script>
<script type="text/javascript" src="editor_plugin_src.js" ></script>
<base target="_self" />
<script type="text/javascript">
function validateForm()
{
var flagv = true;
var msgv = "";
var fileName = document.getElementById("File1").value;
if (fileName == "") {
flagv = false;
msgv = msgv + ((msgv != "")? "\n" : "") + "No file chosen";
}
if (fileName != "" && !/\.html?$/i.test(fileName)) {
flagv = false;
msgv = msgv + ((msgv != "")? "\n" : "") + "Extension of file invalid, only allowed extensions html and htm";
}
if (flagv) {
document.getElementById("containerDataForm").style.display = "none";
document.getElementById("containerProgressBar").style.display = "inline";
} else {
alert(msgv);
}
return flagv;
}
</script>
</head>
<body>
<?php
$Action = isset($_GET["q"]) ? $_GET["q"] : "none";
G::LoadSystem('inputfilter');
$filter = new InputFilter();
if(isset($_GET["q"])) {
$_GET["q"] = $filter->xssFilterHard($_GET["q"]);
$Action = $_GET["q"];
} else {
$Action = "none";
}
//$Action = isset($_GET["q"]) ? $_GET["q"] : "none";
if($Action =="none"){
displayUploadForm();
}else if($Action=="upload"){
@@ -21,22 +58,41 @@
// displays the upload form
function displayUploadForm()
{
echo '<form action="uploader.php?'.$_SERVER["QUERY_STRING"].'&q=upload" method="post" enctype="multipart/form-data" onsubmit="">'
.'File Name: <br/>'
.'<input type="file" size="40" name="upload_file" ID="File1"/><br/>'
.'<input type="submit" name="Upload File" value="Upload File" style="width: 150px;" onclick="document.getElementById(\'progress_div\').style.visibility=\'visible\';"/>'
.' <div id="progress_div" style="visibility: hidden;"><img src="progress.gif" alt="wait..." style="padding-top: 5px;"></div>'
.'</form>';
G::LoadSystem('inputfilter');
$filter = new InputFilter();
if(isset($_SERVER["QUERY_STRING"])) {
$_SERVER["QUERY_STRING"] = $filter->xssFilterHard($_SERVER["QUERY_STRING"],'url');
}
$html = "
<div id=\"containerDataForm\">
<form method=\"post\" enctype=\"multipart/form-data\" action=\"uploader.php?" . $_SERVER["QUERY_STRING"] . "&q=upload\" onsubmit=\"return validateForm();\">
File:&nbsp;
<input type=\"file\" id=\"File1\" name=\"upload_file\" />&nbsp;(*.html, *.htm)
<br/><br/>
<input type=\"submit\" name=\"Upload File\" value=\"Upload File\" />
</form>
</div>
<div id=\"containerProgressBar\" style=\"display: none;\">
Uploading...&nbsp;<img src=\"progress.gif\" alt=\"\" title=\"Uploading...\" />
</div>
";
echo $html;
}
// uploads the file to the destination path, and returns a link with link path substituted for destination path
function uploadContentFile()
{
G::LoadSystem('inputfilter');
$filter = new InputFilter();
$_FILES["upload_file"] = $filter->xssFilterHard($_FILES["upload_file"]);
$StatusMessage = "";
$ActualFileName = "";
$FileObject = $_FILES["upload_file"]; // find data on the file
$DestPath = sys_get_temp_dir();
$aux='';
$chain = preg_replace("/\r\n+|\r+|\n+|\t+/i", ' ', file_get_contents(htmlentities($FileObject['tmp_name'])));
$chain = preg_replace("/\r\n+|\r+|\n+|\t+/i", " ", file_get_contents($_FILES["upload_file"]["tmp_name"]));
$chain=preg_replace('#<head(.*?)>(.*?)</head>#is', ' ', $chain);
$chain=strip_tags($chain, '<address><label><canvas><option><ol><u><textarea><em><h1><h2><h3><h4><h5><h6><section><tbody><tr><th><td><hr><center><br><b><img><p><a><table><caption><thead><div><ul><li><form><input><strong><span><small><button><figure>');
$chain=str_replace ('"',"'",$chain);
@@ -47,6 +103,9 @@ function uploadContentFile()
function showPopUp($PopupText)
{
G::LoadSystem('inputfilter');
$filter = new InputFilter();
$PopupText = $filter->xssFilterHard($PopupText);
echo "<script type=\"text/javascript\" language=\"javascript\">alert (\"$PopupText\");</script>";
}

2
gulliver/js/tinymce/jscripts/tiny_mce/themes/advanced/js/source_editor.js vendored
View File

@@ -73,6 +73,6 @@ function resizeInputs() {
if (el) {
el.style.width = (vp.w - 20) + 'px';
el.style.height = (vp.h - 65) + 'px';
el.style.height = (vp.h - 122) + 'px';
}
}

8
gulliver/methods/controls/calendar.php
View File

@@ -25,6 +25,9 @@
td {font-family: Tahoma, Verdana, sans-serif; font-size: 11px;}
</style>
<?php
G::LoadSystem('inputfilter');
$filter = new InputFilter();
$_GET = $filter->xssFilterHard($_GET);
$ARR_MONTHS = array ( "January", "February", "March", "April", "May", "June",
"July", "August", "September", "October", "November", "December");
@@ -108,6 +111,11 @@
$end_date = mktime ( 0,0,0, $dt_currentMonth+1, + $i, $dt_currentYear ) ;
}
$numWeeks = ( $end_date - $start_date )/3600/24/7 ;
$dtmin_value = $filter->xssFilterHard($dtmin_value);
$dtmax_value = $filter->xssFilterHard($dtmax_value);
$dt_currentYear = $filter->xssFilterHard($dt_currentYear);
$dt_currentMonth = $filter->xssFilterHard($dt_currentMonth);
//print date('Y-m-d', $start_date ) . " $dtmin_value $dtmax_value ";
?>

6
gulliver/methods/genericAjax.php
View File

@@ -1,4 +1,10 @@
<?php
G::LoadSystem('inputfilter');
$filter = new InputFilter();
$_GET = $filter->xssFilterHard($_GET,"url");
$_POST = $filter->xssFilterHard($_POST,"url");
$_REQUEST = $filter->xssFilterHard($_REQUEST,"url");
$_SESSION = $filter->xssFilterHard($_SESSION,"url");
$request = isset($_POST['request'])? $_POST['request']: null;
if( !isset($request) ){

15
gulliver/system/class.bootstrap.php
View File

@@ -1,5 +1,4 @@
<?php
/**
* class.bootstrap.php
*
@@ -8,7 +7,6 @@
*/
class Bootstrap
{
public static $includeClassPaths = array();
public static $includePaths = array();
protected $relativeIncludePaths = array();
@@ -461,6 +459,11 @@ class Bootstrap
*/
public function streamFile($file, $download = false, $downloadFileName = '', $forceLoad = false)
{
G::LoadSystem('inputfilter');
$filter = new InputFilter();
$file = $filter->xssFilterHard($file);
$downloadFileName = $filter->xssFilterHard($downloadFileName);
$fileNameIni = $file;
$browserCacheFilesUid = G::browserCacheFilesGetUid();
@@ -477,11 +480,8 @@ class Bootstrap
//trick to generate the translation.language.js file , merging two files
if (strtolower($typefile) == 'js' && $typearray[0] == 'translation') {
Bootstrap::sendHeaders($fileNameIni, "text/javascript", $download, $downloadFileName);
$output = Bootstrap::streamJSTranslationFile($filename, $typearray[count($typearray) - 2]);
echo $output;
return;
}
@@ -2894,6 +2894,11 @@ class Bootstrap
if ($hashType == '') {
$hashType = Bootstrap::getPasswordHashType();
}
G::LoadSystem('inputfilter');
$filter = new InputFilter();
$hashType = $filter->validateInput($hashType);
$pass = $filter->validateInput($pass);
eval("\$var = hash('" . $hashType . "', '" . $pass . "');");

21
gulliver/system/class.database_mssql.php
View File

@@ -218,7 +218,10 @@ class database extends database_base
public function getPrimaryKey ($sTable)
{
try {
$sSQL = " SELECT c.COLUMN_NAME " . " FROM INFORMATION_SCHEMA.TABLE_CONSTRAINTS pk , " . " INFORMATION_SCHEMA.KEY_COLUMN_USAGE c " . " WHERE pk.TABLE_NAME = '" . trim( $sTable ) . "' " . " AND CONSTRAINT_TYPE = 'PRIMARY KEY' " . " AND c.TABLE_NAME = pk.TABLE_NAME " . " AND c.CONSTRAINT_NAME = pk.CONSTRAINT_NAME ";
G::LoadSystem('inputfilter');
$filter = new InputFilter();
$sSQL = " SELECT c.COLUMN_NAME " . " FROM INFORMATION_SCHEMA.TABLE_CONSTRAINTS pk , " . " INFORMATION_SCHEMA.KEY_COLUMN_USAGE c " . " WHERE pk.TABLE_NAME = '%s' " . " AND CONSTRAINT_TYPE = 'PRIMARY KEY' " . " AND c.TABLE_NAME = pk.TABLE_NAME " . " AND c.CONSTRAINT_NAME = pk.CONSTRAINT_NAME ";
$sSQL = $filter->preventSqlInjection($sSQL, array(trim( $sTable )));
$oPrimaryKey = $this->executeQuery( $sSQL );
$aPrimaryKey = mssql_fetch_array( $oPrimaryKey );
mssql_free_result( $oPrimaryKey );
@@ -238,8 +241,10 @@ class database extends database_base
public function getFieldConstraint ($sTable, $sField)
{
try {
$sSQL = " select a.name " . " from sysobjects a " . " inner join syscolumns b on a.id = b.cdefault " . " where a.xtype = 'D' " . " and a.parent_obj = (select id from sysobjects where xtype = 'U' and name = '" . trim( $sTable ) . "') " . " and b.name = '" . trim( $sField ) . "' ";
G::LoadSystem('inputfilter');
$filter = new InputFilter();
$sSQL = " select a.name " . " from sysobjects a " . " inner join syscolumns b on a.id = b.cdefault " . " where a.xtype = 'D' " . " and a.parent_obj = (select id from sysobjects where xtype = 'U' and name = '%s') " . " and b.name = '%s' ";
$sSQL = $filter->preventSqlInjection($sSQL, array(trim( $sTable ),trim( $sField )));
$oFieldConstraint = $this->executeQuery( $sSQL );
$aFieldConstraint = mssql_fetch_array( $oFieldConstraint );
mssql_free_result( $oFieldConstraint );
@@ -259,8 +264,11 @@ class database extends database_base
public function dropFieldConstraint ($sTable, $sField)
{
try {
G::LoadSystem('inputfilter');
$filter = new InputFilter();
$sConstraint = $this->getFieldConstraint( $sTable, $sField );
$sSQL = "ALTER TABLE " . $sTable . " DROP CONSTRAINT " . $sConstraint . $this->sEndLine;
$sSQL = "ALTER TABLE %s DROP CONSTRAINT %s";
$sSQL = $filter->preventSqlInjection($sSQL, array($sTable,$sConstraint . $this->sEndLine));
$oFieldConstraint = $this->executeQuery( $sSQL );
return $oFieldConstraint;
} catch (Exception $oException) {
@@ -367,7 +375,10 @@ class database extends database_base
if (! $this->oConnection) {
return false;
}
return $this->executeQuery( 'USE ' . $this->sDataBase );
G::LoadSystem('inputfilter');
$filter = new InputFilter();
$query = $filter->preventSqlInjection("USE %s", array($this->sDataBase));
return $this->executeQuery( $query );
}
public function logQuery ($sQuery)

45
gulliver/system/class.dbMaintenance.php
View File

@@ -254,6 +254,9 @@ class DataBaseMaintenance
*/
function dumpData ($table)
{
G::LoadSystem('inputfilter');
$filter = new InputFilter();
$table = $filter->validateInput($table, 'nosql');
$this->outfile = $this->tmpDir . $table . '.dump';
//if the file exists delete it
@@ -261,7 +264,8 @@ class DataBaseMaintenance
@unlink( $this->outfile );
}
$sql = "SELECT * INTO OUTFILE '{$this->outfile}' FIELDS TERMINATED BY '\t|\t' OPTIONALLY ENCLOSED BY '\"' LINES TERMINATED BY '\t\t\r\r\n' FROM $table";
$sql = "SELECT * INTO OUTFILE '{%s}' FIELDS TERMINATED BY '\t|\t' OPTIONALLY ENCLOSED BY '\"' LINES TERMINATED BY '\t\t\r\r\n' FROM %s";
$sql = $filter->preventSqlInjection($sql, array($this->outfile,$table));
// The mysql_escape_string function has been DEPRECATED as of PHP 5.3.0.
// Commented that is not assigned to a variable.
// mysql_escape_string("';");
@@ -281,8 +285,11 @@ class DataBaseMaintenance
*/
function restoreData ($backupFile)
{
G::LoadSystem('inputfilter');
$filter = new InputFilter();
$tableName = str_replace( '.dump', '', basename( $backupFile ) );
$sql = "LOAD DATA INFILE '$backupFile' INTO TABLE $tableName FIELDS TERMINATED BY '\t|\t' OPTIONALLY ENCLOSED BY '\"' LINES TERMINATED BY '\t\t\r\r\n'";
$sql = "LOAD DATA INFILE '%s' INTO TABLE %s FIELDS TERMINATED BY '\t|\t' OPTIONALLY ENCLOSED BY '\"' LINES TERMINATED BY '\t\t\r\r\n'";
$sql = $filter->preventSqlInjection($sql, array($backupFile,$tableName));
if (! @mysql_query( $sql )) {
print mysql_error() . "\n";
return false;
@@ -298,8 +305,12 @@ class DataBaseMaintenance
function backupData ()
{
$aTables = $this->getTablesList();
G::LoadSystem('inputfilter');
$filter = new InputFilter();
$aTables = $filter->xssFilterHard($aTables);
foreach ($aTables as $table) {
if ($this->dumpData( $table ) !== false) {
$this->outfile = $filter->xssFilterHard($this->outfile);
printf( "%20s %s %s\n", 'Dump of table:', $table, " in file {$this->outfile}" );
} else {
return false;
@@ -336,6 +347,11 @@ class DataBaseMaintenance
{
$aTables = $this->getTablesList();
G::LoadSystem('inputfilter');
$filter = new InputFilter();
$aTables = $filter->xssFilterHard($aTables);
$this->tmpDir = $filter->xssFilterHard($this->tmpDir);
$this->infile = $filter->xssFilterHard($this->infile);
foreach ($aTables as $table) {
if (isset( $type ) && $type == 'sql') {
@@ -421,11 +437,15 @@ class DataBaseMaintenance
function lockTables ()
{
G::LoadSystem('inputfilter');
$filter = new InputFilter();
$aTables = $this->getTablesList();
if (empty( $aTables ))
return false;
printf( "%-70s", "LOCK TABLES" );
if (@mysql_query( "LOCK TABLES " . implode( " READ, ", $aTables ) . " READ; " )) {
$sQuery = "LOCK TABLES " . implode( " READ, ", $aTables ) . " READ; ";
$sQuery = $filter->preventSqlInjection($sQuery);
if (@mysql_query( $sQuery )) {
echo " [OK]\n";
return true;
} else {
@@ -454,8 +474,14 @@ class DataBaseMaintenance
function dumpSqlInserts ($table)
{
G::LoadSystem('inputfilter');
$filter = new InputFilter();
$table = $filter->xssFilterHard($table);
$table = $filter->validateInput($table, 'nosql');
$bytesSaved = 0;
$result = @mysql_query( "SELECT * FROM `$table`" );
$query = "SELECT * FROM `%s`";
$query = $filter->preventSqlInjection($query, array($table));
$result = @mysql_query( $query );
$num_rows = mysql_num_rows( $result );
$num_fields = mysql_num_fields( $result );
@@ -476,6 +502,7 @@ class DataBaseMaintenance
$data .= ");\n";
}
$data = $filter->xssFilterHard($data);
printf( "%-59s%20s", "Dump of table $table", strlen( $data ) . " Bytes Saved\n" );
return $data;
}
@@ -624,11 +651,13 @@ class DataBaseMaintenance
* @return string $tableSchema
*/
function getSchemaFromTable ($tablename)
{
//$tableSchema = "/* Structure for table `$tablename` */\n";
//$tableSchema .= "DROP TABLE IF EXISTS `$tablename`;\n\n";
{
G::LoadSystem('inputfilter');
$filter = new InputFilter();
$tablename = $filter->validateInput($tablename, 'nosql');
$tableSchema = "";
$sql = "show create table `$tablename`; ";
$sql = "show create table `%s`; ";
$sql = $filter->preventSqlInjection($sql, array($tablename));
$result = @mysql_query( $sql );
if ($result) {
if ($row = mysql_fetch_assoc( $result )) {

6
gulliver/system/class.dbconnection.php
View File

@@ -186,6 +186,10 @@ class DBConnection
{
global $_SESSION;
global $_SERVER;
G::LoadSystem('inputfilter');
$filter = new InputFilter();
$_SERVER = $filter->xssFilterHard($_SERVER);
$_SESSION = $filter->xssFilterHard($_SESSION);
if (is_null( $errorLevel ))
if (isset( $this->errorLevel )) {
$errorLevel = $this->errorLevel;
@@ -207,7 +211,7 @@ class DBConnection
print "</textarea></td></tr></table>";
}
//G::setErrorHandler ( );
G::customErrorLog( 'DB_Error', $obj->code . ' ' . $obj->message . '-' . $obj->userinfo, '', '' );
//G::customErrorLog( 'DB_Error', $obj->code . ' ' . $obj->message . '-' . $obj->userinfo, '', '' );
if ($errorLevel == DB_ERROR_SHOW_AND_STOP || $errorLevel == DB_ERROR_SHOWALL_AND_STOP) {
die(); //stop
}

24
gulliver/system/class.g.php
View File

@@ -463,8 +463,11 @@ class G
* @return void
*/
public static function LoadSystem ($strClass)
{
require_once (PATH_GULLIVER . 'class.' . $strClass . '.php');
{ require_once (PATH_GULLIVER . 'class.inputfilter.php');
$filter = new InputFilter();
$path = PATH_GULLIVER . 'class.' . $strClass . '.php';
$path = $filter->validateInput($path, 'path');
require_once ($path);
}
public function LoadSystemExist ($strClass)
@@ -1070,6 +1073,12 @@ class G
*/
public static function streamFile ($file, $download = false, $downloadFileName = '')
{
G::LoadSystem('inputfilter');
$filter = new InputFilter();
$file = $filter->xssFilterHard($file);
if(isset($_SERVER['REQUEST_URI'])) {
$_SERVER['REQUEST_URI'] = $filter->xssFilterHard($_SERVER['REQUEST_URI'],"url");
}
require_once (PATH_THIRDPARTY . 'jsmin/jsmin.php');
$folderarray = explode( '/', $file );
$typearray = explode( '.', basename( $file ) );
@@ -1078,8 +1087,11 @@ class G
//trick to generate the translation.language.js file , merging two files
if (strtolower( $typefile ) == 'js' && $typearray[0] == 'translation') {
$download = $filter->xssFilterHard($download);
$downloadFileName = $filter->xssFilterHard($downloadFileName);
G::sendHeaders( $filename, 'text/javascript', $download, $downloadFileName );
$output = G::streamJSTranslationFile( $filename, $typearray[1] );
$output = $filter->xssFilterHard($output);
print $output;
return;
}
@@ -1088,6 +1100,7 @@ class G
if (strtolower( $typefile ) == 'css' && $folderarray[count( $folderarray ) - 2] == 'css') {
G::sendHeaders( $filename, 'text/css', $download, $downloadFileName );
$output = G::streamCSSBigFile( $typearray[0] );
$output = $filter->xssFilterHard($output);
print $output;
return;
}
@@ -3137,6 +3150,9 @@ class G
*/
public function pr ($var)
{
G::LoadSystem('inputfilter');
$filter = new InputFilter();
$var = $filter->xssFilterHard($var);
print ("<pre>") ;
print_r( $var );
print ("</pre>") ;
@@ -3314,10 +3330,10 @@ class G
*
* @author Erik A.O. <erik@colosa.com>
*/
public function json_decode($Json)
public function json_decode($Json, $assoc = false)
{
if (function_exists('json_decode')) {
return json_decode($Json);
return json_decode($Json, $assoc);
} else {
G::LoadThirdParty('pear/json', 'class.json');
$oJSON = new Services_JSON();

277
gulliver/system/class.inputfilter.php
View File

@@ -364,5 +364,280 @@ class InputFilter
}
return $string;
}
/**
* Internal method removes tags/special characters
* @author Marcelo Cuiza
* @access protected
* @param Array or String $input
* @param String $type
* @return Array or String $input
*/
public function xssFilter($input, $type = "")
{
if(is_array($input)) {
if(sizeof($input)) {
foreach($input as $i => $val) {
if(is_array($val) && sizeof($val)) {
$input[$i] = $this->xssFilter($val);
} else {
if(!empty($val)) {
if($type != "url") {
$inputFiltered = addslashes(htmlspecialchars(filter_var($val, FILTER_SANITIZE_STRING), ENT_COMPAT, 'UTF-8'));
} else {
$inputFiltered = filter_var($val, FILTER_SANITIZE_STRING);
}
} else {
$inputFiltered = "";
}
$input[$i] = $inputFiltered;
}
}
}
return $input;
} else {
if(!isset($input) || trim($input) === '' || $input === NULL ) {
return '';
} else {
if($type != "url") {
return addslashes(htmlspecialchars(filter_var($input, FILTER_SANITIZE_STRING), ENT_COMPAT, 'UTF-8'));
} else {
return filter_var($input, FILTER_SANITIZE_STRING);
}
}
}
}
/**
* Internal method: remove malicious code, fix missing end tags, fix illegal nesting, convert deprecated tags, validate CSS, preserve rich formatting
* @author Marcelo Cuiza
* @access protected
* @param Array or String $input
* @param String $type
* @return Array or String $input
*/
function xssFilterHard($input, $type = "")
{
require_once (PATH_THIRDPARTY . 'HTMLPurifier/HTMLPurifier.auto.php');
$config = HTMLPurifier_Config::createDefault();
$purifier = new HTMLPurifier($config);
if(is_array($input)) {
if(sizeof($input)) {
foreach($input as $i => $val) {
if(is_array($val) || is_object($val) && sizeof($val)) {
$input[$i] = $this->xssFilterHard($val);
} else {
if(!empty($val)) {
if(!is_object(G::json_decode($val))) {
$inputFiltered = $purifier->purify($val);
if($type != "url" && !strpos(basename($val), "=")) {
$inputFiltered = addslashes(htmlspecialchars($inputFiltered, ENT_COMPAT, 'UTF-8'));
} else {
$inputFiltered = str_replace('&amp;','&',$inputFiltered);
}
} else {
$jsArray = G::json_decode($val,true);
if(is_array($jsArray) && sizeof($jsArray)) {
foreach($jsArray as $j => $jsVal){
if(is_array($jsVal) && sizeof($jsVal)) {
$jsArray[$j] = $this->xssFilterHard($jsVal);
} else {
if(!empty($jsVal)) {
$jsArray[$j] = $purifier->purify($jsVal);
}
}
}
$inputFiltered = G::json_encode($jsArray);
} else {
$inputFiltered = $val;
}
}
} else {
$inputFiltered = "";
}
$input[$i] = $inputFiltered;
}
}
}
return $input;
} else {
if(!isset($input) || empty($input)) {
return '';
} else {
if(is_object($input)) {
if(sizeof($input)) {
foreach($input as $j => $jsVal){
if(is_array($jsVal) || is_object($jsVal) && sizeof($jsVal)) {
$input->j = $this->xssFilterHard($jsVal);
} else {
if(!empty($jsVal)) {
$input->j = $purifier->purify($jsVal);
}
}
}
}
return $input;
}
if(!is_object(G::json_decode($input))) {
$input = $purifier->purify($input);
if($type != "url" && !strpos(basename($input), "=")) {
$input = addslashes(htmlspecialchars($input, ENT_COMPAT, 'UTF-8'));
} else {
$input = str_replace('&amp;','&',$input);
}
} else {
$jsArray = G::json_decode($input,true);
if(is_array($jsArray) && sizeof($jsArray)) {
foreach($jsArray as $j => $jsVal){
if(is_array($jsVal) || is_object($jsVal) && sizeof($jsVal)) {
$jsArray[$j] = $this->xssFilterHard($jsVal);
} else {
if(!empty($jsVal)) {
$jsArray[$j] = $purifier->purify($jsVal);
}
}
}
$input = G::json_encode($jsArray);
}
}
return $input;
}
}
}
/**
* Internal method: protect against SQL injection
* @author Marcelo Cuiza
* @access protected
* @param String $con
* @param String $query
* @param Array $values
* @return String $query
*/
function preventSqlInjection($query, $values = Array(), &$con = NULL)
{
if(is_array($values) && sizeof($values)) {
foreach($values as $k1 => $val1) {
$values[$k1] = mysql_real_escape_string($val1);
}
if ( get_magic_quotes_gpc() ) {
foreach($values as $k => $val) {
$values[$k] = stripslashes($val);
}
}
$newquery = vsprintf($query,$values);
} else {
//$newquery = mysql_real_escape_string($query);
$newquery = $this->quoteSmart($this->decode($query), $con);
}
return $newquery;
}
/**
* Internal method: protect against SQL injenction
* @author Marcelo Cuiza
* @access protected
* @param String $value
* @param String or Array $types
* @param String $valType
* @return String $value
*/
function validateInput($value, $types = 'string', $valType = 'sanitize')
{
if(!isset($value) || empty($value)) {
return '';
}
if(is_array($types) && sizeof($types)){
foreach($types as $type){
if($valType == 'sanitize') {
$value = $this->sanitizeInputValue($value, $type);
} else {
$value = $this->validateInputValue($value, $type);
}
}
} elseif(is_string($types)) {
if($types == 'sanitize' || $types == 'validate') {
$valType = $types;
$types = 'string';
}
if($valType == 'sanitize') {
$value = $this->sanitizeInputValue($value, $types);
} else {
$value = $this->validateInputValue($value, $types);
}
}
return $value;
}
function sanitizeInputValue($value, $type) {
switch($type) {
case 'float':
$value = filter_var($value, FILTER_SANITIZE_NUMBER_FLOAT, FILTER_FLAG_ALLOW_FRACTION | FILTER_FLAG_ALLOW_THOUSAND);
break;
case 'int':
$value = (int)filter_var($value, FILTER_SANITIZE_NUMBER_INT);
break;
case 'boolean':
$value = (boolean)filter_var($value, FILTER_VALIDATE_BOOLEAN,FILTER_NULL_ON_FAILURE);
break;
case 'path':
if(!file_exists($value)) {
$value = '';
}
break;
case 'nosql':
$value = (string)filter_var($value, FILTER_SANITIZE_STRING, FILTER_FLAG_STRIP_LOW | FILTER_FLAG_STRIP_HIGH);
if(preg_match('/\b(or|and|xor|drop|insert|update|delete|select)\b/i' , $value, $matches, PREG_OFFSET_CAPTURE)) {
$value = substr($value,0,$matches[0][1]);
}
break;
default:
$value = (string)filter_var($value, FILTER_SANITIZE_STRING, FILTER_FLAG_STRIP_LOW | FILTER_FLAG_STRIP_HIGH);
}
return $value;
}
function validateInputValue($value, $type) {
switch($type) {
case 'float':
$value = str_replace(',', '.', $value);
if(!filter_var($value, FILTER_VALIDATE_FLOAT)) {
throw new Exception('not a float value');
}
break;
case 'int':
if(!filter_var($value, FILTER_VALIDATE_INT)) {
throw new Exception('not a int value');
}
break;
case 'boolean':
if(!preg_match('/\b(yes|no|false|true|1|0)\b/i' , $value)) {
throw new Exception('not a boolean value');
}
break;
case 'path':
if(!file_exists($value)) {
throw new Exception('not a valid path');
}
break;
case 'nosql':
if(preg_match('/\b(or|and|xor|drop|insert|update|delete|select)\b/i' , $value)) {
throw new Exception('sql command found');
}
break;
default:
if(!is_string($value)) {
throw new Exception('not a string value');
}
}
}
}

21
gulliver/system/class.pagedTable.php
View File

@@ -778,6 +778,13 @@ class pagedTable
*/
public function renderTable ($block = '')
{
G::LoadSystem('inputfilter');
$filter = new InputFilter();
$this->orderBy = $filter->xssFilterHard($this->orderBy);
$this->currentPage = $filter->xssFilterHard($this->currentPage);
$this->id = $filter->xssFilterHard($this->id);
$this->name = $filter->xssFilterHard($this->name);
$this->ownerPage = $filter->xssFilterHard($this->ownerPage);
// DBConnection
$this->prepareQuery();
//Query for get the number of rows
@@ -797,6 +804,9 @@ class pagedTable
$this->tpl->assign( 'pagedTable_Id', $this->id );
$this->tpl->assign( 'pagedTable_Name', $this->name );
$this->tpl->assign( 'pagedTable_Height', $this->xmlForm->height );
$this->xmlForm->home = $filter->xssFilterHard($this->xmlForm->home);
$this->filterForm = $filter->xssFilterHard($this->filterForm);
$this->menu = $filter->xssFilterHard($this->menu);
if (file_exists( $this->xmlForm->home . $this->filterForm . '.xml' )) {
$filterForm = new filterForm( $this->filterForm, $this->xmlForm->home );
if ($this->menu === '') {
@@ -893,10 +903,14 @@ class pagedTable
$this->tpl->assign( 'rowId', 'insertAtLast' );
if ($this->currentPage > 1) {
$firstUrl = $this->ownerPage . '?order=' . $this->orderBy . '&page=1';
$firstUrl = $filter->xssFilterHard($firstUrl);
$firstAjax = $this->id . ".doGoToPage(1);return false;";
$firstAjax = $filter->xssFilterHard($firstAjax);
$prevpage = $this->currentPage - 1;
$prevUrl = $this->ownerPage . '?order=' . $this->orderBy . '&page=' . $prevpage;
$prevUrl = $filter->xssFilterHard($prevUrl);
$prevAjax = $this->id . ".doGoToPage(" . $prevpage . ");return false;";
$prevAjax = $filter->xssFilterHard($prevAjax);
$first = "<a href=\"" . htmlentities( $firstUrl, ENT_QUOTES, 'utf-8' ) . "\" onclick=\"" . $firstAjax . "\" class='firstPage'>&nbsp;</a>";
$prev = "<a href=\"" . htmlentities( $prevUrl, ENT_QUOTES, 'utf-8' ) . "\" onclick=\"" . $prevAjax . "\" class='previousPage'>&nbsp;</a>";
} else {
@@ -905,10 +919,14 @@ class pagedTable
}
if ($this->currentPage < $this->totpages) {
$lastUrl = $this->ownerPage . '?order=' . $this->orderBy . '&page=' . $this->totpages;
$lastUrl = $filter->xssFilterHard($lastUrl);
$lastAjax = $this->id . ".doGoToPage(" . $this->totpages . ");return false;";
$lastAjax = $filter->xssFilterHard($lastAjax);
$nextpage = $this->currentPage + 1;
$nextUrl = $this->ownerPage . '?order=' . $this->orderBy . '&page=' . $nextpage;
$nextUrl = $filter->xssFilterHard($nextUrl);
$nextAjax = $this->id . ".doGoToPage(" . $nextpage . ");return false;";
$nextAjax = $filter->xssFilterHard($nextAjax);
$next = "<a href=\"" . htmlentities( $nextUrl, ENT_QUOTES, 'utf-8' ) . "\" onclick=\"" . $nextAjax . "\" class='nextPage'>&nbsp;</a>";
$last = "<a href=\"" . htmlentities( $lastUrl, ENT_QUOTES, 'utf-8' ) . "\" onclick=\"" . $lastAjax . "\" class='lastPage'>&nbsp;</a>";
} else {
@@ -919,7 +937,8 @@ class pagedTable
for ($r = 1; $r <= $this->totpages; $r ++) {
if (($r >= ($this->currentPage - 5)) && ($r <= ($this->currentPage + 5))) {
$pageAjax = $this->id . ".doGoToPage(" . $r . ");return false;";
if ($r != $this->currentPage) {
if ($r != $this->currentPage) {
$pageAjax = $filter->xssFilterHard($pageAjax);
$pagesEnum .= "&nbsp;<a href=\"" . htmlentities( $this->ownerPage . '?order=' . $this->orderBy . '&page=' . $r, ENT_QUOTES, 'utf-8' ) . "\" onclick=\"" . $pageAjax . "\">" . $r . "</a>";
} else {
$pagesEnum .= "&nbsp;<a>" . $r . "</a>";

4
gulliver/system/class.soapNtlm.php
View File

@@ -184,6 +184,9 @@ class soapNtlm
*/
private function createBuffer ($path)
{
G::LoadSystem('inputfilter');
$filter = new InputFilter();
$path = $filter->xssFilterHard($path, "url");
if ($this->buffer) {
return;
}
@@ -198,6 +201,7 @@ class soapNtlm
//Apply proxy settings
if (class_exists( 'System' )) {
$sysConf = System::getSystemConfiguration();
$sysConf = $filter->xssFilterHard($sysConf);
if ($sysConf['proxy_host'] != '') {
curl_setopt( $this->ch, CURLOPT_PROXY, $sysConf['proxy_host'] . ($sysConf['proxy_port'] != '' ? ':' . $sysConf['proxy_port'] : '') );
if ($sysConf['proxy_port'] != '') {

14
gulliver/system/class.webResource.php
View File

@@ -66,7 +66,14 @@ class WebResource
$paramsRef[] = '$parameters[' . $key . ']';
}
}
$res = eval( 'return ($this->' . $post['function'] . '(' . implode( ',', $paramsRef ) . '));' );
$paramsRef = implode( ',', $paramsRef );
G::LoadSystem('inputfilter');
$filter = new InputFilter();
$post['function'] = $filter->validateInput($post['function']);
$paramsRef = $filter->validateInput($paramsRef);
$res = eval( 'return ($this->' . $post['function'] . '(' . $paramsRef . '));' );
$res = G::json_encode( $res );
print ($res) ;
} else {
@@ -82,13 +89,18 @@ class WebResource
*/
function _encode ()
{
G::LoadSystem('inputfilter');
$filter = new InputFilter();
header( 'Content-Type: text/json' );
$methods = get_class_methods( get_class( $this ) );
$methods = $filter->xssFilterHard($methods);
$this->_uri = $filter->xssFilterHard($this->_uri);
print ('{') ;
$first = true;
foreach ($methods as $method) {
//To avoid PHP version incompatibilities, put the $method name in lowercase
$method = strtolower( $method );
$method = $filter->xssFilterHard($method);
if ((substr( $method, 0, 1 ) === '_') || (strcasecmp( $method, 'WebResource' ) == 0) || (strcasecmp( $method, get_class( $this ) ) == 0)) {
} elseif (strcasecmp( substr( $method, 0, 3 ), 'js_' ) == 0) {
if (! $first) {

11
gulliver/thirdparty/HTMLPurifier/HTMLPurifier.auto.php vendored Normal file
View File

@@ -0,0 +1,11 @@
<?php
/**
* This is a stub include that automatically configures the include path.
*/
set_include_path(dirname(__FILE__) . PATH_SEPARATOR . get_include_path() );
require_once 'HTMLPurifier/Bootstrap.php';
require_once 'HTMLPurifier.autoload.php';
// vim: et sw=4 sts=4

27
gulliver/thirdparty/HTMLPurifier/HTMLPurifier.autoload.php vendored Normal file
View File

@@ -0,0 +1,27 @@
<?php
/**
* @file
* Convenience file that registers autoload handler for HTML Purifier.
* It also does some sanity checks.
*/
if (function_exists('spl_autoload_register') && function_exists('spl_autoload_unregister')) {
// We need unregister for our pre-registering functionality
HTMLPurifier_Bootstrap::registerAutoload();
if (function_exists('__autoload')) {
// Be polite and ensure that userland autoload gets retained
spl_autoload_register('__autoload');
}
} elseif (!function_exists('__autoload')) {
function __autoload($class)
{
return HTMLPurifier_Bootstrap::autoload($class);
}
}
if (ini_get('zend.ze1_compatibility_mode')) {
trigger_error("HTML Purifier is not compatible with zend.ze1_compatibility_mode; please turn it off", E_USER_ERROR);
}
// vim: et sw=4 sts=4

4
gulliver/thirdparty/HTMLPurifier/HTMLPurifier.composer.php vendored Normal file
View File

@@ -0,0 +1,4 @@
<?php
if (!defined('HTMLPURIFIER_PREFIX')) {
define('HTMLPURIFIER_PREFIX', __DIR__);
}

25
gulliver/thirdparty/HTMLPurifier/HTMLPurifier.func.php vendored Normal file
View File

@@ -0,0 +1,25 @@
<?php
/**
* @file
* Defines a function wrapper for HTML Purifier for quick use.
* @note ''HTMLPurifier()'' is NOT the same as ''new HTMLPurifier()''
*/
/**
* Purify HTML.
* @param string $html String HTML to purify
* @param mixed $config Configuration to use, can be any value accepted by
* HTMLPurifier_Config::create()
* @return string
*/
function HTMLPurifier($html, $config = null)
{
static $purifier = false;
if (!$purifier) {
$purifier = new HTMLPurifier();
}
return $purifier->purify($html, $config);
}
// vim: et sw=4 sts=4

229
gulliver/thirdparty/HTMLPurifier/HTMLPurifier.includes.php vendored Normal file
View File

@@ -0,0 +1,229 @@
<?php
/**
* @file
* This file was auto-generated by generate-includes.php and includes all of
* the core files required by HTML Purifier. Use this if performance is a
* primary concern and you are using an opcode cache. PLEASE DO NOT EDIT THIS
* FILE, changes will be overwritten the next time the script is run.
*
* @version 4.6.0
*
* @warning
* You must *not* include any other HTML Purifier files before this file,
* because 'require' not 'require_once' is used.
*
* @warning
* This file requires that the include path contains the HTML Purifier
* library directory; this is not auto-set.
*/
require 'HTMLPurifier.php';
require 'HTMLPurifier/Arborize.php';
require 'HTMLPurifier/AttrCollections.php';
require 'HTMLPurifier/AttrDef.php';
require 'HTMLPurifier/AttrTransform.php';
require 'HTMLPurifier/AttrTypes.php';
require 'HTMLPurifier/AttrValidator.php';
require 'HTMLPurifier/Bootstrap.php';
require 'HTMLPurifier/Definition.php';
require 'HTMLPurifier/CSSDefinition.php';
require 'HTMLPurifier/ChildDef.php';
require 'HTMLPurifier/Config.php';
require 'HTMLPurifier/ConfigSchema.php';
require 'HTMLPurifier/ContentSets.php';
require 'HTMLPurifier/Context.php';
require 'HTMLPurifier/DefinitionCache.php';
require 'HTMLPurifier/DefinitionCacheFactory.php';
require 'HTMLPurifier/Doctype.php';
require 'HTMLPurifier/DoctypeRegistry.php';
require 'HTMLPurifier/ElementDef.php';
require 'HTMLPurifier/Encoder.php';
require 'HTMLPurifier/EntityLookup.php';
require 'HTMLPurifier/EntityParser.php';
require 'HTMLPurifier/ErrorCollector.php';
require 'HTMLPurifier/ErrorStruct.php';
require 'HTMLPurifier/Exception.php';
require 'HTMLPurifier/Filter.php';
require 'HTMLPurifier/Generator.php';
require 'HTMLPurifier/HTMLDefinition.php';
require 'HTMLPurifier/HTMLModule.php';
require 'HTMLPurifier/HTMLModuleManager.php';
require 'HTMLPurifier/IDAccumulator.php';
require 'HTMLPurifier/Injector.php';
require 'HTMLPurifier/Language.php';
require 'HTMLPurifier/LanguageFactory.php';
require 'HTMLPurifier/Length.php';
require 'HTMLPurifier/Lexer.php';
require 'HTMLPurifier/Node.php';
require 'HTMLPurifier/PercentEncoder.php';
require 'HTMLPurifier/PropertyList.php';
require 'HTMLPurifier/PropertyListIterator.php';
require 'HTMLPurifier/Queue.php';
require 'HTMLPurifier/Strategy.php';
require 'HTMLPurifier/StringHash.php';
require 'HTMLPurifier/StringHashParser.php';
require 'HTMLPurifier/TagTransform.php';
require 'HTMLPurifier/Token.php';
require 'HTMLPurifier/TokenFactory.php';
require 'HTMLPurifier/URI.php';
require 'HTMLPurifier/URIDefinition.php';
require 'HTMLPurifier/URIFilter.php';
require 'HTMLPurifier/URIParser.php';
require 'HTMLPurifier/URIScheme.php';
require 'HTMLPurifier/URISchemeRegistry.php';
require 'HTMLPurifier/UnitConverter.php';
require 'HTMLPurifier/VarParser.php';
require 'HTMLPurifier/VarParserException.php';
require 'HTMLPurifier/Zipper.php';
require 'HTMLPurifier/AttrDef/CSS.php';
require 'HTMLPurifier/AttrDef/Clone.php';
require 'HTMLPurifier/AttrDef/Enum.php';
require 'HTMLPurifier/AttrDef/Integer.php';
require 'HTMLPurifier/AttrDef/Lang.php';
require 'HTMLPurifier/AttrDef/Switch.php';
require 'HTMLPurifier/AttrDef/Text.php';
require 'HTMLPurifier/AttrDef/URI.php';
require 'HTMLPurifier/AttrDef/CSS/Number.php';
require 'HTMLPurifier/AttrDef/CSS/AlphaValue.php';
require 'HTMLPurifier/AttrDef/CSS/Background.php';
require 'HTMLPurifier/AttrDef/CSS/BackgroundPosition.php';
require 'HTMLPurifier/AttrDef/CSS/Border.php';
require 'HTMLPurifier/AttrDef/CSS/Color.php';
require 'HTMLPurifier/AttrDef/CSS/Composite.php';
require 'HTMLPurifier/AttrDef/CSS/DenyElementDecorator.php';
require 'HTMLPurifier/AttrDef/CSS/Filter.php';
require 'HTMLPurifier/AttrDef/CSS/Font.php';
require 'HTMLPurifier/AttrDef/CSS/FontFamily.php';
require 'HTMLPurifier/AttrDef/CSS/Ident.php';
require 'HTMLPurifier/AttrDef/CSS/ImportantDecorator.php';
require 'HTMLPurifier/AttrDef/CSS/Length.php';
require 'HTMLPurifier/AttrDef/CSS/ListStyle.php';
require 'HTMLPurifier/AttrDef/CSS/Multiple.php';
require 'HTMLPurifier/AttrDef/CSS/Percentage.php';
require 'HTMLPurifier/AttrDef/CSS/TextDecoration.php';
require 'HTMLPurifier/AttrDef/CSS/URI.php';
require 'HTMLPurifier/AttrDef/HTML/Bool.php';
require 'HTMLPurifier/AttrDef/HTML/Nmtokens.php';
require 'HTMLPurifier/AttrDef/HTML/Class.php';
require 'HTMLPurifier/AttrDef/HTML/Color.php';
require 'HTMLPurifier/AttrDef/HTML/FrameTarget.php';
require 'HTMLPurifier/AttrDef/HTML/ID.php';
require 'HTMLPurifier/AttrDef/HTML/Pixels.php';
require 'HTMLPurifier/AttrDef/HTML/Length.php';
require 'HTMLPurifier/AttrDef/HTML/LinkTypes.php';
require 'HTMLPurifier/AttrDef/HTML/MultiLength.php';
require 'HTMLPurifier/AttrDef/URI/Email.php';
require 'HTMLPurifier/AttrDef/URI/Host.php';
require 'HTMLPurifier/AttrDef/URI/IPv4.php';
require 'HTMLPurifier/AttrDef/URI/IPv6.php';
require 'HTMLPurifier/AttrDef/URI/Email/SimpleCheck.php';
require 'HTMLPurifier/AttrTransform/Background.php';
require 'HTMLPurifier/AttrTransform/BdoDir.php';
require 'HTMLPurifier/AttrTransform/BgColor.php';
require 'HTMLPurifier/AttrTransform/BoolToCSS.php';
require 'HTMLPurifier/AttrTransform/Border.php';
require 'HTMLPurifier/AttrTransform/EnumToCSS.php';
require 'HTMLPurifier/AttrTransform/ImgRequired.php';
require 'HTMLPurifier/AttrTransform/ImgSpace.php';
require 'HTMLPurifier/AttrTransform/Input.php';
require 'HTMLPurifier/AttrTransform/Lang.php';
require 'HTMLPurifier/AttrTransform/Length.php';
require 'HTMLPurifier/AttrTransform/Name.php';
require 'HTMLPurifier/AttrTransform/NameSync.php';
require 'HTMLPurifier/AttrTransform/Nofollow.php';
require 'HTMLPurifier/AttrTransform/SafeEmbed.php';
require 'HTMLPurifier/AttrTransform/SafeObject.php';
require 'HTMLPurifier/AttrTransform/SafeParam.php';
require 'HTMLPurifier/AttrTransform/ScriptRequired.php';
require 'HTMLPurifier/AttrTransform/TargetBlank.php';
require 'HTMLPurifier/AttrTransform/Textarea.php';
require 'HTMLPurifier/ChildDef/Chameleon.php';
require 'HTMLPurifier/ChildDef/Custom.php';
require 'HTMLPurifier/ChildDef/Empty.php';
require 'HTMLPurifier/ChildDef/List.php';
require 'HTMLPurifier/ChildDef/Required.php';
require 'HTMLPurifier/ChildDef/Optional.php';
require 'HTMLPurifier/ChildDef/StrictBlockquote.php';
require 'HTMLPurifier/ChildDef/Table.php';
require 'HTMLPurifier/DefinitionCache/Decorator.php';
require 'HTMLPurifier/DefinitionCache/Null.php';
require 'HTMLPurifier/DefinitionCache/Serializer.php';
require 'HTMLPurifier/DefinitionCache/Decorator/Cleanup.php';
require 'HTMLPurifier/DefinitionCache/Decorator/Memory.php';
require 'HTMLPurifier/HTMLModule/Bdo.php';
require 'HTMLPurifier/HTMLModule/CommonAttributes.php';
require 'HTMLPurifier/HTMLModule/Edit.php';
require 'HTMLPurifier/HTMLModule/Forms.php';
require 'HTMLPurifier/HTMLModule/Hypertext.php';
require 'HTMLPurifier/HTMLModule/Iframe.php';
require 'HTMLPurifier/HTMLModule/Image.php';
require 'HTMLPurifier/HTMLModule/Legacy.php';
require 'HTMLPurifier/HTMLModule/List.php';
require 'HTMLPurifier/HTMLModule/Name.php';
require 'HTMLPurifier/HTMLModule/Nofollow.php';
require 'HTMLPurifier/HTMLModule/NonXMLCommonAttributes.php';
require 'HTMLPurifier/HTMLModule/Object.php';
require 'HTMLPurifier/HTMLModule/Presentation.php';
require 'HTMLPurifier/HTMLModule/Proprietary.php';
require 'HTMLPurifier/HTMLModule/Ruby.php';
require 'HTMLPurifier/HTMLModule/SafeEmbed.php';
require 'HTMLPurifier/HTMLModule/SafeObject.php';
require 'HTMLPurifier/HTMLModule/SafeScripting.php';
require 'HTMLPurifier/HTMLModule/Scripting.php';
require 'HTMLPurifier/HTMLModule/StyleAttribute.php';
require 'HTMLPurifier/HTMLModule/Tables.php';
require 'HTMLPurifier/HTMLModule/Target.php';
require 'HTMLPurifier/HTMLModule/TargetBlank.php';
require 'HTMLPurifier/HTMLModule/Text.php';
require 'HTMLPurifier/HTMLModule/Tidy.php';
require 'HTMLPurifier/HTMLModule/XMLCommonAttributes.php';
require 'HTMLPurifier/HTMLModule/Tidy/Name.php';
require 'HTMLPurifier/HTMLModule/Tidy/Proprietary.php';
require 'HTMLPurifier/HTMLModule/Tidy/XHTMLAndHTML4.php';
require 'HTMLPurifier/HTMLModule/Tidy/Strict.php';
require 'HTMLPurifier/HTMLModule/Tidy/Transitional.php';
require 'HTMLPurifier/HTMLModule/Tidy/XHTML.php';
require 'HTMLPurifier/Injector/AutoParagraph.php';
require 'HTMLPurifier/Injector/DisplayLinkURI.php';
require 'HTMLPurifier/Injector/Linkify.php';
require 'HTMLPurifier/Injector/PurifierLinkify.php';
require 'HTMLPurifier/Injector/RemoveEmpty.php';
require 'HTMLPurifier/Injector/RemoveSpansWithoutAttributes.php';
require 'HTMLPurifier/Injector/SafeObject.php';
require 'HTMLPurifier/Lexer/DOMLex.php';
require 'HTMLPurifier/Lexer/DirectLex.php';
require 'HTMLPurifier/Node/Comment.php';
require 'HTMLPurifier/Node/Element.php';
require 'HTMLPurifier/Node/Text.php';
require 'HTMLPurifier/Strategy/Composite.php';
require 'HTMLPurifier/Strategy/Core.php';
require 'HTMLPurifier/Strategy/FixNesting.php';
require 'HTMLPurifier/Strategy/MakeWellFormed.php';
require 'HTMLPurifier/Strategy/RemoveForeignElements.php';
require 'HTMLPurifier/Strategy/ValidateAttributes.php';
require 'HTMLPurifier/TagTransform/Font.php';
require 'HTMLPurifier/TagTransform/Simple.php';
require 'HTMLPurifier/Token/Comment.php';
require 'HTMLPurifier/Token/Tag.php';
require 'HTMLPurifier/Token/Empty.php';
require 'HTMLPurifier/Token/End.php';
require 'HTMLPurifier/Token/Start.php';
require 'HTMLPurifier/Token/Text.php';
require 'HTMLPurifier/URIFilter/DisableExternal.php';
require 'HTMLPurifier/URIFilter/DisableExternalResources.php';
require 'HTMLPurifier/URIFilter/DisableResources.php';
require 'HTMLPurifier/URIFilter/HostBlacklist.php';
require 'HTMLPurifier/URIFilter/MakeAbsolute.php';
require 'HTMLPurifier/URIFilter/Munge.php';
require 'HTMLPurifier/URIFilter/SafeIframe.php';
require 'HTMLPurifier/URIScheme/data.php';
require 'HTMLPurifier/URIScheme/file.php';
require 'HTMLPurifier/URIScheme/ftp.php';
require 'HTMLPurifier/URIScheme/http.php';
require 'HTMLPurifier/URIScheme/https.php';
require 'HTMLPurifier/URIScheme/mailto.php';
require 'HTMLPurifier/URIScheme/news.php';
require 'HTMLPurifier/URIScheme/nntp.php';
require 'HTMLPurifier/VarParser/Flexible.php';
require 'HTMLPurifier/VarParser/Native.php';

30
gulliver/thirdparty/HTMLPurifier/HTMLPurifier.kses.php vendored Normal file
View File

@@ -0,0 +1,30 @@
<?php
/**
* @file
* Emulation layer for code that used kses(), substituting in HTML Purifier.
*/
require_once dirname(__FILE__) . '/HTMLPurifier.auto.php';
function kses($string, $allowed_html, $allowed_protocols = null)
{
$config = HTMLPurifier_Config::createDefault();
$allowed_elements = array();
$allowed_attributes = array();
foreach ($allowed_html as $element => $attributes) {
$allowed_elements[$element] = true;
foreach ($attributes as $attribute => $x) {
$allowed_attributes["$element.$attribute"] = true;
}
}
$config->set('HTML.AllowedElements', $allowed_elements);
$config->set('HTML.AllowedAttributes', $allowed_attributes);
if ($allowed_protocols !== null) {
$config->set('URI.AllowedSchemes', $allowed_protocols);
}
$purifier = new HTMLPurifier($config);
return $purifier->purify($string);
}
// vim: et sw=4 sts=4

11
gulliver/thirdparty/HTMLPurifier/HTMLPurifier.path.php vendored Normal file
View File

@@ -0,0 +1,11 @@
<?php
/**
* @file
* Convenience stub file that adds HTML Purifier's library file to the path
* without any other side-effects.
*/
set_include_path(dirname(__FILE__) . PATH_SEPARATOR . get_include_path() );
// vim: et sw=4 sts=4

292
gulliver/thirdparty/HTMLPurifier/HTMLPurifier.php vendored Normal file
View File

@@ -0,0 +1,292 @@
<?php
/*! @mainpage
*
* HTML Purifier is an HTML filter that will take an arbitrary snippet of
* HTML and rigorously test, validate and filter it into a version that
* is safe for output onto webpages. It achieves this by:
*
* -# Lexing (parsing into tokens) the document,
* -# Executing various strategies on the tokens:
* -# Removing all elements not in the whitelist,
* -# Making the tokens well-formed,
* -# Fixing the nesting of the nodes, and
* -# Validating attributes of the nodes; and
* -# Generating HTML from the purified tokens.
*
* However, most users will only need to interface with the HTMLPurifier
* and HTMLPurifier_Config.
*/
/*
HTML Purifier 4.6.0 - Standards Compliant HTML Filtering
Copyright (C) 2006-2008 Edward Z. Yang
This library is free software; you can redistribute it and/or
modify it under the terms of the GNU Lesser General Public
License as published by the Free Software Foundation; either
version 2.1 of the License, or (at your option) any later version.
This library is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
Lesser General Public License for more details.
You should have received a copy of the GNU Lesser General Public
License along with this library; if not, write to the Free Software
Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
*/
/**
* Facade that coordinates HTML Purifier's subsystems in order to purify HTML.
*
* @note There are several points in which configuration can be specified
* for HTML Purifier. The precedence of these (from lowest to
* highest) is as follows:
* -# Instance: new HTMLPurifier($config)
* -# Invocation: purify($html, $config)
* These configurations are entirely independent of each other and
* are *not* merged (this behavior may change in the future).
*
* @todo We need an easier way to inject strategies using the configuration
* object.
*/
class HTMLPurifier
{
/**
* Version of HTML Purifier.
* @type string
*/
public $version = '4.6.0';
/**
* Constant with version of HTML Purifier.
*/
const VERSION = '4.6.0';
/**
* Global configuration object.
* @type HTMLPurifier_Config
*/
public $config;
/**
* Array of extra filter objects to run on HTML,
* for backwards compatibility.
* @type HTMLPurifier_Filter[]
*/
private $filters = array();
/**
* Single instance of HTML Purifier.
* @type HTMLPurifier
*/
private static $instance;
/**
* @type HTMLPurifier_Strategy_Core
*/
protected $strategy;
/**
* @type HTMLPurifier_Generator
*/
protected $generator;
/**
* Resultant context of last run purification.
* Is an array of contexts if the last called method was purifyArray().
* @type HTMLPurifier_Context
*/
public $context;
/**
* Initializes the purifier.
*
* @param HTMLPurifier_Config $config Optional HTMLPurifier_Config object
* for all instances of the purifier, if omitted, a default
* configuration is supplied (which can be overridden on a
* per-use basis).
* The parameter can also be any type that
* HTMLPurifier_Config::create() supports.
*/
public function __construct($config = null)
{
$this->config = HTMLPurifier_Config::create($config);
$this->strategy = new HTMLPurifier_Strategy_Core();
}
/**
* Adds a filter to process the output. First come first serve
*
* @param HTMLPurifier_Filter $filter HTMLPurifier_Filter object
*/
public function addFilter($filter)
{
trigger_error(
'HTMLPurifier->addFilter() is deprecated, use configuration directives' .
' in the Filter namespace or Filter.Custom',
E_USER_WARNING
);
$this->filters[] = $filter;
}
/**
* Filters an HTML snippet/document to be XSS-free and standards-compliant.
*
* @param string $html String of HTML to purify
* @param HTMLPurifier_Config $config Config object for this operation,
* if omitted, defaults to the config object specified during this
* object's construction. The parameter can also be any type
* that HTMLPurifier_Config::create() supports.
*
* @return string Purified HTML
*/
public function purify($html, $config = null)
{
// :TODO: make the config merge in, instead of replace
$config = $config ? HTMLPurifier_Config::create($config) : $this->config;
// implementation is partially environment dependant, partially
// configuration dependant
$lexer = HTMLPurifier_Lexer::create($config);
$context = new HTMLPurifier_Context();
// setup HTML generator
$this->generator = new HTMLPurifier_Generator($config, $context);
$context->register('Generator', $this->generator);
// set up global context variables
if ($config->get('Core.CollectErrors')) {
// may get moved out if other facilities use it
$language_factory = HTMLPurifier_LanguageFactory::instance();
$language = $language_factory->create($config, $context);
$context->register('Locale', $language);
$error_collector = new HTMLPurifier_ErrorCollector($context);
$context->register('ErrorCollector', $error_collector);
}
// setup id_accumulator context, necessary due to the fact that
// AttrValidator can be called from many places
$id_accumulator = HTMLPurifier_IDAccumulator::build($config, $context);
$context->register('IDAccumulator', $id_accumulator);
$html = HTMLPurifier_Encoder::convertToUTF8($html, $config, $context);
// setup filters
$filter_flags = $config->getBatch('Filter');
$custom_filters = $filter_flags['Custom'];
unset($filter_flags['Custom']);
$filters = array();
foreach ($filter_flags as $filter => $flag) {
if (!$flag) {
continue;
}
if (strpos($filter, '.') !== false) {
continue;
}
$class = "HTMLPurifier_Filter_$filter";
$filters[] = new $class;
}
foreach ($custom_filters as $filter) {
// maybe "HTMLPurifier_Filter_$filter", but be consistent with AutoFormat
$filters[] = $filter;
}
$filters = array_merge($filters, $this->filters);
// maybe prepare(), but later
for ($i = 0, $filter_size = count($filters); $i < $filter_size; $i++) {
$html = $filters[$i]->preFilter($html, $config, $context);
}
// purified HTML
$html =
$this->generator->generateFromTokens(
// list of tokens
$this->strategy->execute(
// list of un-purified tokens
$lexer->tokenizeHTML(
// un-purified HTML
$html,
$config,
$context
),
$config,
$context
)
);
for ($i = $filter_size - 1; $i >= 0; $i--) {
$html = $filters[$i]->postFilter($html, $config, $context);
}
$html = HTMLPurifier_Encoder::convertFromUTF8($html, $config, $context);
$this->context =& $context;
return $html;
}
/**
* Filters an array of HTML snippets
*
* @param string[] $array_of_html Array of html snippets
* @param HTMLPurifier_Config $config Optional config object for this operation.
* See HTMLPurifier::purify() for more details.
*
* @return string[] Array of purified HTML
*/
public function purifyArray($array_of_html, $config = null)
{
$context_array = array();
foreach ($array_of_html as $key => $html) {
$array_of_html[$key] = $this->purify($html, $config);
$context_array[$key] = $this->context;
}
$this->context = $context_array;
return $array_of_html;
}
/**
* Singleton for enforcing just one HTML Purifier in your system
*
* @param HTMLPurifier|HTMLPurifier_Config $prototype Optional prototype
* HTMLPurifier instance to overload singleton with,
* or HTMLPurifier_Config instance to configure the
* generated version with.
*
* @return HTMLPurifier
*/
public static function instance($prototype = null)
{
if (!self::$instance || $prototype) {
if ($prototype instanceof HTMLPurifier) {
self::$instance = $prototype;
} elseif ($prototype) {
self::$instance = new HTMLPurifier($prototype);
} else {
self::$instance = new HTMLPurifier();
}
}
return self::$instance;
}
/**
* Singleton for enforcing just one HTML Purifier in your system
*
* @param HTMLPurifier|HTMLPurifier_Config $prototype Optional prototype
* HTMLPurifier instance to overload singleton with,
* or HTMLPurifier_Config instance to configure the
* generated version with.
*
* @return HTMLPurifier
* @note Backwards compatibility, see instance()
*/
public static function getInstance($prototype = null)
{
return HTMLPurifier::instance($prototype);
}
}
// vim: et sw=4 sts=4

223
gulliver/thirdparty/HTMLPurifier/HTMLPurifier.safe-includes.php vendored Normal file
View File

@@ -0,0 +1,223 @@
<?php
/**
* @file
* This file was auto-generated by generate-includes.php and includes all of
* the core files required by HTML Purifier. This is a convenience stub that
* includes all files using dirname(__FILE__) and require_once. PLEASE DO NOT
* EDIT THIS FILE, changes will be overwritten the next time the script is run.
*
* Changes to include_path are not necessary.
*/
$__dir = dirname(__FILE__);
require_once $__dir . '/HTMLPurifier.php';
require_once $__dir . '/HTMLPurifier/Arborize.php';
require_once $__dir . '/HTMLPurifier/AttrCollections.php';
require_once $__dir . '/HTMLPurifier/AttrDef.php';
require_once $__dir . '/HTMLPurifier/AttrTransform.php';
require_once $__dir . '/HTMLPurifier/AttrTypes.php';
require_once $__dir . '/HTMLPurifier/AttrValidator.php';
require_once $__dir . '/HTMLPurifier/Bootstrap.php';
require_once $__dir . '/HTMLPurifier/Definition.php';
require_once $__dir . '/HTMLPurifier/CSSDefinition.php';
require_once $__dir . '/HTMLPurifier/ChildDef.php';
require_once $__dir . '/HTMLPurifier/Config.php';
require_once $__dir . '/HTMLPurifier/ConfigSchema.php';
require_once $__dir . '/HTMLPurifier/ContentSets.php';
require_once $__dir . '/HTMLPurifier/Context.php';
require_once $__dir . '/HTMLPurifier/DefinitionCache.php';
require_once $__dir . '/HTMLPurifier/DefinitionCacheFactory.php';
require_once $__dir . '/HTMLPurifier/Doctype.php';
require_once $__dir . '/HTMLPurifier/DoctypeRegistry.php';
require_once $__dir . '/HTMLPurifier/ElementDef.php';
require_once $__dir . '/HTMLPurifier/Encoder.php';
require_once $__dir . '/HTMLPurifier/EntityLookup.php';
require_once $__dir . '/HTMLPurifier/EntityParser.php';
require_once $__dir . '/HTMLPurifier/ErrorCollector.php';
require_once $__dir . '/HTMLPurifier/ErrorStruct.php';
require_once $__dir . '/HTMLPurifier/Exception.php';
require_once $__dir . '/HTMLPurifier/Filter.php';
require_once $__dir . '/HTMLPurifier/Generator.php';
require_once $__dir . '/HTMLPurifier/HTMLDefinition.php';
require_once $__dir . '/HTMLPurifier/HTMLModule.php';
require_once $__dir . '/HTMLPurifier/HTMLModuleManager.php';
require_once $__dir . '/HTMLPurifier/IDAccumulator.php';
require_once $__dir . '/HTMLPurifier/Injector.php';
require_once $__dir . '/HTMLPurifier/Language.php';
require_once $__dir . '/HTMLPurifier/LanguageFactory.php';
require_once $__dir . '/HTMLPurifier/Length.php';
require_once $__dir . '/HTMLPurifier/Lexer.php';
require_once $__dir . '/HTMLPurifier/Node.php';
require_once $__dir . '/HTMLPurifier/PercentEncoder.php';
require_once $__dir . '/HTMLPurifier/PropertyList.php';
require_once $__dir . '/HTMLPurifier/PropertyListIterator.php';
require_once $__dir . '/HTMLPurifier/Queue.php';
require_once $__dir . '/HTMLPurifier/Strategy.php';
require_once $__dir . '/HTMLPurifier/StringHash.php';
require_once $__dir . '/HTMLPurifier/StringHashParser.php';
require_once $__dir . '/HTMLPurifier/TagTransform.php';
require_once $__dir . '/HTMLPurifier/Token.php';
require_once $__dir . '/HTMLPurifier/TokenFactory.php';
require_once $__dir . '/HTMLPurifier/URI.php';
require_once $__dir . '/HTMLPurifier/URIDefinition.php';
require_once $__dir . '/HTMLPurifier/URIFilter.php';
require_once $__dir . '/HTMLPurifier/URIParser.php';
require_once $__dir . '/HTMLPurifier/URIScheme.php';
require_once $__dir . '/HTMLPurifier/URISchemeRegistry.php';
require_once $__dir . '/HTMLPurifier/UnitConverter.php';
require_once $__dir . '/HTMLPurifier/VarParser.php';
require_once $__dir . '/HTMLPurifier/VarParserException.php';
require_once $__dir . '/HTMLPurifier/Zipper.php';
require_once $__dir . '/HTMLPurifier/AttrDef/CSS.php';
require_once $__dir . '/HTMLPurifier/AttrDef/Clone.php';
require_once $__dir . '/HTMLPurifier/AttrDef/Enum.php';
require_once $__dir . '/HTMLPurifier/AttrDef/Integer.php';
require_once $__dir . '/HTMLPurifier/AttrDef/Lang.php';
require_once $__dir . '/HTMLPurifier/AttrDef/Switch.php';
require_once $__dir . '/HTMLPurifier/AttrDef/Text.php';
require_once $__dir . '/HTMLPurifier/AttrDef/URI.php';
require_once $__dir . '/HTMLPurifier/AttrDef/CSS/Number.php';
require_once $__dir . '/HTMLPurifier/AttrDef/CSS/AlphaValue.php';
require_once $__dir . '/HTMLPurifier/AttrDef/CSS/Background.php';
require_once $__dir . '/HTMLPurifier/AttrDef/CSS/BackgroundPosition.php';
require_once $__dir . '/HTMLPurifier/AttrDef/CSS/Border.php';
require_once $__dir . '/HTMLPurifier/AttrDef/CSS/Color.php';
require_once $__dir . '/HTMLPurifier/AttrDef/CSS/Composite.php';
require_once $__dir . '/HTMLPurifier/AttrDef/CSS/DenyElementDecorator.php';
require_once $__dir . '/HTMLPurifier/AttrDef/CSS/Filter.php';
require_once $__dir . '/HTMLPurifier/AttrDef/CSS/Font.php';
require_once $__dir . '/HTMLPurifier/AttrDef/CSS/FontFamily.php';
require_once $__dir . '/HTMLPurifier/AttrDef/CSS/Ident.php';
require_once $__dir . '/HTMLPurifier/AttrDef/CSS/ImportantDecorator.php';
require_once $__dir . '/HTMLPurifier/AttrDef/CSS/Length.php';
require_once $__dir . '/HTMLPurifier/AttrDef/CSS/ListStyle.php';
require_once $__dir . '/HTMLPurifier/AttrDef/CSS/Multiple.php';
require_once $__dir . '/HTMLPurifier/AttrDef/CSS/Percentage.php';
require_once $__dir . '/HTMLPurifier/AttrDef/CSS/TextDecoration.php';
require_once $__dir . '/HTMLPurifier/AttrDef/CSS/URI.php';
require_once $__dir . '/HTMLPurifier/AttrDef/HTML/Bool.php';
require_once $__dir . '/HTMLPurifier/AttrDef/HTML/Nmtokens.php';
require_once $__dir . '/HTMLPurifier/AttrDef/HTML/Class.php';
require_once $__dir . '/HTMLPurifier/AttrDef/HTML/Color.php';
require_once $__dir . '/HTMLPurifier/AttrDef/HTML/FrameTarget.php';
require_once $__dir . '/HTMLPurifier/AttrDef/HTML/ID.php';
require_once $__dir . '/HTMLPurifier/AttrDef/HTML/Pixels.php';
require_once $__dir . '/HTMLPurifier/AttrDef/HTML/Length.php';
require_once $__dir . '/HTMLPurifier/AttrDef/HTML/LinkTypes.php';
require_once $__dir . '/HTMLPurifier/AttrDef/HTML/MultiLength.php';
require_once $__dir . '/HTMLPurifier/AttrDef/URI/Email.php';
require_once $__dir . '/HTMLPurifier/AttrDef/URI/Host.php';
require_once $__dir . '/HTMLPurifier/AttrDef/URI/IPv4.php';
require_once $__dir . '/HTMLPurifier/AttrDef/URI/IPv6.php';
require_once $__dir . '/HTMLPurifier/AttrDef/URI/Email/SimpleCheck.php';
require_once $__dir . '/HTMLPurifier/AttrTransform/Background.php';
require_once $__dir . '/HTMLPurifier/AttrTransform/BdoDir.php';
require_once $__dir . '/HTMLPurifier/AttrTransform/BgColor.php';
require_once $__dir . '/HTMLPurifier/AttrTransform/BoolToCSS.php';
require_once $__dir . '/HTMLPurifier/AttrTransform/Border.php';
require_once $__dir . '/HTMLPurifier/AttrTransform/EnumToCSS.php';
require_once $__dir . '/HTMLPurifier/AttrTransform/ImgRequired.php';
require_once $__dir . '/HTMLPurifier/AttrTransform/ImgSpace.php';
require_once $__dir . '/HTMLPurifier/AttrTransform/Input.php';
require_once $__dir . '/HTMLPurifier/AttrTransform/Lang.php';
require_once $__dir . '/HTMLPurifier/AttrTransform/Length.php';
require_once $__dir . '/HTMLPurifier/AttrTransform/Name.php';
require_once $__dir . '/HTMLPurifier/AttrTransform/NameSync.php';
require_once $__dir . '/HTMLPurifier/AttrTransform/Nofollow.php';
require_once $__dir . '/HTMLPurifier/AttrTransform/SafeEmbed.php';
require_once $__dir . '/HTMLPurifier/AttrTransform/SafeObject.php';
require_once $__dir . '/HTMLPurifier/AttrTransform/SafeParam.php';
require_once $__dir . '/HTMLPurifier/AttrTransform/ScriptRequired.php';
require_once $__dir . '/HTMLPurifier/AttrTransform/TargetBlank.php';
require_once $__dir . '/HTMLPurifier/AttrTransform/Textarea.php';
require_once $__dir . '/HTMLPurifier/ChildDef/Chameleon.php';
require_once $__dir . '/HTMLPurifier/ChildDef/Custom.php';
require_once $__dir . '/HTMLPurifier/ChildDef/Empty.php';
require_once $__dir . '/HTMLPurifier/ChildDef/List.php';
require_once $__dir . '/HTMLPurifier/ChildDef/Required.php';
require_once $__dir . '/HTMLPurifier/ChildDef/Optional.php';
require_once $__dir . '/HTMLPurifier/ChildDef/StrictBlockquote.php';
require_once $__dir . '/HTMLPurifier/ChildDef/Table.php';
require_once $__dir . '/HTMLPurifier/DefinitionCache/Decorator.php';
require_once $__dir . '/HTMLPurifier/DefinitionCache/Null.php';
require_once $__dir . '/HTMLPurifier/DefinitionCache/Serializer.php';
require_once $__dir . '/HTMLPurifier/DefinitionCache/Decorator/Cleanup.php';
require_once $__dir . '/HTMLPurifier/DefinitionCache/Decorator/Memory.php';
require_once $__dir . '/HTMLPurifier/HTMLModule/Bdo.php';
require_once $__dir . '/HTMLPurifier/HTMLModule/CommonAttributes.php';
require_once $__dir . '/HTMLPurifier/HTMLModule/Edit.php';
require_once $__dir . '/HTMLPurifier/HTMLModule/Forms.php';
require_once $__dir . '/HTMLPurifier/HTMLModule/Hypertext.php';
require_once $__dir . '/HTMLPurifier/HTMLModule/Iframe.php';
require_once $__dir . '/HTMLPurifier/HTMLModule/Image.php';
require_once $__dir . '/HTMLPurifier/HTMLModule/Legacy.php';
require_once $__dir . '/HTMLPurifier/HTMLModule/List.php';
require_once $__dir . '/HTMLPurifier/HTMLModule/Name.php';
require_once $__dir . '/HTMLPurifier/HTMLModule/Nofollow.php';
require_once $__dir . '/HTMLPurifier/HTMLModule/NonXMLCommonAttributes.php';
require_once $__dir . '/HTMLPurifier/HTMLModule/Object.php';
require_once $__dir . '/HTMLPurifier/HTMLModule/Presentation.php';
require_once $__dir . '/HTMLPurifier/HTMLModule/Proprietary.php';
require_once $__dir . '/HTMLPurifier/HTMLModule/Ruby.php';
require_once $__dir . '/HTMLPurifier/HTMLModule/SafeEmbed.php';
require_once $__dir . '/HTMLPurifier/HTMLModule/SafeObject.php';
require_once $__dir . '/HTMLPurifier/HTMLModule/SafeScripting.php';
require_once $__dir . '/HTMLPurifier/HTMLModule/Scripting.php';
require_once $__dir . '/HTMLPurifier/HTMLModule/StyleAttribute.php';
require_once $__dir . '/HTMLPurifier/HTMLModule/Tables.php';
require_once $__dir . '/HTMLPurifier/HTMLModule/Target.php';
require_once $__dir . '/HTMLPurifier/HTMLModule/TargetBlank.php';
require_once $__dir . '/HTMLPurifier/HTMLModule/Text.php';
require_once $__dir . '/HTMLPurifier/HTMLModule/Tidy.php';
require_once $__dir . '/HTMLPurifier/HTMLModule/XMLCommonAttributes.php';
require_once $__dir . '/HTMLPurifier/HTMLModule/Tidy/Name.php';
require_once $__dir . '/HTMLPurifier/HTMLModule/Tidy/Proprietary.php';
require_once $__dir . '/HTMLPurifier/HTMLModule/Tidy/XHTMLAndHTML4.php';
require_once $__dir . '/HTMLPurifier/HTMLModule/Tidy/Strict.php';
require_once $__dir . '/HTMLPurifier/HTMLModule/Tidy/Transitional.php';
require_once $__dir . '/HTMLPurifier/HTMLModule/Tidy/XHTML.php';
require_once $__dir . '/HTMLPurifier/Injector/AutoParagraph.php';
require_once $__dir . '/HTMLPurifier/Injector/DisplayLinkURI.php';
require_once $__dir . '/HTMLPurifier/Injector/Linkify.php';
require_once $__dir . '/HTMLPurifier/Injector/PurifierLinkify.php';
require_once $__dir . '/HTMLPurifier/Injector/RemoveEmpty.php';
require_once $__dir . '/HTMLPurifier/Injector/RemoveSpansWithoutAttributes.php';
require_once $__dir . '/HTMLPurifier/Injector/SafeObject.php';
require_once $__dir . '/HTMLPurifier/Lexer/DOMLex.php';
require_once $__dir . '/HTMLPurifier/Lexer/DirectLex.php';
require_once $__dir . '/HTMLPurifier/Node/Comment.php';
require_once $__dir . '/HTMLPurifier/Node/Element.php';
require_once $__dir . '/HTMLPurifier/Node/Text.php';
require_once $__dir . '/HTMLPurifier/Strategy/Composite.php';
require_once $__dir . '/HTMLPurifier/Strategy/Core.php';
require_once $__dir . '/HTMLPurifier/Strategy/FixNesting.php';
require_once $__dir . '/HTMLPurifier/Strategy/MakeWellFormed.php';
require_once $__dir . '/HTMLPurifier/Strategy/RemoveForeignElements.php';
require_once $__dir . '/HTMLPurifier/Strategy/ValidateAttributes.php';
require_once $__dir . '/HTMLPurifier/TagTransform/Font.php';
require_once $__dir . '/HTMLPurifier/TagTransform/Simple.php';
require_once $__dir . '/HTMLPurifier/Token/Comment.php';
require_once $__dir . '/HTMLPurifier/Token/Tag.php';
require_once $__dir . '/HTMLPurifier/Token/Empty.php';
require_once $__dir . '/HTMLPurifier/Token/End.php';
require_once $__dir . '/HTMLPurifier/Token/Start.php';
require_once $__dir . '/HTMLPurifier/Token/Text.php';
require_once $__dir . '/HTMLPurifier/URIFilter/DisableExternal.php';
require_once $__dir . '/HTMLPurifier/URIFilter/DisableExternalResources.php';
require_once $__dir . '/HTMLPurifier/URIFilter/DisableResources.php';
require_once $__dir . '/HTMLPurifier/URIFilter/HostBlacklist.php';
require_once $__dir . '/HTMLPurifier/URIFilter/MakeAbsolute.php';
require_once $__dir . '/HTMLPurifier/URIFilter/Munge.php';
require_once $__dir . '/HTMLPurifier/URIFilter/SafeIframe.php';
require_once $__dir . '/HTMLPurifier/URIScheme/data.php';
require_once $__dir . '/HTMLPurifier/URIScheme/file.php';
require_once $__dir . '/HTMLPurifier/URIScheme/ftp.php';
require_once $__dir . '/HTMLPurifier/URIScheme/http.php';
require_once $__dir . '/HTMLPurifier/URIScheme/https.php';
require_once $__dir . '/HTMLPurifier/URIScheme/mailto.php';
require_once $__dir . '/HTMLPurifier/URIScheme/news.php';
require_once $__dir . '/HTMLPurifier/URIScheme/nntp.php';
require_once $__dir . '/HTMLPurifier/VarParser/Flexible.php';
require_once $__dir . '/HTMLPurifier/VarParser/Native.php';

71
gulliver/thirdparty/HTMLPurifier/HTMLPurifier/Arborize.php vendored Normal file
View File

@@ -0,0 +1,71 @@
<?php
/**
* Converts a stream of HTMLPurifier_Token into an HTMLPurifier_Node,
* and back again.
*
* @note This transformation is not an equivalence. We mutate the input
* token stream to make it so; see all [MUT] markers in code.
*/
class HTMLPurifier_Arborize
{
public static function arborize($tokens, $config, $context) {
$definition = $config->getHTMLDefinition();
$parent = new HTMLPurifier_Token_Start($definition->info_parent);
$stack = array($parent->toNode());
foreach ($tokens as $token) {
$token->skip = null; // [MUT]
$token->carryover = null; // [MUT]
if ($token instanceof HTMLPurifier_Token_End) {
$token->start = null; // [MUT]
$r = array_pop($stack);
assert($r->name === $token->name);
assert(empty($token->attr));
$r->endCol = $token->col;
$r->endLine = $token->line;
$r->endArmor = $token->armor;
continue;
}
$node = $token->toNode();
$stack[count($stack)-1]->children[] = $node;
if ($token instanceof HTMLPurifier_Token_Start) {
$stack[] = $node;
}
}
assert(count($stack) == 1);
return $stack[0];
}
public static function flatten($node, $config, $context) {
$level = 0;
$nodes = array($level => new HTMLPurifier_Queue(array($node)));
$closingTokens = array();
$tokens = array();
do {
while (!$nodes[$level]->isEmpty()) {
$node = $nodes[$level]->shift(); // FIFO
list($start, $end) = $node->toTokenPair();
if ($level > 0) {
$tokens[] = $start;
}
if ($end !== NULL) {
$closingTokens[$level][] = $end;
}
if ($node instanceof HTMLPurifier_Node_Element) {
$level++;
$nodes[$level] = new HTMLPurifier_Queue();
foreach ($node->children as $childNode) {
$nodes[$level]->push($childNode);
}
}
}
$level--;
if ($level && isset($closingTokens[$level])) {
while ($token = array_pop($closingTokens[$level])) {
$tokens[] = $token;
}
}
} while ($level > 0);
return $tokens;
}
}

143
gulliver/thirdparty/HTMLPurifier/HTMLPurifier/AttrCollections.php vendored Normal file
View File

@@ -0,0 +1,143 @@
<?php
/**
* Defines common attribute collections that modules reference
*/
class HTMLPurifier_AttrCollections
{
/**
* Associative array of attribute collections, indexed by name.
* @type array
*/
public $info = array();
/**
* Performs all expansions on internal data for use by other inclusions
* It also collects all attribute collection extensions from
* modules
* @param HTMLPurifier_AttrTypes $attr_types HTMLPurifier_AttrTypes instance
* @param HTMLPurifier_HTMLModule[] $modules Hash array of HTMLPurifier_HTMLModule members
*/
public function __construct($attr_types, $modules)
{
// load extensions from the modules
foreach ($modules as $module) {
foreach ($module->attr_collections as $coll_i => $coll) {
if (!isset($this->info[$coll_i])) {
$this->info[$coll_i] = array();
}
foreach ($coll as $attr_i => $attr) {
if ($attr_i === 0 && isset($this->info[$coll_i][$attr_i])) {
// merge in includes
$this->info[$coll_i][$attr_i] = array_merge(
$this->info[$coll_i][$attr_i],
$attr
);
continue;
}
$this->info[$coll_i][$attr_i] = $attr;
}
}
}
// perform internal expansions and inclusions
foreach ($this->info as $name => $attr) {
// merge attribute collections that include others
$this->performInclusions($this->info[$name]);
// replace string identifiers with actual attribute objects
$this->expandIdentifiers($this->info[$name], $attr_types);
}
}
/**
* Takes a reference to an attribute associative array and performs
* all inclusions specified by the zero index.
* @param array &$attr Reference to attribute array
*/
public function performInclusions(&$attr)
{
if (!isset($attr[0])) {
return;
}
$merge = $attr[0];
$seen = array(); // recursion guard
// loop through all the inclusions
for ($i = 0; isset($merge[$i]); $i++) {
if (isset($seen[$merge[$i]])) {
continue;
}
$seen[$merge[$i]] = true;
// foreach attribute of the inclusion, copy it over
if (!isset($this->info[$merge[$i]])) {
continue;
}
foreach ($this->info[$merge[$i]] as $key => $value) {
if (isset($attr[$key])) {
continue;
} // also catches more inclusions
$attr[$key] = $value;
}
if (isset($this->info[$merge[$i]][0])) {
// recursion
$merge = array_merge($merge, $this->info[$merge[$i]][0]);
}
}
unset($attr[0]);
}
/**
* Expands all string identifiers in an attribute array by replacing
* them with the appropriate values inside HTMLPurifier_AttrTypes
* @param array &$attr Reference to attribute array
* @param HTMLPurifier_AttrTypes $attr_types HTMLPurifier_AttrTypes instance
*/
public function expandIdentifiers(&$attr, $attr_types)
{
// because foreach will process new elements we add, make sure we
// skip duplicates
$processed = array();
foreach ($attr as $def_i => $def) {
// skip inclusions
if ($def_i === 0) {
continue;
}
if (isset($processed[$def_i])) {
continue;
}
// determine whether or not attribute is required
if ($required = (strpos($def_i, '*') !== false)) {
// rename the definition
unset($attr[$def_i]);
$def_i = trim($def_i, '*');
$attr[$def_i] = $def;
}
$processed[$def_i] = true;
// if we've already got a literal object, move on
if (is_object($def)) {
// preserve previous required
$attr[$def_i]->required = ($required || $attr[$def_i]->required);
continue;
}
if ($def === false) {
unset($attr[$def_i]);
continue;
}
if ($t = $attr_types->get($def)) {
$attr[$def_i] = $t;
$attr[$def_i]->required = $required;
} else {
unset($attr[$def_i]);
}
}
}
}
// vim: et sw=4 sts=4

138
gulliver/thirdparty/HTMLPurifier/HTMLPurifier/AttrDef.php vendored Normal file
View File

@@ -0,0 +1,138 @@
<?php
/**
* Base class for all validating attribute definitions.
*
* This family of classes forms the core for not only HTML attribute validation,
* but also any sort of string that needs to be validated or cleaned (which
* means CSS properties and composite definitions are defined here too).
* Besides defining (through code) what precisely makes the string valid,
* subclasses are also responsible for cleaning the code if possible.
*/
abstract class HTMLPurifier_AttrDef
{
/**
* Tells us whether or not an HTML attribute is minimized.
* Has no meaning in other contexts.
* @type bool
*/
public $minimized = false;
/**
* Tells us whether or not an HTML attribute is required.
* Has no meaning in other contexts
* @type bool
*/
public $required = false;
/**
* Validates and cleans passed string according to a definition.
*
* @param string $string String to be validated and cleaned.
* @param HTMLPurifier_Config $config Mandatory HTMLPurifier_Config object.
* @param HTMLPurifier_Context $context Mandatory HTMLPurifier_Context object.
*/
abstract public function validate($string, $config, $context);
/**
* Convenience method that parses a string as if it were CDATA.
*
* This method process a string in the manner specified at
* <http://www.w3.org/TR/html4/types.html#h-6.2> by removing
* leading and trailing whitespace, ignoring line feeds, and replacing
* carriage returns and tabs with spaces. While most useful for HTML
* attributes specified as CDATA, it can also be applied to most CSS
* values.
*
* @note This method is not entirely standards compliant, as trim() removes
* more types of whitespace than specified in the spec. In practice,
* this is rarely a problem, as those extra characters usually have
* already been removed by HTMLPurifier_Encoder.
*
* @warning This processing is inconsistent with XML's whitespace handling
* as specified by section 3.3.3 and referenced XHTML 1.0 section
* 4.7. However, note that we are NOT necessarily
* parsing XML, thus, this behavior may still be correct. We
* assume that newlines have been normalized.
*/
public function parseCDATA($string)
{
$string = trim($string);
$string = str_replace(array("\n", "\t", "\r"), ' ', $string);
return $string;
}
/**
* Factory method for creating this class from a string.
* @param string $string String construction info
* @return HTMLPurifier_AttrDef Created AttrDef object corresponding to $string
*/
public function make($string)
{
// default implementation, return a flyweight of this object.
// If $string has an effect on the returned object (i.e. you
// need to overload this method), it is best
// to clone or instantiate new copies. (Instantiation is safer.)
return $this;
}
/**
* Removes spaces from rgb(0, 0, 0) so that shorthand CSS properties work
* properly. THIS IS A HACK!
* @param string $string a CSS colour definition
* @return string
*/
protected function mungeRgb($string)
{
return preg_replace('/rgb\((\d+)\s*,\s*(\d+)\s*,\s*(\d+)\)/', 'rgb(\1,\2,\3)', $string);
}
/**
* Parses a possibly escaped CSS string and returns the "pure"
* version of it.
*/
protected function expandCSSEscape($string)
{
// flexibly parse it
$ret = '';
for ($i = 0, $c = strlen($string); $i < $c; $i++) {
if ($string[$i] === '\\') {
$i++;
if ($i >= $c) {
$ret .= '\\';
break;
}
if (ctype_xdigit($string[$i])) {
$code = $string[$i];
for ($a = 1, $i++; $i < $c && $a < 6; $i++, $a++) {
if (!ctype_xdigit($string[$i])) {
break;
}
$code .= $string[$i];
}
// We have to be extremely careful when adding
// new characters, to make sure we're not breaking
// the encoding.
$char = HTMLPurifier_Encoder::unichr(hexdec($code));
if (HTMLPurifier_Encoder::cleanUTF8($char) === '') {
continue;
}
$ret .= $char;
if ($i < $c && trim($string[$i]) !== '') {
$i--;
}
continue;
}
if ($string[$i] === "\n") {
continue;
}
}
$ret .= $string[$i];
}
return $ret;
}
}
// vim: et sw=4 sts=4

106
gulliver/thirdparty/HTMLPurifier/HTMLPurifier/AttrDef/CSS.php vendored Normal file
View File

@@ -0,0 +1,106 @@
<?php
/**
* Validates the HTML attribute style, otherwise known as CSS.
* @note We don't implement the whole CSS specification, so it might be
* difficult to reuse this component in the context of validating
* actual stylesheet declarations.
* @note If we were really serious about validating the CSS, we would
* tokenize the styles and then parse the tokens. Obviously, we
* are not doing that. Doing that could seriously harm performance,
* but would make these components a lot more viable for a CSS
* filtering solution.
*/
class HTMLPurifier_AttrDef_CSS extends HTMLPurifier_AttrDef
{
/**
* @param string $css
* @param HTMLPurifier_Config $config
* @param HTMLPurifier_Context $context
* @return bool|string
*/
public function validate($css, $config, $context)
{
$css = $this->parseCDATA($css);
$definition = $config->getCSSDefinition();
// we're going to break the spec and explode by semicolons.
// This is because semicolon rarely appears in escaped form
// Doing this is generally flaky but fast
// IT MIGHT APPEAR IN URIs, see HTMLPurifier_AttrDef_CSSURI
// for details
$declarations = explode(';', $css);
$propvalues = array();
/**
* Name of the current CSS property being validated.
*/
$property = false;
$context->register('CurrentCSSProperty', $property);
foreach ($declarations as $declaration) {
if (!$declaration) {
continue;
}
if (!strpos($declaration, ':')) {
continue;
}
list($property, $value) = explode(':', $declaration, 2);
$property = trim($property);
$value = trim($value);
$ok = false;
do {
if (isset($definition->info[$property])) {
$ok = true;
break;
}
if (ctype_lower($property)) {
break;
}
$property = strtolower($property);
if (isset($definition->info[$property])) {
$ok = true;
break;
}
} while (0);
if (!$ok) {
continue;
}
// inefficient call, since the validator will do this again
if (strtolower(trim($value)) !== 'inherit') {
// inherit works for everything (but only on the base property)
$result = $definition->info[$property]->validate(
$value,
$config,
$context
);
} else {
$result = 'inherit';
}
if ($result === false) {
continue;
}
$propvalues[$property] = $result;
}
$context->destroy('CurrentCSSProperty');
// procedure does not write the new CSS simultaneously, so it's
// slightly inefficient, but it's the only way of getting rid of
// duplicates. Perhaps config to optimize it, but not now.
$new_declarations = '';
foreach ($propvalues as $prop => $value) {
$new_declarations .= "$prop:$value;";
}
return $new_declarations ? $new_declarations : false;
}
}
// vim: et sw=4 sts=4

Some files were not shown because too many files have changed in this diff Show More