| CODENOTIFIER | HelpYou are not signed inSign in |
Project: Joomla
Revision: 10333
Author: instance
Date: 25 May 2008 11:34:37
Changes:Formatting and documentation changes... Mostly wrapping very long lines.
Files:| ... | ...@@ -1,10 +1,10 @@ | |
| 1 | 1 | <?php |
| 2 | 2 | /** |
| 3 | * @version $Id$ | |
| 4 | * @package Joomla.Framework | |
| 5 | * @subpackage Filter | |
| 6 | * @copyright Copyright (C) 2005 - 2008 Open Source Matters. All rights reserved. | |
| 7 | * @license GNU/GPL, see LICENSE.php | |
| 3 | * @version $Id$ | |
| 4 | * @package Joomla.Framework | |
| 5 | * @subpackage Filter | |
| 6 | * @copyright Copyright (C) 2005 - 2008 Open Source Matters. All rights reserved. | |
| 7 | * @license GNU/GPL, see LICENSE.php | |
| 8 | 8 | * Joomla! is free software. This version may have been modified pursuant to the |
| 9 | 9 | * GNU General Public License, and as distributed it includes or is derivative |
| 10 | 10 | * of works licensed under the GNU General Public License or other free or open |
| ... | ...@@ -19,12 +19,13 @@ | |
| 19 | 19 | * JFilterInput is a class for filtering input from any data source |
| 20 | 20 | * |
| 21 | 21 | * Forked from the php input filter library by: Daniel Morris <dan@rootcube.com> |
| 22 | * Original Contributors: Gianpaolo Racca, Ghislain Picard, Marco Wandschneider, Chris Tobin and Andrew Eddie. | |
| 22 | * Original Contributors: Gianpaolo Racca, Ghislain Picard, Marco Wandschneider, | |
| 23 | * Chris Tobin and Andrew Eddie. | |
| 23 | 24 | * |
| 24 | * @author Louis Landry <louis.landry@joomla.org> | |
| 25 | * @package Joomla.Framework | |
| 26 | * @subpackage Filter | |
| 27 | * @since 1.5 | |
| 25 | * @author Louis Landry <louis.landry@joomla.org> | |
| 26 | * @package Joomla.Framework | |
| 27 | * @subpackage Filter | |
| 28 | * @since 1.5 | |
| 28 | 29 | */ |
| 29 | 30 | class JFilterInput extends JObject |
| 30 | 31 | { |
| ... | ...@@ -35,61 +36,92 @@ | |
| 35 | 36 | var $attrMethod; // default = 0 |
| 36 | 37 | |
| 37 | 38 | var $xssAuto; // default = 1 |
| 38 | var $tagBlacklist = array ('applet', 'body', 'bgsound', 'base', 'basefont', 'embed', 'frame', 'frameset', 'head', 'html', 'id', 'iframe', 'ilayer', 'layer', 'link', 'meta', 'name', 'object', 'script', 'style', 'title', 'xml'); | |
| 39 | var $attrBlacklist = array ('action', 'background', 'codebase', 'dynsrc', 'lowsrc'); // also will strip ALL event handlers | |
| 39 | ||
| 40 | /** | |
| 41 | * HTML tag black list. Any HTML in these elements will be removed. | |
| 42 | * | |
| 43 | * @var array | |
| 44 | */ | |
| 45 | var $tagBlacklist = array ( | |
| 46 | 'applet', 'body', 'bgsound', 'base', 'basefont', 'embed', | |
| 47 | 'frame', 'frameset', 'head', 'html', 'id', 'iframe', 'ilayer', | |
| 48 | 'layer', 'link', 'meta', 'name', 'object', 'script', 'style', | |
| 49 | 'title', 'xml' | |
| 50 | ); | |
| 51 | ||
| 52 | /** | |
| 53 | * Attribute black list. These attributes will be removed from HTML | |
| 54 | * elements. Also will strip ALL event handlers. | |
| 55 | * | |
| 56 | * @var array | |
| 57 | */ | |
| 58 | var $attrBlacklist = array ( | |
| 59 | 'action', 'background', 'codebase', 'dynsrc', 'lowsrc' | |
| 60 | ); | |
| 40 | 61 | |
| 41 | 62 | /** |
| 42 | 63 | * Constructor for inputFilter class. Only first parameter is required. |
| 43 | 64 | * |
| 44 | * @access protected | |
| 45 | * @param array $tagsArray list of user-defined tags | |
| 46 | * @param array $attrArray list of user-defined attributes | |
| 47 | * @param int $tagsMethod WhiteList method = 0, BlackList method = 1 | |
| 48 | * @param int $attrMethod WhiteList method = 0, BlackList method = 1 | |
| 49 | * @param int $xssAuto Only auto clean essentials = 0, Allow clean blacklisted tags/attr = 1 | |
| 50 | * @since 1.5 | |
| 65 | * @access protected | |
| 66 | * @param array $tagsArray list of user-defined tags | |
| 67 | * @param array $attrArray list of user-defined attributes | |
| 68 | * @param int $tagsMethod WhiteList method = 0, BlackList method = 1 | |
| 69 | * @param int $attrMethod WhiteList method = 0, BlackList method = 1 | |
| 70 | * @param int $xssAuto Only auto clean essentials = 0, Allow clean | |
| 71 | * blacklisted tags/attr = 1 | |
| 72 | * @since 1.5 | |
| 51 | 73 | */ |
| 52 | function __construct($tagsArray = array(), $attrArray = array(), $tagsMethod = 0, $attrMethod = 0, $xssAuto = 1) | |
| 53 | { | |
| 74 | function __construct( | |
| 75 | $tagsArray = array(), $attrArray = array(), $tagsMethod = 0, | |
| 76 | $attrMethod = 0, $xssAuto = 1 | |
| 77 | ) { | |
| 54 | 78 | // Make sure user defined arrays are in lowercase |
| 55 | 79 | $tagsArray = array_map('strtolower', (array) $tagsArray); |
| 56 | 80 | $attrArray = array_map('strtolower', (array) $attrArray); |
| 57 | 81 | |
| 58 | 82 | // Assign member variables |
| 59 | $this->tagsArray = $tagsArray; | |
| 60 | $this->attrArray = $attrArray; | |
| 61 | $this->tagsMethod = $tagsMethod; | |
| 62 | $this->attrMethod = $attrMethod; | |
| 63 | $this->xssAuto = $xssAuto; | |
| 83 | $this->tagsArray = $tagsArray; | |
| 84 | $this->attrArray = $attrArray; | |
| 85 | $this->tagsMethod = $tagsMethod; | |
| 86 | $this->attrMethod = $attrMethod; | |
| 87 | $this->xssAuto = $xssAuto; | |
| 64 | 88 | } |
| 65 | 89 | |
| 66 | 90 | /** |
| 67 | * Returns a reference to an input filter object, only creating it if it doesn't already exist. | |
| 91 | * Returns a reference to an input filter object, only creating it if it | |
| 92 | * doesn't already exist. | |
| 68 | 93 | * |
| 69 | 94 | * This method must be invoked as: |
| 70 | * <pre> $filter = & JFilterInput::getInstance();</pre> | |
| 95 | * <pre> $filter = & JFilterInput::getInstance();</pre> | |
| 71 | 96 | * |
| 72 | 97 | * @static |
| 73 | * @param array $tagsArray list of user-defined tags | |
| 74 | * @param array $attrArray list of user-defined attributes | |
| 75 | * @param int $tagsMethod WhiteList method = 0, BlackList method = 1 | |
| 76 | * @param int $attrMethod WhiteList method = 0, BlackList method = 1 | |
| 77 | * @param int $xssAuto Only auto clean essentials = 0, Allow clean blacklisted tags/attr = 1 | |
| 78 | * @return object The JFilterInput object. | |
| 79 | * @since 1.5 | |
| 98 | * @param array $tagsArray list of user-defined tags | |
| 99 | * @param array $attrArray list of user-defined attributes | |
| 100 | * @param int $tagsMethod WhiteList method = 0, BlackList method = 1 | |
| 101 | * @param int $attrMethod WhiteList method = 0, BlackList method = 1 | |
| 102 | * @param int $xssAuto Only auto clean essentials = 0, Allow clean | |
| 103 | * blacklisted tags/attr = 1 | |
| 104 | * @return object The JFilterInput object. | |
| 105 | * @since 1.5 | |
| 80 | 106 | */ |
| 81 | function & getInstance($tagsArray = array(), $attrArray = array(), $tagsMethod = 0, $attrMethod = 0, $xssAuto = 1) | |
| 82 | { | |
| 107 | function & getInstance( | |
| 108 | $tagsArray = array(), $attrArray = array(), $tagsMethod = 0, | |
| 109 | $attrMethod = 0, $xssAuto = 1 | |
| 110 | ) { | |
| 83 | 111 | static $instances; |
| 84 | 112 | |
| 85 | $sig = md5(serialize(array($tagsArray,$attrArray,$tagsMethod,$attrMethod,$xssAuto))); | |
| 113 | $sig = md5(serialize( | |
| 114 | array($tagsArray, $attrArray, $tagsMethod, $attrMethod, $xssAuto) | |
| 115 | )); | |
| 86 | 116 | |
| 87 | 117 | if (!isset ($instances)) { |
| 88 | 118 | $instances = array(); |
| 89 | 119 | } |
| 90 | 120 | |
| 91 | if (empty ($instances[$sig])) { | |
| 92 | $instances[$sig] = new JFilterInput($tagsArray, $attrArray, $tagsMethod, $attrMethod, $xssAuto); | |
| 121 | if (empty($instances[$sig])) { | |
| 122 | $instances[$sig] = new JFilterInput( | |
| 123 | $tagsArray, $attrArray, $tagsMethod, $attrMethod, $xssAuto | |
| 124 | ); | |
| 93 | 125 | } |
| 94 | 126 | |
| 95 | 127 | return $instances[$sig]; |
| ... | ...@@ -99,11 +131,12 @@ | |
| 99 | 131 | * Method to be called by another php script. Processes for XSS and |
| 100 | 132 | * specified bad code. |
| 101 | 133 | * |
| 102 | * @access public | |
| 103 | * @param mixed $source Input string/array-of-string to be 'cleaned' | |
| 104 | * @param string $type Return type for the variable (INT, FLOAT, BOOLEAN, WORD, ALNUM, CMD, BASE64, STRING, ARRAY, PATH, NONE) | |
| 105 | * @return mixed 'Cleaned' version of input parameter | |
| 106 | * @since 1.5 | |
| 134 | * @access public | |
| 135 | * @param mixed $source Input string/array-of-string to be 'cleaned' | |
| 136 | * @param string $type Return type for the variable (INT, FLOAT, | |
| 137 | * BOOLEAN, WORD, ALNUM, CMD, BASE64, STRING, ARRAY, PATH, NONE) | |
| 138 | * @return mixed 'Cleaned' version of input parameter | |
| 139 | * @since 1.5 | |
| 107 | 140 | * @static |
| 108 | 141 | */ |
| 109 | 142 | function clean($source, $type='string') |
| ... | ...@@ -207,24 +240,31 @@ | |
| 207 | 240 | * Function to determine if contents of an attribute is safe |
| 208 | 241 | * |
| 209 | 242 | * @static |
| 210 | * @param array $attrSubSet A 2 element array for attributes name,value | |
| 211 | * @return boolean True if bad code is detected | |
| 212 | * @since 1.5 | |
| 243 | * @param array $attrSubSet A two element array for attributes name, | |
| 244 | * value. | |
| 245 | * @return boolean True if bad code is detected. | |
| 246 | * @since 1.5 | |
| 213 | 247 | */ |
| 214 | 248 | function checkAttribute($attrSubSet) |
| 215 | 249 | { |
| 216 | 250 | $attrSubSet[0] = strtolower($attrSubSet[0]); |
| 217 | 251 | $attrSubSet[1] = strtolower($attrSubSet[1]); |
| 218 | return (((strpos($attrSubSet[1], 'expression') !== false) && ($attrSubSet[0]) == 'style') || (strpos($attrSubSet[1], 'javascript:') !== false) || (strpos($attrSubSet[1], 'behaviour:') !== false) || (strpos($attrSubSet[1], 'vbscript:') !== false) || (strpos($attrSubSet[1], 'mocha:') !== false) || (strpos($attrSubSet[1], 'livescript:') !== false)); | |
| 252 | return (((strpos($attrSubSet[1], 'expression') !== false) | |
| 253 | && ($attrSubSet[0]) == 'style') | |
| 254 | || (strpos($attrSubSet[1], 'javascript:') !== false) | |
| 255 | || (strpos($attrSubSet[1], 'behaviour:') !== false) | |
| 256 | || (strpos($attrSubSet[1], 'vbscript:') !== false) | |
| 257 | || (strpos($attrSubSet[1], 'mocha:') !== false) | |
| 258 | || (strpos($attrSubSet[1], 'livescript:') !== false)); | |
| 219 | 259 | } |
| 220 | 260 | |
| 221 | 261 | /** |
| 222 | 262 | * Internal method to iteratively remove all unwanted tags and attributes |
| 223 | 263 | * |
| 224 | * @access protected | |
| 225 | * @param string $source Input string to be 'cleaned' | |
| 226 | * @return string 'Cleaned' version of input parameter | |
| 227 | * @since 1.5 | |
| 264 | * @access protected | |
| 265 | * @param string $source Input string to be 'cleaned' | |
| 266 | * @return string 'Cleaned' version of input parameter | |
| 267 | * @since 1.5 | |
| 228 | 268 | */ |
| 229 | 269 | function _remove($source) |
| 230 | 270 | { |
| ... | ...@@ -242,10 +282,10 @@ | |
| 242 | 282 | /** |
| 243 | 283 | * Internal method to strip a string of certain tags |
| 244 | 284 | * |
| 245 | * @access protected | |
| 246 | * @param string $source Input string to be 'cleaned' | |
| 247 | * @return string 'Cleaned' version of input parameter | |
| 248 | * @since 1.5 | |
| 285 | * @access protected | |
| 286 | * @param string $source Input string to be 'cleaned' | |
| 287 | * @return string 'Cleaned' version of input parameter | |
| 288 | * @since 1.5 | |
| 249 | 289 | */ |
| 250 | 290 | function _cleanTags($source) |
| 251 | 291 | { |
| ... | ...@@ -253,57 +293,59 @@ | |
| 253 | 293 | * In the beginning we don't really have a tag, so everything is |
| 254 | 294 | * postTag |
| 255 | 295 | */ |
| 256 | $preTag = null; | |
| 257 | $postTag = $source; | |
| 296 | $preTag = null; | |
| 297 | $postTag = $source; | |
| 258 | 298 | $currentSpace = false; |
| 259 | $attr = ''; // moffats: setting to null due to issues in migration system - undefined variable errors | |
| 299 | // moffats: setting to null due to issues in migration | |
| 300 | // system - undefined variable errors | |
| 301 | $attr = ''; | |
| 260 | 302 | |
| 261 | 303 | // Is there a tag? If so it will certainly start with a '<' |
| 262 | $tagOpen_start = strpos($source, '<'); | |
| 304 | $tagOpen_start = strpos($source, '<'); | |
| 263 | 305 | |
| 264 | 306 | while ($tagOpen_start !== false) |
| 265 | 307 | { |
| 266 | 308 | // Get some information about the tag we are processing |
| 267 | $preTag .= substr($postTag, 0, $tagOpen_start); | |
| 268 | $postTag = substr($postTag, $tagOpen_start); | |
| 269 | $fromTagOpen = substr($postTag, 1); | |
| 270 | $tagOpen_end = strpos($fromTagOpen, '>'); | |
| 309 | $preTag .= substr($postTag, 0, $tagOpen_start); | |
| 310 | $postTag = substr($postTag, $tagOpen_start); | |
| 311 | $fromTagOpen = substr($postTag, 1); | |
| 312 | $tagOpen_end = strpos($fromTagOpen, '>'); | |
| 271 | 313 | |
| 272 | 314 | // Let's catch any non-terminated tags and skip over them |
| 273 | 315 | if ($tagOpen_end === false) { |
| 274 | $postTag = substr($postTag, $tagOpen_start +1); | |
| 275 | $tagOpen_start = strpos($postTag, '<'); | |
| 316 | $postTag = substr($postTag, $tagOpen_start +1); | |
| 317 | $tagOpen_start = strpos($postTag, '<'); | |
| 276 | 318 | continue; |
| 277 | 319 | } |
| 278 | 320 | |
| 279 | 321 | // Do we have a nested tag? |
| 280 | 322 | $tagOpen_nested = strpos($fromTagOpen, '<'); |
| 281 | $tagOpen_nested_end = strpos(substr($postTag, $tagOpen_end), '>'); | |
| 323 | $tagOpen_nested_end = strpos(substr($postTag, $tagOpen_end), '>'); | |
| 282 | 324 | if (($tagOpen_nested !== false) && ($tagOpen_nested < $tagOpen_end)) { |
| 283 | $preTag .= substr($postTag, 0, ($tagOpen_nested +1)); | |
| 284 | $postTag = substr($postTag, ($tagOpen_nested +1)); | |
| 285 | $tagOpen_start = strpos($postTag, '<'); | |
| 325 | $preTag .= substr($postTag, 0, ($tagOpen_nested +1)); | |
| 326 | $postTag = substr($postTag, ($tagOpen_nested +1)); | |
| 327 | $tagOpen_start = strpos($postTag, '<'); | |
| 286 | 328 | continue; |
| 287 | 329 | } |
| 288 | 330 | |
| 289 | 331 | // Lets get some information about our tag and setup attribute pairs |
| 290 | $tagOpen_nested = (strpos($fromTagOpen, '<') + $tagOpen_start +1); | |
| 291 | $currentTag = substr($fromTagOpen, 0, $tagOpen_end); | |
| 292 | $tagLength = strlen($currentTag); | |
| 293 | $tagLeft = $currentTag; | |
| 294 | $attrSet = array (); | |
| 295 | $currentSpace = strpos($tagLeft, ' '); | |
| 332 | $tagOpen_nested = (strpos($fromTagOpen, '<') + $tagOpen_start +1); | |
| 333 | $currentTag = substr($fromTagOpen, 0, $tagOpen_end); | |
| 334 | $tagLength = strlen($currentTag); | |
| 335 | $tagLeft = $currentTag; | |
| 336 | $attrSet = array (); | |
| 337 | $currentSpace = strpos($tagLeft, ' '); | |
| 296 | 338 | |
| 297 | 339 | // Are we an open tag or a close tag? |
| 298 | 340 | if (substr($currentTag, 0, 1) == '/') { |
| 299 | 341 | // Close Tag |
| 300 | $isCloseTag = true; | |
| 301 | list ($tagName) = explode(' ', $currentTag); | |
| 302 | $tagName = substr($tagName, 1); | |
| 342 | $isCloseTag = true; | |
| 343 | list($tagName) = explode(' ', $currentTag); | |
| 344 | $tagName = substr($tagName, 1); | |
| 303 | 345 | } else { |
| 304 | 346 | // Open Tag |
| 305 | $isCloseTag = false; | |
| 306 | list ($tagName) = explode(' ', $currentTag); | |
| 347 | $isCloseTag = false; | |
| 348 | list($tagName) = explode(' ', $currentTag); | |
| 307 | 349 | } |
| 308 | 350 | |
| 309 | 351 | /* |
| ... | ...@@ -311,9 +353,14 @@ | |
| 311 | 353 | * OR no tagname |
| 312 | 354 | * OR remove if xssauto is on and tag is blacklisted |
| 313 | 355 | */ |
| 314 | if ((!preg_match("/^[a-z][a-z0-9]*$/i", $tagName)) || (!$tagName) || ((in_array(strtolower($tagName), $this->tagBlacklist)) && ($this->xssAuto))) { | |
| 315 | $postTag = substr($postTag, ($tagLength +2)); | |
| 316 | $tagOpen_start = strpos($postTag, '<'); | |
| 356 | if ((!preg_match("/^[a-z][a-z0-9]*$/i", $tagName)) | |
| 357 | || (!$tagName) | |
| 358 | || ((in_array(strtolower($tagName), $this->tagBlacklist)) | |
| 359 | && ($this->xssAuto) | |
| 360 | ) | |
| 361 | ) { | |
| 362 | $postTag = substr($postTag, ($tagLength +2)); | |
| 363 | $tagOpen_start = strpos($postTag, '<'); | |
| 317 | 364 | // Strip tag |
| 318 | 365 | continue; |
| 319 | 366 | } |
| ... | ...@@ -324,11 +371,12 @@ | |
| 324 | 371 | */ |
| 325 | 372 | while ($currentSpace !== false) |
| 326 | 373 | { |
| 327 | $attr = ''; | |
| 328 | $fromSpace = substr($tagLeft, ($currentSpace +1)); | |
| 329 | $nextSpace = strpos($fromSpace, ' '); | |
| 330 | $openQuotes = strpos($fromSpace, '"'); | |
| 331 | $closeQuotes = strpos(substr($fromSpace, ($openQuotes +1)), '"') + $openQuotes +1; | |
| 374 | $attr = ''; | |
| 375 | $fromSpace = substr($tagLeft, ($currentSpace +1)); | |
| 376 | $nextSpace = strpos($fromSpace, ' '); | |
| 377 | $openQuotes = strpos($fromSpace, '"'); | |
| 378 | $closeQuotes = strpos(substr($fromSpace, ($openQuotes + 1)), '"') | |
| 379 | + $openQuotes +1; | |
| 332 | 380 | |
| 333 | 381 | // Do we have an attribute to process? [check for equal sign] |
| 334 | 382 | if (strpos($fromSpace, '=') !== false) { |
| ... | ...@@ -337,8 +385,10 @@ | |
| 337 | 385 | * grab the substring from the closing quote, otherwise grab |
| 338 | 386 | * till the next space |
| 339 | 387 | */ |
| 340 | if (($openQuotes !== false) && (strpos(substr($fromSpace, ($openQuotes +1)), '"') !== false)) { | |
| 341 | $attr = substr($fromSpace, 0, ($closeQuotes +1)); | |
| 388 | if (($openQuotes !== false) | |
| 389 | && (strpos(substr($fromSpace, ($openQuotes + 1)), '"') !== false) | |
| 390 | ) { | |
| 391 | $attr = substr($fromSpace, 0, ($closeQuotes + 1)); | |
| 342 | 392 | } else { |
| 343 | 393 | $attr = substr($fromSpace, 0, $nextSpace); |
| 344 | 394 | } |
| ... | ...@@ -361,15 +411,17 @@ | |
| 361 | 411 | $attrSet[] = $attr; |
| 362 | 412 | |
| 363 | 413 | // Move search point and continue iteration |
| 364 | $tagLeft = substr($fromSpace, strlen($attr)); | |
| 365 | $currentSpace = strpos($tagLeft, ' '); | |
| 414 | $tagLeft = substr($fromSpace, strlen($attr)); | |
| 415 | $currentSpace = strpos($tagLeft, ' '); | |
| 366 | 416 | } |
| 367 | 417 | |
| 368 | 418 | // Is our tag in the user input array? |
| 369 | 419 | $tagFound = in_array(strtolower($tagName), $this->tagsArray); |
| 370 | 420 | |
| 371 | 421 | // If the tag is allowed lets append it to the output string |
| 372 | if ((!$tagFound && $this->tagsMethod) || ($tagFound && !$this->tagsMethod)) { | |
| 422 | if ((!$tagFound && $this->tagsMethod) | |
| 423 | || ($tagFound && !$this->tagsMethod) | |
| 424 | ) { | |
| 373 | 425 | |
| 374 | 426 | // Reconstruct tag with allowed attributes |
| 375 | 427 | if (!$isCloseTag) { |
| ... | ...@@ -394,8 +446,8 @@ | |
| 394 | 446 | } |
| 395 | 447 | |
| 396 | 448 | // Find next tag's start and continue iteration |
| 397 | $postTag = substr($postTag, ($tagLength +2)); | |
| 398 | $tagOpen_start = strpos($postTag, '<'); | |
| 449 | $postTag = substr($postTag, ($tagLength +2)); | |
| 450 | $tagOpen_start = strpos($postTag, '<'); | |
| 399 | 451 | } |
| 400 | 452 | |
| 401 | 453 | // Append any code after the end of tags and return |
| ... | ...@@ -408,10 +460,10 @@ | |
| 408 | 460 | /** |
| 409 | 461 | * Internal method to strip a tag of certain attributes |
| 410 | 462 | * |
| 411 | * @access protected | |
| 412 | * @param array $attrSet Array of attribute pairs to filter | |
| 413 | * @return array Filtered array of attribute pairs | |
| 414 | * @since 1.5 | |
| 463 | * @access protected | |
| 464 | * @param array $attrSet Array of attribute pairs to filter | |
| 465 | * @return array Filtered array of attribute pairs | |
| 466 | * @since 1.5 | |
| 415 | 467 | */ |
| 416 | 468 | function _cleanAttributes($attrSet) |
| 417 | 469 | { |
| ... | ...@@ -434,7 +486,12 @@ | |
| 434 | 486 | * Remove all "non-regular" attribute names |
| 435 | 487 | * AND blacklisted attributes |
| 436 | 488 | */ |
| 437 | if ((!preg_match('/[a-z]*$/i', $attrSubSet[0])) || (($this->xssAuto) && ((in_array(strtolower($attrSubSet[0]), $this->attrBlacklist)) || (substr($attrSubSet[0], 0, 2) == 'on')))) { | |
| 489 | if ((!preg_match('/[a-z]*$/i', $attrSubSet[0])) | |
| 490 | || (($this->xssAuto) | |
| 491 | && ((in_array(strtolower($attrSubSet[0]), $this->attrBlacklist)) | |
| 492 | || (substr($attrSubSet[0], 0, 2) == 'on')) | |
| 493 | ) | |
| 494 | ) { | |
| 438 | 495 | continue; |
| 439 | 496 | } |
| 440 | 497 | |
| ... | ...@@ -446,8 +503,13 @@ | |
| 446 | 503 | $attrSubSet[1] = preg_replace('/[\n\r]/', '', $attrSubSet[1]); |
| 447 | 504 | // strip double quotes |
| 448 | 505 | $attrSubSet[1] = str_replace('"', '', $attrSubSet[1]); |
| 449 | // convert single quotes from either side to doubles (Single quotes shouldn't be used to pad attr value) | |
| 450 | if ((substr($attrSubSet[1], 0, 1) == "'") && (substr($attrSubSet[1], (strlen($attrSubSet[1]) - 1), 1) == "'")) { | |
| 506 | /* | |
| 507 | * Convert single quotes from either side to | |
| 508 | * doubles (Single quotes shouldn't be used to pad attr value) | |
| 509 | */ | |
| 510 | if ((substr($attrSubSet[1], 0, 1) == "'") | |
| 511 | && (substr($attrSubSet[1], (strlen($attrSubSet[1]) - 1), 1) == "'") | |
| 512 | ) { | |
| 451 | 513 | $attrSubSet[1] = substr($attrSubSet[1], 1, (strlen($attrSubSet[1]) - 2)); |
| 452 | 514 | } |
| 453 | 515 | // strip slashes |
| ... | ...@@ -463,8 +525,9 @@ | |
| 463 | 525 | $attrFound = in_array(strtolower($attrSubSet[0]), $this->attrArray); |
| 464 | 526 | |
| 465 | 527 | // If the tag is allowed lets keep it |
| 466 | if ((!$attrFound && $this->attrMethod) || ($attrFound && !$this->attrMethod)) { | |
| 467 | ||
| 528 | if ((!$attrFound && $this->attrMethod) | |
| 529 | || ($attrFound && !$this->attrMethod) | |
| 530 | ) { | |
| 468 | 531 | // Does the attribute have a value? |
| 469 | 532 | if ($attrSubSet[1]) { |
| 470 | 533 | $newSet[] = $attrSubSet[0].'="'.$attrSubSet[1].'"'; |
| ... | ...@@ -485,10 +548,10 @@ | |
| 485 | 548 | /** |
| 486 | 549 | * Try to convert to plaintext |
| 487 | 550 | * |
| 488 | * @access protected | |
| 489 | * @param string $source | |
| 490 | * @return string Plaintext string | |
| 491 | * @since 1.5 | |
| 551 | * @access protected | |
| 552 | * @param string $source | |
| 553 | * @return string Plaintext string | |
| 554 | * @since 1.5 | |
| 492 | 555 | */ |
| 493 | 556 | function _decode($source) |
| 494 | 557 | { |
| ... | ...@@ -504,4 +567,5 @@ | |
| 504 | 567 | $source = preg_replace('/&#x([a-f0-9]+);/mei', "chr(0x\\1)", $source); // hex notation |
| 505 | 568 | return $source; |
| 506 | 569 | } |
| 507 | } | |
| 508 | 570 | \ No newline at end of file |
| 571 | ||
| 572 | } |
| ... | ...@@ -128,9 +128,13 @@ | |
| 128 | 128 | break; |
| 129 | 129 | } |
| 130 | 130 | |
| 131 | if (isset($GLOBALS['_JREQUEST'][$name]['SET.'.$hash]) && ($GLOBALS['_JREQUEST'][$name]['SET.'.$hash] === true)) { | |
| 131 | if ( | |
| 132 | isset($GLOBALS['_JREQUEST'][$name]['SET.'.$hash]) | |
| 133 | && ($GLOBALS['_JREQUEST'][$name]['SET.'.$hash] === true) | |
| 134 | ) { | |
| 132 | 135 | // Get the variable from the input hash |
| 133 | $var = (isset($input[$name]) && $input[$name] !== null) ? $input[$name] : $default; | |
| 136 | $var = (isset($input[$name]) && $input[$name] !== null) | |
| 137 | ? $input[$name] : $default; | |
| 134 | 138 | } |
| 135 | 139 | elseif (!isset($GLOBALS['_JREQUEST'][$name][$sig])) |
| 136 | 140 | { |
| ... | ...@@ -544,24 +548,24 @@ | |
| 544 | 548 | * other than the 1 bit is set, a strict filter is applied. |
| 545 | 549 | * @param string The variable type {@see JFilterInput::clean()}. |
| 546 | 550 | */ |
| 547 | function _cleanVar($var, $mask = 0, $type=null) | |
| 551 | function _cleanVar($var, $mask = 0, $type = null) | |
| 548 | 552 | { |
| 549 | 553 | // Static input filters for specific settings |
| 550 | 554 | static $noHtmlFilter = null; |
| 551 | 555 | static $safeHtmlFilter = null; |
| 552 | 556 | |
| 553 | 557 | // If the no trim flag is not set, trim the variable |
| 554 | if (!($mask & 1) && is_string($var)) { | |
| 558 | if (!($mask & JREQUEST_NOTRIM) && is_string($var)) { | |
| 555 | 559 | $var = trim($var); |
| 556 | 560 | } |
| 557 | 561 | |
| 558 | 562 | // Now we handle input filtering |
| 559 | if ($mask & 2) | |
| 563 | if ($mask & JREQUEST_ALLOWRAW) | |
| 560 | 564 | { |
| 561 | 565 | // If the allow raw flag is set, do not modify the variable |
| 562 | 566 | $var = $var; |
| 563 | 567 | } |
| 564 | elseif ($mask & 4) | |
| 568 | elseif ($mask & JREQUEST_ALLOWHTML) | |
| 565 | 569 | { |
| 566 | 570 | // If the allow html flag is set, apply a safe html filter to the variable |
| 567 | 571 | if (is_null($safeHtmlFilter)) { |
| ... | ...@@ -589,7 +593,9 @@ | |
| 589 | 593 | */ |
| 590 | 594 | function _stripSlashesRecursive( $value ) |
| 591 | 595 | { |
| 592 | $value = is_array( $value ) ? array_map( array( 'JRequest', '_stripSlashesRecursive' ), $value ) : stripslashes( $value ); | |
| 596 | $value = is_array( $value ) | |
| 597 | ? array_map( array( 'JRequest', '_stripSlashesRecursive' ), $value ) | |
| 598 | : stripslashes( $value ); | |
| 593 | 599 | return $value; |
| 594 | 600 | } |
| 595 | 601 | } |
| 596 | 602 | \ No newline at end of file |