diff --git a/lib/htmlpurifier/HTMLPurifier.php b/lib/htmlpurifier/HTMLPurifier.php
index ba2c7b30670..11b217b008b 100644
--- a/lib/htmlpurifier/HTMLPurifier.php
+++ b/lib/htmlpurifier/HTMLPurifier.php
@@ -19,7 +19,7 @@
*/
/*
- HTML Purifier 4.1.1 - Standards Compliant HTML Filtering
+ HTML Purifier 4.2.0 - Standards Compliant HTML Filtering
Copyright (C) 2006-2008 Edward Z. Yang
This library is free software; you can redistribute it and/or
@@ -55,10 +55,10 @@ class HTMLPurifier
{
/** Version of HTML Purifier */
- public $version = '4.1.1';
+ public $version = '4.2.0';
/** Constant with version of HTML Purifier */
- const VERSION = '4.1.1';
+ const VERSION = '4.2.0';
/** Global configuration object */
public $config;
diff --git a/lib/htmlpurifier/HTMLPurifier.safe-includes.php b/lib/htmlpurifier/HTMLPurifier.safe-includes.php
index 6402de04584..ec68b498081 100644
--- a/lib/htmlpurifier/HTMLPurifier.safe-includes.php
+++ b/lib/htmlpurifier/HTMLPurifier.safe-includes.php
@@ -190,10 +190,12 @@ require_once $__dir . '/HTMLPurifier/Token/Start.php';
require_once $__dir . '/HTMLPurifier/Token/Text.php';
require_once $__dir . '/HTMLPurifier/URIFilter/DisableExternal.php';
require_once $__dir . '/HTMLPurifier/URIFilter/DisableExternalResources.php';
+require_once $__dir . '/HTMLPurifier/URIFilter/DisableResources.php';
require_once $__dir . '/HTMLPurifier/URIFilter/HostBlacklist.php';
require_once $__dir . '/HTMLPurifier/URIFilter/MakeAbsolute.php';
require_once $__dir . '/HTMLPurifier/URIFilter/Munge.php';
require_once $__dir . '/HTMLPurifier/URIScheme/data.php';
+require_once $__dir . '/HTMLPurifier/URIScheme/file.php';
require_once $__dir . '/HTMLPurifier/URIScheme/ftp.php';
require_once $__dir . '/HTMLPurifier/URIScheme/http.php';
require_once $__dir . '/HTMLPurifier/URIScheme/https.php';
diff --git a/lib/htmlpurifier/HTMLPurifier/AttrDef/Lang.php b/lib/htmlpurifier/HTMLPurifier/AttrDef/Lang.php
index f70e7aa1bdd..10e6da56db1 100644
--- a/lib/htmlpurifier/HTMLPurifier/AttrDef/Lang.php
+++ b/lib/htmlpurifier/HTMLPurifier/AttrDef/Lang.php
@@ -9,10 +9,6 @@ class HTMLPurifier_AttrDef_Lang extends HTMLPurifier_AttrDef
public function validate($string, $config, $context) {
-// moodle change - we use special lang strings unfortunatelly
- return preg_replace('/[^0-9a-zA-Z_-]/', '', $string);
-// moodle change end
-
$string = trim($string);
if (!$string) return false;
diff --git a/lib/htmlpurifier/HTMLPurifier/AttrTransform/SafeParam.php b/lib/htmlpurifier/HTMLPurifier/AttrTransform/SafeParam.php
index 3f992ec31b2..d378c4f5f74 100644
--- a/lib/htmlpurifier/HTMLPurifier/AttrTransform/SafeParam.php
+++ b/lib/htmlpurifier/HTMLPurifier/AttrTransform/SafeParam.php
@@ -33,6 +33,13 @@ class HTMLPurifier_AttrTransform_SafeParam extends HTMLPurifier_AttrTransform
case 'allowNetworking':
$attr['value'] = 'internal';
break;
+ case 'allowFullScreen':
+ if ($config->get('HTML.FlashAllowFullScreen')) {
+ $attr['value'] = ($attr['value'] == 'true') ? 'true' : 'false';
+ } else {
+ $attr['value'] = 'false';
+ }
+ break;
case 'wmode':
$attr['value'] = 'window';
break;
diff --git a/lib/htmlpurifier/HTMLPurifier/CSSDefinition.php b/lib/htmlpurifier/HTMLPurifier/CSSDefinition.php
index 6a2e6f56d99..f0257da0944 100644
--- a/lib/htmlpurifier/HTMLPurifier/CSSDefinition.php
+++ b/lib/htmlpurifier/HTMLPurifier/CSSDefinition.php
@@ -272,20 +272,29 @@ class HTMLPurifier_CSSDefinition extends HTMLPurifier_Definition
// setup allowed elements
$support = "(for information on implementing this, see the ".
"support forums) ";
- $allowed_attributes = $config->get('CSS.AllowedProperties');
- if ($allowed_attributes !== null) {
+ $allowed_properties = $config->get('CSS.AllowedProperties');
+ if ($allowed_properties !== null) {
foreach ($this->info as $name => $d) {
- if(!isset($allowed_attributes[$name])) unset($this->info[$name]);
- unset($allowed_attributes[$name]);
+ if(!isset($allowed_properties[$name])) unset($this->info[$name]);
+ unset($allowed_properties[$name]);
}
// emit errors
- foreach ($allowed_attributes as $name => $d) {
+ foreach ($allowed_properties as $name => $d) {
// :TODO: Is this htmlspecialchars() call really necessary?
$name = htmlspecialchars($name);
trigger_error("Style attribute '$name' is not supported $support", E_USER_WARNING);
}
}
+ $forbidden_properties = $config->get('CSS.ForbiddenProperties');
+ if ($forbidden_properties !== null) {
+ foreach ($this->info as $name => $d) {
+ if (isset($forbidden_properties[$name])) {
+ unset($this->info[$name]);
+ }
+ }
+ }
+
}
}
diff --git a/lib/htmlpurifier/HTMLPurifier/Config.php b/lib/htmlpurifier/HTMLPurifier/Config.php
index 2a334b0d83d..54d4085363d 100644
--- a/lib/htmlpurifier/HTMLPurifier/Config.php
+++ b/lib/htmlpurifier/HTMLPurifier/Config.php
@@ -20,7 +20,7 @@ class HTMLPurifier_Config
/**
* HTML Purifier's version
*/
- public $version = '4.1.1';
+ public $version = '4.2.0';
/**
* Bool indicator whether or not to automatically finalize
diff --git a/lib/htmlpurifier/HTMLPurifier/ConfigSchema/schema.ser b/lib/htmlpurifier/HTMLPurifier/ConfigSchema/schema.ser
index 22b8d54a59f..978089c6291 100644
Binary files a/lib/htmlpurifier/HTMLPurifier/ConfigSchema/schema.ser and b/lib/htmlpurifier/HTMLPurifier/ConfigSchema/schema.ser differ
diff --git a/lib/htmlpurifier/HTMLPurifier/ConfigSchema/schema/CSS.ForbiddenProperties.txt b/lib/htmlpurifier/HTMLPurifier/ConfigSchema/schema/CSS.ForbiddenProperties.txt
new file mode 100644
index 00000000000..f1f5c5f12b4
--- /dev/null
+++ b/lib/htmlpurifier/HTMLPurifier/ConfigSchema/schema/CSS.ForbiddenProperties.txt
@@ -0,0 +1,13 @@
+CSS.ForbiddenProperties
+TYPE: lookup
+VERSION: 4.2.0
+DEFAULT: array()
+--DESCRIPTION--
+
+ This is the logical inverse of %CSS.AllowedProperties, and it will
+ override that directive or any other directive. If possible,
+ %CSS.AllowedProperties is recommended over this directive,
+ because it can sometimes be difficult to tell whether or not you've
+ forbidden all of the CSS properties you truly would like to disallow.
+
+--# vim: et sw=4 sts=4
diff --git a/lib/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Core.NormalizeNewlines.txt b/lib/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Core.NormalizeNewlines.txt
new file mode 100644
index 00000000000..d77f5360d7c
--- /dev/null
+++ b/lib/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Core.NormalizeNewlines.txt
@@ -0,0 +1,11 @@
+Core.NormalizeNewlines
+TYPE: bool
+VERSION: 4.2.0
+DEFAULT: true
+--DESCRIPTION--
+
+ Whether or not to normalize newlines to the operating
+ system default. When false, HTML Purifier
+ will attempt to preserve mixed newline files.
+
+--# vim: et sw=4 sts=4
diff --git a/lib/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Core.RemoveProcessingInstructions.txt b/lib/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Core.RemoveProcessingInstructions.txt
new file mode 100644
index 00000000000..3397d9f71f0
--- /dev/null
+++ b/lib/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Core.RemoveProcessingInstructions.txt
@@ -0,0 +1,11 @@
+Core.RemoveProcessingInstructions
+TYPE: bool
+VERSION: 4.2.0
+DEFAULT: false
+--DESCRIPTION--
+Instead of escaping processing instructions in the form <? ...
+?>, remove it out-right. This may be useful if the HTML
+you are validating contains XML processing instruction gunk, however,
+it can also be user-unfriendly for people attempting to post PHP
+snippets.
+--# vim: et sw=4 sts=4
diff --git a/lib/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Filter.YouTube.txt b/lib/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Filter.YouTube.txt
index 7fa6536b2c7..321eaa2d803 100644
--- a/lib/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Filter.YouTube.txt
+++ b/lib/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Filter.YouTube.txt
@@ -3,6 +3,11 @@ TYPE: bool
VERSION: 3.1.0
DEFAULT: false
--DESCRIPTION--
+
+ Warning: Deprecated in favor of %HTML.SafeObject and
+ %Output.FlashCompat (turn both on to allow YouTube videos and other
+ Flash content).
+
This directive enables YouTube video embedding in HTML Purifier. Check
this document
diff --git a/lib/htmlpurifier/HTMLPurifier/ConfigSchema/schema/HTML.Allowed.txt b/lib/htmlpurifier/HTMLPurifier/ConfigSchema/schema/HTML.Allowed.txt
index 3e231d2d16a..0b2c106da5e 100644
--- a/lib/htmlpurifier/HTMLPurifier/ConfigSchema/schema/HTML.Allowed.txt
+++ b/lib/htmlpurifier/HTMLPurifier/ConfigSchema/schema/HTML.Allowed.txt
@@ -5,11 +5,14 @@ DEFAULT: NULL
--DESCRIPTION--
- This is a convenience directive that rolls the functionality of
- %HTML.AllowedElements and %HTML.AllowedAttributes into one directive.
+ This is a preferred convenience directive that combines
+ %HTML.AllowedElements and %HTML.AllowedAttributes.
Specify elements and attributes that are allowed using:
- element1[attr1|attr2],element2.... You can also use
- newlines instead of commas to separate elements.
+ element1[attr1|attr2],element2.... For example,
+ if you would like to only allow paragraphs and links, specify
+ a[href],p. You can specify attributes that apply
+ to all elements using an asterisk, e.g. *[lang].
+ You can also use newlines instead of commas to separate elements.
Warning:
diff --git a/lib/htmlpurifier/HTMLPurifier/ConfigSchema/schema/HTML.AllowedElements.txt b/lib/htmlpurifier/HTMLPurifier/ConfigSchema/schema/HTML.AllowedElements.txt
index 888d5581969..1d3fa7907dc 100644
--- a/lib/htmlpurifier/HTMLPurifier/ConfigSchema/schema/HTML.AllowedElements.txt
+++ b/lib/htmlpurifier/HTMLPurifier/ConfigSchema/schema/HTML.AllowedElements.txt
@@ -4,12 +4,17 @@ VERSION: 1.3.0
DEFAULT: NULL
--DESCRIPTION--
- If HTML Purifier's tag set is unsatisfactory for your needs, you
- can overload it with your own list of tags to allow. Note that this
- method is subtractive: it does its job by taking away from HTML Purifier
- usual feature set, so you cannot add a tag that HTML Purifier never
- supported in the first place (like embed, form or head). If you
- change this, you probably also want to change %HTML.AllowedAttributes.
+ If HTML Purifier's tag set is unsatisfactory for your needs, you can
+ overload it with your own list of tags to allow. If you change
+ this, you probably also want to change %HTML.AllowedAttributes; see
+ also %HTML.Allowed which lets you set allowed elements and
+ attributes at the same time.
+
+
+ If you attempt to allow an element that HTML Purifier does not know
+ about, HTML Purifier will raise an error. You will need to manually
+ tell HTML Purifier about this element by using the
+ advanced customization features.
Warning: If another directive conflicts with the
diff --git a/lib/htmlpurifier/HTMLPurifier/ConfigSchema/schema/HTML.FlashAllowFullScreen.txt b/lib/htmlpurifier/HTMLPurifier/ConfigSchema/schema/HTML.FlashAllowFullScreen.txt
new file mode 100644
index 00000000000..7878dc0bf64
--- /dev/null
+++ b/lib/htmlpurifier/HTMLPurifier/ConfigSchema/schema/HTML.FlashAllowFullScreen.txt
@@ -0,0 +1,11 @@
+HTML.FlashAllowFullScreen
+TYPE: bool
+VERSION: 4.2.0
+DEFAULT: false
+--DESCRIPTION--
+
+ Whether or not to permit embedded Flash content from
+ %HTML.SafeObject to expand to the full screen. Corresponds to
+ the allowFullScreen parameter.
+
+--# vim: et sw=4 sts=4
diff --git a/lib/htmlpurifier/HTMLPurifier/ConfigSchema/schema/URI.AllowedSchemes.txt b/lib/htmlpurifier/HTMLPurifier/ConfigSchema/schema/URI.AllowedSchemes.txt
index ae3a913f242..666635a5ff0 100644
--- a/lib/htmlpurifier/HTMLPurifier/ConfigSchema/schema/URI.AllowedSchemes.txt
+++ b/lib/htmlpurifier/HTMLPurifier/ConfigSchema/schema/URI.AllowedSchemes.txt
@@ -12,6 +12,6 @@ array (
--DESCRIPTION--
Whitelist that defines the schemes that a URI is allowed to have. This
prevents XSS attacks from using pseudo-schemes like javascript or mocha.
-There is also support for the data URI scheme, but it is not
-enabled by default.
+There is also support for the data and file
+URI schemes, but they are not enabled by default.
--# vim: et sw=4 sts=4
diff --git a/lib/htmlpurifier/HTMLPurifier/ConfigSchema/schema/URI.DisableResources.txt b/lib/htmlpurifier/HTMLPurifier/ConfigSchema/schema/URI.DisableResources.txt
index 51e6ea91f79..f891de49965 100644
--- a/lib/htmlpurifier/HTMLPurifier/ConfigSchema/schema/URI.DisableResources.txt
+++ b/lib/htmlpurifier/HTMLPurifier/ConfigSchema/schema/URI.DisableResources.txt
@@ -1,12 +1,15 @@
URI.DisableResources
TYPE: bool
-VERSION: 1.3.0
+VERSION: 4.2.0
DEFAULT: false
--DESCRIPTION--
-
Disables embedding resources, essentially meaning no pictures. You can
still link to them though. See %URI.DisableExternalResources for why
this might be a good idea.
+
+ Note: While this directive has been available since 1.3.0,
+ it didn't actually start doing anything until 4.2.0.
+
--# vim: et sw=4 sts=4
diff --git a/lib/htmlpurifier/HTMLPurifier/DefinitionCache/Serializer.php b/lib/htmlpurifier/HTMLPurifier/DefinitionCache/Serializer.php
index 7a6aa93f029..8a5144273b9 100644
--- a/lib/htmlpurifier/HTMLPurifier/DefinitionCache/Serializer.php
+++ b/lib/htmlpurifier/HTMLPurifier/DefinitionCache/Serializer.php
@@ -109,6 +109,11 @@ class HTMLPurifier_DefinitionCache_Serializer extends
*/
private function _prepareDir($config) {
$directory = $this->generateDirectoryPath($config);
+ //$chmod = $config->get('Cache.SerializerPermissions'); // it would be nice to get this accepted in upstream
+ global $CFG; $chmod = $CFG->directorypermissions;
+ if (!$chmod) {
+ $chmod = 0755;
+ }
if (!is_dir($directory)) {
$base = $this->generateBaseDirectoryPath($config);
if (!is_dir($base)) {
@@ -116,13 +121,13 @@ class HTMLPurifier_DefinitionCache_Serializer extends
please create or change using %Cache.SerializerPath',
E_USER_WARNING);
return false;
- } elseif (!$this->_testPermissions($base)) {
+ } elseif (!$this->_testPermissions($base, $chmod)) {
return false;
}
- $old = umask(0022); // disable group and world writes
- mkdir($directory);
+ $old = umask(0000);
+ mkdir($directory, $chmod);
umask($old);
- } elseif (!$this->_testPermissions($directory)) {
+ } elseif (!$this->_testPermissions($directory, $chmod)) {
return false;
}
return true;
@@ -132,7 +137,7 @@ class HTMLPurifier_DefinitionCache_Serializer extends
* Tests permissions on a directory and throws out friendly
* error messages and attempts to chmod it itself if possible
*/
- private function _testPermissions($dir) {
+ private function _testPermissions($dir, $chmod) {
// early abort, if it is writable, everything is hunky-dory
if (is_writable($dir)) return true;
if (!is_dir($dir)) {
@@ -146,17 +151,18 @@ class HTMLPurifier_DefinitionCache_Serializer extends
// POSIX system, we can give more specific advice
if (fileowner($dir) === posix_getuid()) {
// we can chmod it ourselves
- chmod($dir, 0755);
+ $chmod = $chmod | 0700;
+ chmod($dir, $chmod);
return true;
} elseif (filegroup($dir) === posix_getgid()) {
- $chmod = '775';
+ $chmod = $chmod | 0007;
} else {
// PHP's probably running as nobody, so we'll
// need to give global permissions
- $chmod = '777';
+ $chmod = $chmod | 0777;
}
trigger_error('Directory '.$dir.' not writable, '.
- 'please chmod to ' . $chmod,
+ 'please chmod to ' . decoct($chmod),
E_USER_WARNING);
} else {
// generic error message
diff --git a/lib/htmlpurifier/HTMLPurifier/Generator.php b/lib/htmlpurifier/HTMLPurifier/Generator.php
index 4a62417271e..e6221db7609 100644
--- a/lib/htmlpurifier/HTMLPurifier/Generator.php
+++ b/lib/htmlpurifier/HTMLPurifier/Generator.php
@@ -98,9 +98,11 @@ class HTMLPurifier_Generator
}
// Normalize newlines to system defined value
- $nl = $this->config->get('Output.Newline');
- if ($nl === null) $nl = PHP_EOL;
- if ($nl !== "\n") $html = str_replace("\n", $nl, $html);
+ if ($this->config->get('Core.NormalizeNewlines')) {
+ $nl = $this->config->get('Output.Newline');
+ if ($nl === null) $nl = PHP_EOL;
+ if ($nl !== "\n") $html = str_replace("\n", $nl, $html);
+ }
return $html;
}
@@ -215,7 +217,10 @@ class HTMLPurifier_Generator
* permissible for non-attribute output.
* @return String escaped data.
*/
- public function escape($string, $quote = ENT_COMPAT) {
+ public function escape($string, $quote = null) {
+ // Workaround for APC bug on Mac Leopard reported by sidepodcast
+ // http://htmlpurifier.org/phorum/read.php?3,4823,4846
+ if ($quote === null) $quote = ENT_COMPAT;
return htmlspecialchars($string, $quote, 'UTF-8');
}
diff --git a/lib/htmlpurifier/HTMLPurifier/HTMLDefinition.php b/lib/htmlpurifier/HTMLPurifier/HTMLDefinition.php
index c99ac11eb22..33bb38ac5f4 100644
--- a/lib/htmlpurifier/HTMLPurifier/HTMLDefinition.php
+++ b/lib/htmlpurifier/HTMLPurifier/HTMLDefinition.php
@@ -300,7 +300,12 @@ class HTMLPurifier_HTMLDefinition extends HTMLPurifier_Definition
unset($allowed_attributes_mutable[$key]);
}
}
- if ($delete) unset($this->info[$tag]->attr[$attr]);
+ if ($delete) {
+ if ($this->info[$tag]->attr[$attr]->required) {
+ trigger_error("Required attribute '$attr' in element '$tag' was not allowed, which means '$tag' will not be allowed either", E_USER_WARNING);
+ }
+ unset($this->info[$tag]->attr[$attr]);
+ }
}
}
// emit errors
diff --git a/lib/htmlpurifier/HTMLPurifier/HTMLModule/Text.php b/lib/htmlpurifier/HTMLPurifier/HTMLModule/Text.php
index e6a5d0d81b7..ae77c71886e 100644
--- a/lib/htmlpurifier/HTMLPurifier/HTMLModule/Text.php
+++ b/lib/htmlpurifier/HTMLPurifier/HTMLModule/Text.php
@@ -45,13 +45,6 @@ class HTMLPurifier_HTMLModule_Text extends HTMLPurifier_HTMLModule
$this->addElement('span', 'Inline', 'Inline', 'Common');
$this->addElement('br', 'Inline', 'Empty', 'Core');
- // Moodle specific elements - start
- $this->addElement('nolink', 'Inline', 'Flow');
- $this->addElement('tex', 'Inline', 'Flow');
- $this->addElement('algebra', 'Inline', 'Flow');
- $this->addElement('lang', 'Inline', 'Flow', 'I18N');
- // Moodle specific elements - end
-
// Block Phrasal --------------------------------------------------
$this->addElement('address', 'Block', 'Inline', 'Common');
$this->addElement('blockquote', 'Block', 'Optional: Heading | Block | List', 'Common', array('cite' => 'URI') );
diff --git a/lib/htmlpurifier/HTMLPurifier/HTMLModule/XMLCommonAttributes.php b/lib/htmlpurifier/HTMLPurifier/HTMLModule/XMLCommonAttributes.php
index 0913f3c8ddf..9c0e0319841 100644
--- a/lib/htmlpurifier/HTMLPurifier/HTMLModule/XMLCommonAttributes.php
+++ b/lib/htmlpurifier/HTMLPurifier/HTMLModule/XMLCommonAttributes.php
@@ -5,11 +5,9 @@ class HTMLPurifier_HTMLModule_XMLCommonAttributes extends HTMLPurifier_HTMLModul
public $name = 'XMLCommonAttributes';
public $attr_collections = array(
-/* moodle comment - xml:lang breaks our multilang
'Lang' => array(
'xml:lang' => 'LanguageCode',
)
-*/
);
}
diff --git a/lib/htmlpurifier/HTMLPurifier/Injector/SafeObject.php b/lib/htmlpurifier/HTMLPurifier/Injector/SafeObject.php
index 9e178ce01aa..c1d8b041281 100644
--- a/lib/htmlpurifier/HTMLPurifier/Injector/SafeObject.php
+++ b/lib/htmlpurifier/HTMLPurifier/Injector/SafeObject.php
@@ -22,6 +22,7 @@ class HTMLPurifier_Injector_SafeObject extends HTMLPurifier_Injector
'movie' => true,
'flashvars' => true,
'src' => true,
+ 'allowFullScreen' => true, // if omitted, assume to be 'false'
);
public function prepare($config, $context) {
diff --git a/lib/htmlpurifier/HTMLPurifier/Lexer.php b/lib/htmlpurifier/HTMLPurifier/Lexer.php
index 0e2ed0af8ad..325d5c5f138 100644
--- a/lib/htmlpurifier/HTMLPurifier/Lexer.php
+++ b/lib/htmlpurifier/HTMLPurifier/Lexer.php
@@ -230,6 +230,17 @@ class HTMLPurifier_Lexer
);
}
+ /**
+ * Special Internet Explorer conditional comments should be removed.
+ */
+ protected static function removeIEConditional($string) {
+ return preg_replace(
+ '##si', // probably should generalize for all strings
+ '',
+ $string
+ );
+ }
+
/**
* Callback function for escapeCDATA() that does the work.
*
@@ -252,7 +263,7 @@ class HTMLPurifier_Lexer
public function normalize($html, $config, $context) {
// normalize newlines to \n
- if ($config->get('Output.Newline')!=="\n") {
+ if ($config->get('Core.NormalizeNewlines')) {
$html = str_replace("\r\n", "\n", $html);
$html = str_replace("\r", "\n", $html);
}
@@ -262,6 +273,8 @@ class HTMLPurifier_Lexer
$html = $this->escapeCommentedCDATA($html);
}
+ $html = $this->removeIEConditional($html);
+
// escape CDATA
$html = $this->escapeCDATA($html);
@@ -286,6 +299,11 @@ class HTMLPurifier_Lexer
// represent non-SGML characters (horror, horror!)
$html = HTMLPurifier_Encoder::cleanUTF8($html);
+ // if processing instructions are to removed, remove them now
+ if ($config->get('Core.RemoveProcessingInstructions')) {
+ $html = preg_replace('#<\?.+?\?>#s', '', $html);
+ }
+
return $html;
}
diff --git a/lib/htmlpurifier/HTMLPurifier/Lexer/PH5P.php b/lib/htmlpurifier/HTMLPurifier/Lexer/PH5P.php
index fa1bf973e0b..faf00b82913 100644
--- a/lib/htmlpurifier/HTMLPurifier/Lexer/PH5P.php
+++ b/lib/htmlpurifier/HTMLPurifier/Lexer/PH5P.php
@@ -125,8 +125,6 @@ class HTML5 {
const EOF = 5;
public function __construct($data) {
- $data = str_replace("\r\n", "\n", $data);
- $data = str_replace("\r", null, $data);
$this->data = $data;
$this->char = -1;
diff --git a/lib/htmlpurifier/HTMLPurifier/URIFilter/DisableResources.php b/lib/htmlpurifier/HTMLPurifier/URIFilter/DisableResources.php
new file mode 100644
index 00000000000..67538c7bb2e
--- /dev/null
+++ b/lib/htmlpurifier/HTMLPurifier/URIFilter/DisableResources.php
@@ -0,0 +1,11 @@
+get('EmbeddedURI', true);
+ }
+}
+
+// vim: et sw=4 sts=4
diff --git a/lib/htmlpurifier/HTMLPurifier/URIScheme/file.php b/lib/htmlpurifier/HTMLPurifier/URIScheme/file.php
new file mode 100644
index 00000000000..407b6c17f1d
--- /dev/null
+++ b/lib/htmlpurifier/HTMLPurifier/URIScheme/file.php
@@ -0,0 +1,26 @@
+userinfo = null;
+ // file:// makes no provisions for accessing the resource
+ $uri->port = null;
+ // While it seems to work on Firefox, the querystring has
+ // no possible effect and is thus stripped.
+ $uri->query = null;
+ return true;
+ }
+
+}
+
+// vim: et sw=4 sts=4
diff --git a/lib/htmlpurifier/HTMLPurifier/VarParser/Flexible.php b/lib/htmlpurifier/HTMLPurifier/VarParser/Flexible.php
index c954250e9f0..21b87675a3f 100644
--- a/lib/htmlpurifier/HTMLPurifier/VarParser/Flexible.php
+++ b/lib/htmlpurifier/HTMLPurifier/VarParser/Flexible.php
@@ -62,7 +62,7 @@ class HTMLPurifier_VarParser_Flexible extends HTMLPurifier_VarParser
foreach ($var as $keypair) {
$c = explode(':', $keypair, 2);
if (!isset($c[1])) continue;
- $nvar[$c[0]] = $c[1];
+ $nvar[trim($c[0])] = trim($c[1]);
}
$var = $nvar;
}
@@ -79,8 +79,15 @@ class HTMLPurifier_VarParser_Flexible extends HTMLPurifier_VarParser
return $new;
} else break;
}
+ if ($type === self::ALIST) {
+ trigger_error("Array list did not have consecutive integer indexes", E_USER_WARNING);
+ return array_values($var);
+ }
if ($type === self::LOOKUP) {
foreach ($var as $key => $value) {
+ if ($value !== true) {
+ trigger_error("Lookup array has non-true value at key '$key'; maybe your input array was not indexed numerically", E_USER_WARNING);
+ }
$var[$key] = true;
}
}
diff --git a/lib/htmlpurifier/readme_moodle.txt b/lib/htmlpurifier/readme_moodle.txt
index 59badb19c65..40ae79b0bb5 100644
--- a/lib/htmlpurifier/readme_moodle.txt
+++ b/lib/htmlpurifier/readme_moodle.txt
@@ -1,9 +1,6 @@
-Description of HTML Purifier v4.1.1 library import into Moodle
+Description of HTML Purifier v4.2.0 library import into Moodle
Changes:
- * HMLTModule/Text.php - added , , and tags
- * HMLTModule/XMLCommonAttributes.php - remove xml:lang - needed for multilang
- * AttrDef/Lang.php - relax lang check - needed for multilang
- * Lexer.php - Subverted line break normalisation (requires setting: Output.Newline to \n) MDL-22654
+ * DefinitionCache/Serializer.php - using our directory permissions
skodak
diff --git a/lib/weblib.php b/lib/weblib.php
index 2ef7e08f8bb..dfd570402fe 100644
--- a/lib/weblib.php
+++ b/lib/weblib.php
@@ -2058,23 +2058,51 @@ function purify_html($text) {
// this can not be done only once because we sometimes need to reset the cache
$cachedir = $CFG->dataroot.'/cache/htmlpurifier';
- $status = check_dir_exists($cachedir, true, true);
+ check_dir_exists($cachedir);
static $purifier = false;
- static $config;
if ($purifier === false) {
require_once $CFG->libdir.'/htmlpurifier/HTMLPurifier.safe-includes.php';
$config = HTMLPurifier_Config::createDefault();
- $config->set('Output.Newline', "\n");
+
+ $config->set('HTML.DefinitionID', 'moodlehtml');
+ $config->set('HTML.DefinitionRev', 1);
+ $config->set('Cache.SerializerPath', $cachedir);
+ //$config->set('Cache.SerializerPermission', $CFG->directorypermissions); // it would be nice to get this upstream
+ $config->set('Core.NormalizeNewlines', false);
$config->set('Core.ConvertDocumentToFragment', true);
$config->set('Core.Encoding', 'UTF-8');
$config->set('HTML.Doctype', 'XHTML 1.0 Transitional');
- $config->set('Cache.SerializerPath', $cachedir);
- $config->set('URI.AllowedSchemes', array('http'=>1, 'https'=>1, 'ftp'=>1, 'irc'=>1, 'nntp'=>1, 'news'=>1, 'rtsp'=>1, 'teamspeak'=>1, 'gopher'=>1, 'mms'=>1));
+ $config->set('URI.AllowedSchemes', array('http'=>true, 'https'=>true, 'ftp'=>true, 'irc'=>true, 'nntp'=>true, 'news'=>true, 'rtsp'=>true, 'teamspeak'=>true, 'gopher'=>true, 'mms'=>true));
$config->set('Attr.AllowedFrameTargets', array('_blank'));
+
+ if (!empty($CFG->allowobjectembed)) {
+ $config->set('HTML.SafeObject', true);
+ $config->set('Output.FlashCompat', true);
+ $config->set('HTML.SafeEmbed', true);
+ }
+
+ $def = $config->getHTMLDefinition(true);
+ $def->addElement('nolink', 'Block', 'Flow', array()); // skip our filters inside
+ $def->addElement('tex', 'Inline', 'Inline', array()); // tex syntax, equivalent to $$xx$$
+ $def->addElement('algebra', 'Inline', 'Inline', array()); // algebra syntax, equivalent to @@xx@@
+ $def->addElement('lang', 'Block', 'Flow', array(), array('lang'=>'CDATA')); // old anf future style multilang - only our hacked lang attribute
+ $def->addAttribute('span', 'xxxlang', 'CDATA'); // current problematic multilang
+
$purifier = new HTMLPurifier($config);
}
- return $purifier->purify($text);
+
+ $multilang = (strpos($text, 'class="multilang"') !== false);
+
+ if ($multilang) {
+ $text = preg_replace('//', '', $text);
+ }
+ $text = $purifier->purify($text);
+ if ($multilang) {
+ $text = preg_replace('//', '', $text);
+ }
+
+ return $text;
}
/**