L-electron-Rare/moodle
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

MDL-22537 new html purifier backported to stable, unfortunately PHP5 only

Browse Source
This commit is contained in:
Petr Skoda
2010-05-21 11:39:22 +00:00
parent f8502768a2
commit db359e6369
330 changed files with 13929 additions and 10060 deletions
Download Patch File Download Diff File Expand all files Collapse all files
lib/htmlpurifier/HTMLPurifier/Injector/AutoParagraph.php
+276 -214
View File
@@ -1,168 +1,203 @@
<?php
require_once 'HTMLPurifier/Injector.php';
HTMLPurifier_ConfigSchema::define(
'AutoFormat', 'AutoParagraph', false, 'bool', '
<p>
This directive turns on auto-paragraphing, where double newlines are
converted in to paragraphs whenever possible. Auto-paragraphing:
</p>
<ul>
<li>Always applies to inline elements or text in the root node,</li>
<li>Applies to inline elements or text with double newlines in nodes
that allow paragraph tags,</li>
<li>Applies to double newlines in paragraph tags</li>
</ul>
<p>
<code>p</code> tags must be allowed for this directive to take effect.
We do not use <code>br</code> tags for paragraphing, as that is
semantically incorrect.
</p>
<p>
To prevent auto-paragraphing as a content-producer, refrain from using
double-newlines except to specify a new paragraph or in contexts where
it has special meaning (whitespace usually has no meaning except in
tags like <code>pre</code>, so this should not be difficult.) To prevent
the paragraphing of inline text adjacent to block elements, wrap them
in <code>div</code> tags (the behavior is slightly different outside of
the root node.)
</p>
<p>
This directive has been available since 2.0.1.
</p>
');
/**
* Injector that auto paragraphs text in the root node based on
* double-spacing.
* @todo Ensure all states are unit tested, including variations as well.
* @todo Make a graph of the flow control for this Injector.
*/
class HTMLPurifier_Injector_AutoParagraph extends HTMLPurifier_Injector
{
var $name = 'AutoParagraph';
var $needed = array('p');
function _pStart() {
public $name = 'AutoParagraph';
public $needed = array('p');
private function _pStart() {
$par = new HTMLPurifier_Token_Start('p');
$par->armor['MakeWellFormed_TagClosedError'] = true;
return $par;
}
function handleText(&$token) {
public function handleText(&$token) {
$text = $token->data;
if (empty($this->currentNesting)) {
if (!$this->allowsElement('p')) return;
// case 1: we're in root node (and it allows paragraphs)
$token = array($this->_pStart());
$this->_splitText($text, $token);
} elseif ($this->currentNesting[count($this->currentNesting)-1]->name == 'p') {
// case 2: we're in a paragraph
// Does the current parent allow <p> tags?
if ($this->allowsElement('p')) {
if (empty($this->currentNesting) || strpos($text, "\n\n") !== false) {
// Note that we have differing behavior when dealing with text
// in the anonymous root node, or a node inside the document.
// If the text as a double-newline, the treatment is the same;
// if it doesn't, see the next if-block if you're in the document.
$i = $nesting = null;
if (!$this->forwardUntilEndToken($i, $current, $nesting) && $token->is_whitespace) {
// State 1.1: ... ^ (whitespace, then document end)
// ----
// This is a degenerate case
} else {
if (!$token->is_whitespace || $this->_isInline($current)) {
// State 1.2: PAR1
// ----
// State 1.3: PAR1\n\nPAR2
// ------------
// State 1.4: <div>PAR1\n\nPAR2 (see State 2)
// ------------
$token = array($this->_pStart());
$this->_splitText($text, $token);
} else {
// State 1.5: \n<hr />
// --
}
}
} else {
// State 2: <div>PAR1... (similar to 1.4)
// ----
// We're in an element that allows paragraph tags, but we're not
// sure if we're going to need them.
if ($this->_pLookAhead()) {
// State 2.1: <div>PAR1<b>PAR1\n\nPAR2
// ----
// Note: This will always be the first child, since any
// previous inline element would have triggered this very
// same routine, and found the double newline. One possible
// exception would be a comment.
$token = array($this->_pStart(), $token);
} else {
// State 2.2.1: <div>PAR1<div>
// ----
// State 2.2.2: <div>PAR1<b>PAR1</b></div>
// ----
}
}
// Is the current parent a <p> tag?
} elseif (
!empty($this->currentNesting) &&
$this->currentNesting[count($this->currentNesting)-1]->name == 'p'
) {
// State 3.1: ...<p>PAR1
// ----
// State 3.2: ...<p>PAR1\n\nPAR2
// ------------
$token = array();
$this->_splitText($text, $token);
} elseif ($this->allowsElement('p')) {
// case 3: we're in an element that allows paragraphs
if (strpos($text, "\n\n") !== false) {
// case 3.1: this text node has a double-newline
$token = array($this->_pStart());
$this->_splitText($text, $token);
// Abort!
} else {
// State 4.1: ...<b>PAR1
// ----
// State 4.2: ...<b>PAR1\n\nPAR2
// ------------
}
}
public function handleElement(&$token) {
// We don't have to check if we're already in a <p> tag for block
// tokens, because the tag would have been autoclosed by MakeWellFormed.
if ($this->allowsElement('p')) {
if (!empty($this->currentNesting)) {
if ($this->_isInline($token)) {
// State 1: <div>...<b>
// ---
// Check if this token is adjacent to the parent token
// (seek backwards until token isn't whitespace)
$i = null;
$this->backward($i, $prev);
if (!$prev instanceof HTMLPurifier_Token_Start) {
// Token wasn't adjacent
if (
$prev instanceof HTMLPurifier_Token_Text &&
substr($prev->data, -2) === "\n\n"
) {
// State 1.1.4: <div><p>PAR1</p>\n\n<b>
// ---
// Quite frankly, this should be handled by splitText
$token = array($this->_pStart(), $token);
} else {
// State 1.1.1: <div><p>PAR1</p><b>
// ---
// State 1.1.2: <div><br /><b>
// ---
// State 1.1.3: <div>PAR<b>
// ---
}
} else {
// State 1.2.1: <div><b>
// ---
// Lookahead to see if <p> is needed.
if ($this->_pLookAhead()) {
// State 1.3.1: <div><b>PAR1\n\nPAR2
// ---
$token = array($this->_pStart(), $token);
} else {
// State 1.3.2: <div><b>PAR1</b></div>
// ---
// State 1.3.3: <div><b>PAR1</b><div></div>\n\n</div>
// ---
}
}
} else {
// State 2.3: ...<div>
// -----
}
} else {
$ok = false;
// test if up-coming tokens are either block or have
// a double newline in them
$nesting = 0;
for ($i = $this->inputIndex + 1; isset($this->inputTokens[$i]); $i++) {
if ($this->inputTokens[$i]->type == 'start'){
if (!$this->_isInline($this->inputTokens[$i])) {
// we haven't found a double-newline, and
// we've hit a block element, so don't paragraph
$ok = false;
break;
}
$nesting++;
}
if ($this->inputTokens[$i]->type == 'end') {
if ($nesting <= 0) break;
$nesting--;
}
if ($this->inputTokens[$i]->type == 'text') {
// found it!
if (strpos($this->inputTokens[$i]->data, "\n\n") !== false) {
$ok = true;
break;
}
}
}
if ($ok) {
// case 3.2: this text node is next to another node
// that will start a paragraph
if ($this->_isInline($token)) {
// State 3.1: <b>
// ---
// This is where the {p} tag is inserted, not reflected in
// inputTokens yet, however.
$token = array($this->_pStart(), $token);
} else {
// State 3.2: <div>
// -----
}
}
}
}
function handleElement(&$token) {
// check if we're inside a tag already
if (!empty($this->currentNesting)) {
if ($this->allowsElement('p')) {
// special case: we're in an element that allows paragraphs
// this token is already paragraph, abort
if ($token->name == 'p') return;
// this token is a block level, abort
if (!$this->_isInline($token)) return;
// check if this token is adjacent to the parent token
$prev = $this->inputTokens[$this->inputIndex - 1];
if ($prev->type != 'start') {
// not adjacent, we can abort early
// add lead paragraph tag if our token is inline
// and the previous tag was an end paragraph
$i = null;
if ($this->backward($i, $prev)) {
if (
$prev->name == 'p' && $prev->type == 'end' &&
$this->_isInline($token)
!$prev instanceof HTMLPurifier_Token_Text
) {
$token = array($this->_pStart(), $token);
// State 3.1.1: ...</p>{p}<b>
// ---
// State 3.2.1: ...</p><div>
// -----
if (!is_array($token)) $token = array($token);
array_unshift($token, new HTMLPurifier_Token_Text("\n\n"));
} else {
// State 3.1.2: ...</p>\n\n{p}<b>
// ---
// State 3.2.2: ...</p>\n\n<div>
// -----
// Note: PAR<ELEM> cannot occur because PAR would have been
// wrapped in <p> tags.
}
return;
}
// this token is the first child of the element that allows
// paragraph. We have to peek ahead and see whether or not
// there is anything inside that suggests that a paragraph
// will be needed
$ok = false;
// maintain a mini-nesting counter, this lets us bail out
// early if possible
$j = 1; // current nesting, one is due to parent (we recalculate current token)
for ($i = $this->inputIndex; isset($this->inputTokens[$i]); $i++) {
if ($this->inputTokens[$i]->type == 'start') $j++;
if ($this->inputTokens[$i]->type == 'end') $j--;
if ($this->inputTokens[$i]->type == 'text') {
if (strpos($this->inputTokens[$i]->data, "\n\n") !== false) {
$ok = true;
break;
}
}
if ($j <= 0) break;
}
if ($ok) {
$token = array($this->_pStart(), $token);
}
}
return;
} else {
// State 2.2: <ul><li>
// ----
// State 2.4: <p><b>
// ---
}
// check if the start tag counts as a "block" element
if (!$this->_isInline($token)) return;
// append a paragraph tag before the token
$token = array($this->_pStart(), $token);
}
/**
* Splits up a text in paragraph tokens and appends them
* to the result stream that will replace the original
@@ -172,112 +207,139 @@ class HTMLPurifier_Injector_AutoParagraph extends HTMLPurifier_Injector
* tags will be appended onto
* @param $config Instance of HTMLPurifier_Config
* @param $context Instance of HTMLPurifier_Context
* @private
*/
function _splitText($data, &$result) {
private function _splitText($data, &$result) {
$raw_paragraphs = explode("\n\n", $data);
// remove empty paragraphs
$paragraphs = array();
$paragraphs = array(); // without empty paragraphs
$needs_start = false;
$needs_end = false;
$c = count($raw_paragraphs);
if ($c == 1) {
// there were no double-newlines, abort quickly
// There were no double-newlines, abort quickly. In theory this
// should never happen.
$result[] = new HTMLPurifier_Token_Text($data);
return;
}
for ($i = 0; $i < $c; $i++) {
$par = $raw_paragraphs[$i];
if (trim($par) !== '') {
$paragraphs[] = $par;
continue;
}
if ($i == 0 && empty($result)) {
// The empty result indicates that the AutoParagraph
// injector did not add any start paragraph tokens.
// The fact that the first paragraph is empty indicates
// that there was a double-newline at the start of the
// data.
// Combined together, this means that we are in a paragraph,
// and the newline means we should start a new one.
$result[] = new HTMLPurifier_Token_End('p');
// However, the start token should only be added if
// there is more processing to be done (i.e. there are
// real paragraphs in here). If there are none, the
// next start paragraph tag will be handled by the
// next run-around the injector
$needs_start = true;
} elseif ($i + 1 == $c) {
// a double-paragraph at the end indicates that
// there is an overriding need to start a new paragraph
// for the next section. This has no effect until
// we've processed all of the other paragraphs though
$needs_end = true;
} else {
if ($i == 0) {
// Double newline at the front
if (empty($result)) {
// The empty result indicates that the AutoParagraph
// injector did not add any start paragraph tokens.
// This means that we have been in a paragraph for
// a while, and the newline means we should start a new one.
$result[] = new HTMLPurifier_Token_End('p');
$result[] = new HTMLPurifier_Token_Text("\n\n");
// However, the start token should only be added if
// there is more processing to be done (i.e. there are
// real paragraphs in here). If there are none, the
// next start paragraph tag will be handled by the
// next call to the injector
$needs_start = true;
} else {
// We just started a new paragraph!
// Reinstate a double-newline for presentation's sake, since
// it was in the source code.
array_unshift($result, new HTMLPurifier_Token_Text("\n\n"));
}
} elseif ($i + 1 == $c) {
// Double newline at the end
// There should be a trailing </p> when we're finally done.
$needs_end = true;
}
}
}
// check if there are no "real" paragraphs to be processed
// Check if this was just a giant blob of whitespace. Move this earlier,
// perhaps?
if (empty($paragraphs)) {
return;
}
// add a start tag if an end tag was added while processing
// the raw paragraphs (that happens if there's a leading double
// newline)
if ($needs_start) $result[] = $this->_pStart();
// append the paragraphs onto the result
// Add the start tag indicated by \n\n at the beginning of $data
if ($needs_start) {
$result[] = $this->_pStart();
}
// Append the paragraphs onto the result
foreach ($paragraphs as $par) {
$result[] = new HTMLPurifier_Token_Text($par);
$result[] = new HTMLPurifier_Token_End('p');
$result[] = new HTMLPurifier_Token_Text("\n\n");
$result[] = $this->_pStart();
}
// remove trailing start token, if one is needed, it will
// be handled the next time this injector is called
// Remove trailing start token; Injector will handle this later if
// it was indeed needed. This prevents from needing to do a lookahead,
// at the cost of a lookbehind later.
array_pop($result);
// check the outside to determine whether or not the
// end paragraph tag should be removed. It should be removed
// unless the next non-whitespace token is a paragraph
// or a block element.
$remove_paragraph_end = true;
// If there is no need for an end tag, remove all of it and let
// MakeWellFormed close it later.
if (!$needs_end) {
// Start of the checks one after the current token's index
for ($i = $this->inputIndex + 1; isset($this->inputTokens[$i]); $i++) {
if ($this->inputTokens[$i]->type == 'start' || $this->inputTokens[$i]->type == 'empty') {
$remove_paragraph_end = $this->_isInline($this->inputTokens[$i]);
}
// check if we can abort early (whitespace means we carry-on!)
if ($this->inputTokens[$i]->type == 'text' && !$this->inputTokens[$i]->is_whitespace) break;
// end tags will automatically be handled by MakeWellFormed,
// so we don't have to worry about them
if ($this->inputTokens[$i]->type == 'end') break;
}
} else {
$remove_paragraph_end = false;
array_pop($result); // removes \n\n
array_pop($result); // removes </p>
}
// check the outside to determine whether or not the
// end paragraph tag should be removed
if ($remove_paragraph_end) {
array_pop($result);
}
}
/**
* Returns true if passed token is inline (and, ergo, allowed in
* paragraph tags)
* @private
*/
function _isInline($token) {
private function _isInline($token) {
return isset($this->htmlDefinition->info['p']->child->elements[$token->name]);
}
/**
* Looks ahead in the token list and determines whether or not we need
* to insert a <p> tag.
*/
private function _pLookAhead() {
$this->current($i, $current);
if ($current instanceof HTMLPurifier_Token_Start) $nesting = 1;
else $nesting = 0;
$ok = false;
while ($this->forwardUntilEndToken($i, $current, $nesting)) {
$result = $this->_checkNeedsP($current);
if ($result !== null) {
$ok = $result;
break;
}
}
return $ok;
}
/**
* Determines if a particular token requires an earlier inline token
* to get a paragraph. This should be used with _forwardUntilEndToken
*/
private function _checkNeedsP($current) {
if ($current instanceof HTMLPurifier_Token_Start){
if (!$this->_isInline($current)) {
// <div>PAR1<div>
// ----
// Terminate early, since we hit a block element
return false;
}
} elseif ($current instanceof HTMLPurifier_Token_Text) {
if (strpos($current->data, "\n\n") !== false) {
// <div>PAR1<b>PAR1\n\nPAR2
// ----
return true;
} else {
// <div>PAR1<b>PAR1...
// ----
}
}
return null;
}
}
// vim: et sw=4 sts=4
lib/htmlpurifier/HTMLPurifier/Injector/DisplayLinkURI.php
+26
View File
@@ -0,0 +1,26 @@
<?php
/**
* Injector that displays the URL of an anchor instead of linking to it, in addition to showing the text of the link.
*/
class HTMLPurifier_Injector_DisplayLinkURI extends HTMLPurifier_Injector
{
public $name = 'DisplayLinkURI';
public $needed = array('a');
public function handleElement(&$token) {
}
public function handleEnd(&$token) {
if (isset($token->start->attr['href'])){
$url = $token->start->attr['href'];
unset($token->start->attr['href']);
$token = array($token, new HTMLPurifier_Token_Text(" ($url)"));
} else {
// nothing to display
}
}
}
// vim: et sw=4 sts=4
lib/htmlpurifier/HTMLPurifier/Injector/Linkify.php
+12 -22
View File
@@ -1,41 +1,30 @@
<?php
require_once 'HTMLPurifier/Injector.php';
HTMLPurifier_ConfigSchema::define(
'AutoFormat', 'Linkify', false, 'bool', '
<p>
This directive turns on linkification, auto-linking http, ftp and
https URLs. <code>a</code> tags with the <code>href</code> attribute
must be allowed. This directive has been available since 2.0.1.
</p>
');
/**
* Injector that converts http, https and ftp text URLs to actual links.
*/
class HTMLPurifier_Injector_Linkify extends HTMLPurifier_Injector
{
var $name = 'Linkify';
var $needed = array('a' => array('href'));
function handleText(&$token) {
public $name = 'Linkify';
public $needed = array('a' => array('href'));
public function handleText(&$token) {
if (!$this->allowsElement('a')) return;
if (strpos($token->data, '://') === false) {
// our really quick heuristic failed, abort
// this may not work so well if we want to match things like
// "google.com", but then again, most people don't
return;
}
// there is/are URL(s). Let's split the string:
// Note: this regex is extremely permissive
$bits = preg_split('#((?:https?|ftp)://[^\s\'"<>()]+)#S', $token->data, -1, PREG_SPLIT_DELIM_CAPTURE);
$token = array();
// $i = index
// $c = count
// $l = is link
@@ -49,8 +38,9 @@ class HTMLPurifier_Injector_Linkify extends HTMLPurifier_Injector
$token[] = new HTMLPurifier_Token_End('a');
}
}
}
}
// vim: et sw=4 sts=4
lib/htmlpurifier/HTMLPurifier/Injector/PurifierLinkify.php
+14 -34
View File
@@ -1,49 +1,28 @@
<?php
require_once 'HTMLPurifier/Injector.php';
HTMLPurifier_ConfigSchema::define(
'AutoFormat', 'PurifierLinkify', false, 'bool', '
<p>
Internal auto-formatter that converts configuration directives in
syntax <a>%Namespace.Directive</a> to links. <code>a</code> tags
with the <code>href</code> attribute must be allowed.
This directive has been available since 2.0.1.
</p>
');
HTMLPurifier_ConfigSchema::define(
'AutoFormatParam', 'PurifierLinkifyDocURL', '#%s', 'string', '
<p>
Location of configuration documentation to link to, let %s substitute
into the configuration\'s namespace and directive names sans the percent
sign. This directive has been available since 2.0.1.
</p>
');
/**
* Injector that converts configuration directive syntax %Namespace.Directive
* to links
*/
class HTMLPurifier_Injector_PurifierLinkify extends HTMLPurifier_Injector
{
var $name = 'PurifierLinkify';
var $docURL;
var $needed = array('a' => array('href'));
function prepare($config, &$context) {
$this->docURL = $config->get('AutoFormatParam', 'PurifierLinkifyDocURL');
public $name = 'PurifierLinkify';
public $docURL;
public $needed = array('a' => array('href'));
public function prepare($config, $context) {
$this->docURL = $config->get('AutoFormat.PurifierLinkify.DocURL');
return parent::prepare($config, $context);
}
function handleText(&$token) {
public function handleText(&$token) {
if (!$this->allowsElement('a')) return;
if (strpos($token->data, '%') === false) return;
$bits = preg_split('#%([a-z0-9]+\.[a-z0-9]+)#Si', $token->data, -1, PREG_SPLIT_DELIM_CAPTURE);
$token = array();
// $i = index
// $c = count
// $l = is link
@@ -58,8 +37,9 @@ class HTMLPurifier_Injector_PurifierLinkify extends HTMLPurifier_Injector
$token[] = new HTMLPurifier_Token_End('a');
}
}
}
}
// vim: et sw=4 sts=4
lib/htmlpurifier/HTMLPurifier/Injector/RemoveEmpty.php
+51
View File
@@ -0,0 +1,51 @@
<?php
class HTMLPurifier_Injector_RemoveEmpty extends HTMLPurifier_Injector
{
private $context, $config, $attrValidator, $removeNbsp, $removeNbspExceptions;
public function prepare($config, $context) {
parent::prepare($config, $context);
$this->config = $config;
$this->context = $context;
$this->removeNbsp = $config->get('AutoFormat.RemoveEmpty.RemoveNbsp');
$this->removeNbspExceptions = $config->get('AutoFormat.RemoveEmpty.RemoveNbsp.Exceptions');
$this->attrValidator = new HTMLPurifier_AttrValidator();
}
public function handleElement(&$token) {
if (!$token instanceof HTMLPurifier_Token_Start) return;
$next = false;
for ($i = $this->inputIndex + 1, $c = count($this->inputTokens); $i < $c; $i++) {
$next = $this->inputTokens[$i];
if ($next instanceof HTMLPurifier_Token_Text) {
if ($next->is_whitespace) continue;
if ($this->removeNbsp && !isset($this->removeNbspExceptions[$token->name])) {
$plain = str_replace("\xC2\xA0", "", $next->data);
$isWsOrNbsp = $plain === '' || ctype_space($plain);
if ($isWsOrNbsp) continue;
}
}
break;
}
if (!$next || ($next instanceof HTMLPurifier_Token_End && $next->name == $token->name)) {
if ($token->name == 'colgroup') return;
$this->attrValidator->validateToken($token, $this->config, $this->context);
$token->armor['ValidateAttributes'] = true;
if (isset($token->attr['id']) || isset($token->attr['name'])) return;
$token = $i - $this->inputIndex + 1;
for ($b = $this->inputIndex - 1; $b > 0; $b--) {
$prev = $this->inputTokens[$b];
if ($prev instanceof HTMLPurifier_Token_Text && $prev->is_whitespace) continue;
break;
}
// This is safe because we removed the token that triggered this.
$this->rewind($b - 1);
return;
}
}
}
// vim: et sw=4 sts=4
lib/htmlpurifier/HTMLPurifier/Injector/RemoveSpansWithoutAttributes.php
+60
View File
@@ -0,0 +1,60 @@
<?php
/**
* Injector that removes spans with no attributes
*/
class HTMLPurifier_Injector_RemoveSpansWithoutAttributes extends HTMLPurifier_Injector
{
public $name = 'RemoveSpansWithoutAttributes';
public $needed = array('span');
private $attrValidator;
/**
* Used by AttrValidator
*/
private $config;
private $context;
public function prepare($config, $context) {
$this->attrValidator = new HTMLPurifier_AttrValidator();
$this->config = $config;
$this->context = $context;
return parent::prepare($config, $context);
}
public function handleElement(&$token) {
if ($token->name !== 'span' || !$token instanceof HTMLPurifier_Token_Start) {
return;
}
// We need to validate the attributes now since this doesn't normally
// happen until after MakeWellFormed. If all the attributes are removed
// the span needs to be removed too.
$this->attrValidator->validateToken($token, $this->config, $this->context);
$token->armor['ValidateAttributes'] = true;
if (!empty($token->attr)) {
return;
}
$nesting = 0;
$spanContentTokens = array();
while ($this->forwardUntilEndToken($i, $current, $nesting)) {}
if ($current instanceof HTMLPurifier_Token_End && $current->name === 'span') {
// Mark closing span tag for deletion
$current->markForDeletion = true;
// Delete open span tag
$token = false;
}
}
public function handleEnd(&$token) {
if ($token->markForDeletion) {
$token = false;
}
}
}
// vim: et sw=4 sts=4
lib/htmlpurifier/HTMLPurifier/Injector/SafeObject.php
+90
View File
@@ -0,0 +1,90 @@
<?php
/**
* Adds important param elements to inside of object in order to make
* things safe.
*/
class HTMLPurifier_Injector_SafeObject extends HTMLPurifier_Injector
{
public $name = 'SafeObject';
public $needed = array('object', 'param');
protected $objectStack = array();
protected $paramStack = array();
// Keep this synchronized with AttrTransform/SafeParam.php
protected $addParam = array(
'allowScriptAccess' => 'never',
'allowNetworking' => 'internal',
);
protected $allowedParam = array(
'wmode' => true,
'movie' => true,
'flashvars' => true,
'src' => true,
);
public function prepare($config, $context) {
parent::prepare($config, $context);
}
public function handleElement(&$token) {
if ($token->name == 'object') {
$this->objectStack[] = $token;
$this->paramStack[] = array();
$new = array($token);
foreach ($this->addParam as $name => $value) {
$new[] = new HTMLPurifier_Token_Empty('param', array('name' => $name, 'value' => $value));
}
$token = $new;
} elseif ($token->name == 'param') {
$nest = count($this->currentNesting) - 1;
if ($nest >= 0 && $this->currentNesting[$nest]->name === 'object') {
$i = count($this->objectStack) - 1;
if (!isset($token->attr['name'])) {
$token = false;
return;
}
$n = $token->attr['name'];
// We need this fix because YouTube doesn't supply a data
// attribute, which we need if a type is specified. This is
// *very* Flash specific.
if (!isset($this->objectStack[$i]->attr['data']) &&
($token->attr['name'] == 'movie' || $token->attr['name'] == 'src')) {
$this->objectStack[$i]->attr['data'] = $token->attr['value'];
}
// Check if the parameter is the correct value but has not
// already been added
if (
!isset($this->paramStack[$i][$n]) &&
isset($this->addParam[$n]) &&
$token->attr['name'] === $this->addParam[$n]
) {
// keep token, and add to param stack
$this->paramStack[$i][$n] = true;
} elseif (isset($this->allowedParam[$n])) {
// keep token, don't do anything to it
// (could possibly check for duplicates here)
} else {
$token = false;
}
} else {
// not directly inside an object, DENY!
$token = false;
}
}
}
public function handleEnd(&$token) {
// This is the WRONG way of handling the object and param stacks;
// we should be inserting them directly on the relevant object tokens
// so that the global stack handling handles it.
if ($token->name == 'object') {
array_pop($this->objectStack);
array_pop($this->paramStack);
}
}
}
// vim: et sw=4 sts=4