diff --git a/3rdparty/HTMLPurifier/HTMLPurifier.standalone.php b/3rdparty/HTMLPurifier/HTMLPurifier.standalone.php
deleted file mode 100644
index cfdbcc92..00000000
--- a/3rdparty/HTMLPurifier/HTMLPurifier.standalone.php
+++ /dev/null
@@ -1,22584 +0,0 @@
-config = HTMLPurifier_Config::create($config);
- $this->strategy = new HTMLPurifier_Strategy_Core();
- }
-
- /**
- * Adds a filter to process the output. First come first serve
- *
- * @param HTMLPurifier_Filter $filter HTMLPurifier_Filter object
- */
- public function addFilter($filter)
- {
- trigger_error(
- 'HTMLPurifier->addFilter() is deprecated, use configuration directives' .
- ' in the Filter namespace or Filter.Custom',
- E_USER_WARNING
- );
- $this->filters[] = $filter;
- }
-
- /**
- * Filters an HTML snippet/document to be XSS-free and standards-compliant.
- *
- * @param string $html String of HTML to purify
- * @param HTMLPurifier_Config $config Config object for this operation,
- * if omitted, defaults to the config object specified during this
- * object's construction. The parameter can also be any type
- * that HTMLPurifier_Config::create() supports.
- *
- * @return string Purified HTML
- */
- public function purify($html, $config = null)
- {
- // :TODO: make the config merge in, instead of replace
- $config = $config ? HTMLPurifier_Config::create($config) : $this->config;
-
- // implementation is partially environment dependant, partially
- // configuration dependant
- $lexer = HTMLPurifier_Lexer::create($config);
-
- $context = new HTMLPurifier_Context();
-
- // setup HTML generator
- $this->generator = new HTMLPurifier_Generator($config, $context);
- $context->register('Generator', $this->generator);
-
- // set up global context variables
- if ($config->get('Core.CollectErrors')) {
- // may get moved out if other facilities use it
- $language_factory = HTMLPurifier_LanguageFactory::instance();
- $language = $language_factory->create($config, $context);
- $context->register('Locale', $language);
-
- $error_collector = new HTMLPurifier_ErrorCollector($context);
- $context->register('ErrorCollector', $error_collector);
- }
-
- // setup id_accumulator context, necessary due to the fact that
- // AttrValidator can be called from many places
- $id_accumulator = HTMLPurifier_IDAccumulator::build($config, $context);
- $context->register('IDAccumulator', $id_accumulator);
-
- $html = HTMLPurifier_Encoder::convertToUTF8($html, $config, $context);
-
- // setup filters
- $filter_flags = $config->getBatch('Filter');
- $custom_filters = $filter_flags['Custom'];
- unset($filter_flags['Custom']);
- $filters = array();
- foreach ($filter_flags as $filter => $flag) {
- if (!$flag) {
- continue;
- }
- if (strpos($filter, '.') !== false) {
- continue;
- }
- $class = "HTMLPurifier_Filter_$filter";
- $filters[] = new $class;
- }
- foreach ($custom_filters as $filter) {
- // maybe "HTMLPurifier_Filter_$filter", but be consistent with AutoFormat
- $filters[] = $filter;
- }
- $filters = array_merge($filters, $this->filters);
- // maybe prepare(), but later
-
- for ($i = 0, $filter_size = count($filters); $i < $filter_size; $i++) {
- $html = $filters[$i]->preFilter($html, $config, $context);
- }
-
- // purified HTML
- $html =
- $this->generator->generateFromTokens(
- // list of tokens
- $this->strategy->execute(
- // list of un-purified tokens
- $lexer->tokenizeHTML(
- // un-purified HTML
- $html,
- $config,
- $context
- ),
- $config,
- $context
- )
- );
-
- for ($i = $filter_size - 1; $i >= 0; $i--) {
- $html = $filters[$i]->postFilter($html, $config, $context);
- }
-
- $html = HTMLPurifier_Encoder::convertFromUTF8($html, $config, $context);
- $this->context =& $context;
- return $html;
- }
-
- /**
- * Filters an array of HTML snippets
- *
- * @param string[] $array_of_html Array of html snippets
- * @param HTMLPurifier_Config $config Optional config object for this operation.
- * See HTMLPurifier::purify() for more details.
- *
- * @return string[] Array of purified HTML
- */
- public function purifyArray($array_of_html, $config = null)
- {
- $context_array = array();
- foreach($array_of_html as $key=>$value){
- if (is_array($value)) {
- $array[$key] = $this->purifyArray($value, $config);
- } else {
- $array[$key] = $this->purify($value, $config);
- }
- $context_array[$key] = $this->context;
- }
- $this->context = $context_array;
- return $array;
- }
-
- /**
- * Singleton for enforcing just one HTML Purifier in your system
- *
- * @param HTMLPurifier|HTMLPurifier_Config $prototype Optional prototype
- * HTMLPurifier instance to overload singleton with,
- * or HTMLPurifier_Config instance to configure the
- * generated version with.
- *
- * @return HTMLPurifier
- */
- public static function instance($prototype = null)
- {
- if (!self::$instance || $prototype) {
- if ($prototype instanceof HTMLPurifier) {
- self::$instance = $prototype;
- } elseif ($prototype) {
- self::$instance = new HTMLPurifier($prototype);
- } else {
- self::$instance = new HTMLPurifier();
- }
- }
- return self::$instance;
- }
-
- /**
- * Singleton for enforcing just one HTML Purifier in your system
- *
- * @param HTMLPurifier|HTMLPurifier_Config $prototype Optional prototype
- * HTMLPurifier instance to overload singleton with,
- * or HTMLPurifier_Config instance to configure the
- * generated version with.
- *
- * @return HTMLPurifier
- * @note Backwards compatibility, see instance()
- */
- public static function getInstance($prototype = null)
- {
- return HTMLPurifier::instance($prototype);
- }
-}
-
-
-
-
-
-/**
- * Converts a stream of HTMLPurifier_Token into an HTMLPurifier_Node,
- * and back again.
- *
- * @note This transformation is not an equivalence. We mutate the input
- * token stream to make it so; see all [MUT] markers in code.
- */
-class HTMLPurifier_Arborize
-{
- public static function arborize($tokens, $config, $context) {
- $definition = $config->getHTMLDefinition();
- $parent = new HTMLPurifier_Token_Start($definition->info_parent);
- $stack = array($parent->toNode());
- foreach ($tokens as $token) {
- $token->skip = null; // [MUT]
- $token->carryover = null; // [MUT]
- if ($token instanceof HTMLPurifier_Token_End) {
- $token->start = null; // [MUT]
- $r = array_pop($stack);
- //assert($r->name === $token->name);
- //assert(empty($token->attr));
- $r->endCol = $token->col;
- $r->endLine = $token->line;
- $r->endArmor = $token->armor;
- continue;
- }
- $node = $token->toNode();
- $stack[count($stack)-1]->children[] = $node;
- if ($token instanceof HTMLPurifier_Token_Start) {
- $stack[] = $node;
- }
- }
- //assert(count($stack) == 1);
- return $stack[0];
- }
-
- public static function flatten($node, $config, $context) {
- $level = 0;
- $nodes = array($level => new HTMLPurifier_Queue(array($node)));
- $closingTokens = array();
- $tokens = array();
- do {
- while (!$nodes[$level]->isEmpty()) {
- $node = $nodes[$level]->shift(); // FIFO
- list($start, $end) = $node->toTokenPair();
- if ($level > 0) {
- $tokens[] = $start;
- }
- if ($end !== NULL) {
- $closingTokens[$level][] = $end;
- }
- if ($node instanceof HTMLPurifier_Node_Element) {
- $level++;
- $nodes[$level] = new HTMLPurifier_Queue();
- foreach ($node->children as $childNode) {
- $nodes[$level]->push($childNode);
- }
- }
- }
- $level--;
- if ($level && isset($closingTokens[$level])) {
- while ($token = array_pop($closingTokens[$level])) {
- $tokens[] = $token;
- }
- }
- } while ($level > 0);
- return $tokens;
- }
-}
-
-
-
-/**
- * Defines common attribute collections that modules reference
- */
-
-class HTMLPurifier_AttrCollections
-{
-
- /**
- * Associative array of attribute collections, indexed by name.
- * @type array
- */
- public $info = array();
-
- /**
- * Performs all expansions on internal data for use by other inclusions
- * It also collects all attribute collection extensions from
- * modules
- * @param HTMLPurifier_AttrTypes $attr_types HTMLPurifier_AttrTypes instance
- * @param HTMLPurifier_HTMLModule[] $modules Hash array of HTMLPurifier_HTMLModule members
- */
- public function __construct($attr_types, $modules)
- {
- $this->doConstruct($attr_types, $modules);
- }
-
- public function doConstruct($attr_types, $modules)
- {
- // load extensions from the modules
- foreach ($modules as $module) {
- foreach ($module->attr_collections as $coll_i => $coll) {
- if (!isset($this->info[$coll_i])) {
- $this->info[$coll_i] = array();
- }
- foreach ($coll as $attr_i => $attr) {
- if ($attr_i === 0 && isset($this->info[$coll_i][$attr_i])) {
- // merge in includes
- $this->info[$coll_i][$attr_i] = array_merge(
- $this->info[$coll_i][$attr_i],
- $attr
- );
- continue;
- }
- $this->info[$coll_i][$attr_i] = $attr;
- }
- }
- }
- // perform internal expansions and inclusions
- foreach ($this->info as $name => $attr) {
- // merge attribute collections that include others
- $this->performInclusions($this->info[$name]);
- // replace string identifiers with actual attribute objects
- $this->expandIdentifiers($this->info[$name], $attr_types);
- }
- }
-
- /**
- * Takes a reference to an attribute associative array and performs
- * all inclusions specified by the zero index.
- * @param array &$attr Reference to attribute array
- */
- public function performInclusions(&$attr)
- {
- if (!isset($attr[0])) {
- return;
- }
- $merge = $attr[0];
- $seen = array(); // recursion guard
- // loop through all the inclusions
- for ($i = 0; isset($merge[$i]); $i++) {
- if (isset($seen[$merge[$i]])) {
- continue;
- }
- $seen[$merge[$i]] = true;
- // foreach attribute of the inclusion, copy it over
- if (!isset($this->info[$merge[$i]])) {
- continue;
- }
- foreach ($this->info[$merge[$i]] as $key => $value) {
- if (isset($attr[$key])) {
- continue;
- } // also catches more inclusions
- $attr[$key] = $value;
- }
- if (isset($this->info[$merge[$i]][0])) {
- // recursion
- $merge = array_merge($merge, $this->info[$merge[$i]][0]);
- }
- }
- unset($attr[0]);
- }
-
- /**
- * Expands all string identifiers in an attribute array by replacing
- * them with the appropriate values inside HTMLPurifier_AttrTypes
- * @param array &$attr Reference to attribute array
- * @param HTMLPurifier_AttrTypes $attr_types HTMLPurifier_AttrTypes instance
- */
- public function expandIdentifiers(&$attr, $attr_types)
- {
- // because foreach will process new elements we add, make sure we
- // skip duplicates
- $processed = array();
-
- foreach ($attr as $def_i => $def) {
- // skip inclusions
- if ($def_i === 0) {
- continue;
- }
-
- if (isset($processed[$def_i])) {
- continue;
- }
-
- // determine whether or not attribute is required
- if ($required = (strpos($def_i, '*') !== false)) {
- // rename the definition
- unset($attr[$def_i]);
- $def_i = trim($def_i, '*');
- $attr[$def_i] = $def;
- }
-
- $processed[$def_i] = true;
-
- // if we've already got a literal object, move on
- if (is_object($def)) {
- // preserve previous required
- $attr[$def_i]->required = ($required || $attr[$def_i]->required);
- continue;
- }
-
- if ($def === false) {
- unset($attr[$def_i]);
- continue;
- }
-
- if ($t = $attr_types->get($def)) {
- $attr[$def_i] = $t;
- $attr[$def_i]->required = $required;
- } else {
- unset($attr[$def_i]);
- }
- }
- }
-}
-
-
-
-
-
-/**
- * Base class for all validating attribute definitions.
- *
- * This family of classes forms the core for not only HTML attribute validation,
- * but also any sort of string that needs to be validated or cleaned (which
- * means CSS properties and composite definitions are defined here too).
- * Besides defining (through code) what precisely makes the string valid,
- * subclasses are also responsible for cleaning the code if possible.
- */
-
-abstract class HTMLPurifier_AttrDef
-{
-
- /**
- * Tells us whether or not an HTML attribute is minimized.
- * Has no meaning in other contexts.
- * @type bool
- */
- public $minimized = false;
-
- /**
- * Tells us whether or not an HTML attribute is required.
- * Has no meaning in other contexts
- * @type bool
- */
- public $required = false;
-
- /**
- * Validates and cleans passed string according to a definition.
- *
- * @param string $string String to be validated and cleaned.
- * @param HTMLPurifier_Config $config Mandatory HTMLPurifier_Config object.
- * @param HTMLPurifier_Context $context Mandatory HTMLPurifier_Context object.
- */
- abstract public function validate($string, $config, $context);
-
- /**
- * Convenience method that parses a string as if it were CDATA.
- *
- * This method process a string in the manner specified at
- * by removing
- * leading and trailing whitespace, ignoring line feeds, and replacing
- * carriage returns and tabs with spaces. While most useful for HTML
- * attributes specified as CDATA, it can also be applied to most CSS
- * values.
- *
- * @note This method is not entirely standards compliant, as trim() removes
- * more types of whitespace than specified in the spec. In practice,
- * this is rarely a problem, as those extra characters usually have
- * already been removed by HTMLPurifier_Encoder.
- *
- * @warning This processing is inconsistent with XML's whitespace handling
- * as specified by section 3.3.3 and referenced XHTML 1.0 section
- * 4.7. However, note that we are NOT necessarily
- * parsing XML, thus, this behavior may still be correct. We
- * assume that newlines have been normalized.
- */
- public function parseCDATA($string)
- {
- $string = trim($string);
- $string = str_replace(array("\n", "\t", "\r"), ' ', $string);
- return $string;
- }
-
- /**
- * Factory method for creating this class from a string.
- * @param string $string String construction info
- * @return HTMLPurifier_AttrDef Created AttrDef object corresponding to $string
- */
- public function make($string)
- {
- // default implementation, return a flyweight of this object.
- // If $string has an effect on the returned object (i.e. you
- // need to overload this method), it is best
- // to clone or instantiate new copies. (Instantiation is safer.)
- return $this;
- }
-
- /**
- * Removes spaces from rgb(0, 0, 0) so that shorthand CSS properties work
- * properly. THIS IS A HACK!
- * @param string $string a CSS colour definition
- * @return string
- */
- protected function mungeRgb($string)
- {
- $p = '\s*(\d+(\.\d+)?([%]?))\s*';
-
- if (preg_match('/(rgba|hsla)\(/', $string)) {
- return preg_replace('/(rgba|hsla)\('.$p.','.$p.','.$p.','.$p.'\)/', '\1(\2,\5,\8,\11)', $string);
- }
-
- return preg_replace('/(rgb|hsl)\('.$p.','.$p.','.$p.'\)/', '\1(\2,\5,\8)', $string);
- }
-
- /**
- * Parses a possibly escaped CSS string and returns the "pure"
- * version of it.
- */
- protected function expandCSSEscape($string)
- {
- // flexibly parse it
- $ret = '';
- for ($i = 0, $c = strlen($string); $i < $c; $i++) {
- if ($string[$i] === '\\') {
- $i++;
- if ($i >= $c) {
- $ret .= '\\';
- break;
- }
- if (ctype_xdigit($string[$i])) {
- $code = $string[$i];
- for ($a = 1, $i++; $i < $c && $a < 6; $i++, $a++) {
- if (!ctype_xdigit($string[$i])) {
- break;
- }
- $code .= $string[$i];
- }
- // We have to be extremely careful when adding
- // new characters, to make sure we're not breaking
- // the encoding.
- $char = HTMLPurifier_Encoder::unichr(hexdec($code));
- if (HTMLPurifier_Encoder::cleanUTF8($char) === '') {
- continue;
- }
- $ret .= $char;
- if ($i < $c && trim($string[$i]) !== '') {
- $i--;
- }
- continue;
- }
- if ($string[$i] === "\n") {
- continue;
- }
- }
- $ret .= $string[$i];
- }
- return $ret;
- }
-}
-
-
-
-
-
-/**
- * Processes an entire attribute array for corrections needing multiple values.
- *
- * Occasionally, a certain attribute will need to be removed and popped onto
- * another value. Instead of creating a complex return syntax for
- * HTMLPurifier_AttrDef, we just pass the whole attribute array to a
- * specialized object and have that do the special work. That is the
- * family of HTMLPurifier_AttrTransform.
- *
- * An attribute transformation can be assigned to run before or after
- * HTMLPurifier_AttrDef validation. See HTMLPurifier_HTMLDefinition for
- * more details.
- */
-
-abstract class HTMLPurifier_AttrTransform
-{
-
- /**
- * Abstract: makes changes to the attributes dependent on multiple values.
- *
- * @param array $attr Assoc array of attributes, usually from
- * HTMLPurifier_Token_Tag::$attr
- * @param HTMLPurifier_Config $config Mandatory HTMLPurifier_Config object.
- * @param HTMLPurifier_Context $context Mandatory HTMLPurifier_Context object
- * @return array Processed attribute array.
- */
- abstract public function transform($attr, $config, $context);
-
- /**
- * Prepends CSS properties to the style attribute, creating the
- * attribute if it doesn't exist.
- * @param array &$attr Attribute array to process (passed by reference)
- * @param string $css CSS to prepend
- */
- public function prependCSS(&$attr, $css)
- {
- $attr['style'] = isset($attr['style']) ? $attr['style'] : '';
- $attr['style'] = $css . $attr['style'];
- }
-
- /**
- * Retrieves and removes an attribute
- * @param array &$attr Attribute array to process (passed by reference)
- * @param mixed $key Key of attribute to confiscate
- * @return mixed
- */
- public function confiscateAttr(&$attr, $key)
- {
- if (!isset($attr[$key])) {
- return null;
- }
- $value = $attr[$key];
- unset($attr[$key]);
- return $value;
- }
-}
-
-
-
-
-
-/**
- * Provides lookup array of attribute types to HTMLPurifier_AttrDef objects
- */
-class HTMLPurifier_AttrTypes
-{
- /**
- * Lookup array of attribute string identifiers to concrete implementations.
- * @type HTMLPurifier_AttrDef[]
- */
- protected $info = array();
-
- /**
- * Constructs the info array, supplying default implementations for attribute
- * types.
- */
- public function __construct()
- {
- // XXX This is kind of poor, since we don't actually /clone/
- // instances; instead, we use the supplied make() attribute. So,
- // the underlying class must know how to deal with arguments.
- // With the old implementation of Enum, that ignored its
- // arguments when handling a make dispatch, the IAlign
- // definition wouldn't work.
-
- // pseudo-types, must be instantiated via shorthand
- $this->info['Enum'] = new HTMLPurifier_AttrDef_Enum();
- $this->info['Bool'] = new HTMLPurifier_AttrDef_HTML_Bool();
-
- $this->info['CDATA'] = new HTMLPurifier_AttrDef_Text();
- $this->info['ID'] = new HTMLPurifier_AttrDef_HTML_ID();
- $this->info['Length'] = new HTMLPurifier_AttrDef_HTML_Length();
- $this->info['MultiLength'] = new HTMLPurifier_AttrDef_HTML_MultiLength();
- $this->info['NMTOKENS'] = new HTMLPurifier_AttrDef_HTML_Nmtokens();
- $this->info['Pixels'] = new HTMLPurifier_AttrDef_HTML_Pixels();
- $this->info['Text'] = new HTMLPurifier_AttrDef_Text();
- $this->info['URI'] = new HTMLPurifier_AttrDef_URI();
- $this->info['LanguageCode'] = new HTMLPurifier_AttrDef_Lang();
- $this->info['Color'] = new HTMLPurifier_AttrDef_HTML_Color();
- $this->info['IAlign'] = self::makeEnum('top,middle,bottom,left,right');
- $this->info['LAlign'] = self::makeEnum('top,bottom,left,right');
- $this->info['FrameTarget'] = new HTMLPurifier_AttrDef_HTML_FrameTarget();
-
- // unimplemented aliases
- $this->info['ContentType'] = new HTMLPurifier_AttrDef_Text();
- $this->info['ContentTypes'] = new HTMLPurifier_AttrDef_Text();
- $this->info['Charsets'] = new HTMLPurifier_AttrDef_Text();
- $this->info['Character'] = new HTMLPurifier_AttrDef_Text();
-
- // "proprietary" types
- $this->info['Class'] = new HTMLPurifier_AttrDef_HTML_Class();
-
- // number is really a positive integer (one or more digits)
- // FIXME: ^^ not always, see start and value of list items
- $this->info['Number'] = new HTMLPurifier_AttrDef_Integer(false, false, true);
- }
-
- private static function makeEnum($in)
- {
- return new HTMLPurifier_AttrDef_Clone(new HTMLPurifier_AttrDef_Enum(explode(',', $in)));
- }
-
- /**
- * Retrieves a type
- * @param string $type String type name
- * @return HTMLPurifier_AttrDef Object AttrDef for type
- */
- public function get($type)
- {
- // determine if there is any extra info tacked on
- if (strpos($type, '#') !== false) {
- list($type, $string) = explode('#', $type, 2);
- } else {
- $string = '';
- }
-
- if (!isset($this->info[$type])) {
- trigger_error('Cannot retrieve undefined attribute type ' . $type, E_USER_ERROR);
- return;
- }
- return $this->info[$type]->make($string);
- }
-
- /**
- * Sets a new implementation for a type
- * @param string $type String type name
- * @param HTMLPurifier_AttrDef $impl Object AttrDef for type
- */
- public function set($type, $impl)
- {
- $this->info[$type] = $impl;
- }
-}
-
-
-
-
-
-/**
- * Validates the attributes of a token. Doesn't manage required attributes
- * very well. The only reason we factored this out was because RemoveForeignElements
- * also needed it besides ValidateAttributes.
- */
-class HTMLPurifier_AttrValidator
-{
-
- /**
- * Validates the attributes of a token, mutating it as necessary.
- * that has valid tokens
- * @param HTMLPurifier_Token $token Token to validate.
- * @param HTMLPurifier_Config $config Instance of HTMLPurifier_Config
- * @param HTMLPurifier_Context $context Instance of HTMLPurifier_Context
- */
- public function validateToken($token, $config, $context)
- {
- $definition = $config->getHTMLDefinition();
- $e =& $context->get('ErrorCollector', true);
-
- // initialize IDAccumulator if necessary
- $ok =& $context->get('IDAccumulator', true);
- if (!$ok) {
- $id_accumulator = HTMLPurifier_IDAccumulator::build($config, $context);
- $context->register('IDAccumulator', $id_accumulator);
- }
-
- // initialize CurrentToken if necessary
- $current_token =& $context->get('CurrentToken', true);
- if (!$current_token) {
- $context->register('CurrentToken', $token);
- }
-
- if (!$token instanceof HTMLPurifier_Token_Start &&
- !$token instanceof HTMLPurifier_Token_Empty
- ) {
- return;
- }
-
- // create alias to global definition array, see also $defs
- // DEFINITION CALL
- $d_defs = $definition->info_global_attr;
-
- // don't update token until the very end, to ensure an atomic update
- $attr = $token->attr;
-
- // do global transformations (pre)
- // nothing currently utilizes this
- foreach ($definition->info_attr_transform_pre as $transform) {
- $attr = $transform->transform($o = $attr, $config, $context);
- if ($e) {
- if ($attr != $o) {
- $e->send(E_NOTICE, 'AttrValidator: Attributes transformed', $o, $attr);
- }
- }
- }
-
- // do local transformations only applicable to this element (pre)
- // ex.
to
- foreach ($definition->info[$token->name]->attr_transform_pre as $transform) {
- $attr = $transform->transform($o = $attr, $config, $context);
- if ($e) {
- if ($attr != $o) {
- $e->send(E_NOTICE, 'AttrValidator: Attributes transformed', $o, $attr);
- }
- }
- }
-
- // create alias to this element's attribute definition array, see
- // also $d_defs (global attribute definition array)
- // DEFINITION CALL
- $defs = $definition->info[$token->name]->attr;
-
- $attr_key = false;
- $context->register('CurrentAttr', $attr_key);
-
- // iterate through all the attribute keypairs
- // Watch out for name collisions: $key has previously been used
- foreach ($attr as $attr_key => $value) {
-
- // call the definition
- if (isset($defs[$attr_key])) {
- // there is a local definition defined
- if ($defs[$attr_key] === false) {
- // We've explicitly been told not to allow this element.
- // This is usually when there's a global definition
- // that must be overridden.
- // Theoretically speaking, we could have a
- // AttrDef_DenyAll, but this is faster!
- $result = false;
- } else {
- // validate according to the element's definition
- $result = $defs[$attr_key]->validate(
- $value,
- $config,
- $context
- );
- }
- } elseif (isset($d_defs[$attr_key])) {
- // there is a global definition defined, validate according
- // to the global definition
- $result = $d_defs[$attr_key]->validate(
- $value,
- $config,
- $context
- );
- } else {
- // system never heard of the attribute? DELETE!
- $result = false;
- }
-
- // put the results into effect
- if ($result === false || $result === null) {
- // this is a generic error message that should replaced
- // with more specific ones when possible
- if ($e) {
- $e->send(E_ERROR, 'AttrValidator: Attribute removed');
- }
-
- // remove the attribute
- unset($attr[$attr_key]);
- } elseif (is_string($result)) {
- // generally, if a substitution is happening, there
- // was some sort of implicit correction going on. We'll
- // delegate it to the attribute classes to say exactly what.
-
- // simple substitution
- $attr[$attr_key] = $result;
- } else {
- // nothing happens
- }
-
- // we'd also want slightly more complicated substitution
- // involving an array as the return value,
- // although we're not sure how colliding attributes would
- // resolve (certain ones would be completely overriden,
- // others would prepend themselves).
- }
-
- $context->destroy('CurrentAttr');
-
- // post transforms
-
- // global (error reporting untested)
- foreach ($definition->info_attr_transform_post as $transform) {
- $attr = $transform->transform($o = $attr, $config, $context);
- if ($e) {
- if ($attr != $o) {
- $e->send(E_NOTICE, 'AttrValidator: Attributes transformed', $o, $attr);
- }
- }
- }
-
- // local (error reporting untested)
- foreach ($definition->info[$token->name]->attr_transform_post as $transform) {
- $attr = $transform->transform($o = $attr, $config, $context);
- if ($e) {
- if ($attr != $o) {
- $e->send(E_NOTICE, 'AttrValidator: Attributes transformed', $o, $attr);
- }
- }
- }
-
- $token->attr = $attr;
-
- // destroy CurrentToken if we made it ourselves
- if (!$current_token) {
- $context->destroy('CurrentToken');
- }
-
- }
-
-
-}
-
-
-
-
-
-// constants are slow, so we use as few as possible
-if (!defined('HTMLPURIFIER_PREFIX')) {
- define('HTMLPURIFIER_PREFIX', dirname(__FILE__) . '/standalone');
- set_include_path(HTMLPURIFIER_PREFIX . PATH_SEPARATOR . get_include_path());
-}
-
-// accomodations for versions earlier than 5.0.2
-// borrowed from PHP_Compat, LGPL licensed, by Aidan Lister
-if (!defined('PHP_EOL')) {
- switch (strtoupper(substr(PHP_OS, 0, 3))) {
- case 'WIN':
- define('PHP_EOL', "\r\n");
- break;
- case 'DAR':
- define('PHP_EOL', "\r");
- break;
- default:
- define('PHP_EOL', "\n");
- }
-}
-
-/**
- * Bootstrap class that contains meta-functionality for HTML Purifier such as
- * the autoload function.
- *
- * @note
- * This class may be used without any other files from HTML Purifier.
- */
-class HTMLPurifier_Bootstrap
-{
-
- /**
- * Autoload function for HTML Purifier
- * @param string $class Class to load
- * @return bool
- */
- public static function autoload($class)
- {
- $file = HTMLPurifier_Bootstrap::getPath($class);
- if (!$file) {
- return false;
- }
- // Technically speaking, it should be ok and more efficient to
- // just do 'require', but Antonio Parraga reports that with
- // Zend extensions such as Zend debugger and APC, this invariant
- // may be broken. Since we have efficient alternatives, pay
- // the cost here and avoid the bug.
- require_once HTMLPURIFIER_PREFIX . '/' . $file;
- return true;
- }
-
- /**
- * Returns the path for a specific class.
- * @param string $class Class path to get
- * @return string
- */
- public static function getPath($class)
- {
- if (strncmp('HTMLPurifier', $class, 12) !== 0) {
- return false;
- }
- // Custom implementations
- if (strncmp('HTMLPurifier_Language_', $class, 22) === 0) {
- $code = str_replace('_', '-', substr($class, 22));
- $file = 'HTMLPurifier/Language/classes/' . $code . '.php';
- } else {
- $file = str_replace('_', '/', $class) . '.php';
- }
- if (!file_exists(HTMLPURIFIER_PREFIX . '/' . $file)) {
- return false;
- }
- return $file;
- }
-
- /**
- * "Pre-registers" our autoloader on the SPL stack.
- */
- public static function registerAutoload()
- {
- $autoload = array('HTMLPurifier_Bootstrap', 'autoload');
- if (($funcs = spl_autoload_functions()) === false) {
- spl_autoload_register($autoload);
- } elseif (function_exists('spl_autoload_unregister')) {
- if (version_compare(PHP_VERSION, '5.3.0', '>=')) {
- // prepend flag exists, no need for shenanigans
- spl_autoload_register($autoload, true, true);
- } else {
- $buggy = version_compare(PHP_VERSION, '5.2.11', '<');
- $compat = version_compare(PHP_VERSION, '5.1.2', '<=') &&
- version_compare(PHP_VERSION, '5.1.0', '>=');
- foreach ($funcs as $func) {
- if ($buggy && is_array($func)) {
- // :TRICKY: There are some compatibility issues and some
- // places where we need to error out
- $reflector = new ReflectionMethod($func[0], $func[1]);
- if (!$reflector->isStatic()) {
- throw new Exception(
- 'HTML Purifier autoloader registrar is not compatible
- with non-static object methods due to PHP Bug #44144;
- Please do not use HTMLPurifier.autoload.php (or any
- file that includes this file); instead, place the code:
- spl_autoload_register(array(\'HTMLPurifier_Bootstrap\', \'autoload\'))
- after your own autoloaders.'
- );
- }
- // Suprisingly, spl_autoload_register supports the
- // Class::staticMethod callback format, although call_user_func doesn't
- if ($compat) {
- $func = implode('::', $func);
- }
- }
- spl_autoload_unregister($func);
- }
- spl_autoload_register($autoload);
- foreach ($funcs as $func) {
- spl_autoload_register($func);
- }
- }
- }
- }
-}
-
-
-
-
-
-/**
- * Super-class for definition datatype objects, implements serialization
- * functions for the class.
- */
-abstract class HTMLPurifier_Definition
-{
-
- /**
- * Has setup() been called yet?
- * @type bool
- */
- public $setup = false;
-
- /**
- * If true, write out the final definition object to the cache after
- * setup. This will be true only if all invocations to get a raw
- * definition object are also optimized. This does not cause file
- * system thrashing because on subsequent calls the cached object
- * is used and any writes to the raw definition object are short
- * circuited. See enduser-customize.html for the high-level
- * picture.
- * @type bool
- */
- public $optimized = null;
-
- /**
- * What type of definition is it?
- * @type string
- */
- public $type;
-
- /**
- * Sets up the definition object into the final form, something
- * not done by the constructor
- * @param HTMLPurifier_Config $config
- */
- abstract protected function doSetup($config);
-
- /**
- * Setup function that aborts if already setup
- * @param HTMLPurifier_Config $config
- */
- public function setup($config)
- {
- if ($this->setup) {
- return;
- }
- $this->setup = true;
- $this->doSetup($config);
- }
-}
-
-
-
-
-
-/**
- * Defines allowed CSS attributes and what their values are.
- * @see HTMLPurifier_HTMLDefinition
- */
-class HTMLPurifier_CSSDefinition extends HTMLPurifier_Definition
-{
-
- public $type = 'CSS';
-
- /**
- * Assoc array of attribute name to definition object.
- * @type HTMLPurifier_AttrDef[]
- */
- public $info = array();
-
- /**
- * Constructs the info array. The meat of this class.
- * @param HTMLPurifier_Config $config
- */
- protected function doSetup($config)
- {
- $this->info['text-align'] = new HTMLPurifier_AttrDef_Enum(
- array('left', 'right', 'center', 'justify'),
- false
- );
-
- $border_style =
- $this->info['border-bottom-style'] =
- $this->info['border-right-style'] =
- $this->info['border-left-style'] =
- $this->info['border-top-style'] = new HTMLPurifier_AttrDef_Enum(
- array(
- 'none',
- 'hidden',
- 'dotted',
- 'dashed',
- 'solid',
- 'double',
- 'groove',
- 'ridge',
- 'inset',
- 'outset'
- ),
- false
- );
-
- $this->info['border-style'] = new HTMLPurifier_AttrDef_CSS_Multiple($border_style);
-
- $this->info['clear'] = new HTMLPurifier_AttrDef_Enum(
- array('none', 'left', 'right', 'both'),
- false
- );
- $this->info['float'] = new HTMLPurifier_AttrDef_Enum(
- array('none', 'left', 'right'),
- false
- );
- $this->info['font-style'] = new HTMLPurifier_AttrDef_Enum(
- array('normal', 'italic', 'oblique'),
- false
- );
- $this->info['font-variant'] = new HTMLPurifier_AttrDef_Enum(
- array('normal', 'small-caps'),
- false
- );
-
- $uri_or_none = new HTMLPurifier_AttrDef_CSS_Composite(
- array(
- new HTMLPurifier_AttrDef_Enum(array('none')),
- new HTMLPurifier_AttrDef_CSS_URI()
- )
- );
-
- $this->info['list-style-position'] = new HTMLPurifier_AttrDef_Enum(
- array('inside', 'outside'),
- false
- );
- $this->info['list-style-type'] = new HTMLPurifier_AttrDef_Enum(
- array(
- 'disc',
- 'circle',
- 'square',
- 'decimal',
- 'lower-roman',
- 'upper-roman',
- 'lower-alpha',
- 'upper-alpha',
- 'none'
- ),
- false
- );
- $this->info['list-style-image'] = $uri_or_none;
-
- $this->info['list-style'] = new HTMLPurifier_AttrDef_CSS_ListStyle($config);
-
- $this->info['text-transform'] = new HTMLPurifier_AttrDef_Enum(
- array('capitalize', 'uppercase', 'lowercase', 'none'),
- false
- );
- $this->info['color'] = new HTMLPurifier_AttrDef_CSS_Color();
-
- $this->info['background-image'] = $uri_or_none;
- $this->info['background-repeat'] = new HTMLPurifier_AttrDef_Enum(
- array('repeat', 'repeat-x', 'repeat-y', 'no-repeat')
- );
- $this->info['background-attachment'] = new HTMLPurifier_AttrDef_Enum(
- array('scroll', 'fixed')
- );
- $this->info['background-position'] = new HTMLPurifier_AttrDef_CSS_BackgroundPosition();
-
- $border_color =
- $this->info['border-top-color'] =
- $this->info['border-bottom-color'] =
- $this->info['border-left-color'] =
- $this->info['border-right-color'] =
- $this->info['background-color'] = new HTMLPurifier_AttrDef_CSS_Composite(
- array(
- new HTMLPurifier_AttrDef_Enum(array('transparent')),
- new HTMLPurifier_AttrDef_CSS_Color()
- )
- );
-
- $this->info['background'] = new HTMLPurifier_AttrDef_CSS_Background($config);
-
- $this->info['border-color'] = new HTMLPurifier_AttrDef_CSS_Multiple($border_color);
-
- $border_width =
- $this->info['border-top-width'] =
- $this->info['border-bottom-width'] =
- $this->info['border-left-width'] =
- $this->info['border-right-width'] = new HTMLPurifier_AttrDef_CSS_Composite(
- array(
- new HTMLPurifier_AttrDef_Enum(array('thin', 'medium', 'thick')),
- new HTMLPurifier_AttrDef_CSS_Length('0') //disallow negative
- )
- );
-
- $this->info['border-width'] = new HTMLPurifier_AttrDef_CSS_Multiple($border_width);
-
- $this->info['letter-spacing'] = new HTMLPurifier_AttrDef_CSS_Composite(
- array(
- new HTMLPurifier_AttrDef_Enum(array('normal')),
- new HTMLPurifier_AttrDef_CSS_Length()
- )
- );
-
- $this->info['word-spacing'] = new HTMLPurifier_AttrDef_CSS_Composite(
- array(
- new HTMLPurifier_AttrDef_Enum(array('normal')),
- new HTMLPurifier_AttrDef_CSS_Length()
- )
- );
-
- $this->info['font-size'] = new HTMLPurifier_AttrDef_CSS_Composite(
- array(
- new HTMLPurifier_AttrDef_Enum(
- array(
- 'xx-small',
- 'x-small',
- 'small',
- 'medium',
- 'large',
- 'x-large',
- 'xx-large',
- 'larger',
- 'smaller'
- )
- ),
- new HTMLPurifier_AttrDef_CSS_Percentage(),
- new HTMLPurifier_AttrDef_CSS_Length()
- )
- );
-
- $this->info['line-height'] = new HTMLPurifier_AttrDef_CSS_Composite(
- array(
- new HTMLPurifier_AttrDef_Enum(array('normal')),
- new HTMLPurifier_AttrDef_CSS_Number(true), // no negatives
- new HTMLPurifier_AttrDef_CSS_Length('0'),
- new HTMLPurifier_AttrDef_CSS_Percentage(true)
- )
- );
-
- $margin =
- $this->info['margin-top'] =
- $this->info['margin-bottom'] =
- $this->info['margin-left'] =
- $this->info['margin-right'] = new HTMLPurifier_AttrDef_CSS_Composite(
- array(
- new HTMLPurifier_AttrDef_CSS_Length(),
- new HTMLPurifier_AttrDef_CSS_Percentage(),
- new HTMLPurifier_AttrDef_Enum(array('auto'))
- )
- );
-
- $this->info['margin'] = new HTMLPurifier_AttrDef_CSS_Multiple($margin);
-
- // non-negative
- $padding =
- $this->info['padding-top'] =
- $this->info['padding-bottom'] =
- $this->info['padding-left'] =
- $this->info['padding-right'] = new HTMLPurifier_AttrDef_CSS_Composite(
- array(
- new HTMLPurifier_AttrDef_CSS_Length('0'),
- new HTMLPurifier_AttrDef_CSS_Percentage(true)
- )
- );
-
- $this->info['padding'] = new HTMLPurifier_AttrDef_CSS_Multiple($padding);
-
- $this->info['text-indent'] = new HTMLPurifier_AttrDef_CSS_Composite(
- array(
- new HTMLPurifier_AttrDef_CSS_Length(),
- new HTMLPurifier_AttrDef_CSS_Percentage()
- )
- );
-
- $trusted_wh = new HTMLPurifier_AttrDef_CSS_Composite(
- array(
- new HTMLPurifier_AttrDef_CSS_Length('0'),
- new HTMLPurifier_AttrDef_CSS_Percentage(true),
- new HTMLPurifier_AttrDef_Enum(array('auto', 'initial', 'inherit'))
- )
- );
- $trusted_min_wh = new HTMLPurifier_AttrDef_CSS_Composite(
- array(
- new HTMLPurifier_AttrDef_CSS_Length('0'),
- new HTMLPurifier_AttrDef_CSS_Percentage(true),
- new HTMLPurifier_AttrDef_Enum(array('initial', 'inherit'))
- )
- );
- $trusted_max_wh = new HTMLPurifier_AttrDef_CSS_Composite(
- array(
- new HTMLPurifier_AttrDef_CSS_Length('0'),
- new HTMLPurifier_AttrDef_CSS_Percentage(true),
- new HTMLPurifier_AttrDef_Enum(array('none', 'initial', 'inherit'))
- )
- );
- $max = $config->get('CSS.MaxImgLength');
-
- $this->info['width'] =
- $this->info['height'] =
- $max === null ?
- $trusted_wh :
- new HTMLPurifier_AttrDef_Switch(
- 'img',
- // For img tags:
- new HTMLPurifier_AttrDef_CSS_Composite(
- array(
- new HTMLPurifier_AttrDef_CSS_Length('0', $max),
- new HTMLPurifier_AttrDef_Enum(array('auto'))
- )
- ),
- // For everyone else:
- $trusted_wh
- );
- $this->info['min-width'] =
- $this->info['min-height'] =
- $max === null ?
- $trusted_min_wh :
- new HTMLPurifier_AttrDef_Switch(
- 'img',
- // For img tags:
- new HTMLPurifier_AttrDef_CSS_Composite(
- array(
- new HTMLPurifier_AttrDef_CSS_Length('0', $max),
- new HTMLPurifier_AttrDef_Enum(array('initial', 'inherit'))
- )
- ),
- // For everyone else:
- $trusted_min_wh
- );
- $this->info['max-width'] =
- $this->info['max-height'] =
- $max === null ?
- $trusted_max_wh :
- new HTMLPurifier_AttrDef_Switch(
- 'img',
- // For img tags:
- new HTMLPurifier_AttrDef_CSS_Composite(
- array(
- new HTMLPurifier_AttrDef_CSS_Length('0', $max),
- new HTMLPurifier_AttrDef_Enum(array('none', 'initial', 'inherit'))
- )
- ),
- // For everyone else:
- $trusted_max_wh
- );
-
- $this->info['text-decoration'] = new HTMLPurifier_AttrDef_CSS_TextDecoration();
-
- $this->info['font-family'] = new HTMLPurifier_AttrDef_CSS_FontFamily();
-
- // this could use specialized code
- $this->info['font-weight'] = new HTMLPurifier_AttrDef_Enum(
- array(
- 'normal',
- 'bold',
- 'bolder',
- 'lighter',
- '100',
- '200',
- '300',
- '400',
- '500',
- '600',
- '700',
- '800',
- '900'
- ),
- false
- );
-
- // MUST be called after other font properties, as it references
- // a CSSDefinition object
- $this->info['font'] = new HTMLPurifier_AttrDef_CSS_Font($config);
-
- // same here
- $this->info['border'] =
- $this->info['border-bottom'] =
- $this->info['border-top'] =
- $this->info['border-left'] =
- $this->info['border-right'] = new HTMLPurifier_AttrDef_CSS_Border($config);
-
- $this->info['border-collapse'] = new HTMLPurifier_AttrDef_Enum(
- array('collapse', 'separate')
- );
-
- $this->info['caption-side'] = new HTMLPurifier_AttrDef_Enum(
- array('top', 'bottom')
- );
-
- $this->info['table-layout'] = new HTMLPurifier_AttrDef_Enum(
- array('auto', 'fixed')
- );
-
- $this->info['vertical-align'] = new HTMLPurifier_AttrDef_CSS_Composite(
- array(
- new HTMLPurifier_AttrDef_Enum(
- array(
- 'baseline',
- 'sub',
- 'super',
- 'top',
- 'text-top',
- 'middle',
- 'bottom',
- 'text-bottom'
- )
- ),
- new HTMLPurifier_AttrDef_CSS_Length(),
- new HTMLPurifier_AttrDef_CSS_Percentage()
- )
- );
-
- $this->info['border-spacing'] = new HTMLPurifier_AttrDef_CSS_Multiple(new HTMLPurifier_AttrDef_CSS_Length(), 2);
-
- // These CSS properties don't work on many browsers, but we live
- // in THE FUTURE!
- $this->info['white-space'] = new HTMLPurifier_AttrDef_Enum(
- array('nowrap', 'normal', 'pre', 'pre-wrap', 'pre-line')
- );
-
- if ($config->get('CSS.Proprietary')) {
- $this->doSetupProprietary($config);
- }
-
- if ($config->get('CSS.AllowTricky')) {
- $this->doSetupTricky($config);
- }
-
- if ($config->get('CSS.Trusted')) {
- $this->doSetupTrusted($config);
- }
-
- $allow_important = $config->get('CSS.AllowImportant');
- // wrap all attr-defs with decorator that handles !important
- foreach ($this->info as $k => $v) {
- $this->info[$k] = new HTMLPurifier_AttrDef_CSS_ImportantDecorator($v, $allow_important);
- }
-
- $this->setupConfigStuff($config);
- }
-
- /**
- * @param HTMLPurifier_Config $config
- */
- protected function doSetupProprietary($config)
- {
- // Internet Explorer only scrollbar colors
- $this->info['scrollbar-arrow-color'] = new HTMLPurifier_AttrDef_CSS_Color();
- $this->info['scrollbar-base-color'] = new HTMLPurifier_AttrDef_CSS_Color();
- $this->info['scrollbar-darkshadow-color'] = new HTMLPurifier_AttrDef_CSS_Color();
- $this->info['scrollbar-face-color'] = new HTMLPurifier_AttrDef_CSS_Color();
- $this->info['scrollbar-highlight-color'] = new HTMLPurifier_AttrDef_CSS_Color();
- $this->info['scrollbar-shadow-color'] = new HTMLPurifier_AttrDef_CSS_Color();
-
- // vendor specific prefixes of opacity
- $this->info['-moz-opacity'] = new HTMLPurifier_AttrDef_CSS_AlphaValue();
- $this->info['-khtml-opacity'] = new HTMLPurifier_AttrDef_CSS_AlphaValue();
-
- // only opacity, for now
- $this->info['filter'] = new HTMLPurifier_AttrDef_CSS_Filter();
-
- // more CSS3
- $this->info['page-break-after'] =
- $this->info['page-break-before'] = new HTMLPurifier_AttrDef_Enum(
- array(
- 'auto',
- 'always',
- 'avoid',
- 'left',
- 'right'
- )
- );
- $this->info['page-break-inside'] = new HTMLPurifier_AttrDef_Enum(array('auto', 'avoid'));
-
- $border_radius = new HTMLPurifier_AttrDef_CSS_Composite(
- array(
- new HTMLPurifier_AttrDef_CSS_Percentage(true), // disallow negative
- new HTMLPurifier_AttrDef_CSS_Length('0') // disallow negative
- ));
-
- $this->info['border-top-left-radius'] =
- $this->info['border-top-right-radius'] =
- $this->info['border-bottom-right-radius'] =
- $this->info['border-bottom-left-radius'] = new HTMLPurifier_AttrDef_CSS_Multiple($border_radius, 2);
- // TODO: support SLASH syntax
- $this->info['border-radius'] = new HTMLPurifier_AttrDef_CSS_Multiple($border_radius, 4);
-
- }
-
- /**
- * @param HTMLPurifier_Config $config
- */
- protected function doSetupTricky($config)
- {
- $this->info['display'] = new HTMLPurifier_AttrDef_Enum(
- array(
- 'inline',
- 'block',
- 'list-item',
- 'run-in',
- 'compact',
- 'marker',
- 'table',
- 'inline-block',
- 'inline-table',
- 'table-row-group',
- 'table-header-group',
- 'table-footer-group',
- 'table-row',
- 'table-column-group',
- 'table-column',
- 'table-cell',
- 'table-caption',
- 'none'
- )
- );
- $this->info['visibility'] = new HTMLPurifier_AttrDef_Enum(
- array('visible', 'hidden', 'collapse')
- );
- $this->info['overflow'] = new HTMLPurifier_AttrDef_Enum(array('visible', 'hidden', 'auto', 'scroll'));
- $this->info['opacity'] = new HTMLPurifier_AttrDef_CSS_AlphaValue();
- }
-
- /**
- * @param HTMLPurifier_Config $config
- */
- protected function doSetupTrusted($config)
- {
- $this->info['position'] = new HTMLPurifier_AttrDef_Enum(
- array('static', 'relative', 'absolute', 'fixed')
- );
- $this->info['top'] =
- $this->info['left'] =
- $this->info['right'] =
- $this->info['bottom'] = new HTMLPurifier_AttrDef_CSS_Composite(
- array(
- new HTMLPurifier_AttrDef_CSS_Length(),
- new HTMLPurifier_AttrDef_CSS_Percentage(),
- new HTMLPurifier_AttrDef_Enum(array('auto')),
- )
- );
- $this->info['z-index'] = new HTMLPurifier_AttrDef_CSS_Composite(
- array(
- new HTMLPurifier_AttrDef_Integer(),
- new HTMLPurifier_AttrDef_Enum(array('auto')),
- )
- );
- }
-
- /**
- * Performs extra config-based processing. Based off of
- * HTMLPurifier_HTMLDefinition.
- * @param HTMLPurifier_Config $config
- * @todo Refactor duplicate elements into common class (probably using
- * composition, not inheritance).
- */
- protected function setupConfigStuff($config)
- {
- // setup allowed elements
- $support = "(for information on implementing this, see the " .
- "support forums) ";
- $allowed_properties = $config->get('CSS.AllowedProperties');
- if ($allowed_properties !== null) {
- foreach ($this->info as $name => $d) {
- if (!isset($allowed_properties[$name])) {
- unset($this->info[$name]);
- }
- unset($allowed_properties[$name]);
- }
- // emit errors
- foreach ($allowed_properties as $name => $d) {
- // :TODO: Is this htmlspecialchars() call really necessary?
- $name = htmlspecialchars($name);
- trigger_error("Style attribute '$name' is not supported $support", E_USER_WARNING);
- }
- }
-
- $forbidden_properties = $config->get('CSS.ForbiddenProperties');
- if ($forbidden_properties !== null) {
- foreach ($this->info as $name => $d) {
- if (isset($forbidden_properties[$name])) {
- unset($this->info[$name]);
- }
- }
- }
- }
-}
-
-
-
-
-
-/**
- * Defines allowed child nodes and validates nodes against it.
- */
-abstract class HTMLPurifier_ChildDef
-{
- /**
- * Type of child definition, usually right-most part of class name lowercase.
- * Used occasionally in terms of context.
- * @type string
- */
- public $type;
-
- /**
- * Indicates whether or not an empty array of children is okay.
- *
- * This is necessary for redundant checking when changes affecting
- * a child node may cause a parent node to now be disallowed.
- * @type bool
- */
- public $allow_empty;
-
- /**
- * Lookup array of all elements that this definition could possibly allow.
- * @type array
- */
- public $elements = array();
-
- /**
- * Get lookup of tag names that should not close this element automatically.
- * All other elements will do so.
- * @param HTMLPurifier_Config $config HTMLPurifier_Config object
- * @return array
- */
- public function getAllowedElements($config)
- {
- return $this->elements;
- }
-
- /**
- * Validates nodes according to definition and returns modification.
- *
- * @param HTMLPurifier_Node[] $children Array of HTMLPurifier_Node
- * @param HTMLPurifier_Config $config HTMLPurifier_Config object
- * @param HTMLPurifier_Context $context HTMLPurifier_Context object
- * @return bool|array true to leave nodes as is, false to remove parent node, array of replacement children
- */
- abstract public function validateChildren($children, $config, $context);
-}
-
-
-
-
-
-/**
- * Configuration object that triggers customizable behavior.
- *
- * @warning This class is strongly defined: that means that the class
- * will fail if an undefined directive is retrieved or set.
- *
- * @note Many classes that could (although many times don't) use the
- * configuration object make it a mandatory parameter. This is
- * because a configuration object should always be forwarded,
- * otherwise, you run the risk of missing a parameter and then
- * being stumped when a configuration directive doesn't work.
- *
- * @todo Reconsider some of the public member variables
- */
-class HTMLPurifier_Config
-{
-
- /**
- * HTML Purifier's version
- * @type string
- */
- public $version = '4.12.0';
-
- /**
- * Whether or not to automatically finalize
- * the object if a read operation is done.
- * @type bool
- */
- public $autoFinalize = true;
-
- // protected member variables
-
- /**
- * Namespace indexed array of serials for specific namespaces.
- * @see getSerial() for more info.
- * @type string[]
- */
- protected $serials = array();
-
- /**
- * Serial for entire configuration object.
- * @type string
- */
- protected $serial;
-
- /**
- * Parser for variables.
- * @type HTMLPurifier_VarParser_Flexible
- */
- protected $parser = null;
-
- /**
- * Reference HTMLPurifier_ConfigSchema for value checking.
- * @type HTMLPurifier_ConfigSchema
- * @note This is public for introspective purposes. Please don't
- * abuse!
- */
- public $def;
-
- /**
- * Indexed array of definitions.
- * @type HTMLPurifier_Definition[]
- */
- protected $definitions;
-
- /**
- * Whether or not config is finalized.
- * @type bool
- */
- protected $finalized = false;
-
- /**
- * Property list containing configuration directives.
- * @type array
- */
- protected $plist;
-
- /**
- * Whether or not a set is taking place due to an alias lookup.
- * @type bool
- */
- private $aliasMode;
-
- /**
- * Set to false if you do not want line and file numbers in errors.
- * (useful when unit testing). This will also compress some errors
- * and exceptions.
- * @type bool
- */
- public $chatty = true;
-
- /**
- * Current lock; only gets to this namespace are allowed.
- * @type string
- */
- private $lock;
-
- /**
- * Constructor
- * @param HTMLPurifier_ConfigSchema $definition ConfigSchema that defines
- * what directives are allowed.
- * @param HTMLPurifier_PropertyList $parent
- */
- public function __construct($definition, $parent = null)
- {
- $parent = $parent ? $parent : $definition->defaultPlist;
- $this->plist = new HTMLPurifier_PropertyList($parent);
- $this->def = $definition; // keep a copy around for checking
- $this->parser = new HTMLPurifier_VarParser_Flexible();
- }
-
- /**
- * Convenience constructor that creates a config object based on a mixed var
- * @param mixed $config Variable that defines the state of the config
- * object. Can be: a HTMLPurifier_Config() object,
- * an array of directives based on loadArray(),
- * or a string filename of an ini file.
- * @param HTMLPurifier_ConfigSchema $schema Schema object
- * @return HTMLPurifier_Config Configured object
- */
- public static function create($config, $schema = null)
- {
- if ($config instanceof HTMLPurifier_Config) {
- // pass-through
- return $config;
- }
- if (!$schema) {
- $ret = HTMLPurifier_Config::createDefault();
- } else {
- $ret = new HTMLPurifier_Config($schema);
- }
- if (is_string($config)) {
- $ret->loadIni($config);
- } elseif (is_array($config)) $ret->loadArray($config);
- return $ret;
- }
-
- /**
- * Creates a new config object that inherits from a previous one.
- * @param HTMLPurifier_Config $config Configuration object to inherit from.
- * @return HTMLPurifier_Config object with $config as its parent.
- */
- public static function inherit(HTMLPurifier_Config $config)
- {
- return new HTMLPurifier_Config($config->def, $config->plist);
- }
-
- /**
- * Convenience constructor that creates a default configuration object.
- * @return HTMLPurifier_Config default object.
- */
- public static function createDefault()
- {
- $definition = HTMLPurifier_ConfigSchema::instance();
- $config = new HTMLPurifier_Config($definition);
- return $config;
- }
-
- /**
- * Retrieves a value from the configuration.
- *
- * @param string $key String key
- * @param mixed $a
- *
- * @return mixed
- */
- public function get($key, $a = null)
- {
- if ($a !== null) {
- $this->triggerError(
- "Using deprecated API: use \$config->get('$key.$a') instead",
- E_USER_WARNING
- );
- $key = "$key.$a";
- }
- if (!$this->finalized) {
- $this->autoFinalize();
- }
- if (!isset($this->def->info[$key])) {
- // can't add % due to SimpleTest bug
- $this->triggerError(
- 'Cannot retrieve value of undefined directive ' . htmlspecialchars($key),
- E_USER_WARNING
- );
- return;
- }
- if (isset($this->def->info[$key]->isAlias)) {
- $d = $this->def->info[$key];
- $this->triggerError(
- 'Cannot get value from aliased directive, use real name ' . $d->key,
- E_USER_ERROR
- );
- return;
- }
- if ($this->lock) {
- list($ns) = explode('.', $key);
- if ($ns !== $this->lock) {
- $this->triggerError(
- 'Cannot get value of namespace ' . $ns . ' when lock for ' .
- $this->lock .
- ' is active, this probably indicates a Definition setup method ' .
- 'is accessing directives that are not within its namespace',
- E_USER_ERROR
- );
- return;
- }
- }
- return $this->plist->get($key);
- }
-
- /**
- * Retrieves an array of directives to values from a given namespace
- *
- * @param string $namespace String namespace
- *
- * @return array
- */
- public function getBatch($namespace)
- {
- if (!$this->finalized) {
- $this->autoFinalize();
- }
- $full = $this->getAll();
- if (!isset($full[$namespace])) {
- $this->triggerError(
- 'Cannot retrieve undefined namespace ' .
- htmlspecialchars($namespace),
- E_USER_WARNING
- );
- return;
- }
- return $full[$namespace];
- }
-
- /**
- * Returns a SHA-1 signature of a segment of the configuration object
- * that uniquely identifies that particular configuration
- *
- * @param string $namespace Namespace to get serial for
- *
- * @return string
- * @note Revision is handled specially and is removed from the batch
- * before processing!
- */
- public function getBatchSerial($namespace)
- {
- if (empty($this->serials[$namespace])) {
- $batch = $this->getBatch($namespace);
- unset($batch['DefinitionRev']);
- $this->serials[$namespace] = sha1(serialize($batch));
- }
- return $this->serials[$namespace];
- }
-
- /**
- * Returns a SHA-1 signature for the entire configuration object
- * that uniquely identifies that particular configuration
- *
- * @return string
- */
- public function getSerial()
- {
- if (empty($this->serial)) {
- $this->serial = sha1(serialize($this->getAll()));
- }
- return $this->serial;
- }
-
- /**
- * Retrieves all directives, organized by namespace
- *
- * @warning This is a pretty inefficient function, avoid if you can
- */
- public function getAll()
- {
- if (!$this->finalized) {
- $this->autoFinalize();
- }
- $ret = array();
- foreach ($this->plist->squash() as $name => $value) {
- list($ns, $key) = explode('.', $name, 2);
- $ret[$ns][$key] = $value;
- }
- return $ret;
- }
-
- /**
- * Sets a value to configuration.
- *
- * @param string $key key
- * @param mixed $value value
- * @param mixed $a
- */
- public function set($key, $value, $a = null)
- {
- if (strpos($key, '.') === false) {
- $namespace = $key;
- $directive = $value;
- $value = $a;
- $key = "$key.$directive";
- $this->triggerError("Using deprecated API: use \$config->set('$key', ...) instead", E_USER_NOTICE);
- } else {
- list($namespace) = explode('.', $key);
- }
- if ($this->isFinalized('Cannot set directive after finalization')) {
- return;
- }
- if (!isset($this->def->info[$key])) {
- $this->triggerError(
- 'Cannot set undefined directive ' . htmlspecialchars($key) . ' to value',
- E_USER_WARNING
- );
- return;
- }
- $def = $this->def->info[$key];
-
- if (isset($def->isAlias)) {
- if ($this->aliasMode) {
- $this->triggerError(
- 'Double-aliases not allowed, please fix '.
- 'ConfigSchema bug with' . $key,
- E_USER_ERROR
- );
- return;
- }
- $this->aliasMode = true;
- $this->set($def->key, $value);
- $this->aliasMode = false;
- $this->triggerError("$key is an alias, preferred directive name is {$def->key}", E_USER_NOTICE);
- return;
- }
-
- // Raw type might be negative when using the fully optimized form
- // of stdClass, which indicates allow_null == true
- $rtype = is_int($def) ? $def : $def->type;
- if ($rtype < 0) {
- $type = -$rtype;
- $allow_null = true;
- } else {
- $type = $rtype;
- $allow_null = isset($def->allow_null);
- }
-
- try {
- $value = $this->parser->parse($value, $type, $allow_null);
- } catch (HTMLPurifier_VarParserException $e) {
- $this->triggerError(
- 'Value for ' . $key . ' is of invalid type, should be ' .
- HTMLPurifier_VarParser::getTypeName($type),
- E_USER_WARNING
- );
- return;
- }
- if (is_string($value) && is_object($def)) {
- // resolve value alias if defined
- if (isset($def->aliases[$value])) {
- $value = $def->aliases[$value];
- }
- // check to see if the value is allowed
- if (isset($def->allowed) && !isset($def->allowed[$value])) {
- $this->triggerError(
- 'Value not supported, valid values are: ' .
- $this->_listify($def->allowed),
- E_USER_WARNING
- );
- return;
- }
- }
- $this->plist->set($key, $value);
-
- // reset definitions if the directives they depend on changed
- // this is a very costly process, so it's discouraged
- // with finalization
- if ($namespace == 'HTML' || $namespace == 'CSS' || $namespace == 'URI') {
- $this->definitions[$namespace] = null;
- }
-
- $this->serials[$namespace] = false;
- }
-
- /**
- * Convenience function for error reporting
- *
- * @param array $lookup
- *
- * @return string
- */
- private function _listify($lookup)
- {
- $list = array();
- foreach ($lookup as $name => $b) {
- $list[] = $name;
- }
- return implode(', ', $list);
- }
-
- /**
- * Retrieves object reference to the HTML definition.
- *
- * @param bool $raw Return a copy that has not been setup yet. Must be
- * called before it's been setup, otherwise won't work.
- * @param bool $optimized If true, this method may return null, to
- * indicate that a cached version of the modified
- * definition object is available and no further edits
- * are necessary. Consider using
- * maybeGetRawHTMLDefinition, which is more explicitly
- * named, instead.
- *
- * @return HTMLPurifier_HTMLDefinition
- */
- public function getHTMLDefinition($raw = false, $optimized = false)
- {
- return $this->getDefinition('HTML', $raw, $optimized);
- }
-
- /**
- * Retrieves object reference to the CSS definition
- *
- * @param bool $raw Return a copy that has not been setup yet. Must be
- * called before it's been setup, otherwise won't work.
- * @param bool $optimized If true, this method may return null, to
- * indicate that a cached version of the modified
- * definition object is available and no further edits
- * are necessary. Consider using
- * maybeGetRawCSSDefinition, which is more explicitly
- * named, instead.
- *
- * @return HTMLPurifier_CSSDefinition
- */
- public function getCSSDefinition($raw = false, $optimized = false)
- {
- return $this->getDefinition('CSS', $raw, $optimized);
- }
-
- /**
- * Retrieves object reference to the URI definition
- *
- * @param bool $raw Return a copy that has not been setup yet. Must be
- * called before it's been setup, otherwise won't work.
- * @param bool $optimized If true, this method may return null, to
- * indicate that a cached version of the modified
- * definition object is available and no further edits
- * are necessary. Consider using
- * maybeGetRawURIDefinition, which is more explicitly
- * named, instead.
- *
- * @return HTMLPurifier_URIDefinition
- */
- public function getURIDefinition($raw = false, $optimized = false)
- {
- return $this->getDefinition('URI', $raw, $optimized);
- }
-
- /**
- * Retrieves a definition
- *
- * @param string $type Type of definition: HTML, CSS, etc
- * @param bool $raw Whether or not definition should be returned raw
- * @param bool $optimized Only has an effect when $raw is true. Whether
- * or not to return null if the result is already present in
- * the cache. This is off by default for backwards
- * compatibility reasons, but you need to do things this
- * way in order to ensure that caching is done properly.
- * Check out enduser-customize.html for more details.
- * We probably won't ever change this default, as much as the
- * maybe semantics is the "right thing to do."
- *
- * @throws HTMLPurifier_Exception
- * @return HTMLPurifier_Definition
- */
- public function getDefinition($type, $raw = false, $optimized = false)
- {
- if ($optimized && !$raw) {
- throw new HTMLPurifier_Exception("Cannot set optimized = true when raw = false");
- }
- if (!$this->finalized) {
- $this->autoFinalize();
- }
- // temporarily suspend locks, so we can handle recursive definition calls
- $lock = $this->lock;
- $this->lock = null;
- $factory = HTMLPurifier_DefinitionCacheFactory::instance();
- $cache = $factory->create($type, $this);
- $this->lock = $lock;
- if (!$raw) {
- // full definition
- // ---------------
- // check if definition is in memory
- if (!empty($this->definitions[$type])) {
- $def = $this->definitions[$type];
- // check if the definition is setup
- if ($def->setup) {
- return $def;
- } else {
- $def->setup($this);
- if ($def->optimized) {
- $cache->add($def, $this);
- }
- return $def;
- }
- }
- // check if definition is in cache
- $def = $cache->get($this);
- if ($def) {
- // definition in cache, save to memory and return it
- $this->definitions[$type] = $def;
- return $def;
- }
- // initialize it
- $def = $this->initDefinition($type);
- // set it up
- $this->lock = $type;
- $def->setup($this);
- $this->lock = null;
- // save in cache
- $cache->add($def, $this);
- // return it
- return $def;
- } else {
- // raw definition
- // --------------
- // check preconditions
- $def = null;
- if ($optimized) {
- if (is_null($this->get($type . '.DefinitionID'))) {
- // fatally error out if definition ID not set
- throw new HTMLPurifier_Exception(
- "Cannot retrieve raw version without specifying %$type.DefinitionID"
- );
- }
- }
- if (!empty($this->definitions[$type])) {
- $def = $this->definitions[$type];
- if ($def->setup && !$optimized) {
- $extra = $this->chatty ?
- " (try moving this code block earlier in your initialization)" :
- "";
- throw new HTMLPurifier_Exception(
- "Cannot retrieve raw definition after it has already been setup" .
- $extra
- );
- }
- if ($def->optimized === null) {
- $extra = $this->chatty ? " (try flushing your cache)" : "";
- throw new HTMLPurifier_Exception(
- "Optimization status of definition is unknown" . $extra
- );
- }
- if ($def->optimized !== $optimized) {
- $msg = $optimized ? "optimized" : "unoptimized";
- $extra = $this->chatty ?
- " (this backtrace is for the first inconsistent call, which was for a $msg raw definition)"
- : "";
- throw new HTMLPurifier_Exception(
- "Inconsistent use of optimized and unoptimized raw definition retrievals" . $extra
- );
- }
- }
- // check if definition was in memory
- if ($def) {
- if ($def->setup) {
- // invariant: $optimized === true (checked above)
- return null;
- } else {
- return $def;
- }
- }
- // if optimized, check if definition was in cache
- // (because we do the memory check first, this formulation
- // is prone to cache slamming, but I think
- // guaranteeing that either /all/ of the raw
- // setup code or /none/ of it is run is more important.)
- if ($optimized) {
- // This code path only gets run once; once we put
- // something in $definitions (which is guaranteed by the
- // trailing code), we always short-circuit above.
- $def = $cache->get($this);
- if ($def) {
- // save the full definition for later, but don't
- // return it yet
- $this->definitions[$type] = $def;
- return null;
- }
- }
- // check invariants for creation
- if (!$optimized) {
- if (!is_null($this->get($type . '.DefinitionID'))) {
- if ($this->chatty) {
- $this->triggerError(
- 'Due to a documentation error in previous version of HTML Purifier, your ' .
- 'definitions are not being cached. If this is OK, you can remove the ' .
- '%$type.DefinitionRev and %$type.DefinitionID declaration. Otherwise, ' .
- 'modify your code to use maybeGetRawDefinition, and test if the returned ' .
- 'value is null before making any edits (if it is null, that means that a ' .
- 'cached version is available, and no raw operations are necessary). See ' .
- '' .
- 'Customize for more details',
- E_USER_WARNING
- );
- } else {
- $this->triggerError(
- "Useless DefinitionID declaration",
- E_USER_WARNING
- );
- }
- }
- }
- // initialize it
- $def = $this->initDefinition($type);
- $def->optimized = $optimized;
- return $def;
- }
- throw new HTMLPurifier_Exception("The impossible happened!");
- }
-
- /**
- * Initialise definition
- *
- * @param string $type What type of definition to create
- *
- * @return HTMLPurifier_CSSDefinition|HTMLPurifier_HTMLDefinition|HTMLPurifier_URIDefinition
- * @throws HTMLPurifier_Exception
- */
- private function initDefinition($type)
- {
- // quick checks failed, let's create the object
- if ($type == 'HTML') {
- $def = new HTMLPurifier_HTMLDefinition();
- } elseif ($type == 'CSS') {
- $def = new HTMLPurifier_CSSDefinition();
- } elseif ($type == 'URI') {
- $def = new HTMLPurifier_URIDefinition();
- } else {
- throw new HTMLPurifier_Exception(
- "Definition of $type type not supported"
- );
- }
- $this->definitions[$type] = $def;
- return $def;
- }
-
- public function maybeGetRawDefinition($name)
- {
- return $this->getDefinition($name, true, true);
- }
-
- /**
- * @return HTMLPurifier_HTMLDefinition
- */
- public function maybeGetRawHTMLDefinition()
- {
- return $this->getDefinition('HTML', true, true);
- }
-
- /**
- * @return HTMLPurifier_CSSDefinition
- */
- public function maybeGetRawCSSDefinition()
- {
- return $this->getDefinition('CSS', true, true);
- }
-
- /**
- * @return HTMLPurifier_URIDefinition
- */
- public function maybeGetRawURIDefinition()
- {
- return $this->getDefinition('URI', true, true);
- }
-
- /**
- * Loads configuration values from an array with the following structure:
- * Namespace.Directive => Value
- *
- * @param array $config_array Configuration associative array
- */
- public function loadArray($config_array)
- {
- if ($this->isFinalized('Cannot load directives after finalization')) {
- return;
- }
- foreach ($config_array as $key => $value) {
- $key = str_replace('_', '.', $key);
- if (strpos($key, '.') !== false) {
- $this->set($key, $value);
- } else {
- $namespace = $key;
- $namespace_values = $value;
- foreach ($namespace_values as $directive => $value2) {
- $this->set($namespace .'.'. $directive, $value2);
- }
- }
- }
- }
-
- /**
- * Returns a list of array(namespace, directive) for all directives
- * that are allowed in a web-form context as per an allowed
- * namespaces/directives list.
- *
- * @param array $allowed List of allowed namespaces/directives
- * @param HTMLPurifier_ConfigSchema $schema Schema to use, if not global copy
- *
- * @return array
- */
- public static function getAllowedDirectivesForForm($allowed, $schema = null)
- {
- if (!$schema) {
- $schema = HTMLPurifier_ConfigSchema::instance();
- }
- if ($allowed !== true) {
- if (is_string($allowed)) {
- $allowed = array($allowed);
- }
- $allowed_ns = array();
- $allowed_directives = array();
- $blacklisted_directives = array();
- foreach ($allowed as $ns_or_directive) {
- if (strpos($ns_or_directive, '.') !== false) {
- // directive
- if ($ns_or_directive[0] == '-') {
- $blacklisted_directives[substr($ns_or_directive, 1)] = true;
- } else {
- $allowed_directives[$ns_or_directive] = true;
- }
- } else {
- // namespace
- $allowed_ns[$ns_or_directive] = true;
- }
- }
- }
- $ret = array();
- foreach ($schema->info as $key => $def) {
- list($ns, $directive) = explode('.', $key, 2);
- if ($allowed !== true) {
- if (isset($blacklisted_directives["$ns.$directive"])) {
- continue;
- }
- if (!isset($allowed_directives["$ns.$directive"]) && !isset($allowed_ns[$ns])) {
- continue;
- }
- }
- if (isset($def->isAlias)) {
- continue;
- }
- if ($directive == 'DefinitionID' || $directive == 'DefinitionRev') {
- continue;
- }
- $ret[] = array($ns, $directive);
- }
- return $ret;
- }
-
- /**
- * Loads configuration values from $_GET/$_POST that were posted
- * via ConfigForm
- *
- * @param array $array $_GET or $_POST array to import
- * @param string|bool $index Index/name that the config variables are in
- * @param array|bool $allowed List of allowed namespaces/directives
- * @param bool $mq_fix Boolean whether or not to enable magic quotes fix
- * @param HTMLPurifier_ConfigSchema $schema Schema to use, if not global copy
- *
- * @return mixed
- */
- public static function loadArrayFromForm($array, $index = false, $allowed = true, $mq_fix = true, $schema = null)
- {
- $ret = HTMLPurifier_Config::prepareArrayFromForm($array, $index, $allowed, $mq_fix, $schema);
- $config = HTMLPurifier_Config::create($ret, $schema);
- return $config;
- }
-
- /**
- * Merges in configuration values from $_GET/$_POST to object. NOT STATIC.
- *
- * @param array $array $_GET or $_POST array to import
- * @param string|bool $index Index/name that the config variables are in
- * @param array|bool $allowed List of allowed namespaces/directives
- * @param bool $mq_fix Boolean whether or not to enable magic quotes fix
- */
- public function mergeArrayFromForm($array, $index = false, $allowed = true, $mq_fix = true)
- {
- $ret = HTMLPurifier_Config::prepareArrayFromForm($array, $index, $allowed, $mq_fix, $this->def);
- $this->loadArray($ret);
- }
-
- /**
- * Prepares an array from a form into something usable for the more
- * strict parts of HTMLPurifier_Config
- *
- * @param array $array $_GET or $_POST array to import
- * @param string|bool $index Index/name that the config variables are in
- * @param array|bool $allowed List of allowed namespaces/directives
- * @param bool $mq_fix Boolean whether or not to enable magic quotes fix
- * @param HTMLPurifier_ConfigSchema $schema Schema to use, if not global copy
- *
- * @return array
- */
- public static function prepareArrayFromForm($array, $index = false, $allowed = true, $mq_fix = true, $schema = null)
- {
- if ($index !== false) {
- $array = (isset($array[$index]) && is_array($array[$index])) ? $array[$index] : array();
- }
- $mq = $mq_fix && function_exists('get_magic_quotes_gpc') && get_magic_quotes_gpc();
-
- $allowed = HTMLPurifier_Config::getAllowedDirectivesForForm($allowed, $schema);
- $ret = array();
- foreach ($allowed as $key) {
- list($ns, $directive) = $key;
- $skey = "$ns.$directive";
- if (!empty($array["Null_$skey"])) {
- $ret[$ns][$directive] = null;
- continue;
- }
- if (!isset($array[$skey])) {
- continue;
- }
- $value = $mq ? stripslashes($array[$skey]) : $array[$skey];
- $ret[$ns][$directive] = $value;
- }
- return $ret;
- }
-
- /**
- * Loads configuration values from an ini file
- *
- * @param string $filename Name of ini file
- */
- public function loadIni($filename)
- {
- if ($this->isFinalized('Cannot load directives after finalization')) {
- return;
- }
- $array = parse_ini_file($filename, true);
- $this->loadArray($array);
- }
-
- /**
- * Checks whether or not the configuration object is finalized.
- *
- * @param string|bool $error String error message, or false for no error
- *
- * @return bool
- */
- public function isFinalized($error = false)
- {
- if ($this->finalized && $error) {
- $this->triggerError($error, E_USER_ERROR);
- }
- return $this->finalized;
- }
-
- /**
- * Finalizes configuration only if auto finalize is on and not
- * already finalized
- */
- public function autoFinalize()
- {
- if ($this->autoFinalize) {
- $this->finalize();
- } else {
- $this->plist->squash(true);
- }
- }
-
- /**
- * Finalizes a configuration object, prohibiting further change
- */
- public function finalize()
- {
- $this->finalized = true;
- $this->parser = null;
- }
-
- /**
- * Produces a nicely formatted error message by supplying the
- * stack frame information OUTSIDE of HTMLPurifier_Config.
- *
- * @param string $msg An error message
- * @param int $no An error number
- */
- protected function triggerError($msg, $no)
- {
- // determine previous stack frame
- $extra = '';
- if ($this->chatty) {
- $trace = debug_backtrace();
- // zip(tail(trace), trace) -- but PHP is not Haskell har har
- for ($i = 0, $c = count($trace); $i < $c - 1; $i++) {
- // XXX this is not correct on some versions of HTML Purifier
- if (isset($trace[$i + 1]['class']) && $trace[$i + 1]['class'] === 'HTMLPurifier_Config') {
- continue;
- }
- $frame = $trace[$i];
- $extra = " invoked on line {$frame['line']} in file {$frame['file']}";
- break;
- }
- }
- trigger_error($msg . $extra, $no);
- }
-
- /**
- * Returns a serialized form of the configuration object that can
- * be reconstituted.
- *
- * @return string
- */
- public function serialize()
- {
- $this->getDefinition('HTML');
- $this->getDefinition('CSS');
- $this->getDefinition('URI');
- return serialize($this);
- }
-
-}
-
-
-
-
-
-/**
- * Configuration definition, defines directives and their defaults.
- */
-class HTMLPurifier_ConfigSchema
-{
- /**
- * Defaults of the directives and namespaces.
- * @type array
- * @note This shares the exact same structure as HTMLPurifier_Config::$conf
- */
- public $defaults = array();
-
- /**
- * The default property list. Do not edit this property list.
- * @type array
- */
- public $defaultPlist;
-
- /**
- * Definition of the directives.
- * The structure of this is:
- *
- * array(
- * 'Namespace' => array(
- * 'Directive' => new stdClass(),
- * )
- * )
- *
- * The stdClass may have the following properties:
- *
- * - If isAlias isn't set:
- * - type: Integer type of directive, see HTMLPurifier_VarParser for definitions
- * - allow_null: If set, this directive allows null values
- * - aliases: If set, an associative array of value aliases to real values
- * - allowed: If set, a lookup array of allowed (string) values
- * - If isAlias is set:
- * - namespace: Namespace this directive aliases to
- * - name: Directive name this directive aliases to
- *
- * In certain degenerate cases, stdClass will actually be an integer. In
- * that case, the value is equivalent to an stdClass with the type
- * property set to the integer. If the integer is negative, type is
- * equal to the absolute value of integer, and allow_null is true.
- *
- * This class is friendly with HTMLPurifier_Config. If you need introspection
- * about the schema, you're better of using the ConfigSchema_Interchange,
- * which uses more memory but has much richer information.
- * @type array
- */
- public $info = array();
-
- /**
- * Application-wide singleton
- * @type HTMLPurifier_ConfigSchema
- */
- protected static $singleton;
-
- public function __construct()
- {
- $this->defaultPlist = new HTMLPurifier_PropertyList();
- }
-
- /**
- * Unserializes the default ConfigSchema.
- * @return HTMLPurifier_ConfigSchema
- */
- public static function makeFromSerial()
- {
- $contents = file_get_contents(HTMLPURIFIER_PREFIX . '/HTMLPurifier/ConfigSchema/schema.ser');
- $r = unserialize($contents);
- if (!$r) {
- $hash = sha1($contents);
- trigger_error("Unserialization of configuration schema failed, sha1 of file was $hash", E_USER_ERROR);
- }
- return $r;
- }
-
- /**
- * Retrieves an instance of the application-wide configuration definition.
- * @param HTMLPurifier_ConfigSchema $prototype
- * @return HTMLPurifier_ConfigSchema
- */
- public static function instance($prototype = null)
- {
- if ($prototype !== null) {
- HTMLPurifier_ConfigSchema::$singleton = $prototype;
- } elseif (HTMLPurifier_ConfigSchema::$singleton === null || $prototype === true) {
- HTMLPurifier_ConfigSchema::$singleton = HTMLPurifier_ConfigSchema::makeFromSerial();
- }
- return HTMLPurifier_ConfigSchema::$singleton;
- }
-
- /**
- * Defines a directive for configuration
- * @warning Will fail of directive's namespace is defined.
- * @warning This method's signature is slightly different from the legacy
- * define() static method! Beware!
- * @param string $key Name of directive
- * @param mixed $default Default value of directive
- * @param string $type Allowed type of the directive. See
- * HTMLPurifier_VarParser::$types for allowed values
- * @param bool $allow_null Whether or not to allow null values
- */
- public function add($key, $default, $type, $allow_null)
- {
- $obj = new stdClass();
- $obj->type = is_int($type) ? $type : HTMLPurifier_VarParser::$types[$type];
- if ($allow_null) {
- $obj->allow_null = true;
- }
- $this->info[$key] = $obj;
- $this->defaults[$key] = $default;
- $this->defaultPlist->set($key, $default);
- }
-
- /**
- * Defines a directive value alias.
- *
- * Directive value aliases are convenient for developers because it lets
- * them set a directive to several values and get the same result.
- * @param string $key Name of Directive
- * @param array $aliases Hash of aliased values to the real alias
- */
- public function addValueAliases($key, $aliases)
- {
- if (!isset($this->info[$key]->aliases)) {
- $this->info[$key]->aliases = array();
- }
- foreach ($aliases as $alias => $real) {
- $this->info[$key]->aliases[$alias] = $real;
- }
- }
-
- /**
- * Defines a set of allowed values for a directive.
- * @warning This is slightly different from the corresponding static
- * method definition.
- * @param string $key Name of directive
- * @param array $allowed Lookup array of allowed values
- */
- public function addAllowedValues($key, $allowed)
- {
- $this->info[$key]->allowed = $allowed;
- }
-
- /**
- * Defines a directive alias for backwards compatibility
- * @param string $key Directive that will be aliased
- * @param string $new_key Directive that the alias will be to
- */
- public function addAlias($key, $new_key)
- {
- $obj = new stdClass;
- $obj->key = $new_key;
- $obj->isAlias = true;
- $this->info[$key] = $obj;
- }
-
- /**
- * Replaces any stdClass that only has the type property with type integer.
- */
- public function postProcess()
- {
- foreach ($this->info as $key => $v) {
- if (count((array) $v) == 1) {
- $this->info[$key] = $v->type;
- } elseif (count((array) $v) == 2 && isset($v->allow_null)) {
- $this->info[$key] = -$v->type;
- }
- }
- }
-}
-
-
-
-
-
-/**
- * @todo Unit test
- */
-class HTMLPurifier_ContentSets
-{
-
- /**
- * List of content set strings (pipe separators) indexed by name.
- * @type array
- */
- public $info = array();
-
- /**
- * List of content set lookups (element => true) indexed by name.
- * @type array
- * @note This is in HTMLPurifier_HTMLDefinition->info_content_sets
- */
- public $lookup = array();
-
- /**
- * Synchronized list of defined content sets (keys of info).
- * @type array
- */
- protected $keys = array();
- /**
- * Synchronized list of defined content values (values of info).
- * @type array
- */
- protected $values = array();
-
- /**
- * Merges in module's content sets, expands identifiers in the content
- * sets and populates the keys, values and lookup member variables.
- * @param HTMLPurifier_HTMLModule[] $modules List of HTMLPurifier_HTMLModule
- */
- public function __construct($modules)
- {
- if (!is_array($modules)) {
- $modules = array($modules);
- }
- // populate content_sets based on module hints
- // sorry, no way of overloading
- foreach ($modules as $module) {
- foreach ($module->content_sets as $key => $value) {
- $temp = $this->convertToLookup($value);
- if (isset($this->lookup[$key])) {
- // add it into the existing content set
- $this->lookup[$key] = array_merge($this->lookup[$key], $temp);
- } else {
- $this->lookup[$key] = $temp;
- }
- }
- }
- $old_lookup = false;
- while ($old_lookup !== $this->lookup) {
- $old_lookup = $this->lookup;
- foreach ($this->lookup as $i => $set) {
- $add = array();
- foreach ($set as $element => $x) {
- if (isset($this->lookup[$element])) {
- $add += $this->lookup[$element];
- unset($this->lookup[$i][$element]);
- }
- }
- $this->lookup[$i] += $add;
- }
- }
-
- foreach ($this->lookup as $key => $lookup) {
- $this->info[$key] = implode(' | ', array_keys($lookup));
- }
- $this->keys = array_keys($this->info);
- $this->values = array_values($this->info);
- }
-
- /**
- * Accepts a definition; generates and assigns a ChildDef for it
- * @param HTMLPurifier_ElementDef $def HTMLPurifier_ElementDef reference
- * @param HTMLPurifier_HTMLModule $module Module that defined the ElementDef
- */
- public function generateChildDef(&$def, $module)
- {
- if (!empty($def->child)) { // already done!
- return;
- }
- $content_model = $def->content_model;
- if (is_string($content_model)) {
- // Assume that $this->keys is alphanumeric
- $def->content_model = preg_replace_callback(
- '/\b(' . implode('|', $this->keys) . ')\b/',
- array($this, 'generateChildDefCallback'),
- $content_model
- );
- //$def->content_model = str_replace(
- // $this->keys, $this->values, $content_model);
- }
- $def->child = $this->getChildDef($def, $module);
- }
-
- public function generateChildDefCallback($matches)
- {
- return $this->info[$matches[0]];
- }
-
- /**
- * Instantiates a ChildDef based on content_model and content_model_type
- * member variables in HTMLPurifier_ElementDef
- * @note This will also defer to modules for custom HTMLPurifier_ChildDef
- * subclasses that need content set expansion
- * @param HTMLPurifier_ElementDef $def HTMLPurifier_ElementDef to have ChildDef extracted
- * @param HTMLPurifier_HTMLModule $module Module that defined the ElementDef
- * @return HTMLPurifier_ChildDef corresponding to ElementDef
- */
- public function getChildDef($def, $module)
- {
- $value = $def->content_model;
- if (is_object($value)) {
- trigger_error(
- 'Literal object child definitions should be stored in '.
- 'ElementDef->child not ElementDef->content_model',
- E_USER_NOTICE
- );
- return $value;
- }
- switch ($def->content_model_type) {
- case 'required':
- return new HTMLPurifier_ChildDef_Required($value);
- case 'optional':
- return new HTMLPurifier_ChildDef_Optional($value);
- case 'empty':
- return new HTMLPurifier_ChildDef_Empty();
- case 'custom':
- return new HTMLPurifier_ChildDef_Custom($value);
- }
- // defer to its module
- $return = false;
- if ($module->defines_child_def) { // save a func call
- $return = $module->getChildDef($def);
- }
- if ($return !== false) {
- return $return;
- }
- // error-out
- trigger_error(
- 'Could not determine which ChildDef class to instantiate',
- E_USER_ERROR
- );
- return false;
- }
-
- /**
- * Converts a string list of elements separated by pipes into
- * a lookup array.
- * @param string $string List of elements
- * @return array Lookup array of elements
- */
- protected function convertToLookup($string)
- {
- $array = explode('|', str_replace(' ', '', $string));
- $ret = array();
- foreach ($array as $k) {
- $ret[$k] = true;
- }
- return $ret;
- }
-}
-
-
-
-
-
-/**
- * Registry object that contains information about the current context.
- * @warning Is a bit buggy when variables are set to null: it thinks
- * they don't exist! So use false instead, please.
- * @note Since the variables Context deals with may not be objects,
- * references are very important here! Do not remove!
- */
-class HTMLPurifier_Context
-{
-
- /**
- * Private array that stores the references.
- * @type array
- */
- private $_storage = array();
-
- /**
- * Registers a variable into the context.
- * @param string $name String name
- * @param mixed $ref Reference to variable to be registered
- */
- public function register($name, &$ref)
- {
- if (array_key_exists($name, $this->_storage)) {
- trigger_error(
- "Name $name produces collision, cannot re-register",
- E_USER_ERROR
- );
- return;
- }
- $this->_storage[$name] =& $ref;
- }
-
- /**
- * Retrieves a variable reference from the context.
- * @param string $name String name
- * @param bool $ignore_error Boolean whether or not to ignore error
- * @return mixed
- */
- public function &get($name, $ignore_error = false)
- {
- if (!array_key_exists($name, $this->_storage)) {
- if (!$ignore_error) {
- trigger_error(
- "Attempted to retrieve non-existent variable $name",
- E_USER_ERROR
- );
- }
- $var = null; // so we can return by reference
- return $var;
- }
- return $this->_storage[$name];
- }
-
- /**
- * Destroys a variable in the context.
- * @param string $name String name
- */
- public function destroy($name)
- {
- if (!array_key_exists($name, $this->_storage)) {
- trigger_error(
- "Attempted to destroy non-existent variable $name",
- E_USER_ERROR
- );
- return;
- }
- unset($this->_storage[$name]);
- }
-
- /**
- * Checks whether or not the variable exists.
- * @param string $name String name
- * @return bool
- */
- public function exists($name)
- {
- return array_key_exists($name, $this->_storage);
- }
-
- /**
- * Loads a series of variables from an associative array
- * @param array $context_array Assoc array of variables to load
- */
- public function loadArray($context_array)
- {
- foreach ($context_array as $key => $discard) {
- $this->register($key, $context_array[$key]);
- }
- }
-}
-
-
-
-
-
-/**
- * Abstract class representing Definition cache managers that implements
- * useful common methods and is a factory.
- * @todo Create a separate maintenance file advanced users can use to
- * cache their custom HTMLDefinition, which can be loaded
- * via a configuration directive
- * @todo Implement memcached
- */
-abstract class HTMLPurifier_DefinitionCache
-{
- /**
- * @type string
- */
- public $type;
-
- /**
- * @param string $type Type of definition objects this instance of the
- * cache will handle.
- */
- public function __construct($type)
- {
- $this->type = $type;
- }
-
- /**
- * Generates a unique identifier for a particular configuration
- * @param HTMLPurifier_Config $config Instance of HTMLPurifier_Config
- * @return string
- */
- public function generateKey($config)
- {
- return $config->version . ',' . // possibly replace with function calls
- $config->getBatchSerial($this->type) . ',' .
- $config->get($this->type . '.DefinitionRev');
- }
-
- /**
- * Tests whether or not a key is old with respect to the configuration's
- * version and revision number.
- * @param string $key Key to test
- * @param HTMLPurifier_Config $config Instance of HTMLPurifier_Config to test against
- * @return bool
- */
- public function isOld($key, $config)
- {
- if (substr_count($key, ',') < 2) {
- return true;
- }
- list($version, $hash, $revision) = explode(',', $key, 3);
- $compare = version_compare($version, $config->version);
- // version mismatch, is always old
- if ($compare != 0) {
- return true;
- }
- // versions match, ids match, check revision number
- if ($hash == $config->getBatchSerial($this->type) &&
- $revision < $config->get($this->type . '.DefinitionRev')) {
- return true;
- }
- return false;
- }
-
- /**
- * Checks if a definition's type jives with the cache's type
- * @note Throws an error on failure
- * @param HTMLPurifier_Definition $def Definition object to check
- * @return bool true if good, false if not
- */
- public function checkDefType($def)
- {
- if ($def->type !== $this->type) {
- trigger_error("Cannot use definition of type {$def->type} in cache for {$this->type}");
- return false;
- }
- return true;
- }
-
- /**
- * Adds a definition object to the cache
- * @param HTMLPurifier_Definition $def
- * @param HTMLPurifier_Config $config
- */
- abstract public function add($def, $config);
-
- /**
- * Unconditionally saves a definition object to the cache
- * @param HTMLPurifier_Definition $def
- * @param HTMLPurifier_Config $config
- */
- abstract public function set($def, $config);
-
- /**
- * Replace an object in the cache
- * @param HTMLPurifier_Definition $def
- * @param HTMLPurifier_Config $config
- */
- abstract public function replace($def, $config);
-
- /**
- * Retrieves a definition object from the cache
- * @param HTMLPurifier_Config $config
- */
- abstract public function get($config);
-
- /**
- * Removes a definition object to the cache
- * @param HTMLPurifier_Config $config
- */
- abstract public function remove($config);
-
- /**
- * Clears all objects from cache
- * @param HTMLPurifier_Config $config
- */
- abstract public function flush($config);
-
- /**
- * Clears all expired (older version or revision) objects from cache
- * @note Be careful implementing this method as flush. Flush must
- * not interfere with other Definition types, and cleanup()
- * should not be repeatedly called by userland code.
- * @param HTMLPurifier_Config $config
- */
- abstract public function cleanup($config);
-}
-
-
-
-
-
-/**
- * Responsible for creating definition caches.
- */
-class HTMLPurifier_DefinitionCacheFactory
-{
- /**
- * @type array
- */
- protected $caches = array('Serializer' => array());
-
- /**
- * @type array
- */
- protected $implementations = array();
-
- /**
- * @type HTMLPurifier_DefinitionCache_Decorator[]
- */
- protected $decorators = array();
-
- /**
- * Initialize default decorators
- */
- public function setup()
- {
- $this->addDecorator('Cleanup');
- }
-
- /**
- * Retrieves an instance of global definition cache factory.
- * @param HTMLPurifier_DefinitionCacheFactory $prototype
- * @return HTMLPurifier_DefinitionCacheFactory
- */
- public static function instance($prototype = null)
- {
- static $instance;
- if ($prototype !== null) {
- $instance = $prototype;
- } elseif ($instance === null || $prototype === true) {
- $instance = new HTMLPurifier_DefinitionCacheFactory();
- $instance->setup();
- }
- return $instance;
- }
-
- /**
- * Registers a new definition cache object
- * @param string $short Short name of cache object, for reference
- * @param string $long Full class name of cache object, for construction
- */
- public function register($short, $long)
- {
- $this->implementations[$short] = $long;
- }
-
- /**
- * Factory method that creates a cache object based on configuration
- * @param string $type Name of definitions handled by cache
- * @param HTMLPurifier_Config $config Config instance
- * @return mixed
- */
- public function create($type, $config)
- {
- $method = $config->get('Cache.DefinitionImpl');
- if ($method === null) {
- return new HTMLPurifier_DefinitionCache_Null($type);
- }
- if (!empty($this->caches[$method][$type])) {
- return $this->caches[$method][$type];
- }
- if (isset($this->implementations[$method]) &&
- class_exists($class = $this->implementations[$method], false)) {
- $cache = new $class($type);
- } else {
- if ($method != 'Serializer') {
- trigger_error("Unrecognized DefinitionCache $method, using Serializer instead", E_USER_WARNING);
- }
- $cache = new HTMLPurifier_DefinitionCache_Serializer($type);
- }
- foreach ($this->decorators as $decorator) {
- $new_cache = $decorator->decorate($cache);
- // prevent infinite recursion in PHP 4
- unset($cache);
- $cache = $new_cache;
- }
- $this->caches[$method][$type] = $cache;
- return $this->caches[$method][$type];
- }
-
- /**
- * Registers a decorator to add to all new cache objects
- * @param HTMLPurifier_DefinitionCache_Decorator|string $decorator An instance or the name of a decorator
- */
- public function addDecorator($decorator)
- {
- if (is_string($decorator)) {
- $class = "HTMLPurifier_DefinitionCache_Decorator_$decorator";
- $decorator = new $class;
- }
- $this->decorators[$decorator->name] = $decorator;
- }
-}
-
-
-
-
-
-/**
- * Represents a document type, contains information on which modules
- * need to be loaded.
- * @note This class is inspected by Printer_HTMLDefinition->renderDoctype.
- * If structure changes, please update that function.
- */
-class HTMLPurifier_Doctype
-{
- /**
- * Full name of doctype
- * @type string
- */
- public $name;
-
- /**
- * List of standard modules (string identifiers or literal objects)
- * that this doctype uses
- * @type array
- */
- public $modules = array();
-
- /**
- * List of modules to use for tidying up code
- * @type array
- */
- public $tidyModules = array();
-
- /**
- * Is the language derived from XML (i.e. XHTML)?
- * @type bool
- */
- public $xml = true;
-
- /**
- * List of aliases for this doctype
- * @type array
- */
- public $aliases = array();
-
- /**
- * Public DTD identifier
- * @type string
- */
- public $dtdPublic;
-
- /**
- * System DTD identifier
- * @type string
- */
- public $dtdSystem;
-
- public function __construct(
- $name = null,
- $xml = true,
- $modules = array(),
- $tidyModules = array(),
- $aliases = array(),
- $dtd_public = null,
- $dtd_system = null
- ) {
- $this->name = $name;
- $this->xml = $xml;
- $this->modules = $modules;
- $this->tidyModules = $tidyModules;
- $this->aliases = $aliases;
- $this->dtdPublic = $dtd_public;
- $this->dtdSystem = $dtd_system;
- }
-}
-
-
-
-
-
-class HTMLPurifier_DoctypeRegistry
-{
-
- /**
- * Hash of doctype names to doctype objects.
- * @type array
- */
- protected $doctypes;
-
- /**
- * Lookup table of aliases to real doctype names.
- * @type array
- */
- protected $aliases;
-
- /**
- * Registers a doctype to the registry
- * @note Accepts a fully-formed doctype object, or the
- * parameters for constructing a doctype object
- * @param string $doctype Name of doctype or literal doctype object
- * @param bool $xml
- * @param array $modules Modules doctype will load
- * @param array $tidy_modules Modules doctype will load for certain modes
- * @param array $aliases Alias names for doctype
- * @param string $dtd_public
- * @param string $dtd_system
- * @return HTMLPurifier_Doctype Editable registered doctype
- */
- public function register(
- $doctype,
- $xml = true,
- $modules = array(),
- $tidy_modules = array(),
- $aliases = array(),
- $dtd_public = null,
- $dtd_system = null
- ) {
- if (!is_array($modules)) {
- $modules = array($modules);
- }
- if (!is_array($tidy_modules)) {
- $tidy_modules = array($tidy_modules);
- }
- if (!is_array($aliases)) {
- $aliases = array($aliases);
- }
- if (!is_object($doctype)) {
- $doctype = new HTMLPurifier_Doctype(
- $doctype,
- $xml,
- $modules,
- $tidy_modules,
- $aliases,
- $dtd_public,
- $dtd_system
- );
- }
- $this->doctypes[$doctype->name] = $doctype;
- $name = $doctype->name;
- // hookup aliases
- foreach ($doctype->aliases as $alias) {
- if (isset($this->doctypes[$alias])) {
- continue;
- }
- $this->aliases[$alias] = $name;
- }
- // remove old aliases
- if (isset($this->aliases[$name])) {
- unset($this->aliases[$name]);
- }
- return $doctype;
- }
-
- /**
- * Retrieves reference to a doctype of a certain name
- * @note This function resolves aliases
- * @note When possible, use the more fully-featured make()
- * @param string $doctype Name of doctype
- * @return HTMLPurifier_Doctype Editable doctype object
- */
- public function get($doctype)
- {
- if (isset($this->aliases[$doctype])) {
- $doctype = $this->aliases[$doctype];
- }
- if (!isset($this->doctypes[$doctype])) {
- trigger_error('Doctype ' . htmlspecialchars($doctype) . ' does not exist', E_USER_ERROR);
- $anon = new HTMLPurifier_Doctype($doctype);
- return $anon;
- }
- return $this->doctypes[$doctype];
- }
-
- /**
- * Creates a doctype based on a configuration object,
- * will perform initialization on the doctype
- * @note Use this function to get a copy of doctype that config
- * can hold on to (this is necessary in order to tell
- * Generator whether or not the current document is XML
- * based or not).
- * @param HTMLPurifier_Config $config
- * @return HTMLPurifier_Doctype
- */
- public function make($config)
- {
- return clone $this->get($this->getDoctypeFromConfig($config));
- }
-
- /**
- * Retrieves the doctype from the configuration object
- * @param HTMLPurifier_Config $config
- * @return string
- */
- public function getDoctypeFromConfig($config)
- {
- // recommended test
- $doctype = $config->get('HTML.Doctype');
- if (!empty($doctype)) {
- return $doctype;
- }
- $doctype = $config->get('HTML.CustomDoctype');
- if (!empty($doctype)) {
- return $doctype;
- }
- // backwards-compatibility
- if ($config->get('HTML.XHTML')) {
- $doctype = 'XHTML 1.0';
- } else {
- $doctype = 'HTML 4.01';
- }
- if ($config->get('HTML.Strict')) {
- $doctype .= ' Strict';
- } else {
- $doctype .= ' Transitional';
- }
- return $doctype;
- }
-}
-
-
-
-
-
-/**
- * Structure that stores an HTML element definition. Used by
- * HTMLPurifier_HTMLDefinition and HTMLPurifier_HTMLModule.
- * @note This class is inspected by HTMLPurifier_Printer_HTMLDefinition.
- * Please update that class too.
- * @warning If you add new properties to this class, you MUST update
- * the mergeIn() method.
- */
-class HTMLPurifier_ElementDef
-{
- /**
- * Does the definition work by itself, or is it created solely
- * for the purpose of merging into another definition?
- * @type bool
- */
- public $standalone = true;
-
- /**
- * Associative array of attribute name to HTMLPurifier_AttrDef.
- * @type array
- * @note Before being processed by HTMLPurifier_AttrCollections
- * when modules are finalized during
- * HTMLPurifier_HTMLDefinition->setup(), this array may also
- * contain an array at index 0 that indicates which attribute
- * collections to load into the full array. It may also
- * contain string indentifiers in lieu of HTMLPurifier_AttrDef,
- * see HTMLPurifier_AttrTypes on how they are expanded during
- * HTMLPurifier_HTMLDefinition->setup() processing.
- */
- public $attr = array();
-
- // XXX: Design note: currently, it's not possible to override
- // previously defined AttrTransforms without messing around with
- // the final generated config. This is by design; a previous version
- // used an associated list of attr_transform, but it was extremely
- // easy to accidentally override other attribute transforms by
- // forgetting to specify an index (and just using 0.) While we
- // could check this by checking the index number and complaining,
- // there is a second problem which is that it is not at all easy to
- // tell when something is getting overridden. Combine this with a
- // codebase where this isn't really being used, and it's perfect for
- // nuking.
-
- /**
- * List of tags HTMLPurifier_AttrTransform to be done before validation.
- * @type array
- */
- public $attr_transform_pre = array();
-
- /**
- * List of tags HTMLPurifier_AttrTransform to be done after validation.
- * @type array
- */
- public $attr_transform_post = array();
-
- /**
- * HTMLPurifier_ChildDef of this tag.
- * @type HTMLPurifier_ChildDef
- */
- public $child;
-
- /**
- * Abstract string representation of internal ChildDef rules.
- * @see HTMLPurifier_ContentSets for how this is parsed and then transformed
- * into an HTMLPurifier_ChildDef.
- * @warning This is a temporary variable that is not available after
- * being processed by HTMLDefinition
- * @type string
- */
- public $content_model;
-
- /**
- * Value of $child->type, used to determine which ChildDef to use,
- * used in combination with $content_model.
- * @warning This must be lowercase
- * @warning This is a temporary variable that is not available after
- * being processed by HTMLDefinition
- * @type string
- */
- public $content_model_type;
-
- /**
- * Does the element have a content model (#PCDATA | Inline)*? This
- * is important for chameleon ins and del processing in
- * HTMLPurifier_ChildDef_Chameleon. Dynamically set: modules don't
- * have to worry about this one.
- * @type bool
- */
- public $descendants_are_inline = false;
-
- /**
- * List of the names of required attributes this element has.
- * Dynamically populated by HTMLPurifier_HTMLDefinition::getElement()
- * @type array
- */
- public $required_attr = array();
-
- /**
- * Lookup table of tags excluded from all descendants of this tag.
- * @type array
- * @note SGML permits exclusions for all descendants, but this is
- * not possible with DTDs or XML Schemas. W3C has elected to
- * use complicated compositions of content_models to simulate
- * exclusion for children, but we go the simpler, SGML-style
- * route of flat-out exclusions, which correctly apply to
- * all descendants and not just children. Note that the XHTML
- * Modularization Abstract Modules are blithely unaware of such
- * distinctions.
- */
- public $excludes = array();
-
- /**
- * This tag is explicitly auto-closed by the following tags.
- * @type array
- */
- public $autoclose = array();
-
- /**
- * If a foreign element is found in this element, test if it is
- * allowed by this sub-element; if it is, instead of closing the
- * current element, place it inside this element.
- * @type string
- */
- public $wrap;
-
- /**
- * Whether or not this is a formatting element affected by the
- * "Active Formatting Elements" algorithm.
- * @type bool
- */
- public $formatting;
-
- /**
- * Low-level factory constructor for creating new standalone element defs
- */
- public static function create($content_model, $content_model_type, $attr)
- {
- $def = new HTMLPurifier_ElementDef();
- $def->content_model = $content_model;
- $def->content_model_type = $content_model_type;
- $def->attr = $attr;
- return $def;
- }
-
- /**
- * Merges the values of another element definition into this one.
- * Values from the new element def take precedence if a value is
- * not mergeable.
- * @param HTMLPurifier_ElementDef $def
- */
- public function mergeIn($def)
- {
- // later keys takes precedence
- foreach ($def->attr as $k => $v) {
- if ($k === 0) {
- // merge in the includes
- // sorry, no way to override an include
- foreach ($v as $v2) {
- $this->attr[0][] = $v2;
- }
- continue;
- }
- if ($v === false) {
- if (isset($this->attr[$k])) {
- unset($this->attr[$k]);
- }
- continue;
- }
- $this->attr[$k] = $v;
- }
- $this->_mergeAssocArray($this->excludes, $def->excludes);
- $this->attr_transform_pre = array_merge($this->attr_transform_pre, $def->attr_transform_pre);
- $this->attr_transform_post = array_merge($this->attr_transform_post, $def->attr_transform_post);
-
- if (!empty($def->content_model)) {
- $this->content_model =
- str_replace("#SUPER", $this->content_model, $def->content_model);
- $this->child = false;
- }
- if (!empty($def->content_model_type)) {
- $this->content_model_type = $def->content_model_type;
- $this->child = false;
- }
- if (!is_null($def->child)) {
- $this->child = $def->child;
- }
- if (!is_null($def->formatting)) {
- $this->formatting = $def->formatting;
- }
- if ($def->descendants_are_inline) {
- $this->descendants_are_inline = $def->descendants_are_inline;
- }
- }
-
- /**
- * Merges one array into another, removes values which equal false
- * @param $a1 Array by reference that is merged into
- * @param $a2 Array that merges into $a1
- */
- private function _mergeAssocArray(&$a1, $a2)
- {
- foreach ($a2 as $k => $v) {
- if ($v === false) {
- if (isset($a1[$k])) {
- unset($a1[$k]);
- }
- continue;
- }
- $a1[$k] = $v;
- }
- }
-}
-
-
-
-
-
-/**
- * A UTF-8 specific character encoder that handles cleaning and transforming.
- * @note All functions in this class should be static.
- */
-class HTMLPurifier_Encoder
-{
-
- /**
- * Constructor throws fatal error if you attempt to instantiate class
- */
- private function __construct()
- {
- trigger_error('Cannot instantiate encoder, call methods statically', E_USER_ERROR);
- }
-
- /**
- * Error-handler that mutes errors, alternative to shut-up operator.
- */
- public static function muteErrorHandler()
- {
- }
-
- /**
- * iconv wrapper which mutes errors, but doesn't work around bugs.
- * @param string $in Input encoding
- * @param string $out Output encoding
- * @param string $text The text to convert
- * @return string
- */
- public static function unsafeIconv($in, $out, $text)
- {
- set_error_handler(array('HTMLPurifier_Encoder', 'muteErrorHandler'));
- $r = iconv($in, $out, $text);
- restore_error_handler();
- return $r;
- }
-
- /**
- * iconv wrapper which mutes errors and works around bugs.
- * @param string $in Input encoding
- * @param string $out Output encoding
- * @param string $text The text to convert
- * @param int $max_chunk_size
- * @return string
- */
- public static function iconv($in, $out, $text, $max_chunk_size = 8000)
- {
- $code = self::testIconvTruncateBug();
- if ($code == self::ICONV_OK) {
- return self::unsafeIconv($in, $out, $text);
- } elseif ($code == self::ICONV_TRUNCATES) {
- // we can only work around this if the input character set
- // is utf-8
- if ($in == 'utf-8') {
- if ($max_chunk_size < 4) {
- trigger_error('max_chunk_size is too small', E_USER_WARNING);
- return false;
- }
- // split into 8000 byte chunks, but be careful to handle
- // multibyte boundaries properly
- if (($c = strlen($text)) <= $max_chunk_size) {
- return self::unsafeIconv($in, $out, $text);
- }
- $r = '';
- $i = 0;
- while (true) {
- if ($i + $max_chunk_size >= $c) {
- $r .= self::unsafeIconv($in, $out, substr($text, $i));
- break;
- }
- // wibble the boundary
- if (0x80 != (0xC0 & ord($text[$i + $max_chunk_size]))) {
- $chunk_size = $max_chunk_size;
- } elseif (0x80 != (0xC0 & ord($text[$i + $max_chunk_size - 1]))) {
- $chunk_size = $max_chunk_size - 1;
- } elseif (0x80 != (0xC0 & ord($text[$i + $max_chunk_size - 2]))) {
- $chunk_size = $max_chunk_size - 2;
- } elseif (0x80 != (0xC0 & ord($text[$i + $max_chunk_size - 3]))) {
- $chunk_size = $max_chunk_size - 3;
- } else {
- return false; // rather confusing UTF-8...
- }
- $chunk = substr($text, $i, $chunk_size); // substr doesn't mind overlong lengths
- $r .= self::unsafeIconv($in, $out, $chunk);
- $i += $chunk_size;
- }
- return $r;
- } else {
- return false;
- }
- } else {
- return false;
- }
- }
-
- /**
- * Cleans a UTF-8 string for well-formedness and SGML validity
- *
- * It will parse according to UTF-8 and return a valid UTF8 string, with
- * non-SGML codepoints excluded.
- *
- * Specifically, it will permit:
- * \x{9}\x{A}\x{D}\x{20}-\x{7E}\x{A0}-\x{D7FF}\x{E000}-\x{FFFD}\x{10000}-\x{10FFFF}
- * Source: https://www.w3.org/TR/REC-xml/#NT-Char
- * Arguably this function should be modernized to the HTML5 set
- * of allowed characters:
- * https://www.w3.org/TR/html5/syntax.html#preprocessing-the-input-stream
- * which simultaneously expand and restrict the set of allowed characters.
- *
- * @param string $str The string to clean
- * @param bool $force_php
- * @return string
- *
- * @note Just for reference, the non-SGML code points are 0 to 31 and
- * 127 to 159, inclusive. However, we allow code points 9, 10
- * and 13, which are the tab, line feed and carriage return
- * respectively. 128 and above the code points map to multibyte
- * UTF-8 representations.
- *
- * @note Fallback code adapted from utf8ToUnicode by Henri Sivonen and
- * hsivonen@iki.fi at under the
- * LGPL license. Notes on what changed are inside, but in general,
- * the original code transformed UTF-8 text into an array of integer
- * Unicode codepoints. Understandably, transforming that back to
- * a string would be somewhat expensive, so the function was modded to
- * directly operate on the string. However, this discourages code
- * reuse, and the logic enumerated here would be useful for any
- * function that needs to be able to understand UTF-8 characters.
- * As of right now, only smart lossless character encoding converters
- * would need that, and I'm probably not going to implement them.
- */
- public static function cleanUTF8($str, $force_php = false)
- {
- // UTF-8 validity is checked since PHP 4.3.5
- // This is an optimization: if the string is already valid UTF-8, no
- // need to do PHP stuff. 99% of the time, this will be the case.
- if (preg_match(
- '/^[\x{9}\x{A}\x{D}\x{20}-\x{7E}\x{A0}-\x{D7FF}\x{E000}-\x{FFFD}\x{10000}-\x{10FFFF}]*$/Du',
- $str
- )) {
- return $str;
- }
-
- $mState = 0; // cached expected number of octets after the current octet
- // until the beginning of the next UTF8 character sequence
- $mUcs4 = 0; // cached Unicode character
- $mBytes = 1; // cached expected number of octets in the current sequence
-
- // original code involved an $out that was an array of Unicode
- // codepoints. Instead of having to convert back into UTF-8, we've
- // decided to directly append valid UTF-8 characters onto a string
- // $out once they're done. $char accumulates raw bytes, while $mUcs4
- // turns into the Unicode code point, so there's some redundancy.
-
- $out = '';
- $char = '';
-
- $len = strlen($str);
- for ($i = 0; $i < $len; $i++) {
- $in = ord($str[$i]);
- $char .= $str[$i]; // append byte to char
- if (0 == $mState) {
- // When mState is zero we expect either a US-ASCII character
- // or a multi-octet sequence.
- if (0 == (0x80 & ($in))) {
- // US-ASCII, pass straight through.
- if (($in <= 31 || $in == 127) &&
- !($in == 9 || $in == 13 || $in == 10) // save \r\t\n
- ) {
- // control characters, remove
- } else {
- $out .= $char;
- }
- // reset
- $char = '';
- $mBytes = 1;
- } elseif (0xC0 == (0xE0 & ($in))) {
- // First octet of 2 octet sequence
- $mUcs4 = ($in);
- $mUcs4 = ($mUcs4 & 0x1F) << 6;
- $mState = 1;
- $mBytes = 2;
- } elseif (0xE0 == (0xF0 & ($in))) {
- // First octet of 3 octet sequence
- $mUcs4 = ($in);
- $mUcs4 = ($mUcs4 & 0x0F) << 12;
- $mState = 2;
- $mBytes = 3;
- } elseif (0xF0 == (0xF8 & ($in))) {
- // First octet of 4 octet sequence
- $mUcs4 = ($in);
- $mUcs4 = ($mUcs4 & 0x07) << 18;
- $mState = 3;
- $mBytes = 4;
- } elseif (0xF8 == (0xFC & ($in))) {
- // First octet of 5 octet sequence.
- //
- // This is illegal because the encoded codepoint must be
- // either:
- // (a) not the shortest form or
- // (b) outside the Unicode range of 0-0x10FFFF.
- // Rather than trying to resynchronize, we will carry on
- // until the end of the sequence and let the later error
- // handling code catch it.
- $mUcs4 = ($in);
- $mUcs4 = ($mUcs4 & 0x03) << 24;
- $mState = 4;
- $mBytes = 5;
- } elseif (0xFC == (0xFE & ($in))) {
- // First octet of 6 octet sequence, see comments for 5
- // octet sequence.
- $mUcs4 = ($in);
- $mUcs4 = ($mUcs4 & 1) << 30;
- $mState = 5;
- $mBytes = 6;
- } else {
- // Current octet is neither in the US-ASCII range nor a
- // legal first octet of a multi-octet sequence.
- $mState = 0;
- $mUcs4 = 0;
- $mBytes = 1;
- $char = '';
- }
- } else {
- // When mState is non-zero, we expect a continuation of the
- // multi-octet sequence
- if (0x80 == (0xC0 & ($in))) {
- // Legal continuation.
- $shift = ($mState - 1) * 6;
- $tmp = $in;
- $tmp = ($tmp & 0x0000003F) << $shift;
- $mUcs4 |= $tmp;
-
- if (0 == --$mState) {
- // End of the multi-octet sequence. mUcs4 now contains
- // the final Unicode codepoint to be output
-
- // Check for illegal sequences and codepoints.
-
- // From Unicode 3.1, non-shortest form is illegal
- if (((2 == $mBytes) && ($mUcs4 < 0x0080)) ||
- ((3 == $mBytes) && ($mUcs4 < 0x0800)) ||
- ((4 == $mBytes) && ($mUcs4 < 0x10000)) ||
- (4 < $mBytes) ||
- // From Unicode 3.2, surrogate characters = illegal
- (($mUcs4 & 0xFFFFF800) == 0xD800) ||
- // Codepoints outside the Unicode range are illegal
- ($mUcs4 > 0x10FFFF)
- ) {
-
- } elseif (0xFEFF != $mUcs4 && // omit BOM
- // check for valid Char unicode codepoints
- (
- 0x9 == $mUcs4 ||
- 0xA == $mUcs4 ||
- 0xD == $mUcs4 ||
- (0x20 <= $mUcs4 && 0x7E >= $mUcs4) ||
- // 7F-9F is not strictly prohibited by XML,
- // but it is non-SGML, and thus we don't allow it
- (0xA0 <= $mUcs4 && 0xD7FF >= $mUcs4) ||
- (0xE000 <= $mUcs4 && 0xFFFD >= $mUcs4) ||
- (0x10000 <= $mUcs4 && 0x10FFFF >= $mUcs4)
- )
- ) {
- $out .= $char;
- }
- // initialize UTF8 cache (reset)
- $mState = 0;
- $mUcs4 = 0;
- $mBytes = 1;
- $char = '';
- }
- } else {
- // ((0xC0 & (*in) != 0x80) && (mState != 0))
- // Incomplete multi-octet sequence.
- // used to result in complete fail, but we'll reset
- $mState = 0;
- $mUcs4 = 0;
- $mBytes = 1;
- $char ='';
- }
- }
- }
- return $out;
- }
-
- /**
- * Translates a Unicode codepoint into its corresponding UTF-8 character.
- * @note Based on Feyd's function at
- * ,
- * which is in public domain.
- * @note While we're going to do code point parsing anyway, a good
- * optimization would be to refuse to translate code points that
- * are non-SGML characters. However, this could lead to duplication.
- * @note This is very similar to the unichr function in
- * maintenance/generate-entity-file.php (although this is superior,
- * due to its sanity checks).
- */
-
- // +----------+----------+----------+----------+
- // | 33222222 | 22221111 | 111111 | |
- // | 10987654 | 32109876 | 54321098 | 76543210 | bit
- // +----------+----------+----------+----------+
- // | | | | 0xxxxxxx | 1 byte 0x00000000..0x0000007F
- // | | | 110yyyyy | 10xxxxxx | 2 byte 0x00000080..0x000007FF
- // | | 1110zzzz | 10yyyyyy | 10xxxxxx | 3 byte 0x00000800..0x0000FFFF
- // | 11110www | 10wwzzzz | 10yyyyyy | 10xxxxxx | 4 byte 0x00010000..0x0010FFFF
- // +----------+----------+----------+----------+
- // | 00000000 | 00011111 | 11111111 | 11111111 | Theoretical upper limit of legal scalars: 2097151 (0x001FFFFF)
- // | 00000000 | 00010000 | 11111111 | 11111111 | Defined upper limit of legal scalar codes
- // +----------+----------+----------+----------+
-
- public static function unichr($code)
- {
- if ($code > 1114111 or $code < 0 or
- ($code >= 55296 and $code <= 57343) ) {
- // bits are set outside the "valid" range as defined
- // by UNICODE 4.1.0
- return '';
- }
-
- $x = $y = $z = $w = 0;
- if ($code < 128) {
- // regular ASCII character
- $x = $code;
- } else {
- // set up bits for UTF-8
- $x = ($code & 63) | 128;
- if ($code < 2048) {
- $y = (($code & 2047) >> 6) | 192;
- } else {
- $y = (($code & 4032) >> 6) | 128;
- if ($code < 65536) {
- $z = (($code >> 12) & 15) | 224;
- } else {
- $z = (($code >> 12) & 63) | 128;
- $w = (($code >> 18) & 7) | 240;
- }
- }
- }
- // set up the actual character
- $ret = '';
- if ($w) {
- $ret .= chr($w);
- }
- if ($z) {
- $ret .= chr($z);
- }
- if ($y) {
- $ret .= chr($y);
- }
- $ret .= chr($x);
-
- return $ret;
- }
-
- /**
- * @return bool
- */
- public static function iconvAvailable()
- {
- static $iconv = null;
- if ($iconv === null) {
- $iconv = function_exists('iconv') && self::testIconvTruncateBug() != self::ICONV_UNUSABLE;
- }
- return $iconv;
- }
-
- /**
- * Convert a string to UTF-8 based on configuration.
- * @param string $str The string to convert
- * @param HTMLPurifier_Config $config
- * @param HTMLPurifier_Context $context
- * @return string
- */
- public static function convertToUTF8($str, $config, $context)
- {
- $encoding = $config->get('Core.Encoding');
- if ($encoding === 'utf-8') {
- return $str;
- }
- static $iconv = null;
- if ($iconv === null) {
- $iconv = self::iconvAvailable();
- }
- if ($iconv && !$config->get('Test.ForceNoIconv')) {
- // unaffected by bugs, since UTF-8 support all characters
- $str = self::unsafeIconv($encoding, 'utf-8//IGNORE', $str);
- if ($str === false) {
- // $encoding is not a valid encoding
- trigger_error('Invalid encoding ' . $encoding, E_USER_ERROR);
- return '';
- }
- // If the string is bjorked by Shift_JIS or a similar encoding
- // that doesn't support all of ASCII, convert the naughty
- // characters to their true byte-wise ASCII/UTF-8 equivalents.
- $str = strtr($str, self::testEncodingSupportsASCII($encoding));
- return $str;
- } elseif ($encoding === 'iso-8859-1') {
- $str = utf8_encode($str);
- return $str;
- }
- $bug = HTMLPurifier_Encoder::testIconvTruncateBug();
- if ($bug == self::ICONV_OK) {
- trigger_error('Encoding not supported, please install iconv', E_USER_ERROR);
- } else {
- trigger_error(
- 'You have a buggy version of iconv, see https://bugs.php.net/bug.php?id=48147 ' .
- 'and http://sourceware.org/bugzilla/show_bug.cgi?id=13541',
- E_USER_ERROR
- );
- }
- }
-
- /**
- * Converts a string from UTF-8 based on configuration.
- * @param string $str The string to convert
- * @param HTMLPurifier_Config $config
- * @param HTMLPurifier_Context $context
- * @return string
- * @note Currently, this is a lossy conversion, with unexpressable
- * characters being omitted.
- */
- public static function convertFromUTF8($str, $config, $context)
- {
- $encoding = $config->get('Core.Encoding');
- if ($escape = $config->get('Core.EscapeNonASCIICharacters')) {
- $str = self::convertToASCIIDumbLossless($str);
- }
- if ($encoding === 'utf-8') {
- return $str;
- }
- static $iconv = null;
- if ($iconv === null) {
- $iconv = self::iconvAvailable();
- }
- if ($iconv && !$config->get('Test.ForceNoIconv')) {
- // Undo our previous fix in convertToUTF8, otherwise iconv will barf
- $ascii_fix = self::testEncodingSupportsASCII($encoding);
- if (!$escape && !empty($ascii_fix)) {
- $clear_fix = array();
- foreach ($ascii_fix as $utf8 => $native) {
- $clear_fix[$utf8] = '';
- }
- $str = strtr($str, $clear_fix);
- }
- $str = strtr($str, array_flip($ascii_fix));
- // Normal stuff
- $str = self::iconv('utf-8', $encoding . '//IGNORE', $str);
- return $str;
- } elseif ($encoding === 'iso-8859-1') {
- $str = utf8_decode($str);
- return $str;
- }
- trigger_error('Encoding not supported', E_USER_ERROR);
- // You might be tempted to assume that the ASCII representation
- // might be OK, however, this is *not* universally true over all
- // encodings. So we take the conservative route here, rather
- // than forcibly turn on %Core.EscapeNonASCIICharacters
- }
-
- /**
- * Lossless (character-wise) conversion of HTML to ASCII
- * @param string $str UTF-8 string to be converted to ASCII
- * @return string ASCII encoded string with non-ASCII character entity-ized
- * @warning Adapted from MediaWiki, claiming fair use: this is a common
- * algorithm. If you disagree with this license fudgery,
- * implement it yourself.
- * @note Uses decimal numeric entities since they are best supported.
- * @note This is a DUMB function: it has no concept of keeping
- * character entities that the projected character encoding
- * can allow. We could possibly implement a smart version
- * but that would require it to also know which Unicode
- * codepoints the charset supported (not an easy task).
- * @note Sort of with cleanUTF8() but it assumes that $str is
- * well-formed UTF-8
- */
- public static function convertToASCIIDumbLossless($str)
- {
- $bytesleft = 0;
- $result = '';
- $working = 0;
- $len = strlen($str);
- for ($i = 0; $i < $len; $i++) {
- $bytevalue = ord($str[$i]);
- if ($bytevalue <= 0x7F) { //0xxx xxxx
- $result .= chr($bytevalue);
- $bytesleft = 0;
- } elseif ($bytevalue <= 0xBF) { //10xx xxxx
- $working = $working << 6;
- $working += ($bytevalue & 0x3F);
- $bytesleft--;
- if ($bytesleft <= 0) {
- $result .= "" . $working . ";";
- }
- } elseif ($bytevalue <= 0xDF) { //110x xxxx
- $working = $bytevalue & 0x1F;
- $bytesleft = 1;
- } elseif ($bytevalue <= 0xEF) { //1110 xxxx
- $working = $bytevalue & 0x0F;
- $bytesleft = 2;
- } else { //1111 0xxx
- $working = $bytevalue & 0x07;
- $bytesleft = 3;
- }
- }
- return $result;
- }
-
- /** No bugs detected in iconv. */
- const ICONV_OK = 0;
-
- /** Iconv truncates output if converting from UTF-8 to another
- * character set with //IGNORE, and a non-encodable character is found */
- const ICONV_TRUNCATES = 1;
-
- /** Iconv does not support //IGNORE, making it unusable for
- * transcoding purposes */
- const ICONV_UNUSABLE = 2;
-
- /**
- * glibc iconv has a known bug where it doesn't handle the magic
- * //IGNORE stanza correctly. In particular, rather than ignore
- * characters, it will return an EILSEQ after consuming some number
- * of characters, and expect you to restart iconv as if it were
- * an E2BIG. Old versions of PHP did not respect the errno, and
- * returned the fragment, so as a result you would see iconv
- * mysteriously truncating output. We can work around this by
- * manually chopping our input into segments of about 8000
- * characters, as long as PHP ignores the error code. If PHP starts
- * paying attention to the error code, iconv becomes unusable.
- *
- * @return int Error code indicating severity of bug.
- */
- public static function testIconvTruncateBug()
- {
- static $code = null;
- if ($code === null) {
- // better not use iconv, otherwise infinite loop!
- $r = self::unsafeIconv('utf-8', 'ascii//IGNORE', "\xCE\xB1" . str_repeat('a', 9000));
- if ($r === false) {
- $code = self::ICONV_UNUSABLE;
- } elseif (($c = strlen($r)) < 9000) {
- $code = self::ICONV_TRUNCATES;
- } elseif ($c > 9000) {
- trigger_error(
- 'Your copy of iconv is extremely buggy. Please notify HTML Purifier maintainers: ' .
- 'include your iconv version as per phpversion()',
- E_USER_ERROR
- );
- } else {
- $code = self::ICONV_OK;
- }
- }
- return $code;
- }
-
- /**
- * This expensive function tests whether or not a given character
- * encoding supports ASCII. 7/8-bit encodings like Shift_JIS will
- * fail this test, and require special processing. Variable width
- * encodings shouldn't ever fail.
- *
- * @param string $encoding Encoding name to test, as per iconv format
- * @param bool $bypass Whether or not to bypass the precompiled arrays.
- * @return Array of UTF-8 characters to their corresponding ASCII,
- * which can be used to "undo" any overzealous iconv action.
- */
- public static function testEncodingSupportsASCII($encoding, $bypass = false)
- {
- // All calls to iconv here are unsafe, proof by case analysis:
- // If ICONV_OK, no difference.
- // If ICONV_TRUNCATE, all calls involve one character inputs,
- // so bug is not triggered.
- // If ICONV_UNUSABLE, this call is irrelevant
- static $encodings = array();
- if (!$bypass) {
- if (isset($encodings[$encoding])) {
- return $encodings[$encoding];
- }
- $lenc = strtolower($encoding);
- switch ($lenc) {
- case 'shift_jis':
- return array("\xC2\xA5" => '\\', "\xE2\x80\xBE" => '~');
- case 'johab':
- return array("\xE2\x82\xA9" => '\\');
- }
- if (strpos($lenc, 'iso-8859-') === 0) {
- return array();
- }
- }
- $ret = array();
- if (self::unsafeIconv('UTF-8', $encoding, 'a') === false) {
- return false;
- }
- for ($i = 0x20; $i <= 0x7E; $i++) { // all printable ASCII chars
- $c = chr($i); // UTF-8 char
- $r = self::unsafeIconv('UTF-8', "$encoding//IGNORE", $c); // initial conversion
- if ($r === '' ||
- // This line is needed for iconv implementations that do not
- // omit characters that do not exist in the target character set
- ($r === $c && self::unsafeIconv($encoding, 'UTF-8//IGNORE', $r) !== $c)
- ) {
- // Reverse engineer: what's the UTF-8 equiv of this byte
- // sequence? This assumes that there's no variable width
- // encoding that doesn't support ASCII.
- $ret[self::unsafeIconv($encoding, 'UTF-8//IGNORE', $c)] = $c;
- }
- }
- $encodings[$encoding] = $ret;
- return $ret;
- }
-}
-
-
-
-
-
-/**
- * Object that provides entity lookup table from entity name to character
- */
-class HTMLPurifier_EntityLookup
-{
- /**
- * Assoc array of entity name to character represented.
- * @type array
- */
- public $table;
-
- /**
- * Sets up the entity lookup table from the serialized file contents.
- * @param bool $file
- * @note The serialized contents are versioned, but were generated
- * using the maintenance script generate_entity_file.php
- * @warning This is not in constructor to help enforce the Singleton
- */
- public function setup($file = false)
- {
- if (!$file) {
- $file = HTMLPURIFIER_PREFIX . '/HTMLPurifier/EntityLookup/entities.ser';
- }
- $this->table = unserialize(file_get_contents($file));
- }
-
- /**
- * Retrieves sole instance of the object.
- * @param bool|HTMLPurifier_EntityLookup $prototype Optional prototype of custom lookup table to overload with.
- * @return HTMLPurifier_EntityLookup
- */
- public static function instance($prototype = false)
- {
- // no references, since PHP doesn't copy unless modified
- static $instance = null;
- if ($prototype) {
- $instance = $prototype;
- } elseif (!$instance) {
- $instance = new HTMLPurifier_EntityLookup();
- $instance->setup();
- }
- return $instance;
- }
-}
-
-
-
-
-
-// if want to implement error collecting here, we'll need to use some sort
-// of global data (probably trigger_error) because it's impossible to pass
-// $config or $context to the callback functions.
-
-/**
- * Handles referencing and derefencing character entities
- */
-class HTMLPurifier_EntityParser
-{
-
- /**
- * Reference to entity lookup table.
- * @type HTMLPurifier_EntityLookup
- */
- protected $_entity_lookup;
-
- /**
- * Callback regex string for entities in text.
- * @type string
- */
- protected $_textEntitiesRegex;
-
- /**
- * Callback regex string for entities in attributes.
- * @type string
- */
- protected $_attrEntitiesRegex;
-
- /**
- * Tests if the beginning of a string is a semi-optional regex
- */
- protected $_semiOptionalPrefixRegex;
-
- public function __construct() {
- // From
- // http://stackoverflow.com/questions/15532252/why-is-reg-being-rendered-as-without-the-bounding-semicolon
- $semi_optional = "quot|QUOT|lt|LT|gt|GT|amp|AMP|AElig|Aacute|Acirc|Agrave|Aring|Atilde|Auml|COPY|Ccedil|ETH|Eacute|Ecirc|Egrave|Euml|Iacute|Icirc|Igrave|Iuml|Ntilde|Oacute|Ocirc|Ograve|Oslash|Otilde|Ouml|REG|THORN|Uacute|Ucirc|Ugrave|Uuml|Yacute|aacute|acirc|acute|aelig|agrave|aring|atilde|auml|brvbar|ccedil|cedil|cent|copy|curren|deg|divide|eacute|ecirc|egrave|eth|euml|frac12|frac14|frac34|iacute|icirc|iexcl|igrave|iquest|iuml|laquo|macr|micro|middot|nbsp|not|ntilde|oacute|ocirc|ograve|ordf|ordm|oslash|otilde|ouml|para|plusmn|pound|raquo|reg|sect|shy|sup1|sup2|sup3|szlig|thorn|times|uacute|ucirc|ugrave|uml|uuml|yacute|yen|yuml";
-
- // NB: three empty captures to put the fourth match in the right
- // place
- $this->_semiOptionalPrefixRegex = "/&()()()($semi_optional)/";
-
- $this->_textEntitiesRegex =
- '/&(?:'.
- // hex
- '[#]x([a-fA-F0-9]+);?|'.
- // dec
- '[#]0*(\d+);?|'.
- // string (mandatory semicolon)
- // NB: order matters: match semicolon preferentially
- '([A-Za-z_:][A-Za-z0-9.\-_:]*);|'.
- // string (optional semicolon)
- "($semi_optional)".
- ')/';
-
- $this->_attrEntitiesRegex =
- '/&(?:'.
- // hex
- '[#]x([a-fA-F0-9]+);?|'.
- // dec
- '[#]0*(\d+);?|'.
- // string (mandatory semicolon)
- // NB: order matters: match semicolon preferentially
- '([A-Za-z_:][A-Za-z0-9.\-_:]*);|'.
- // string (optional semicolon)
- // don't match if trailing is equals or alphanumeric (URL
- // like)
- "($semi_optional)(?![=;A-Za-z0-9])".
- ')/';
-
- }
-
- /**
- * Substitute entities with the parsed equivalents. Use this on
- * textual data in an HTML document (as opposed to attributes.)
- *
- * @param string $string String to have entities parsed.
- * @return string Parsed string.
- */
- public function substituteTextEntities($string)
- {
- return preg_replace_callback(
- $this->_textEntitiesRegex,
- array($this, 'entityCallback'),
- $string
- );
- }
-
- /**
- * Substitute entities with the parsed equivalents. Use this on
- * attribute contents in documents.
- *
- * @param string $string String to have entities parsed.
- * @return string Parsed string.
- */
- public function substituteAttrEntities($string)
- {
- return preg_replace_callback(
- $this->_attrEntitiesRegex,
- array($this, 'entityCallback'),
- $string
- );
- }
-
- /**
- * Callback function for substituteNonSpecialEntities() that does the work.
- *
- * @param array $matches PCRE matches array, with 0 the entire match, and
- * either index 1, 2 or 3 set with a hex value, dec value,
- * or string (respectively).
- * @return string Replacement string.
- */
-
- protected function entityCallback($matches)
- {
- $entity = $matches[0];
- $hex_part = @$matches[1];
- $dec_part = @$matches[2];
- $named_part = empty($matches[3]) ? (empty($matches[4]) ? "" : $matches[4]) : $matches[3];
- if ($hex_part !== NULL && $hex_part !== "") {
- return HTMLPurifier_Encoder::unichr(hexdec($hex_part));
- } elseif ($dec_part !== NULL && $dec_part !== "") {
- return HTMLPurifier_Encoder::unichr((int) $dec_part);
- } else {
- if (!$this->_entity_lookup) {
- $this->_entity_lookup = HTMLPurifier_EntityLookup::instance();
- }
- if (isset($this->_entity_lookup->table[$named_part])) {
- return $this->_entity_lookup->table[$named_part];
- } else {
- // exact match didn't match anything, so test if
- // any of the semicolon optional match the prefix.
- // Test that this is an EXACT match is important to
- // prevent infinite loop
- if (!empty($matches[3])) {
- return preg_replace_callback(
- $this->_semiOptionalPrefixRegex,
- array($this, 'entityCallback'),
- $entity
- );
- }
- return $entity;
- }
- }
- }
-
- // LEGACY CODE BELOW
-
- /**
- * Callback regex string for parsing entities.
- * @type string
- */
- protected $_substituteEntitiesRegex =
- '/&(?:[#]x([a-fA-F0-9]+)|[#]0*(\d+)|([A-Za-z_:][A-Za-z0-9.\-_:]*));?/';
- // 1. hex 2. dec 3. string (XML style)
-
- /**
- * Decimal to parsed string conversion table for special entities.
- * @type array
- */
- protected $_special_dec2str =
- array(
- 34 => '"',
- 38 => '&',
- 39 => "'",
- 60 => '<',
- 62 => '>'
- );
-
- /**
- * Stripped entity names to decimal conversion table for special entities.
- * @type array
- */
- protected $_special_ent2dec =
- array(
- 'quot' => 34,
- 'amp' => 38,
- 'lt' => 60,
- 'gt' => 62
- );
-
- /**
- * Substitutes non-special entities with their parsed equivalents. Since
- * running this whenever you have parsed character is t3h 5uck, we run
- * it before everything else.
- *
- * @param string $string String to have non-special entities parsed.
- * @return string Parsed string.
- */
- public function substituteNonSpecialEntities($string)
- {
- // it will try to detect missing semicolons, but don't rely on it
- return preg_replace_callback(
- $this->_substituteEntitiesRegex,
- array($this, 'nonSpecialEntityCallback'),
- $string
- );
- }
-
- /**
- * Callback function for substituteNonSpecialEntities() that does the work.
- *
- * @param array $matches PCRE matches array, with 0 the entire match, and
- * either index 1, 2 or 3 set with a hex value, dec value,
- * or string (respectively).
- * @return string Replacement string.
- */
-
- protected function nonSpecialEntityCallback($matches)
- {
- // replaces all but big five
- $entity = $matches[0];
- $is_num = (@$matches[0][1] === '#');
- if ($is_num) {
- $is_hex = (@$entity[2] === 'x');
- $code = $is_hex ? hexdec($matches[1]) : (int) $matches[2];
- // abort for special characters
- if (isset($this->_special_dec2str[$code])) {
- return $entity;
- }
- return HTMLPurifier_Encoder::unichr($code);
- } else {
- if (isset($this->_special_ent2dec[$matches[3]])) {
- return $entity;
- }
- if (!$this->_entity_lookup) {
- $this->_entity_lookup = HTMLPurifier_EntityLookup::instance();
- }
- if (isset($this->_entity_lookup->table[$matches[3]])) {
- return $this->_entity_lookup->table[$matches[3]];
- } else {
- return $entity;
- }
- }
- }
-
- /**
- * Substitutes only special entities with their parsed equivalents.
- *
- * @notice We try to avoid calling this function because otherwise, it
- * would have to be called a lot (for every parsed section).
- *
- * @param string $string String to have non-special entities parsed.
- * @return string Parsed string.
- */
- public function substituteSpecialEntities($string)
- {
- return preg_replace_callback(
- $this->_substituteEntitiesRegex,
- array($this, 'specialEntityCallback'),
- $string
- );
- }
-
- /**
- * Callback function for substituteSpecialEntities() that does the work.
- *
- * This callback has same syntax as nonSpecialEntityCallback().
- *
- * @param array $matches PCRE-style matches array, with 0 the entire match, and
- * either index 1, 2 or 3 set with a hex value, dec value,
- * or string (respectively).
- * @return string Replacement string.
- */
- protected function specialEntityCallback($matches)
- {
- $entity = $matches[0];
- $is_num = (@$matches[0][1] === '#');
- if ($is_num) {
- $is_hex = (@$entity[2] === 'x');
- $int = $is_hex ? hexdec($matches[1]) : (int) $matches[2];
- return isset($this->_special_dec2str[$int]) ?
- $this->_special_dec2str[$int] :
- $entity;
- } else {
- return isset($this->_special_ent2dec[$matches[3]]) ?
- $this->_special_dec2str[$this->_special_ent2dec[$matches[3]]] :
- $entity;
- }
- }
-}
-
-
-
-
-
-/**
- * Error collection class that enables HTML Purifier to report HTML
- * problems back to the user
- */
-class HTMLPurifier_ErrorCollector
-{
-
- /**
- * Identifiers for the returned error array. These are purposely numeric
- * so list() can be used.
- */
- const LINENO = 0;
- const SEVERITY = 1;
- const MESSAGE = 2;
- const CHILDREN = 3;
-
- /**
- * @type array
- */
- protected $errors;
-
- /**
- * @type array
- */
- protected $_current;
-
- /**
- * @type array
- */
- protected $_stacks = array(array());
-
- /**
- * @type HTMLPurifier_Language
- */
- protected $locale;
-
- /**
- * @type HTMLPurifier_Generator
- */
- protected $generator;
-
- /**
- * @type HTMLPurifier_Context
- */
- protected $context;
-
- /**
- * @type array
- */
- protected $lines = array();
-
- /**
- * @param HTMLPurifier_Context $context
- */
- public function __construct($context)
- {
- $this->locale =& $context->get('Locale');
- $this->context = $context;
- $this->_current =& $this->_stacks[0];
- $this->errors =& $this->_stacks[0];
- }
-
- /**
- * Sends an error message to the collector for later use
- * @param int $severity Error severity, PHP error style (don't use E_USER_)
- * @param string $msg Error message text
- */
- public function send($severity, $msg)
- {
- $args = array();
- if (func_num_args() > 2) {
- $args = func_get_args();
- array_shift($args);
- unset($args[0]);
- }
-
- $token = $this->context->get('CurrentToken', true);
- $line = $token ? $token->line : $this->context->get('CurrentLine', true);
- $col = $token ? $token->col : $this->context->get('CurrentCol', true);
- $attr = $this->context->get('CurrentAttr', true);
-
- // perform special substitutions, also add custom parameters
- $subst = array();
- if (!is_null($token)) {
- $args['CurrentToken'] = $token;
- }
- if (!is_null($attr)) {
- $subst['$CurrentAttr.Name'] = $attr;
- if (isset($token->attr[$attr])) {
- $subst['$CurrentAttr.Value'] = $token->attr[$attr];
- }
- }
-
- if (empty($args)) {
- $msg = $this->locale->getMessage($msg);
- } else {
- $msg = $this->locale->formatMessage($msg, $args);
- }
-
- if (!empty($subst)) {
- $msg = strtr($msg, $subst);
- }
-
- // (numerically indexed)
- $error = array(
- self::LINENO => $line,
- self::SEVERITY => $severity,
- self::MESSAGE => $msg,
- self::CHILDREN => array()
- );
- $this->_current[] = $error;
-
- // NEW CODE BELOW ...
- // Top-level errors are either:
- // TOKEN type, if $value is set appropriately, or
- // "syntax" type, if $value is null
- $new_struct = new HTMLPurifier_ErrorStruct();
- $new_struct->type = HTMLPurifier_ErrorStruct::TOKEN;
- if ($token) {
- $new_struct->value = clone $token;
- }
- if (is_int($line) && is_int($col)) {
- if (isset($this->lines[$line][$col])) {
- $struct = $this->lines[$line][$col];
- } else {
- $struct = $this->lines[$line][$col] = $new_struct;
- }
- // These ksorts may present a performance problem
- ksort($this->lines[$line], SORT_NUMERIC);
- } else {
- if (isset($this->lines[-1])) {
- $struct = $this->lines[-1];
- } else {
- $struct = $this->lines[-1] = $new_struct;
- }
- }
- ksort($this->lines, SORT_NUMERIC);
-
- // Now, check if we need to operate on a lower structure
- if (!empty($attr)) {
- $struct = $struct->getChild(HTMLPurifier_ErrorStruct::ATTR, $attr);
- if (!$struct->value) {
- $struct->value = array($attr, 'PUT VALUE HERE');
- }
- }
- if (!empty($cssprop)) {
- $struct = $struct->getChild(HTMLPurifier_ErrorStruct::CSSPROP, $cssprop);
- if (!$struct->value) {
- // if we tokenize CSS this might be a little more difficult to do
- $struct->value = array($cssprop, 'PUT VALUE HERE');
- }
- }
-
- // Ok, structs are all setup, now time to register the error
- $struct->addError($severity, $msg);
- }
-
- /**
- * Retrieves raw error data for custom formatter to use
- */
- public function getRaw()
- {
- return $this->errors;
- }
-
- /**
- * Default HTML formatting implementation for error messages
- * @param HTMLPurifier_Config $config Configuration, vital for HTML output nature
- * @param array $errors Errors array to display; used for recursion.
- * @return string
- */
- public function getHTMLFormatted($config, $errors = null)
- {
- $ret = array();
-
- $this->generator = new HTMLPurifier_Generator($config, $this->context);
- if ($errors === null) {
- $errors = $this->errors;
- }
-
- // 'At line' message needs to be removed
-
- // generation code for new structure goes here. It needs to be recursive.
- foreach ($this->lines as $line => $col_array) {
- if ($line == -1) {
- continue;
- }
- foreach ($col_array as $col => $struct) {
- $this->_renderStruct($ret, $struct, $line, $col);
- }
- }
- if (isset($this->lines[-1])) {
- $this->_renderStruct($ret, $this->lines[-1]);
- }
-
- if (empty($errors)) {
- return '
' . $this->locale->getMessage('ErrorCollector: No errors') . '
';
- // W3C uses an icon to indicate the severity of the error.
- $error = $this->locale->getErrorName($severity);
- $string .= "$error ";
- if (!is_null($line) && !is_null($col)) {
- $string .= "Line $line, Column $col: ";
- } else {
- $string .= 'End of Document: ';
- }
- $string .= '' . $this->generator->escape($msg) . ' ';
- $string .= '
';
- // Here, have a marker for the character on the column appropriate.
- // Be sure to clip extremely long lines.
- //$string .= '
';
- //$string .= '';
- //$string .= '
';
- $ret[] = $string;
- }
- foreach ($current->children as $array) {
- $context[] = $current;
- $stack = array_merge($stack, array_reverse($array, true));
- for ($i = count($array); $i > 0; $i--) {
- $context_stack[] = $context;
- }
- }
- }
- }
-}
-
-
-
-
-
-/**
- * Records errors for particular segments of an HTML document such as tokens,
- * attributes or CSS properties. They can contain error structs (which apply
- * to components of what they represent), but their main purpose is to hold
- * errors applying to whatever struct is being used.
- */
-class HTMLPurifier_ErrorStruct
-{
-
- /**
- * Possible values for $children first-key. Note that top-level structures
- * are automatically token-level.
- */
- const TOKEN = 0;
- const ATTR = 1;
- const CSSPROP = 2;
-
- /**
- * Type of this struct.
- * @type string
- */
- public $type;
-
- /**
- * Value of the struct we are recording errors for. There are various
- * values for this:
- * - TOKEN: Instance of HTMLPurifier_Token
- * - ATTR: array('attr-name', 'value')
- * - CSSPROP: array('prop-name', 'value')
- * @type mixed
- */
- public $value;
-
- /**
- * Errors registered for this structure.
- * @type array
- */
- public $errors = array();
-
- /**
- * Child ErrorStructs that are from this structure. For example, a TOKEN
- * ErrorStruct would contain ATTR ErrorStructs. This is a multi-dimensional
- * array in structure: [TYPE]['identifier']
- * @type array
- */
- public $children = array();
-
- /**
- * @param string $type
- * @param string $id
- * @return mixed
- */
- public function getChild($type, $id)
- {
- if (!isset($this->children[$type][$id])) {
- $this->children[$type][$id] = new HTMLPurifier_ErrorStruct();
- $this->children[$type][$id]->type = $type;
- }
- return $this->children[$type][$id];
- }
-
- /**
- * @param int $severity
- * @param string $message
- */
- public function addError($severity, $message)
- {
- $this->errors[] = array($severity, $message);
- }
-}
-
-
-
-
-
-/**
- * Global exception class for HTML Purifier; any exceptions we throw
- * are from here.
- */
-class HTMLPurifier_Exception extends Exception
-{
-
-}
-
-
-
-
-
-/**
- * Represents a pre or post processing filter on HTML Purifier's output
- *
- * Sometimes, a little ad-hoc fixing of HTML has to be done before
- * it gets sent through HTML Purifier: you can use filters to acheive
- * this effect. For instance, YouTube videos can be preserved using
- * this manner. You could have used a decorator for this task, but
- * PHP's support for them is not terribly robust, so we're going
- * to just loop through the filters.
- *
- * Filters should be exited first in, last out. If there are three filters,
- * named 1, 2 and 3, the order of execution should go 1->preFilter,
- * 2->preFilter, 3->preFilter, purify, 3->postFilter, 2->postFilter,
- * 1->postFilter.
- *
- * @note Methods are not declared abstract as it is perfectly legitimate
- * for an implementation not to want anything to happen on a step
- */
-
-class HTMLPurifier_Filter
-{
-
- /**
- * Name of the filter for identification purposes.
- * @type string
- */
- public $name;
-
- /**
- * Pre-processor function, handles HTML before HTML Purifier
- * @param string $html
- * @param HTMLPurifier_Config $config
- * @param HTMLPurifier_Context $context
- * @return string
- */
- public function preFilter($html, $config, $context)
- {
- return $html;
- }
-
- /**
- * Post-processor function, handles HTML after HTML Purifier
- * @param string $html
- * @param HTMLPurifier_Config $config
- * @param HTMLPurifier_Context $context
- * @return string
- */
- public function postFilter($html, $config, $context)
- {
- return $html;
- }
-}
-
-
-
-
-
-/**
- * Generates HTML from tokens.
- * @todo Refactor interface so that configuration/context is determined
- * upon instantiation, no need for messy generateFromTokens() calls
- * @todo Make some of the more internal functions protected, and have
- * unit tests work around that
- */
-class HTMLPurifier_Generator
-{
-
- /**
- * Whether or not generator should produce XML output.
- * @type bool
- */
- private $_xhtml = true;
-
- /**
- * :HACK: Whether or not generator should comment the insides of #i', '', $html);
- }
-
- return $html;
- }
-
- /**
- * Takes a string of HTML (fragment or document) and returns the content
- * @todo Consider making protected
- */
- public function extractBody($html)
- {
- $matches = array();
- $result = preg_match('|(.*?)]*>(.*)|is', $html, $matches);
- if ($result) {
- // Make sure it's not in a comment
- $comment_start = strrpos($matches[1], '');
- if ($comment_start === false ||
- ($comment_end !== false && $comment_end > $comment_start)) {
- return $matches[2];
- }
- }
- return $html;
- }
-}
-
-
-
-
-
-/**
- * Abstract base node class that all others inherit from.
- *
- * Why do we not use the DOM extension? (1) It is not always available,
- * (2) it has funny constraints on the data it can represent,
- * whereas we want a maximally flexible representation, and (3) its
- * interface is a bit cumbersome.
- */
-abstract class HTMLPurifier_Node
-{
- /**
- * Line number of the start token in the source document
- * @type int
- */
- public $line;
-
- /**
- * Column number of the start token in the source document. Null if unknown.
- * @type int
- */
- public $col;
-
- /**
- * Lookup array of processing that this token is exempt from.
- * Currently, valid values are "ValidateAttributes".
- * @type array
- */
- public $armor = array();
-
- /**
- * When true, this node should be ignored as non-existent.
- *
- * Who is responsible for ignoring dead nodes? FixNesting is
- * responsible for removing them before passing on to child
- * validators.
- */
- public $dead = false;
-
- /**
- * Returns a pair of start and end tokens, where the end token
- * is null if it is not necessary. Does not include children.
- * @type array
- */
- abstract public function toTokenPair();
-}
-
-
-
-
-
-/**
- * Class that handles operations involving percent-encoding in URIs.
- *
- * @warning
- * Be careful when reusing instances of PercentEncoder. The object
- * you use for normalize() SHOULD NOT be used for encode(), or
- * vice-versa.
- */
-class HTMLPurifier_PercentEncoder
-{
-
- /**
- * Reserved characters to preserve when using encode().
- * @type array
- */
- protected $preserve = array();
-
- /**
- * String of characters that should be preserved while using encode().
- * @param bool $preserve
- */
- public function __construct($preserve = false)
- {
- // unreserved letters, ought to const-ify
- for ($i = 48; $i <= 57; $i++) { // digits
- $this->preserve[$i] = true;
- }
- for ($i = 65; $i <= 90; $i++) { // upper-case
- $this->preserve[$i] = true;
- }
- for ($i = 97; $i <= 122; $i++) { // lower-case
- $this->preserve[$i] = true;
- }
- $this->preserve[45] = true; // Dash -
- $this->preserve[46] = true; // Period .
- $this->preserve[95] = true; // Underscore _
- $this->preserve[126]= true; // Tilde ~
-
- // extra letters not to escape
- if ($preserve !== false) {
- for ($i = 0, $c = strlen($preserve); $i < $c; $i++) {
- $this->preserve[ord($preserve[$i])] = true;
- }
- }
- }
-
- /**
- * Our replacement for urlencode, it encodes all non-reserved characters,
- * as well as any extra characters that were instructed to be preserved.
- * @note
- * Assumes that the string has already been normalized, making any
- * and all percent escape sequences valid. Percents will not be
- * re-escaped, regardless of their status in $preserve
- * @param string $string String to be encoded
- * @return string Encoded string.
- */
- public function encode($string)
- {
- $ret = '';
- for ($i = 0, $c = strlen($string); $i < $c; $i++) {
- if ($string[$i] !== '%' && !isset($this->preserve[$int = ord($string[$i])])) {
- $ret .= '%' . sprintf('%02X', $int);
- } else {
- $ret .= $string[$i];
- }
- }
- return $ret;
- }
-
- /**
- * Fix up percent-encoding by decoding unreserved characters and normalizing.
- * @warning This function is affected by $preserve, even though the
- * usual desired behavior is for this not to preserve those
- * characters. Be careful when reusing instances of PercentEncoder!
- * @param string $string String to normalize
- * @return string
- */
- public function normalize($string)
- {
- if ($string == '') {
- return '';
- }
- $parts = explode('%', $string);
- $ret = array_shift($parts);
- foreach ($parts as $part) {
- $length = strlen($part);
- if ($length < 2) {
- $ret .= '%25' . $part;
- continue;
- }
- $encoding = substr($part, 0, 2);
- $text = substr($part, 2);
- if (!ctype_xdigit($encoding)) {
- $ret .= '%25' . $part;
- continue;
- }
- $int = hexdec($encoding);
- if (isset($this->preserve[$int])) {
- $ret .= chr($int) . $text;
- continue;
- }
- $encoding = strtoupper($encoding);
- $ret .= '%' . $encoding . $text;
- }
- return $ret;
- }
-}
-
-
-
-
-
-/**
- * Generic property list implementation
- */
-class HTMLPurifier_PropertyList
-{
- /**
- * Internal data-structure for properties.
- * @type array
- */
- protected $data = array();
-
- /**
- * Parent plist.
- * @type HTMLPurifier_PropertyList
- */
- protected $parent;
-
- /**
- * Cache.
- * @type array
- */
- protected $cache;
-
- /**
- * @param HTMLPurifier_PropertyList $parent Parent plist
- */
- public function __construct($parent = null)
- {
- $this->parent = $parent;
- }
-
- /**
- * Recursively retrieves the value for a key
- * @param string $name
- * @throws HTMLPurifier_Exception
- */
- public function get($name)
- {
- if ($this->has($name)) {
- return $this->data[$name];
- }
- // possible performance bottleneck, convert to iterative if necessary
- if ($this->parent) {
- return $this->parent->get($name);
- }
- throw new HTMLPurifier_Exception("Key '$name' not found");
- }
-
- /**
- * Sets the value of a key, for this plist
- * @param string $name
- * @param mixed $value
- */
- public function set($name, $value)
- {
- $this->data[$name] = $value;
- }
-
- /**
- * Returns true if a given key exists
- * @param string $name
- * @return bool
- */
- public function has($name)
- {
- return array_key_exists($name, $this->data);
- }
-
- /**
- * Resets a value to the value of it's parent, usually the default. If
- * no value is specified, the entire plist is reset.
- * @param string $name
- */
- public function reset($name = null)
- {
- if ($name == null) {
- $this->data = array();
- } else {
- unset($this->data[$name]);
- }
- }
-
- /**
- * Squashes this property list and all of its property lists into a single
- * array, and returns the array. This value is cached by default.
- * @param bool $force If true, ignores the cache and regenerates the array.
- * @return array
- */
- public function squash($force = false)
- {
- if ($this->cache !== null && !$force) {
- return $this->cache;
- }
- if ($this->parent) {
- return $this->cache = array_merge($this->parent->squash($force), $this->data);
- } else {
- return $this->cache = $this->data;
- }
- }
-
- /**
- * Returns the parent plist.
- * @return HTMLPurifier_PropertyList
- */
- public function getParent()
- {
- return $this->parent;
- }
-
- /**
- * Sets the parent plist.
- * @param HTMLPurifier_PropertyList $plist Parent plist
- */
- public function setParent($plist)
- {
- $this->parent = $plist;
- }
-}
-
-
-
-
-
-/**
- * Property list iterator. Do not instantiate this class directly.
- */
-class HTMLPurifier_PropertyListIterator extends FilterIterator
-{
-
- /**
- * @type int
- */
- protected $l;
- /**
- * @type string
- */
- protected $filter;
-
- /**
- * @param Iterator $iterator Array of data to iterate over
- * @param string $filter Optional prefix to only allow values of
- */
- public function __construct(Iterator $iterator, $filter = null)
- {
- parent::__construct($iterator);
- $this->l = strlen($filter);
- $this->filter = $filter;
- }
-
- /**
- * @return bool
- */
- public function accept()
- {
- $key = $this->getInnerIterator()->key();
- if (strncmp($key, $this->filter, $this->l) !== 0) {
- return false;
- }
- return true;
- }
-}
-
-
-
-
-
-/**
- * A simple array-backed queue, based off of the classic Okasaki
- * persistent amortized queue. The basic idea is to maintain two
- * stacks: an input stack and an output stack. When the output
- * stack runs out, reverse the input stack and use it as the output
- * stack.
- *
- * We don't use the SPL implementation because it's only supported
- * on PHP 5.3 and later.
- *
- * Exercise: Prove that push/pop on this queue take amortized O(1) time.
- *
- * Exercise: Extend this queue to be a deque, while preserving amortized
- * O(1) time. Some care must be taken on rebalancing to avoid quadratic
- * behaviour caused by repeatedly shuffling data from the input stack
- * to the output stack and back.
- */
-class HTMLPurifier_Queue {
- private $input;
- private $output;
-
- public function __construct($input = array()) {
- $this->input = $input;
- $this->output = array();
- }
-
- /**
- * Shifts an element off the front of the queue.
- */
- public function shift() {
- if (empty($this->output)) {
- $this->output = array_reverse($this->input);
- $this->input = array();
- }
- if (empty($this->output)) {
- return NULL;
- }
- return array_pop($this->output);
- }
-
- /**
- * Pushes an element onto the front of the queue.
- */
- public function push($x) {
- array_push($this->input, $x);
- }
-
- /**
- * Checks if it's empty.
- */
- public function isEmpty() {
- return empty($this->input) && empty($this->output);
- }
-}
-
-
-
-/**
- * Supertype for classes that define a strategy for modifying/purifying tokens.
- *
- * While HTMLPurifier's core purpose is fixing HTML into something proper,
- * strategies provide plug points for extra configuration or even extra
- * features, such as custom tags, custom parsing of text, etc.
- */
-
-
-abstract class HTMLPurifier_Strategy
-{
-
- /**
- * Executes the strategy on the tokens.
- *
- * @param HTMLPurifier_Token[] $tokens Array of HTMLPurifier_Token objects to be operated on.
- * @param HTMLPurifier_Config $config
- * @param HTMLPurifier_Context $context
- * @return HTMLPurifier_Token[] Processed array of token objects.
- */
- abstract public function execute($tokens, $config, $context);
-}
-
-
-
-
-
-/**
- * This is in almost every respect equivalent to an array except
- * that it keeps track of which keys were accessed.
- *
- * @warning For the sake of backwards compatibility with early versions
- * of PHP 5, you must not use the $hash[$key] syntax; if you do
- * our version of offsetGet is never called.
- */
-class HTMLPurifier_StringHash extends ArrayObject
-{
- /**
- * @type array
- */
- protected $accessed = array();
-
- /**
- * Retrieves a value, and logs the access.
- * @param mixed $index
- * @return mixed
- */
- public function offsetGet($index)
- {
- $this->accessed[$index] = true;
- return parent::offsetGet($index);
- }
-
- /**
- * Returns a lookup array of all array indexes that have been accessed.
- * @return array in form array($index => true).
- */
- public function getAccessed()
- {
- return $this->accessed;
- }
-
- /**
- * Resets the access array.
- */
- public function resetAccessed()
- {
- $this->accessed = array();
- }
-}
-
-
-
-
-
-/**
- * Parses string hash files. File format is as such:
- *
- * DefaultKeyValue
- * KEY: Value
- * KEY2: Value2
- * --MULTILINE-KEY--
- * Multiline
- * value.
- *
- * Which would output something similar to:
- *
- * array(
- * 'ID' => 'DefaultKeyValue',
- * 'KEY' => 'Value',
- * 'KEY2' => 'Value2',
- * 'MULTILINE-KEY' => "Multiline\nvalue.\n",
- * )
- *
- * We use this as an easy to use file-format for configuration schema
- * files, but the class itself is usage agnostic.
- *
- * You can use ---- to forcibly terminate parsing of a single string-hash;
- * this marker is used in multi string-hashes to delimit boundaries.
- */
-class HTMLPurifier_StringHashParser
-{
-
- /**
- * @type string
- */
- public $default = 'ID';
-
- /**
- * Parses a file that contains a single string-hash.
- * @param string $file
- * @return array
- */
- public function parseFile($file)
- {
- if (!file_exists($file)) {
- return false;
- }
- $fh = fopen($file, 'r');
- if (!$fh) {
- return false;
- }
- $ret = $this->parseHandle($fh);
- fclose($fh);
- return $ret;
- }
-
- /**
- * Parses a file that contains multiple string-hashes delimited by '----'
- * @param string $file
- * @return array
- */
- public function parseMultiFile($file)
- {
- if (!file_exists($file)) {
- return false;
- }
- $ret = array();
- $fh = fopen($file, 'r');
- if (!$fh) {
- return false;
- }
- while (!feof($fh)) {
- $ret[] = $this->parseHandle($fh);
- }
- fclose($fh);
- return $ret;
- }
-
- /**
- * Internal parser that acepts a file handle.
- * @note While it's possible to simulate in-memory parsing by using
- * custom stream wrappers, if such a use-case arises we should
- * factor out the file handle into its own class.
- * @param resource $fh File handle with pointer at start of valid string-hash
- * block.
- * @return array
- */
- protected function parseHandle($fh)
- {
- $state = false;
- $single = false;
- $ret = array();
- do {
- $line = fgets($fh);
- if ($line === false) {
- break;
- }
- $line = rtrim($line, "\n\r");
- if (!$state && $line === '') {
- continue;
- }
- if ($line === '----') {
- break;
- }
- if (strncmp('--#', $line, 3) === 0) {
- // Comment
- continue;
- } elseif (strncmp('--', $line, 2) === 0) {
- // Multiline declaration
- $state = trim($line, '- ');
- if (!isset($ret[$state])) {
- $ret[$state] = '';
- }
- continue;
- } elseif (!$state) {
- $single = true;
- if (strpos($line, ':') !== false) {
- // Single-line declaration
- list($state, $line) = explode(':', $line, 2);
- $line = trim($line);
- } else {
- // Use default declaration
- $state = $this->default;
- }
- }
- if ($single) {
- $ret[$state] = $line;
- $single = false;
- $state = false;
- } else {
- $ret[$state] .= "$line\n";
- }
- } while (!feof($fh));
- return $ret;
- }
-}
-
-
-
-
-
-/**
- * Defines a mutation of an obsolete tag into a valid tag.
- */
-abstract class HTMLPurifier_TagTransform
-{
-
- /**
- * Tag name to transform the tag to.
- * @type string
- */
- public $transform_to;
-
- /**
- * Transforms the obsolete tag into the valid tag.
- * @param HTMLPurifier_Token_Tag $tag Tag to be transformed.
- * @param HTMLPurifier_Config $config Mandatory HTMLPurifier_Config object
- * @param HTMLPurifier_Context $context Mandatory HTMLPurifier_Context object
- */
- abstract public function transform($tag, $config, $context);
-
- /**
- * Prepends CSS properties to the style attribute, creating the
- * attribute if it doesn't exist.
- * @warning Copied over from AttrTransform, be sure to keep in sync
- * @param array $attr Attribute array to process (passed by reference)
- * @param string $css CSS to prepend
- */
- protected function prependCSS(&$attr, $css)
- {
- $attr['style'] = isset($attr['style']) ? $attr['style'] : '';
- $attr['style'] = $css . $attr['style'];
- }
-}
-
-
-
-
-
-/**
- * Abstract base token class that all others inherit from.
- */
-abstract class HTMLPurifier_Token
-{
- /**
- * Line number node was on in source document. Null if unknown.
- * @type int
- */
- public $line;
-
- /**
- * Column of line node was on in source document. Null if unknown.
- * @type int
- */
- public $col;
-
- /**
- * Lookup array of processing that this token is exempt from.
- * Currently, valid values are "ValidateAttributes" and
- * "MakeWellFormed_TagClosedError"
- * @type array
- */
- public $armor = array();
-
- /**
- * Used during MakeWellFormed. See Note [Injector skips]
- * @type
- */
- public $skip;
-
- /**
- * @type
- */
- public $rewind;
-
- /**
- * @type
- */
- public $carryover;
-
- /**
- * @param string $n
- * @return null|string
- */
- public function __get($n)
- {
- if ($n === 'type') {
- trigger_error('Deprecated type property called; use instanceof', E_USER_NOTICE);
- switch (get_class($this)) {
- case 'HTMLPurifier_Token_Start':
- return 'start';
- case 'HTMLPurifier_Token_Empty':
- return 'empty';
- case 'HTMLPurifier_Token_End':
- return 'end';
- case 'HTMLPurifier_Token_Text':
- return 'text';
- case 'HTMLPurifier_Token_Comment':
- return 'comment';
- default:
- return null;
- }
- }
- }
-
- /**
- * Sets the position of the token in the source document.
- * @param int $l
- * @param int $c
- */
- public function position($l = null, $c = null)
- {
- $this->line = $l;
- $this->col = $c;
- }
-
- /**
- * Convenience function for DirectLex settings line/col position.
- * @param int $l
- * @param int $c
- */
- public function rawPosition($l, $c)
- {
- if ($c === -1) {
- $l++;
- }
- $this->line = $l;
- $this->col = $c;
- }
-
- /**
- * Converts a token into its corresponding node.
- */
- abstract public function toNode();
-}
-
-
-
-
-
-/**
- * Factory for token generation.
- *
- * @note Doing some benchmarking indicates that the new operator is much
- * slower than the clone operator (even discounting the cost of the
- * constructor). This class is for that optimization.
- * Other then that, there's not much point as we don't
- * maintain parallel HTMLPurifier_Token hierarchies (the main reason why
- * you'd want to use an abstract factory).
- * @todo Port DirectLex to use this
- */
-class HTMLPurifier_TokenFactory
-{
- // p stands for prototype
-
- /**
- * @type HTMLPurifier_Token_Start
- */
- private $p_start;
-
- /**
- * @type HTMLPurifier_Token_End
- */
- private $p_end;
-
- /**
- * @type HTMLPurifier_Token_Empty
- */
- private $p_empty;
-
- /**
- * @type HTMLPurifier_Token_Text
- */
- private $p_text;
-
- /**
- * @type HTMLPurifier_Token_Comment
- */
- private $p_comment;
-
- /**
- * Generates blank prototypes for cloning.
- */
- public function __construct()
- {
- $this->p_start = new HTMLPurifier_Token_Start('', array());
- $this->p_end = new HTMLPurifier_Token_End('');
- $this->p_empty = new HTMLPurifier_Token_Empty('', array());
- $this->p_text = new HTMLPurifier_Token_Text('');
- $this->p_comment = new HTMLPurifier_Token_Comment('');
- }
-
- /**
- * Creates a HTMLPurifier_Token_Start.
- * @param string $name Tag name
- * @param array $attr Associative array of attributes
- * @return HTMLPurifier_Token_Start Generated HTMLPurifier_Token_Start
- */
- public function createStart($name, $attr = array())
- {
- $p = clone $this->p_start;
- $p->__construct($name, $attr);
- return $p;
- }
-
- /**
- * Creates a HTMLPurifier_Token_End.
- * @param string $name Tag name
- * @return HTMLPurifier_Token_End Generated HTMLPurifier_Token_End
- */
- public function createEnd($name)
- {
- $p = clone $this->p_end;
- $p->__construct($name);
- return $p;
- }
-
- /**
- * Creates a HTMLPurifier_Token_Empty.
- * @param string $name Tag name
- * @param array $attr Associative array of attributes
- * @return HTMLPurifier_Token_Empty Generated HTMLPurifier_Token_Empty
- */
- public function createEmpty($name, $attr = array())
- {
- $p = clone $this->p_empty;
- $p->__construct($name, $attr);
- return $p;
- }
-
- /**
- * Creates a HTMLPurifier_Token_Text.
- * @param string $data Data of text token
- * @return HTMLPurifier_Token_Text Generated HTMLPurifier_Token_Text
- */
- public function createText($data)
- {
- $p = clone $this->p_text;
- $p->__construct($data);
- return $p;
- }
-
- /**
- * Creates a HTMLPurifier_Token_Comment.
- * @param string $data Data of comment token
- * @return HTMLPurifier_Token_Comment Generated HTMLPurifier_Token_Comment
- */
- public function createComment($data)
- {
- $p = clone $this->p_comment;
- $p->__construct($data);
- return $p;
- }
-}
-
-
-
-
-
-/**
- * HTML Purifier's internal representation of a URI.
- * @note
- * Internal data-structures are completely escaped. If the data needs
- * to be used in a non-URI context (which is very unlikely), be sure
- * to decode it first. The URI may not necessarily be well-formed until
- * validate() is called.
- */
-class HTMLPurifier_URI
-{
- /**
- * @type string
- */
- public $scheme;
-
- /**
- * @type string
- */
- public $userinfo;
-
- /**
- * @type string
- */
- public $host;
-
- /**
- * @type int
- */
- public $port;
-
- /**
- * @type string
- */
- public $path;
-
- /**
- * @type string
- */
- public $query;
-
- /**
- * @type string
- */
- public $fragment;
-
- /**
- * @param string $scheme
- * @param string $userinfo
- * @param string $host
- * @param int $port
- * @param string $path
- * @param string $query
- * @param string $fragment
- * @note Automatically normalizes scheme and port
- */
- public function __construct($scheme, $userinfo, $host, $port, $path, $query, $fragment)
- {
- $this->scheme = is_null($scheme) || ctype_lower($scheme) ? $scheme : strtolower($scheme);
- $this->userinfo = $userinfo;
- $this->host = $host;
- $this->port = is_null($port) ? $port : (int)$port;
- $this->path = $path;
- $this->query = $query;
- $this->fragment = $fragment;
- }
-
- /**
- * Retrieves a scheme object corresponding to the URI's scheme/default
- * @param HTMLPurifier_Config $config
- * @param HTMLPurifier_Context $context
- * @return HTMLPurifier_URIScheme Scheme object appropriate for validating this URI
- */
- public function getSchemeObj($config, $context)
- {
- $registry = HTMLPurifier_URISchemeRegistry::instance();
- if ($this->scheme !== null) {
- $scheme_obj = $registry->getScheme($this->scheme, $config, $context);
- if (!$scheme_obj) {
- return false;
- } // invalid scheme, clean it out
- } else {
- // no scheme: retrieve the default one
- $def = $config->getDefinition('URI');
- $scheme_obj = $def->getDefaultScheme($config, $context);
- if (!$scheme_obj) {
- if ($def->defaultScheme !== null) {
- // something funky happened to the default scheme object
- trigger_error(
- 'Default scheme object "' . $def->defaultScheme . '" was not readable',
- E_USER_WARNING
- );
- } // suppress error if it's null
- return false;
- }
- }
- return $scheme_obj;
- }
-
- /**
- * Generic validation method applicable for all schemes. May modify
- * this URI in order to get it into a compliant form.
- * @param HTMLPurifier_Config $config
- * @param HTMLPurifier_Context $context
- * @return bool True if validation/filtering succeeds, false if failure
- */
- public function validate($config, $context)
- {
- // ABNF definitions from RFC 3986
- $chars_sub_delims = '!$&\'()*+,;=';
- $chars_gen_delims = ':/?#[]@';
- $chars_pchar = $chars_sub_delims . ':@';
-
- // validate host
- if (!is_null($this->host)) {
- $host_def = new HTMLPurifier_AttrDef_URI_Host();
- $this->host = $host_def->validate($this->host, $config, $context);
- if ($this->host === false) {
- $this->host = null;
- }
- }
-
- // validate scheme
- // NOTE: It's not appropriate to check whether or not this
- // scheme is in our registry, since a URIFilter may convert a
- // URI that we don't allow into one we do. So instead, we just
- // check if the scheme can be dropped because there is no host
- // and it is our default scheme.
- if (!is_null($this->scheme) && is_null($this->host) || $this->host === '') {
- // support for relative paths is pretty abysmal when the
- // scheme is present, so axe it when possible
- $def = $config->getDefinition('URI');
- if ($def->defaultScheme === $this->scheme) {
- $this->scheme = null;
- }
- }
-
- // validate username
- if (!is_null($this->userinfo)) {
- $encoder = new HTMLPurifier_PercentEncoder($chars_sub_delims . ':');
- $this->userinfo = $encoder->encode($this->userinfo);
- }
-
- // validate port
- if (!is_null($this->port)) {
- if ($this->port < 1 || $this->port > 65535) {
- $this->port = null;
- }
- }
-
- // validate path
- $segments_encoder = new HTMLPurifier_PercentEncoder($chars_pchar . '/');
- if (!is_null($this->host)) { // this catches $this->host === ''
- // path-abempty (hier and relative)
- // http://www.example.com/my/path
- // //www.example.com/my/path (looks odd, but works, and
- // recognized by most browsers)
- // (this set is valid or invalid on a scheme by scheme
- // basis, so we'll deal with it later)
- // file:///my/path
- // ///my/path
- $this->path = $segments_encoder->encode($this->path);
- } elseif ($this->path !== '') {
- if ($this->path[0] === '/') {
- // path-absolute (hier and relative)
- // http:/my/path
- // /my/path
- if (strlen($this->path) >= 2 && $this->path[1] === '/') {
- // This could happen if both the host gets stripped
- // out
- // http://my/path
- // //my/path
- $this->path = '';
- } else {
- $this->path = $segments_encoder->encode($this->path);
- }
- } elseif (!is_null($this->scheme)) {
- // path-rootless (hier)
- // http:my/path
- // Short circuit evaluation means we don't need to check nz
- $this->path = $segments_encoder->encode($this->path);
- } else {
- // path-noscheme (relative)
- // my/path
- // (once again, not checking nz)
- $segment_nc_encoder = new HTMLPurifier_PercentEncoder($chars_sub_delims . '@');
- $c = strpos($this->path, '/');
- if ($c !== false) {
- $this->path =
- $segment_nc_encoder->encode(substr($this->path, 0, $c)) .
- $segments_encoder->encode(substr($this->path, $c));
- } else {
- $this->path = $segment_nc_encoder->encode($this->path);
- }
- }
- } else {
- // path-empty (hier and relative)
- $this->path = ''; // just to be safe
- }
-
- // qf = query and fragment
- $qf_encoder = new HTMLPurifier_PercentEncoder($chars_pchar . '/?');
-
- if (!is_null($this->query)) {
- $this->query = $qf_encoder->encode($this->query);
- }
-
- if (!is_null($this->fragment)) {
- $this->fragment = $qf_encoder->encode($this->fragment);
- }
- return true;
- }
-
- /**
- * Convert URI back to string
- * @return string URI appropriate for output
- */
- public function toString()
- {
- // reconstruct authority
- $authority = null;
- // there is a rendering difference between a null authority
- // (http:foo-bar) and an empty string authority
- // (http:///foo-bar).
- if (!is_null($this->host)) {
- $authority = '';
- if (!is_null($this->userinfo)) {
- $authority .= $this->userinfo . '@';
- }
- $authority .= $this->host;
- if (!is_null($this->port)) {
- $authority .= ':' . $this->port;
- }
- }
-
- // Reconstruct the result
- // One might wonder about parsing quirks from browsers after
- // this reconstruction. Unfortunately, parsing behavior depends
- // on what *scheme* was employed (file:///foo is handled *very*
- // differently than http:///foo), so unfortunately we have to
- // defer to the schemes to do the right thing.
- $result = '';
- if (!is_null($this->scheme)) {
- $result .= $this->scheme . ':';
- }
- if (!is_null($authority)) {
- $result .= '//' . $authority;
- }
- $result .= $this->path;
- if (!is_null($this->query)) {
- $result .= '?' . $this->query;
- }
- if (!is_null($this->fragment)) {
- $result .= '#' . $this->fragment;
- }
-
- return $result;
- }
-
- /**
- * Returns true if this URL might be considered a 'local' URL given
- * the current context. This is true when the host is null, or
- * when it matches the host supplied to the configuration.
- *
- * Note that this does not do any scheme checking, so it is mostly
- * only appropriate for metadata that doesn't care about protocol
- * security. isBenign is probably what you actually want.
- * @param HTMLPurifier_Config $config
- * @param HTMLPurifier_Context $context
- * @return bool
- */
- public function isLocal($config, $context)
- {
- if ($this->host === null) {
- return true;
- }
- $uri_def = $config->getDefinition('URI');
- if ($uri_def->host === $this->host) {
- return true;
- }
- return false;
- }
-
- /**
- * Returns true if this URL should be considered a 'benign' URL,
- * that is:
- *
- * - It is a local URL (isLocal), and
- * - It has a equal or better level of security
- * @param HTMLPurifier_Config $config
- * @param HTMLPurifier_Context $context
- * @return bool
- */
- public function isBenign($config, $context)
- {
- if (!$this->isLocal($config, $context)) {
- return false;
- }
-
- $scheme_obj = $this->getSchemeObj($config, $context);
- if (!$scheme_obj) {
- return false;
- } // conservative approach
-
- $current_scheme_obj = $config->getDefinition('URI')->getDefaultScheme($config, $context);
- if ($current_scheme_obj->secure) {
- if (!$scheme_obj->secure) {
- return false;
- }
- }
- return true;
- }
-}
-
-
-
-
-
-class HTMLPurifier_URIDefinition extends HTMLPurifier_Definition
-{
-
- public $type = 'URI';
- protected $filters = array();
- protected $postFilters = array();
- protected $registeredFilters = array();
-
- /**
- * HTMLPurifier_URI object of the base specified at %URI.Base
- */
- public $base;
-
- /**
- * String host to consider "home" base, derived off of $base
- */
- public $host;
-
- /**
- * Name of default scheme based on %URI.DefaultScheme and %URI.Base
- */
- public $defaultScheme;
-
- public function __construct()
- {
- $this->registerFilter(new HTMLPurifier_URIFilter_DisableExternal());
- $this->registerFilter(new HTMLPurifier_URIFilter_DisableExternalResources());
- $this->registerFilter(new HTMLPurifier_URIFilter_DisableResources());
- $this->registerFilter(new HTMLPurifier_URIFilter_HostBlacklist());
- $this->registerFilter(new HTMLPurifier_URIFilter_SafeIframe());
- $this->registerFilter(new HTMLPurifier_URIFilter_MakeAbsolute());
- $this->registerFilter(new HTMLPurifier_URIFilter_Munge());
- }
-
- public function registerFilter($filter)
- {
- $this->registeredFilters[$filter->name] = $filter;
- }
-
- public function addFilter($filter, $config)
- {
- $r = $filter->prepare($config);
- if ($r === false) return; // null is ok, for backwards compat
- if ($filter->post) {
- $this->postFilters[$filter->name] = $filter;
- } else {
- $this->filters[$filter->name] = $filter;
- }
- }
-
- protected function doSetup($config)
- {
- $this->setupMemberVariables($config);
- $this->setupFilters($config);
- }
-
- protected function setupFilters($config)
- {
- foreach ($this->registeredFilters as $name => $filter) {
- if ($filter->always_load) {
- $this->addFilter($filter, $config);
- } else {
- $conf = $config->get('URI.' . $name);
- if ($conf !== false && $conf !== null) {
- $this->addFilter($filter, $config);
- }
- }
- }
- unset($this->registeredFilters);
- }
-
- protected function setupMemberVariables($config)
- {
- $this->host = $config->get('URI.Host');
- $base_uri = $config->get('URI.Base');
- if (!is_null($base_uri)) {
- $parser = new HTMLPurifier_URIParser();
- $this->base = $parser->parse($base_uri);
- $this->defaultScheme = $this->base->scheme;
- if (is_null($this->host)) $this->host = $this->base->host;
- }
- if (is_null($this->defaultScheme)) $this->defaultScheme = $config->get('URI.DefaultScheme');
- }
-
- public function getDefaultScheme($config, $context)
- {
- return HTMLPurifier_URISchemeRegistry::instance()->getScheme($this->defaultScheme, $config, $context);
- }
-
- public function filter(&$uri, $config, $context)
- {
- foreach ($this->filters as $name => $f) {
- $result = $f->filter($uri, $config, $context);
- if (!$result) return false;
- }
- return true;
- }
-
- public function postFilter(&$uri, $config, $context)
- {
- foreach ($this->postFilters as $name => $f) {
- $result = $f->filter($uri, $config, $context);
- if (!$result) return false;
- }
- return true;
- }
-
-}
-
-
-
-
-
-/**
- * Chainable filters for custom URI processing.
- *
- * These filters can perform custom actions on a URI filter object,
- * including transformation or blacklisting. A filter named Foo
- * must have a corresponding configuration directive %URI.Foo,
- * unless always_load is specified to be true.
- *
- * The following contexts may be available while URIFilters are being
- * processed:
- *
- * - EmbeddedURI: true if URI is an embedded resource that will
- * be loaded automatically on page load
- * - CurrentToken: a reference to the token that is currently
- * being processed
- * - CurrentAttr: the name of the attribute that is currently being
- * processed
- * - CurrentCSSProperty: the name of the CSS property that is
- * currently being processed (if applicable)
- *
- * @warning This filter is called before scheme object validation occurs.
- * Make sure, if you require a specific scheme object, you
- * you check that it exists. This allows filters to convert
- * proprietary URI schemes into regular ones.
- */
-abstract class HTMLPurifier_URIFilter
-{
-
- /**
- * Unique identifier of filter.
- * @type string
- */
- public $name;
-
- /**
- * True if this filter should be run after scheme validation.
- * @type bool
- */
- public $post = false;
-
- /**
- * True if this filter should always be loaded.
- * This permits a filter to be named Foo without the corresponding
- * %URI.Foo directive existing.
- * @type bool
- */
- public $always_load = false;
-
- /**
- * Performs initialization for the filter. If the filter returns
- * false, this means that it shouldn't be considered active.
- * @param HTMLPurifier_Config $config
- * @return bool
- */
- public function prepare($config)
- {
- return true;
- }
-
- /**
- * Filter a URI object
- * @param HTMLPurifier_URI $uri Reference to URI object variable
- * @param HTMLPurifier_Config $config
- * @param HTMLPurifier_Context $context
- * @return bool Whether or not to continue processing: false indicates
- * URL is no good, true indicates continue processing. Note that
- * all changes are committed directly on the URI object
- */
- abstract public function filter(&$uri, $config, $context);
-}
-
-
-
-
-
-/**
- * Parses a URI into the components and fragment identifier as specified
- * by RFC 3986.
- */
-class HTMLPurifier_URIParser
-{
-
- /**
- * Instance of HTMLPurifier_PercentEncoder to do normalization with.
- */
- protected $percentEncoder;
-
- public function __construct()
- {
- $this->percentEncoder = new HTMLPurifier_PercentEncoder();
- }
-
- /**
- * Parses a URI.
- * @param $uri string URI to parse
- * @return HTMLPurifier_URI representation of URI. This representation has
- * not been validated yet and may not conform to RFC.
- */
- public function parse($uri)
- {
- $uri = $this->percentEncoder->normalize($uri);
-
- // Regexp is as per Appendix B.
- // Note that ["<>] are an addition to the RFC's recommended
- // characters, because they represent external delimeters.
- $r_URI = '!'.
- '(([a-zA-Z0-9\.\+\-]+):)?'. // 2. Scheme
- '(//([^/?#"<>]*))?'. // 4. Authority
- '([^?#"<>]*)'. // 5. Path
- '(\?([^#"<>]*))?'. // 7. Query
- '(#([^"<>]*))?'. // 8. Fragment
- '!';
-
- $matches = array();
- $result = preg_match($r_URI, $uri, $matches);
-
- if (!$result) return false; // *really* invalid URI
-
- // seperate out parts
- $scheme = !empty($matches[1]) ? $matches[2] : null;
- $authority = !empty($matches[3]) ? $matches[4] : null;
- $path = $matches[5]; // always present, can be empty
- $query = !empty($matches[6]) ? $matches[7] : null;
- $fragment = !empty($matches[8]) ? $matches[9] : null;
-
- // further parse authority
- if ($authority !== null) {
- $r_authority = "/^((.+?)@)?(\[[^\]]+\]|[^:]*)(:(\d*))?/";
- $matches = array();
- preg_match($r_authority, $authority, $matches);
- $userinfo = !empty($matches[1]) ? $matches[2] : null;
- $host = !empty($matches[3]) ? $matches[3] : '';
- $port = !empty($matches[4]) ? (int) $matches[5] : null;
- } else {
- $port = $host = $userinfo = null;
- }
-
- return new HTMLPurifier_URI(
- $scheme, $userinfo, $host, $port, $path, $query, $fragment);
- }
-
-}
-
-
-
-
-
-/**
- * Validator for the components of a URI for a specific scheme
- */
-abstract class HTMLPurifier_URIScheme
-{
-
- /**
- * Scheme's default port (integer). If an explicit port number is
- * specified that coincides with the default port, it will be
- * elided.
- * @type int
- */
- public $default_port = null;
-
- /**
- * Whether or not URIs of this scheme are locatable by a browser
- * http and ftp are accessible, while mailto and news are not.
- * @type bool
- */
- public $browsable = false;
-
- /**
- * Whether or not data transmitted over this scheme is encrypted.
- * https is secure, http is not.
- * @type bool
- */
- public $secure = false;
-
- /**
- * Whether or not the URI always uses , resolves edge cases
- * with making relative URIs absolute
- * @type bool
- */
- public $hierarchical = false;
-
- /**
- * Whether or not the URI may omit a hostname when the scheme is
- * explicitly specified, ala file:///path/to/file. As of writing,
- * 'file' is the only scheme that browsers support his properly.
- * @type bool
- */
- public $may_omit_host = false;
-
- /**
- * Validates the components of a URI for a specific scheme.
- * @param HTMLPurifier_URI $uri Reference to a HTMLPurifier_URI object
- * @param HTMLPurifier_Config $config
- * @param HTMLPurifier_Context $context
- * @return bool success or failure
- */
- abstract public function doValidate(&$uri, $config, $context);
-
- /**
- * Public interface for validating components of a URI. Performs a
- * bunch of default actions. Don't overload this method.
- * @param HTMLPurifier_URI $uri Reference to a HTMLPurifier_URI object
- * @param HTMLPurifier_Config $config
- * @param HTMLPurifier_Context $context
- * @return bool success or failure
- */
- public function validate(&$uri, $config, $context)
- {
- if ($this->default_port == $uri->port) {
- $uri->port = null;
- }
- // kludge: browsers do funny things when the scheme but not the
- // authority is set
- if (!$this->may_omit_host &&
- // if the scheme is present, a missing host is always in error
- (!is_null($uri->scheme) && ($uri->host === '' || is_null($uri->host))) ||
- // if the scheme is not present, a *blank* host is in error,
- // since this translates into '///path' which most browsers
- // interpret as being 'http://path'.
- (is_null($uri->scheme) && $uri->host === '')
- ) {
- do {
- if (is_null($uri->scheme)) {
- if (substr($uri->path, 0, 2) != '//') {
- $uri->host = null;
- break;
- }
- // URI is '////path', so we cannot nullify the
- // host to preserve semantics. Try expanding the
- // hostname instead (fall through)
- }
- // first see if we can manually insert a hostname
- $host = $config->get('URI.Host');
- if (!is_null($host)) {
- $uri->host = $host;
- } else {
- // we can't do anything sensible, reject the URL.
- return false;
- }
- } while (false);
- }
- return $this->doValidate($uri, $config, $context);
- }
-}
-
-
-
-
-
-/**
- * Registry for retrieving specific URI scheme validator objects.
- */
-class HTMLPurifier_URISchemeRegistry
-{
-
- /**
- * Retrieve sole instance of the registry.
- * @param HTMLPurifier_URISchemeRegistry $prototype Optional prototype to overload sole instance with,
- * or bool true to reset to default registry.
- * @return HTMLPurifier_URISchemeRegistry
- * @note Pass a registry object $prototype with a compatible interface and
- * the function will copy it and return it all further times.
- */
- public static function instance($prototype = null)
- {
- static $instance = null;
- if ($prototype !== null) {
- $instance = $prototype;
- } elseif ($instance === null || $prototype == true) {
- $instance = new HTMLPurifier_URISchemeRegistry();
- }
- return $instance;
- }
-
- /**
- * Cache of retrieved schemes.
- * @type HTMLPurifier_URIScheme[]
- */
- protected $schemes = array();
-
- /**
- * Retrieves a scheme validator object
- * @param string $scheme String scheme name like http or mailto
- * @param HTMLPurifier_Config $config
- * @param HTMLPurifier_Context $context
- * @return HTMLPurifier_URIScheme
- */
- public function getScheme($scheme, $config, $context)
- {
- if (!$config) {
- $config = HTMLPurifier_Config::createDefault();
- }
-
- // important, otherwise attacker could include arbitrary file
- $allowed_schemes = $config->get('URI.AllowedSchemes');
- if (!$config->get('URI.OverrideAllowedSchemes') &&
- !isset($allowed_schemes[$scheme])
- ) {
- return;
- }
-
- if (isset($this->schemes[$scheme])) {
- return $this->schemes[$scheme];
- }
- if (!isset($allowed_schemes[$scheme])) {
- return;
- }
-
- $class = 'HTMLPurifier_URIScheme_' . $scheme;
- if (!class_exists($class)) {
- return;
- }
- $this->schemes[$scheme] = new $class();
- return $this->schemes[$scheme];
- }
-
- /**
- * Registers a custom scheme to the cache, bypassing reflection.
- * @param string $scheme Scheme name
- * @param HTMLPurifier_URIScheme $scheme_obj
- */
- public function register($scheme, $scheme_obj)
- {
- $this->schemes[$scheme] = $scheme_obj;
- }
-}
-
-
-
-
-
-/**
- * Class for converting between different unit-lengths as specified by
- * CSS.
- */
-class HTMLPurifier_UnitConverter
-{
-
- const ENGLISH = 1;
- const METRIC = 2;
- const DIGITAL = 3;
-
- /**
- * Units information array. Units are grouped into measuring systems
- * (English, Metric), and are assigned an integer representing
- * the conversion factor between that unit and the smallest unit in
- * the system. Numeric indexes are actually magical constants that
- * encode conversion data from one system to the next, with a O(n^2)
- * constraint on memory (this is generally not a problem, since
- * the number of measuring systems is small.)
- */
- protected static $units = array(
- self::ENGLISH => array(
- 'px' => 3, // This is as per CSS 2.1 and Firefox. Your mileage may vary
- 'pt' => 4,
- 'pc' => 48,
- 'in' => 288,
- self::METRIC => array('pt', '0.352777778', 'mm'),
- ),
- self::METRIC => array(
- 'mm' => 1,
- 'cm' => 10,
- self::ENGLISH => array('mm', '2.83464567', 'pt'),
- ),
- );
-
- /**
- * Minimum bcmath precision for output.
- * @type int
- */
- protected $outputPrecision;
-
- /**
- * Bcmath precision for internal calculations.
- * @type int
- */
- protected $internalPrecision;
-
- /**
- * Whether or not BCMath is available.
- * @type bool
- */
- private $bcmath;
-
- public function __construct($output_precision = 4, $internal_precision = 10, $force_no_bcmath = false)
- {
- $this->outputPrecision = $output_precision;
- $this->internalPrecision = $internal_precision;
- $this->bcmath = !$force_no_bcmath && function_exists('bcmul');
- }
-
- /**
- * Converts a length object of one unit into another unit.
- * @param HTMLPurifier_Length $length
- * Instance of HTMLPurifier_Length to convert. You must validate()
- * it before passing it here!
- * @param string $to_unit
- * Unit to convert to.
- * @return HTMLPurifier_Length|bool
- * @note
- * About precision: This conversion function pays very special
- * attention to the incoming precision of values and attempts
- * to maintain a number of significant figure. Results are
- * fairly accurate up to nine digits. Some caveats:
- * - If a number is zero-padded as a result of this significant
- * figure tracking, the zeroes will be eliminated.
- * - If a number contains less than four sigfigs ($outputPrecision)
- * and this causes some decimals to be excluded, those
- * decimals will be added on.
- */
- public function convert($length, $to_unit)
- {
- if (!$length->isValid()) {
- return false;
- }
-
- $n = $length->getN();
- $unit = $length->getUnit();
-
- if ($n === '0' || $unit === false) {
- return new HTMLPurifier_Length('0', false);
- }
-
- $state = $dest_state = false;
- foreach (self::$units as $k => $x) {
- if (isset($x[$unit])) {
- $state = $k;
- }
- if (isset($x[$to_unit])) {
- $dest_state = $k;
- }
- }
- if (!$state || !$dest_state) {
- return false;
- }
-
- // Some calculations about the initial precision of the number;
- // this will be useful when we need to do final rounding.
- $sigfigs = $this->getSigFigs($n);
- if ($sigfigs < $this->outputPrecision) {
- $sigfigs = $this->outputPrecision;
- }
-
- // BCMath's internal precision deals only with decimals. Use
- // our default if the initial number has no decimals, or increase
- // it by how ever many decimals, thus, the number of guard digits
- // will always be greater than or equal to internalPrecision.
- $log = (int)floor(log(abs($n), 10));
- $cp = ($log < 0) ? $this->internalPrecision - $log : $this->internalPrecision; // internal precision
-
- for ($i = 0; $i < 2; $i++) {
-
- // Determine what unit IN THIS SYSTEM we need to convert to
- if ($dest_state === $state) {
- // Simple conversion
- $dest_unit = $to_unit;
- } else {
- // Convert to the smallest unit, pending a system shift
- $dest_unit = self::$units[$state][$dest_state][0];
- }
-
- // Do the conversion if necessary
- if ($dest_unit !== $unit) {
- $factor = $this->div(self::$units[$state][$unit], self::$units[$state][$dest_unit], $cp);
- $n = $this->mul($n, $factor, $cp);
- $unit = $dest_unit;
- }
-
- // Output was zero, so bail out early. Shouldn't ever happen.
- if ($n === '') {
- $n = '0';
- $unit = $to_unit;
- break;
- }
-
- // It was a simple conversion, so bail out
- if ($dest_state === $state) {
- break;
- }
-
- if ($i !== 0) {
- // Conversion failed! Apparently, the system we forwarded
- // to didn't have this unit. This should never happen!
- return false;
- }
-
- // Pre-condition: $i == 0
-
- // Perform conversion to next system of units
- $n = $this->mul($n, self::$units[$state][$dest_state][1], $cp);
- $unit = self::$units[$state][$dest_state][2];
- $state = $dest_state;
-
- // One more loop around to convert the unit in the new system.
-
- }
-
- // Post-condition: $unit == $to_unit
- if ($unit !== $to_unit) {
- return false;
- }
-
- // Useful for debugging:
- //echo "
- Location of configuration documentation to link to, let %s substitute
- into the configuration's namespace and directive names sans the percent
- sign.
-
- Internal auto-formatter that converts configuration directives in
- syntax %Namespace.Directive to links. a tags
- with the href attribute must be allowed.
-
- Given that an element has no contents, it will be removed by default, unless
- this predicate dictates otherwise. The predicate can either be an associative
- map from tag name to list of attributes that must be present for the element
- to be considered preserved: thus, the default always preserves colgroup,
- th and td, and also iframe if it
- has a src.
-
- When %AutoFormat.RemoveEmpty and %AutoFormat.RemoveEmpty.RemoveNbsp
- are enabled, this directive defines what HTML elements should not be
- removede if they have only a non-breaking space in them.
-
- When enabled, HTML Purifier will treat any elements that contain only
- non-breaking spaces as well as regular whitespace as empty, and remove
- them when %AutoFormat.RemoveEmpty is enabled.
-
-
- See %AutoFormat.RemoveEmpty.RemoveNbsp.Exceptions for a list of elements
- that don't have this behavior applied to them.
-
- When enabled, HTML Purifier will attempt to remove empty elements that
- contribute no semantic information to the document. The following types
- of nodes will be removed:
-
-
- Tags with no attributes and no content, and that are not empty
- elements (remove <a></a> but not
- <br />), and
-
-
- Tags with no content, except for:
-
The colgroup element, or
-
- Elements with the id or name attribute,
- when those attributes are permitted on those elements.
-
-
-
-
- Please be very careful when using this functionality; while it may not
- seem that empty elements contain useful information, they can alter the
- layout of a document given appropriate styling. This directive is most
- useful when you are processing machine-generated HTML, please avoid using
- it on regular user HTML.
-
-
- Elements that contain only whitespace will be treated as empty. Non-breaking
- spaces, however, do not count as whitespace. See
- %AutoFormat.RemoveEmpty.RemoveNbsp for alternate behavior.
-
-
- This algorithm is not perfect; you may still notice some empty tags,
- particularly if a node had elements, but those elements were later removed
- because they were not permitted in that context, or tags that, after
- being auto-closed by another tag, where empty. This is for safety reasons
- to prevent clever code from breaking validation. The general rule of thumb:
- if a tag looked empty on the way in, it will get removed; if HTML Purifier
- made it empty, it will stay.
-
- This directive causes span tags without any attributes
- to be removed. It will also remove spans that had all attributes
- removed during processing.
-
- By default, HTML Purifier removes duplicate CSS properties,
- like color:red; color:blue. If this is set to
- true, duplicate properties are allowed.
-
---# vim: et sw=4 sts=4
diff --git a/3rdparty/HTMLPurifier/standalone/HTMLPurifier/ConfigSchema/schema/CSS.AllowImportant.txt b/3rdparty/HTMLPurifier/standalone/HTMLPurifier/ConfigSchema/schema/CSS.AllowImportant.txt
deleted file mode 100644
index 8096eb01..00000000
--- a/3rdparty/HTMLPurifier/standalone/HTMLPurifier/ConfigSchema/schema/CSS.AllowImportant.txt
+++ /dev/null
@@ -1,8 +0,0 @@
-CSS.AllowImportant
-TYPE: bool
-DEFAULT: false
-VERSION: 3.1.0
---DESCRIPTION--
-This parameter determines whether or not !important cascade modifiers should
-be allowed in user CSS. If false, !important will stripped.
---# vim: et sw=4 sts=4
diff --git a/3rdparty/HTMLPurifier/standalone/HTMLPurifier/ConfigSchema/schema/CSS.AllowTricky.txt b/3rdparty/HTMLPurifier/standalone/HTMLPurifier/ConfigSchema/schema/CSS.AllowTricky.txt
deleted file mode 100644
index 9d34debc..00000000
--- a/3rdparty/HTMLPurifier/standalone/HTMLPurifier/ConfigSchema/schema/CSS.AllowTricky.txt
+++ /dev/null
@@ -1,11 +0,0 @@
-CSS.AllowTricky
-TYPE: bool
-DEFAULT: false
-VERSION: 3.1.0
---DESCRIPTION--
-This parameter determines whether or not to allow "tricky" CSS properties and
-values. Tricky CSS properties/values can drastically modify page layout or
-be used for deceptive practices but do not directly constitute a security risk.
-For example, display:none; is considered a tricky property that
-will only be allowed if this directive is set to true.
---# vim: et sw=4 sts=4
diff --git a/3rdparty/HTMLPurifier/standalone/HTMLPurifier/ConfigSchema/schema/CSS.AllowedFonts.txt b/3rdparty/HTMLPurifier/standalone/HTMLPurifier/ConfigSchema/schema/CSS.AllowedFonts.txt
deleted file mode 100644
index 7c2b5476..00000000
--- a/3rdparty/HTMLPurifier/standalone/HTMLPurifier/ConfigSchema/schema/CSS.AllowedFonts.txt
+++ /dev/null
@@ -1,12 +0,0 @@
-CSS.AllowedFonts
-TYPE: lookup/null
-VERSION: 4.3.0
-DEFAULT: NULL
---DESCRIPTION--
-
- Allows you to manually specify a set of allowed fonts. If
- NULL, all fonts are allowed. This directive
- affects generic names (serif, sans-serif, monospace, cursive,
- fantasy) as well as specific font families.
-
- If HTML Purifier's style attributes set is unsatisfactory for your needs,
- you can overload it with your own list of tags to allow. Note that this
- method is subtractive: it does its job by taking away from HTML Purifier
- usual feature set, so you cannot add an attribute that HTML Purifier never
- supported in the first place.
-
-
- Warning: If another directive conflicts with the
- elements here, that directive will win and override.
-
- This is the logical inverse of %CSS.AllowedProperties, and it will
- override that directive or any other directive. If possible,
- %CSS.AllowedProperties is recommended over this directive,
- because it can sometimes be difficult to tell whether or not you've
- forbidden all of the CSS properties you truly would like to disallow.
-
- This parameter sets the maximum allowed length on img tags,
- effectively the width and height properties.
- Only absolute units of measurement (in, pt, pc, mm, cm) and pixels (px) are allowed. This is
- in place to prevent imagecrash attacks, disable with null at your own risk.
- This directive is similar to %HTML.MaxImgLength, and both should be
- concurrently edited, although there are
- subtle differences in the input format (the CSS max is a number with
- a unit).
-
- Whether or not to allow safe, proprietary CSS values.
-
---# vim: et sw=4 sts=4
diff --git a/3rdparty/HTMLPurifier/standalone/HTMLPurifier/ConfigSchema/schema/CSS.Trusted.txt b/3rdparty/HTMLPurifier/standalone/HTMLPurifier/ConfigSchema/schema/CSS.Trusted.txt
deleted file mode 100644
index 917ec42b..00000000
--- a/3rdparty/HTMLPurifier/standalone/HTMLPurifier/ConfigSchema/schema/CSS.Trusted.txt
+++ /dev/null
@@ -1,9 +0,0 @@
-CSS.Trusted
-TYPE: bool
-VERSION: 4.2.1
-DEFAULT: false
---DESCRIPTION--
-Indicates whether or not the user's CSS input is trusted or not. If the
-input is trusted, a more expansive set of allowed properties. See
-also %HTML.Trusted.
---# vim: et sw=4 sts=4
diff --git a/3rdparty/HTMLPurifier/standalone/HTMLPurifier/ConfigSchema/schema/Cache.DefinitionImpl.txt b/3rdparty/HTMLPurifier/standalone/HTMLPurifier/ConfigSchema/schema/Cache.DefinitionImpl.txt
deleted file mode 100644
index afc6a87a..00000000
--- a/3rdparty/HTMLPurifier/standalone/HTMLPurifier/ConfigSchema/schema/Cache.DefinitionImpl.txt
+++ /dev/null
@@ -1,14 +0,0 @@
-Cache.DefinitionImpl
-TYPE: string/null
-VERSION: 2.0.0
-DEFAULT: 'Serializer'
---DESCRIPTION--
-
-This directive defines which method to use when caching definitions,
-the complex data-type that makes HTML Purifier tick. Set to null
-to disable caching (not recommended, as you will see a definite
-performance degradation).
-
---ALIASES--
-Core.DefinitionCache
---# vim: et sw=4 sts=4
diff --git a/3rdparty/HTMLPurifier/standalone/HTMLPurifier/ConfigSchema/schema/Cache.SerializerPath.txt b/3rdparty/HTMLPurifier/standalone/HTMLPurifier/ConfigSchema/schema/Cache.SerializerPath.txt
deleted file mode 100644
index 668f248a..00000000
--- a/3rdparty/HTMLPurifier/standalone/HTMLPurifier/ConfigSchema/schema/Cache.SerializerPath.txt
+++ /dev/null
@@ -1,13 +0,0 @@
-Cache.SerializerPath
-TYPE: string/null
-VERSION: 2.0.0
-DEFAULT: NULL
---DESCRIPTION--
-
-
- Absolute path with no trailing slash to store serialized definitions in.
- Default is within the
- HTML Purifier library inside DefinitionCache/Serializer. This
- path must be writable by the webserver.
-
- This directive enables aggressive pre-filter fixes HTML Purifier can
- perform in order to ensure that open angled-brackets do not get killed
- during parsing stage. Enabling this will result in two preg_replace_callback
- calls and at least two preg_replace calls for every HTML document parsed;
- if your users make very well-formed HTML, you can set this directive false.
- This has no effect when DirectLex is used.
-
-
- Notice: This directive's default turned from false to true
- in HTML Purifier 3.2.0.
-
- This directive enables aggressive pre-filter removal of
- script tags. This is not necessary for security,
- but it can help work around a bug in libxml where embedded
- HTML elements inside script sections cause the parser to
- choke. To revert to pre-4.9.0 behavior, set this to false.
- This directive has no effect if %Core.Trusted is true,
- %Core.RemoveScriptContents is false, or %Core.HiddenElements
- does not contain script.
-
- By RFC 1123, underscores are not permitted in host names.
- (This is in contrast to the specification for DNS, RFC
- 2181, which allows underscores.)
- However, most browsers do the right thing when faced with
- an underscore in the host name, and so some poorly written
- websites are written with the expectation this should work.
- Setting this parameter to true relaxes our allowed character
- check so that underscores are permitted.
-
- This directive allows parsing of many nested tags.
- If you set true, relaxes any hardcoded limit from the parser.
- However, in that case it may cause a Dos attack.
- Be careful when enabling it.
-
- Specifies the number of tokens the DirectLex line number tracking
- implementations should process before attempting to resyncronize the
- current line count by manually counting all previous new-lines. When
- at 0, this functionality is disabled. Lower values will decrease
- performance, and this is only strictly necessary if the counting
- algorithm is buggy (in which case you should report it as a bug).
- This has no effect when %Core.MaintainLineNumbers is disabled or DirectLex is
- not being used.
-
- This directive disables SGML-style exclusions, e.g. the exclusion of
- <object> in any descendant of a
- <pre> tag. Disabling excludes will allow some
- invalid documents to pass through HTML Purifier, but HTML Purifier
- will also be less likely to accidentally remove large documents during
- processing.
-
---# vim: et sw=4 sts=4
diff --git a/3rdparty/HTMLPurifier/standalone/HTMLPurifier/ConfigSchema/schema/Core.EnableIDNA.txt b/3rdparty/HTMLPurifier/standalone/HTMLPurifier/ConfigSchema/schema/Core.EnableIDNA.txt
deleted file mode 100644
index 7f498e7e..00000000
--- a/3rdparty/HTMLPurifier/standalone/HTMLPurifier/ConfigSchema/schema/Core.EnableIDNA.txt
+++ /dev/null
@@ -1,9 +0,0 @@
-Core.EnableIDNA
-TYPE: bool
-DEFAULT: false
-VERSION: 4.4.0
---DESCRIPTION--
-Allows international domain names in URLs. This configuration option
-requires the PEAR Net_IDNA2 module to be installed. It operates by
-punycoding any internationalized host names for maximum portability.
---# vim: et sw=4 sts=4
diff --git a/3rdparty/HTMLPurifier/standalone/HTMLPurifier/ConfigSchema/schema/Core.Encoding.txt b/3rdparty/HTMLPurifier/standalone/HTMLPurifier/ConfigSchema/schema/Core.Encoding.txt
deleted file mode 100644
index 89e2ae34..00000000
--- a/3rdparty/HTMLPurifier/standalone/HTMLPurifier/ConfigSchema/schema/Core.Encoding.txt
+++ /dev/null
@@ -1,15 +0,0 @@
-Core.Encoding
-TYPE: istring
-DEFAULT: 'utf-8'
---DESCRIPTION--
-If for some reason you are unable to convert all webpages to UTF-8, you can
-use this directive as a stop-gap compatibility change to let HTML Purifier
-deal with non UTF-8 input. This technique has notable deficiencies:
-absolutely no characters outside of the selected character encoding will be
-preserved, not even the ones that have been ampersand escaped (this is due
-to a UTF-8 specific feature that automatically resolves all
-entities), making it pretty useless for anything except the most I18N-blind
-applications, although %Core.EscapeNonASCIICharacters offers fixes this
-trouble with another tradeoff. This directive only accepts ISO-8859-1 if
-iconv is not enabled.
---# vim: et sw=4 sts=4
diff --git a/3rdparty/HTMLPurifier/standalone/HTMLPurifier/ConfigSchema/schema/Core.EscapeInvalidChildren.txt b/3rdparty/HTMLPurifier/standalone/HTMLPurifier/ConfigSchema/schema/Core.EscapeInvalidChildren.txt
deleted file mode 100644
index 1cc3fcda..00000000
--- a/3rdparty/HTMLPurifier/standalone/HTMLPurifier/ConfigSchema/schema/Core.EscapeInvalidChildren.txt
+++ /dev/null
@@ -1,12 +0,0 @@
-Core.EscapeInvalidChildren
-TYPE: bool
-DEFAULT: false
---DESCRIPTION--
-
Warning: this configuration option is no longer does anything as of 4.6.0.
-
-
When true, a child is found that is not allowed in the context of the
-parent element will be transformed into text as if it were ASCII. When
-false, that element and all internal tags will be dropped, though text will
-be preserved. There is no option for dropping the element but preserving
-child nodes.
---# vim: et sw=4 sts=4
diff --git a/3rdparty/HTMLPurifier/standalone/HTMLPurifier/ConfigSchema/schema/Core.EscapeInvalidTags.txt b/3rdparty/HTMLPurifier/standalone/HTMLPurifier/ConfigSchema/schema/Core.EscapeInvalidTags.txt
deleted file mode 100644
index 299775fa..00000000
--- a/3rdparty/HTMLPurifier/standalone/HTMLPurifier/ConfigSchema/schema/Core.EscapeInvalidTags.txt
+++ /dev/null
@@ -1,7 +0,0 @@
-Core.EscapeInvalidTags
-TYPE: bool
-DEFAULT: false
---DESCRIPTION--
-When true, invalid tags will be written back to the document as plain text.
-Otherwise, they are silently dropped.
---# vim: et sw=4 sts=4
diff --git a/3rdparty/HTMLPurifier/standalone/HTMLPurifier/ConfigSchema/schema/Core.EscapeNonASCIICharacters.txt b/3rdparty/HTMLPurifier/standalone/HTMLPurifier/ConfigSchema/schema/Core.EscapeNonASCIICharacters.txt
deleted file mode 100644
index f50db2f9..00000000
--- a/3rdparty/HTMLPurifier/standalone/HTMLPurifier/ConfigSchema/schema/Core.EscapeNonASCIICharacters.txt
+++ /dev/null
@@ -1,13 +0,0 @@
-Core.EscapeNonASCIICharacters
-TYPE: bool
-VERSION: 1.4.0
-DEFAULT: false
---DESCRIPTION--
-This directive overcomes a deficiency in %Core.Encoding by blindly
-converting all non-ASCII characters into decimal numeric entities before
-converting it to its native encoding. This means that even characters that
-can be expressed in the non-UTF-8 encoding will be entity-ized, which can
-be a real downer for encodings like Big5. It also assumes that the ASCII
-repetoire is available, although this is the case for almost all encodings.
-Anyway, use UTF-8!
---# vim: et sw=4 sts=4
diff --git a/3rdparty/HTMLPurifier/standalone/HTMLPurifier/ConfigSchema/schema/Core.HiddenElements.txt b/3rdparty/HTMLPurifier/standalone/HTMLPurifier/ConfigSchema/schema/Core.HiddenElements.txt
deleted file mode 100644
index c337e47f..00000000
--- a/3rdparty/HTMLPurifier/standalone/HTMLPurifier/ConfigSchema/schema/Core.HiddenElements.txt
+++ /dev/null
@@ -1,19 +0,0 @@
-Core.HiddenElements
-TYPE: lookup
---DEFAULT--
-array (
- 'script' => true,
- 'style' => true,
-)
---DESCRIPTION--
-
-
- This directive is a lookup array of elements which should have their
- contents removed when they are not allowed by the HTML definition.
- For example, the contents of a script tag are not
- normally shown in a document, so if script tags are to be removed,
- their contents should be removed to. This is opposed to a b
- tag, which defines some presentational changes but does not hide its
- contents.
-
---# vim: et sw=4 sts=4
diff --git a/3rdparty/HTMLPurifier/standalone/HTMLPurifier/ConfigSchema/schema/Core.Language.txt b/3rdparty/HTMLPurifier/standalone/HTMLPurifier/ConfigSchema/schema/Core.Language.txt
deleted file mode 100644
index ed1f39b5..00000000
--- a/3rdparty/HTMLPurifier/standalone/HTMLPurifier/ConfigSchema/schema/Core.Language.txt
+++ /dev/null
@@ -1,10 +0,0 @@
-Core.Language
-TYPE: string
-VERSION: 2.0.0
-DEFAULT: 'en'
---DESCRIPTION--
-
-ISO 639 language code for localizable things in HTML Purifier to use,
-which is mainly error reporting. There is currently only an English (en)
-translation, so this directive is currently useless.
---# vim: et sw=4 sts=4
diff --git a/3rdparty/HTMLPurifier/standalone/HTMLPurifier/ConfigSchema/schema/Core.LegacyEntityDecoder.txt b/3rdparty/HTMLPurifier/standalone/HTMLPurifier/ConfigSchema/schema/Core.LegacyEntityDecoder.txt
deleted file mode 100644
index 81d9ae4d..00000000
--- a/3rdparty/HTMLPurifier/standalone/HTMLPurifier/ConfigSchema/schema/Core.LegacyEntityDecoder.txt
+++ /dev/null
@@ -1,36 +0,0 @@
-Core.LegacyEntityDecoder
-TYPE: bool
-VERSION: 4.9.0
-DEFAULT: false
---DESCRIPTION--
-
- Prior to HTML Purifier 4.9.0, entities were decoded by performing
- a global search replace for all entities whose decoded versions
- did not have special meanings under HTML, and replaced them with
- their decoded versions. We would match all entities, even if they did
- not have a trailing semicolon, but only if there weren't any trailing
- alphanumeric characters.
-
-
-
Original
Text
Attribute
-
¥
¥
¥
-
¥
¥
¥
-
¥a
¥a
¥a
-
¥=
¥=
¥=
-
-
- In HTML Purifier 4.9.0, we changed the behavior of entity parsing
- to match entities that had missing trailing semicolons in less
- cases, to more closely match HTML5 parsing behavior:
-
-
-
Original
Text
Attribute
-
¥
¥
¥
-
¥
¥
¥
-
¥a
¥a
¥a
-
¥=
¥=
¥=
-
-
- This flag reverts back to pre-HTML Purifier 4.9.0 behavior.
-
- This parameter determines what lexer implementation can be used. The
- valid values are:
-
-
-
null
-
- Recommended, the lexer implementation will be auto-detected based on
- your PHP-version and configuration.
-
-
string lexer identifier
-
- This is a slim way of manually overridding the implementation.
- Currently recognized values are: DOMLex (the default PHP5
-implementation)
- and DirectLex (the default PHP4 implementation). Only use this if
- you know what you are doing: usually, the auto-detection will
- manage things for cases you aren't even aware of.
-
-
object lexer instance
-
- Super-advanced: you can specify your own, custom, implementation that
- implements the interface defined by HTMLPurifier_Lexer.
- I may remove this option simply because I don't expect anyone
- to use it.
-
- If true, HTML Purifier will add line number information to all tokens.
- This is useful when error reporting is turned on, but can result in
- significant performance degradation and should not be used when
- unnecessary. This directive must be used with the DirectLex lexer,
- as the DOMLex lexer does not (yet) support this functionality.
- If the value is null, an appropriate value will be selected based
- on other configuration.
-
- This directive enables pre-emptive URI checking in img
- tags, as the attribute validation strategy is not authorized to
- remove elements from the document. Revert to pre-1.3.0 behavior by setting to false.
-
---# vim: et sw=4 sts=4
diff --git a/3rdparty/HTMLPurifier/standalone/HTMLPurifier/ConfigSchema/schema/Core.RemoveProcessingInstructions.txt b/3rdparty/HTMLPurifier/standalone/HTMLPurifier/ConfigSchema/schema/Core.RemoveProcessingInstructions.txt
deleted file mode 100644
index ed6f1342..00000000
--- a/3rdparty/HTMLPurifier/standalone/HTMLPurifier/ConfigSchema/schema/Core.RemoveProcessingInstructions.txt
+++ /dev/null
@@ -1,11 +0,0 @@
-Core.RemoveProcessingInstructions
-TYPE: bool
-VERSION: 4.2.0
-DEFAULT: false
---DESCRIPTION--
-Instead of escaping processing instructions in the form <? ...
-?>, remove it out-right. This may be useful if the HTML
-you are validating contains XML processing instruction gunk, however,
-it can also be user-unfriendly for people attempting to post PHP
-snippets.
---# vim: et sw=4 sts=4
diff --git a/3rdparty/HTMLPurifier/standalone/HTMLPurifier/ConfigSchema/schema/Core.RemoveScriptContents.txt b/3rdparty/HTMLPurifier/standalone/HTMLPurifier/ConfigSchema/schema/Core.RemoveScriptContents.txt
deleted file mode 100644
index efbe994c..00000000
--- a/3rdparty/HTMLPurifier/standalone/HTMLPurifier/ConfigSchema/schema/Core.RemoveScriptContents.txt
+++ /dev/null
@@ -1,12 +0,0 @@
-Core.RemoveScriptContents
-TYPE: bool/null
-DEFAULT: NULL
-VERSION: 2.0.0
-DEPRECATED-VERSION: 2.1.0
-DEPRECATED-USE: Core.HiddenElements
---DESCRIPTION--
-
- This directive enables HTML Purifier to remove not only script tags
- but all of their contents.
-
- This directive can be used to add custom filters; it is nearly the
- equivalent of the now deprecated HTMLPurifier->addFilter()
- method. Specify an array of concrete implementations.
-
- Whether or not to escape the dangerous characters <, > and &
- as \3C, \3E and \26, respectively. This is can be safely set to false
- if the contents of StyleBlocks will be placed in an external stylesheet,
- where there is no risk of it being interpreted as HTML.
-
- If you would like users to be able to define external stylesheets, but
- only allow them to specify CSS declarations for a specific node and
- prevent them from fiddling with other elements, use this directive.
- It accepts any valid CSS selector, and will prepend this to any
- CSS declaration extracted from the document. For example, if this
- directive is set to #user-content and a user uses the
- selector a:hover, the final selector will be
- #user-content a:hover.
-
-
- The comma shorthand may be used; consider the above example, with
- #user-content, #user-content2, the final selector will
- be #user-content a:hover, #user-content2 a:hover.
-
-
- Warning: It is possible for users to bypass this measure
- using a naughty + selector. This is a bug in CSS Tidy 1.3, not HTML
- Purifier, and I am working to get it fixed. Until then, HTML Purifier
- performs a basic check to prevent this.
-
- If left NULL, HTML Purifier will attempt to instantiate a csstidy
- class to use for internal cleaning. This will usually be good enough.
-
-
- However, for trusted user input, you can set this to false to
- disable cleaning. In addition, you can supply your own concrete implementation
- of Tidy's interface to use, although I don't know why you'd want to do that.
-
- This directive turns on the style block extraction filter, which removes
- style blocks from input HTML, cleans them up with CSSTidy,
- and places them in the StyleBlocks context variable, for further
- use by you, usually to be placed in an external stylesheet, or a
- style block in the head of your document.
-
-
- Sample usage:
-
-
';
-?>
-
-
-
- Filter.ExtractStyleBlocks
-body {color:#F00;} Some text';
-
- $config = HTMLPurifier_Config::createDefault();
- $config->set('Filter', 'ExtractStyleBlocks', true);
- $purifier = new HTMLPurifier($config);
-
- $html = $purifier->purify($dirty);
-
- // This implementation writes the stylesheets to the styles/ directory.
- // You can also echo the styles inside the document, but it's a bit
- // more difficult to make sure they get interpreted properly by
- // browsers; try the usual CSS armoring techniques.
- $styles = $purifier->context->get('StyleBlocks');
- $dir = 'styles/';
- if (!is_dir($dir)) mkdir($dir);
- $hash = sha1($_GET['html']);
- foreach ($styles as $i => $style) {
- file_put_contents($name = $dir . $hash . "_$i");
- echo '';
- }
-?>
-
-
-
-
-
-
-
-]]>
-
- Warning: It is possible for a user to mount an
- imagecrash attack using this CSS. Counter-measures are difficult;
- it is not simply enough to limit the range of CSS lengths (using
- relative lengths with many nesting levels allows for large values
- to be attained without actually specifying them in the stylesheet),
- and the flexible nature of selectors makes it difficult to selectively
- disable lengths on image tags (HTML Purifier, however, does disable
- CSS width and height in inline styling). There are probably two effective
- counter measures: an explicit width and height set to auto in all
- images in your document (unlikely) or the disabling of width and
- height (somewhat reasonable). Whether or not these measures should be
- used is left to the reader.
-
- Warning: Deprecated in favor of %HTML.SafeObject and
- %Output.FlashCompat (turn both on to allow YouTube videos and other
- Flash content).
-
-
- This directive enables YouTube video embedding in HTML Purifier. Check
- this document
- on embedding videos for more information on what this filter does.
-
- This is a preferred convenience directive that combines
- %HTML.AllowedElements and %HTML.AllowedAttributes.
- Specify elements and attributes that are allowed using:
- element1[attr1|attr2],element2.... For example,
- if you would like to only allow paragraphs and links, specify
- a[href],p. You can specify attributes that apply
- to all elements using an asterisk, e.g. *[lang].
- You can also use newlines instead of commas to separate elements.
-
-
- Warning:
- All of the constraints on the component directives are still enforced.
- The syntax is a subset of TinyMCE's valid_elements
- whitelist: directly copy-pasting it here will probably result in
- broken whitelists. If %HTML.AllowedElements or %HTML.AllowedAttributes
- are set, this directive has no effect.
-
- If HTML Purifier's attribute set is unsatisfactory, overload it!
- The syntax is "tag.attr" or "*.attr" for the global attributes
- (style, id, class, dir, lang, xml:lang).
-
-
- Warning: If another directive conflicts with the
- elements here, that directive will win and override. For
- example, %HTML.EnableAttrID will take precedence over *.id in this
- directive. You must set that directive to true before you can use
- IDs at all.
-
---# vim: et sw=4 sts=4
diff --git a/3rdparty/HTMLPurifier/standalone/HTMLPurifier/ConfigSchema/schema/HTML.AllowedComments.txt b/3rdparty/HTMLPurifier/standalone/HTMLPurifier/ConfigSchema/schema/HTML.AllowedComments.txt
deleted file mode 100644
index 8440bc39..00000000
--- a/3rdparty/HTMLPurifier/standalone/HTMLPurifier/ConfigSchema/schema/HTML.AllowedComments.txt
+++ /dev/null
@@ -1,10 +0,0 @@
-HTML.AllowedComments
-TYPE: lookup
-VERSION: 4.4.0
-DEFAULT: array()
---DESCRIPTION--
-A whitelist which indicates what explicit comment bodies should be
-allowed, modulo leading and trailing whitespace. See also %HTML.AllowedCommentsRegexp
-(these directives are union'ed together, so a comment is considered
-valid if any directive deems it valid.)
---# vim: et sw=4 sts=4
diff --git a/3rdparty/HTMLPurifier/standalone/HTMLPurifier/ConfigSchema/schema/HTML.AllowedCommentsRegexp.txt b/3rdparty/HTMLPurifier/standalone/HTMLPurifier/ConfigSchema/schema/HTML.AllowedCommentsRegexp.txt
deleted file mode 100644
index b1e65beb..00000000
--- a/3rdparty/HTMLPurifier/standalone/HTMLPurifier/ConfigSchema/schema/HTML.AllowedCommentsRegexp.txt
+++ /dev/null
@@ -1,15 +0,0 @@
-HTML.AllowedCommentsRegexp
-TYPE: string/null
-VERSION: 4.4.0
-DEFAULT: NULL
---DESCRIPTION--
-A regexp, which if it matches the body of a comment, indicates that
-it should be allowed. Trailing and leading spaces are removed prior
-to running this regular expression.
-Warning: Make sure you specify
-correct anchor metacharacters ^regex$, otherwise you may accept
-comments that you did not mean to! In particular, the regex /foo|bar/
-is probably not sufficiently strict, since it also allows foobar.
-See also %HTML.AllowedComments (these directives are union'ed together,
-so a comment is considered valid if any directive deems it valid.)
---# vim: et sw=4 sts=4
diff --git a/3rdparty/HTMLPurifier/standalone/HTMLPurifier/ConfigSchema/schema/HTML.AllowedElements.txt b/3rdparty/HTMLPurifier/standalone/HTMLPurifier/ConfigSchema/schema/HTML.AllowedElements.txt
deleted file mode 100644
index ca3c13dd..00000000
--- a/3rdparty/HTMLPurifier/standalone/HTMLPurifier/ConfigSchema/schema/HTML.AllowedElements.txt
+++ /dev/null
@@ -1,23 +0,0 @@
-HTML.AllowedElements
-TYPE: lookup/null
-VERSION: 1.3.0
-DEFAULT: NULL
---DESCRIPTION--
-
- If HTML Purifier's tag set is unsatisfactory for your needs, you can
- overload it with your own list of tags to allow. If you change
- this, you probably also want to change %HTML.AllowedAttributes; see
- also %HTML.Allowed which lets you set allowed elements and
- attributes at the same time.
-
-
- If you attempt to allow an element that HTML Purifier does not know
- about, HTML Purifier will raise an error. You will need to manually
- tell HTML Purifier about this element by using the
- advanced customization features.
-
-
- Warning: If another directive conflicts with the
- elements here, that directive will win and override.
-
- A doctype comes with a set of usual modules to use. Without having
- to mucking about with the doctypes, you can quickly activate or
- disable these modules by specifying which modules you wish to allow
- with this directive. This is most useful for unit testing specific
- modules, although end users may find it useful for their own ends.
-
-
- If you specify a module that does not exist, the manager will silently
- fail to use it, so be careful! User-defined modules are not affected
- by this directive. Modules defined in %HTML.CoreModules are not
- affected by this directive.
-
---# vim: et sw=4 sts=4
diff --git a/3rdparty/HTMLPurifier/standalone/HTMLPurifier/ConfigSchema/schema/HTML.Attr.Name.UseCDATA.txt b/3rdparty/HTMLPurifier/standalone/HTMLPurifier/ConfigSchema/schema/HTML.Attr.Name.UseCDATA.txt
deleted file mode 100644
index 75d680ee..00000000
--- a/3rdparty/HTMLPurifier/standalone/HTMLPurifier/ConfigSchema/schema/HTML.Attr.Name.UseCDATA.txt
+++ /dev/null
@@ -1,11 +0,0 @@
-HTML.Attr.Name.UseCDATA
-TYPE: bool
-DEFAULT: false
-VERSION: 4.0.0
---DESCRIPTION--
-The W3C specification DTD defines the name attribute to be CDATA, not ID, due
-to limitations of DTD. In certain documents, this relaxed behavior is desired,
-whether it is to specify duplicate names, or to specify names that would be
-illegal IDs (for example, names that begin with a digit.) Set this configuration
-directive to true to use the relaxed parsing rules.
---# vim: et sw=4 sts=4
diff --git a/3rdparty/HTMLPurifier/standalone/HTMLPurifier/ConfigSchema/schema/HTML.BlockWrapper.txt b/3rdparty/HTMLPurifier/standalone/HTMLPurifier/ConfigSchema/schema/HTML.BlockWrapper.txt
deleted file mode 100644
index f32b802c..00000000
--- a/3rdparty/HTMLPurifier/standalone/HTMLPurifier/ConfigSchema/schema/HTML.BlockWrapper.txt
+++ /dev/null
@@ -1,18 +0,0 @@
-HTML.BlockWrapper
-TYPE: string
-VERSION: 1.3.0
-DEFAULT: 'p'
---DESCRIPTION--
-
-
- String name of element to wrap inline elements that are inside a block
- context. This only occurs in the children of blockquote in strict mode.
-
-
- Example: by default value,
- <blockquote>Foo</blockquote> would become
- <blockquote><p>Foo</p></blockquote>.
- The <p> tags can be replaced with whatever you desire,
- as long as it is a block level element.
-
- Certain modularized doctypes (XHTML, namely), have certain modules
- that must be included for the doctype to be an conforming document
- type: put those modules here. By default, XHTML's core modules
- are used. You can set this to a blank array to disable core module
- protection, but this is not recommended.
-
---# vim: et sw=4 sts=4
diff --git a/3rdparty/HTMLPurifier/standalone/HTMLPurifier/ConfigSchema/schema/HTML.CustomDoctype.txt b/3rdparty/HTMLPurifier/standalone/HTMLPurifier/ConfigSchema/schema/HTML.CustomDoctype.txt
deleted file mode 100644
index 187c0a0d..00000000
--- a/3rdparty/HTMLPurifier/standalone/HTMLPurifier/ConfigSchema/schema/HTML.CustomDoctype.txt
+++ /dev/null
@@ -1,9 +0,0 @@
-HTML.CustomDoctype
-TYPE: string/null
-VERSION: 2.0.1
-DEFAULT: NULL
---DESCRIPTION--
-
-A custom doctype for power-users who defined their own document
-type. This directive only applies when %HTML.Doctype is blank.
---# vim: et sw=4 sts=4
diff --git a/3rdparty/HTMLPurifier/standalone/HTMLPurifier/ConfigSchema/schema/HTML.DefinitionID.txt b/3rdparty/HTMLPurifier/standalone/HTMLPurifier/ConfigSchema/schema/HTML.DefinitionID.txt
deleted file mode 100644
index f5433e3f..00000000
--- a/3rdparty/HTMLPurifier/standalone/HTMLPurifier/ConfigSchema/schema/HTML.DefinitionID.txt
+++ /dev/null
@@ -1,33 +0,0 @@
-HTML.DefinitionID
-TYPE: string/null
-DEFAULT: NULL
-VERSION: 2.0.0
---DESCRIPTION--
-
-
- Unique identifier for a custom-built HTML definition. If you edit
- the raw version of the HTMLDefinition, introducing changes that the
- configuration object does not reflect, you must specify this variable.
- If you change your custom edits, you should change this directive, or
- clear your cache. Example:
-
- In the above example, the configuration is still at the defaults, but
- using the advanced API, an extra attribute has been added. The
- configuration object normally has no way of knowing that this change
- has taken place, so it needs an extra directive: %HTML.DefinitionID.
- If someone else attempts to use the default configuration, these two
- pieces of code will not clobber each other in the cache, since one has
- an extra directive attached to it.
-
-
- You must specify a value to this directive to use the
- advanced API features.
-
- Revision identifier for your custom definition specified in
- %HTML.DefinitionID. This serves the same purpose: uniquely identifying
- your custom definition, but this one does so in a chronological
- context: revision 3 is more up-to-date then revision 2. Thus, when
- this gets incremented, the cache handling is smart enough to clean
- up any older revisions of your definition as well as flush the
- cache.
-
---# vim: et sw=4 sts=4
diff --git a/3rdparty/HTMLPurifier/standalone/HTMLPurifier/ConfigSchema/schema/HTML.Doctype.txt b/3rdparty/HTMLPurifier/standalone/HTMLPurifier/ConfigSchema/schema/HTML.Doctype.txt
deleted file mode 100644
index a6969b99..00000000
--- a/3rdparty/HTMLPurifier/standalone/HTMLPurifier/ConfigSchema/schema/HTML.Doctype.txt
+++ /dev/null
@@ -1,11 +0,0 @@
-HTML.Doctype
-TYPE: string/null
-DEFAULT: NULL
---DESCRIPTION--
-Doctype to use during filtering. Technically speaking this is not actually
-a doctype (as it does not identify a corresponding DTD), but we are using
-this name for sake of simplicity. When non-blank, this will override any
-older directives like %HTML.XHTML or %HTML.Strict.
---ALLOWED--
-'HTML 4.01 Transitional', 'HTML 4.01 Strict', 'XHTML 1.0 Transitional', 'XHTML 1.0 Strict', 'XHTML 1.1'
---# vim: et sw=4 sts=4
diff --git a/3rdparty/HTMLPurifier/standalone/HTMLPurifier/ConfigSchema/schema/HTML.FlashAllowFullScreen.txt b/3rdparty/HTMLPurifier/standalone/HTMLPurifier/ConfigSchema/schema/HTML.FlashAllowFullScreen.txt
deleted file mode 100644
index 08d641f9..00000000
--- a/3rdparty/HTMLPurifier/standalone/HTMLPurifier/ConfigSchema/schema/HTML.FlashAllowFullScreen.txt
+++ /dev/null
@@ -1,11 +0,0 @@
-HTML.FlashAllowFullScreen
-TYPE: bool
-VERSION: 4.2.0
-DEFAULT: false
---DESCRIPTION--
-
- Whether or not to permit embedded Flash content from
- %HTML.SafeObject to expand to the full screen. Corresponds to
- the allowFullScreen parameter.
-
- While this directive is similar to %HTML.AllowedAttributes, for
- forwards-compatibility with XML, this attribute has a different syntax. Instead of
- tag.attr, use tag@attr. To disallow href
- attributes in a tags, set this directive to
- a@href. You can also disallow an attribute globally with
- attr or *@attr (either syntax is fine; the latter
- is provided for consistency with %HTML.AllowedAttributes).
-
-
- Warning: This directive complements %HTML.ForbiddenElements,
- accordingly, check
- out that directive for a discussion of why you
- should think twice before using this directive.
-
- This was, perhaps, the most requested feature ever in HTML
- Purifier. Please don't abuse it! This is the logical inverse of
- %HTML.AllowedElements, and it will override that directive, or any
- other directive.
-
-
- If possible, %HTML.Allowed is recommended over this directive, because it
- can sometimes be difficult to tell whether or not you've forbidden all of
- the behavior you would like to disallow. If you forbid img
- with the expectation of preventing images on your site, you'll be in for
- a nasty surprise when people start using the background-image
- CSS property.
-
- This directive controls the maximum number of pixels in the width and
- height attributes in img tags. This is
- in place to prevent imagecrash attacks, disable with null at your own risk.
- This directive is similar to %CSS.MaxImgLength, and both should be
- concurrently edited, although there are
- subtle differences in the input format (the HTML max is an integer).
-
- String name of element that HTML fragment passed to library will be
- inserted in. An interesting variation would be using span as the
- parent element, meaning that only inline tags would be allowed.
-
- Whether or not to allow proprietary elements and attributes in your
- documents, as per HTMLPurifier_HTMLModule_Proprietary.
- Warning: This can cause your documents to stop
- validating!
-
- Whether or not to permit embed tags in documents, with a number of extra
- security features added to prevent script execution. This is similar to
- what websites like MySpace do to embed tags. Embed is a proprietary
- element and will cause your website to stop validating; you should
- see if you can use %Output.FlashCompat with %HTML.SafeObject instead
- first.
- Whether or not to permit iframe tags in untrusted documents. This
- directive must be accompanied by a whitelist of permitted iframes,
- such as %URI.SafeIframeRegexp, otherwise it will fatally error.
- This directive has no effect on strict doctypes, as iframes are not
- valid.
-
- Whether or not to permit object tags in documents, with a number of extra
- security features added to prevent script execution. This is similar to
- what websites like MySpace do to object tags. You should also enable
- %Output.FlashCompat in order to generate Internet Explorer
- compatibility code for your object tags.
-
- Whether or not to permit script tags to external scripts in documents.
- Inline scripting is not allowed, and the script must match an explicit whitelist.
-
---# vim: et sw=4 sts=4
diff --git a/3rdparty/HTMLPurifier/standalone/HTMLPurifier/ConfigSchema/schema/HTML.Strict.txt b/3rdparty/HTMLPurifier/standalone/HTMLPurifier/ConfigSchema/schema/HTML.Strict.txt
deleted file mode 100644
index d99663a5..00000000
--- a/3rdparty/HTMLPurifier/standalone/HTMLPurifier/ConfigSchema/schema/HTML.Strict.txt
+++ /dev/null
@@ -1,9 +0,0 @@
-HTML.Strict
-TYPE: bool
-VERSION: 1.3.0
-DEFAULT: false
-DEPRECATED-VERSION: 1.7.0
-DEPRECATED-USE: HTML.Doctype
---DESCRIPTION--
-Determines whether or not to use Transitional (loose) or Strict rulesets.
---# vim: et sw=4 sts=4
diff --git a/3rdparty/HTMLPurifier/standalone/HTMLPurifier/ConfigSchema/schema/HTML.TargetBlank.txt b/3rdparty/HTMLPurifier/standalone/HTMLPurifier/ConfigSchema/schema/HTML.TargetBlank.txt
deleted file mode 100644
index d65f0d04..00000000
--- a/3rdparty/HTMLPurifier/standalone/HTMLPurifier/ConfigSchema/schema/HTML.TargetBlank.txt
+++ /dev/null
@@ -1,8 +0,0 @@
-HTML.TargetBlank
-TYPE: bool
-VERSION: 4.4.0
-DEFAULT: FALSE
---DESCRIPTION--
-If enabled, target=blank attributes are added to all outgoing links.
-(This includes links from an HTTPS version of a page to an HTTP version.)
---# vim: et sw=4 sts=4
diff --git a/3rdparty/HTMLPurifier/standalone/HTMLPurifier/ConfigSchema/schema/HTML.TargetNoopener.txt b/3rdparty/HTMLPurifier/standalone/HTMLPurifier/ConfigSchema/schema/HTML.TargetNoopener.txt
deleted file mode 100644
index 05cb3424..00000000
--- a/3rdparty/HTMLPurifier/standalone/HTMLPurifier/ConfigSchema/schema/HTML.TargetNoopener.txt
+++ /dev/null
@@ -1,10 +0,0 @@
---# vim: et sw=4 sts=4
-HTML.TargetNoopener
-TYPE: bool
-VERSION: 4.8.0
-DEFAULT: TRUE
---DESCRIPTION--
-If enabled, noopener rel attributes are added to links which have
-a target attribute associated with them. This prevents malicious
-destinations from overwriting the original window.
---# vim: et sw=4 sts=4
diff --git a/3rdparty/HTMLPurifier/standalone/HTMLPurifier/ConfigSchema/schema/HTML.TargetNoreferrer.txt b/3rdparty/HTMLPurifier/standalone/HTMLPurifier/ConfigSchema/schema/HTML.TargetNoreferrer.txt
deleted file mode 100644
index 993a8170..00000000
--- a/3rdparty/HTMLPurifier/standalone/HTMLPurifier/ConfigSchema/schema/HTML.TargetNoreferrer.txt
+++ /dev/null
@@ -1,9 +0,0 @@
-HTML.TargetNoreferrer
-TYPE: bool
-VERSION: 4.8.0
-DEFAULT: TRUE
---DESCRIPTION--
-If enabled, noreferrer rel attributes are added to links which have
-a target attribute associated with them. This prevents malicious
-destinations from overwriting the original window.
---# vim: et sw=4 sts=4
diff --git a/3rdparty/HTMLPurifier/standalone/HTMLPurifier/ConfigSchema/schema/HTML.TidyAdd.txt b/3rdparty/HTMLPurifier/standalone/HTMLPurifier/ConfigSchema/schema/HTML.TidyAdd.txt
deleted file mode 100644
index 602453f6..00000000
--- a/3rdparty/HTMLPurifier/standalone/HTMLPurifier/ConfigSchema/schema/HTML.TidyAdd.txt
+++ /dev/null
@@ -1,8 +0,0 @@
-HTML.TidyAdd
-TYPE: lookup
-VERSION: 2.0.0
-DEFAULT: array()
---DESCRIPTION--
-
-Fixes to add to the default set of Tidy fixes as per your level.
---# vim: et sw=4 sts=4
diff --git a/3rdparty/HTMLPurifier/standalone/HTMLPurifier/ConfigSchema/schema/HTML.TidyLevel.txt b/3rdparty/HTMLPurifier/standalone/HTMLPurifier/ConfigSchema/schema/HTML.TidyLevel.txt
deleted file mode 100644
index bf943e8f..00000000
--- a/3rdparty/HTMLPurifier/standalone/HTMLPurifier/ConfigSchema/schema/HTML.TidyLevel.txt
+++ /dev/null
@@ -1,24 +0,0 @@
-HTML.TidyLevel
-TYPE: string
-VERSION: 2.0.0
-DEFAULT: 'medium'
---DESCRIPTION--
-
-
General level of cleanliness the Tidy module should enforce.
-There are four allowed values:
-
-
none
-
No extra tidying should be done
-
light
-
Only fix elements that would be discarded otherwise due to
- lack of support in doctype
-
medium
-
Enforce best practices
-
heavy
-
Transform all deprecated elements and attributes to standards
- compliant equivalents
-
-
---ALLOWED--
-'none', 'light', 'medium', 'heavy'
---# vim: et sw=4 sts=4
diff --git a/3rdparty/HTMLPurifier/standalone/HTMLPurifier/ConfigSchema/schema/HTML.TidyRemove.txt b/3rdparty/HTMLPurifier/standalone/HTMLPurifier/ConfigSchema/schema/HTML.TidyRemove.txt
deleted file mode 100644
index 92cca2a4..00000000
--- a/3rdparty/HTMLPurifier/standalone/HTMLPurifier/ConfigSchema/schema/HTML.TidyRemove.txt
+++ /dev/null
@@ -1,8 +0,0 @@
-HTML.TidyRemove
-TYPE: lookup
-VERSION: 2.0.0
-DEFAULT: array()
---DESCRIPTION--
-
-Fixes to remove from the default set of Tidy fixes as per your level.
---# vim: et sw=4 sts=4
diff --git a/3rdparty/HTMLPurifier/standalone/HTMLPurifier/ConfigSchema/schema/HTML.Trusted.txt b/3rdparty/HTMLPurifier/standalone/HTMLPurifier/ConfigSchema/schema/HTML.Trusted.txt
deleted file mode 100644
index bc8e6549..00000000
--- a/3rdparty/HTMLPurifier/standalone/HTMLPurifier/ConfigSchema/schema/HTML.Trusted.txt
+++ /dev/null
@@ -1,9 +0,0 @@
-HTML.Trusted
-TYPE: bool
-VERSION: 2.0.0
-DEFAULT: false
---DESCRIPTION--
-Indicates whether or not the user input is trusted or not. If the input is
-trusted, a more expansive set of allowed tags and attributes will be used.
-See also %CSS.Trusted.
---# vim: et sw=4 sts=4
diff --git a/3rdparty/HTMLPurifier/standalone/HTMLPurifier/ConfigSchema/schema/HTML.XHTML.txt b/3rdparty/HTMLPurifier/standalone/HTMLPurifier/ConfigSchema/schema/HTML.XHTML.txt
deleted file mode 100644
index a3c2f42c..00000000
--- a/3rdparty/HTMLPurifier/standalone/HTMLPurifier/ConfigSchema/schema/HTML.XHTML.txt
+++ /dev/null
@@ -1,11 +0,0 @@
-HTML.XHTML
-TYPE: bool
-DEFAULT: true
-VERSION: 1.1.0
-DEPRECATED-VERSION: 1.7.0
-DEPRECATED-USE: HTML.Doctype
---DESCRIPTION--
-Determines whether or not output is XHTML 1.0 or HTML 4.01 flavor.
---ALIASES--
-Core.XHTML
---# vim: et sw=4 sts=4
diff --git a/3rdparty/HTMLPurifier/standalone/HTMLPurifier/ConfigSchema/schema/Output.CommentScriptContents.txt b/3rdparty/HTMLPurifier/standalone/HTMLPurifier/ConfigSchema/schema/Output.CommentScriptContents.txt
deleted file mode 100644
index 2a137047..00000000
--- a/3rdparty/HTMLPurifier/standalone/HTMLPurifier/ConfigSchema/schema/Output.CommentScriptContents.txt
+++ /dev/null
@@ -1,10 +0,0 @@
-Output.CommentScriptContents
-TYPE: bool
-VERSION: 2.0.0
-DEFAULT: true
---DESCRIPTION--
-Determines whether or not HTML Purifier should attempt to fix up the
-contents of script tags for legacy browsers with comments.
---ALIASES--
-Core.CommentScriptContents
---# vim: et sw=4 sts=4
diff --git a/3rdparty/HTMLPurifier/standalone/HTMLPurifier/ConfigSchema/schema/Output.FixInnerHTML.txt b/3rdparty/HTMLPurifier/standalone/HTMLPurifier/ConfigSchema/schema/Output.FixInnerHTML.txt
deleted file mode 100644
index d215ba2d..00000000
--- a/3rdparty/HTMLPurifier/standalone/HTMLPurifier/ConfigSchema/schema/Output.FixInnerHTML.txt
+++ /dev/null
@@ -1,15 +0,0 @@
-Output.FixInnerHTML
-TYPE: bool
-VERSION: 4.3.0
-DEFAULT: true
---DESCRIPTION--
-
- If true, HTML Purifier will protect against Internet Explorer's
- mishandling of the innerHTML attribute by appending
- a space to any attribute that does not contain angled brackets, spaces
- or quotes, but contains a backtick. This slightly changes the
- semantics of any given attribute, so if this is unacceptable and
- you do not use innerHTML on any of your pages, you can
- turn this directive off.
-
- If true, HTML Purifier will generate Internet Explorer compatibility
- code for all object code. This is highly recommended if you enable
- %HTML.SafeObject.
-
- Newline string to format final output with. If left null, HTML Purifier
- will auto-detect the default newline type of the system and use that;
- you can manually override it here. Remember, \r\n is Windows, \r
- is Mac, and \n is Unix.
-
- If true, HTML Purifier will sort attributes by name before writing them back
- to the document, converting a tag like: <el b="" a="" c="" />
- to <el a="" b="" c="" />. This is a workaround for
- a bug in FCKeditor which causes it to swap attributes order, adding noise
- to text diffs. If you're not seeing this bug, chances are, you don't need
- this directive.
-
- Determines whether or not to run Tidy on the final output for pretty
- formatting reasons, such as indentation and wrap.
-
-
- This can greatly improve readability for editors who are hand-editing
- the HTML, but is by no means necessary as HTML Purifier has already
- fixed all major errors the HTML may have had. Tidy is a non-default
- extension, and this directive will silently fail if Tidy is not
- available.
-
-
- If you are looking to make the overall look of your page's source
- better, I recommend running Tidy on the entire page rather than just
- user-content (after all, the indentation relative to the containing
- blocks will be incorrect).
-
---ALIASES--
-Core.TidyFormat
---# vim: et sw=4 sts=4
diff --git a/3rdparty/HTMLPurifier/standalone/HTMLPurifier/ConfigSchema/schema/Test.ForceNoIconv.txt b/3rdparty/HTMLPurifier/standalone/HTMLPurifier/ConfigSchema/schema/Test.ForceNoIconv.txt
deleted file mode 100644
index d1820cdb..00000000
--- a/3rdparty/HTMLPurifier/standalone/HTMLPurifier/ConfigSchema/schema/Test.ForceNoIconv.txt
+++ /dev/null
@@ -1,7 +0,0 @@
-Test.ForceNoIconv
-TYPE: bool
-DEFAULT: false
---DESCRIPTION--
-When set to true, HTMLPurifier_Encoder will act as if iconv does not exist
-and use only pure PHP implementations.
---# vim: et sw=4 sts=4
diff --git a/3rdparty/HTMLPurifier/standalone/HTMLPurifier/ConfigSchema/schema/URI.AllowedSchemes.txt b/3rdparty/HTMLPurifier/standalone/HTMLPurifier/ConfigSchema/schema/URI.AllowedSchemes.txt
deleted file mode 100644
index 0b0533a7..00000000
--- a/3rdparty/HTMLPurifier/standalone/HTMLPurifier/ConfigSchema/schema/URI.AllowedSchemes.txt
+++ /dev/null
@@ -1,18 +0,0 @@
-URI.AllowedSchemes
-TYPE: lookup
---DEFAULT--
-array (
- 'http' => true,
- 'https' => true,
- 'mailto' => true,
- 'ftp' => true,
- 'nntp' => true,
- 'news' => true,
- 'tel' => true,
-)
---DESCRIPTION--
-Whitelist that defines the schemes that a URI is allowed to have. This
-prevents XSS attacks from using pseudo-schemes like javascript or mocha.
-There is also support for the data and file
-URI schemes, but they are not enabled by default.
---# vim: et sw=4 sts=4
diff --git a/3rdparty/HTMLPurifier/standalone/HTMLPurifier/ConfigSchema/schema/URI.Base.txt b/3rdparty/HTMLPurifier/standalone/HTMLPurifier/ConfigSchema/schema/URI.Base.txt
deleted file mode 100644
index ba473080..00000000
--- a/3rdparty/HTMLPurifier/standalone/HTMLPurifier/ConfigSchema/schema/URI.Base.txt
+++ /dev/null
@@ -1,17 +0,0 @@
-URI.Base
-TYPE: string/null
-VERSION: 2.1.0
-DEFAULT: NULL
---DESCRIPTION--
-
-
- The base URI is the URI of the document this purified HTML will be
- inserted into. This information is important if HTML Purifier needs
- to calculate absolute URIs from relative URIs, such as when %URI.MakeAbsolute
- is on. You may use a non-absolute URI for this value, but behavior
- may vary (%URI.MakeAbsolute deals nicely with both absolute and
- relative paths, but forwards-compatibility is not guaranteed).
- Warning: If set, the scheme on this URI
- overrides the one specified by %URI.DefaultScheme.
-
- Disables all URIs in all forms. Not sure why you'd want to do that
- (after all, the Internet's founded on the notion of a hyperlink).
-
-
---ALIASES--
-Attr.DisableURI
---# vim: et sw=4 sts=4
diff --git a/3rdparty/HTMLPurifier/standalone/HTMLPurifier/ConfigSchema/schema/URI.DisableExternal.txt b/3rdparty/HTMLPurifier/standalone/HTMLPurifier/ConfigSchema/schema/URI.DisableExternal.txt
deleted file mode 100644
index 9132ea4f..00000000
--- a/3rdparty/HTMLPurifier/standalone/HTMLPurifier/ConfigSchema/schema/URI.DisableExternal.txt
+++ /dev/null
@@ -1,11 +0,0 @@
-URI.DisableExternal
-TYPE: bool
-VERSION: 1.2.0
-DEFAULT: false
---DESCRIPTION--
-Disables links to external websites. This is a highly effective anti-spam
-and anti-pagerank-leech measure, but comes at a hefty price: nolinks or
-images outside of your domain will be allowed. Non-linkified URIs will
-still be preserved. If you want to be able to link to subdomains or use
-absolute URIs, specify %URI.Host for your website.
---# vim: et sw=4 sts=4
diff --git a/3rdparty/HTMLPurifier/standalone/HTMLPurifier/ConfigSchema/schema/URI.DisableExternalResources.txt b/3rdparty/HTMLPurifier/standalone/HTMLPurifier/ConfigSchema/schema/URI.DisableExternalResources.txt
deleted file mode 100644
index d74bc1e3..00000000
--- a/3rdparty/HTMLPurifier/standalone/HTMLPurifier/ConfigSchema/schema/URI.DisableExternalResources.txt
+++ /dev/null
@@ -1,13 +0,0 @@
-URI.DisableExternalResources
-TYPE: bool
-VERSION: 1.3.0
-DEFAULT: false
---DESCRIPTION--
-Disables the embedding of external resources, preventing users from
-embedding things like images from other hosts. This prevents access
-tracking (good for email viewers), bandwidth leeching, cross-site request
-forging, goatse.cx posting, and other nasties, but also results in a loss
-of end-user functionality (they can't directly post a pic they posted from
-Flickr anymore). Use it if you don't have a robust user-content moderation
-team.
---# vim: et sw=4 sts=4
diff --git a/3rdparty/HTMLPurifier/standalone/HTMLPurifier/ConfigSchema/schema/URI.DisableResources.txt b/3rdparty/HTMLPurifier/standalone/HTMLPurifier/ConfigSchema/schema/URI.DisableResources.txt
deleted file mode 100644
index 6c106144..00000000
--- a/3rdparty/HTMLPurifier/standalone/HTMLPurifier/ConfigSchema/schema/URI.DisableResources.txt
+++ /dev/null
@@ -1,15 +0,0 @@
-URI.DisableResources
-TYPE: bool
-VERSION: 4.2.0
-DEFAULT: false
---DESCRIPTION--
-
- Disables embedding resources, essentially meaning no pictures. You can
- still link to them though. See %URI.DisableExternalResources for why
- this might be a good idea.
-
-
- Note: While this directive has been available since 1.3.0,
- it didn't actually start doing anything until 4.2.0.
-
- Defines the domain name of the server, so we can determine whether or
- an absolute URI is from your website or not. Not strictly necessary,
- as users should be using relative URIs to reference resources on your
- website. It will, however, let you use absolute URIs to link to
- subdomains of the domain you post here: i.e. example.com will allow
- sub.example.com. However, higher up domains will still be excluded:
- if you set %URI.Host to sub.example.com, example.com will be blocked.
- Note: This directive overrides %URI.Base because
- a given page may be on a sub-domain, but you wish HTML Purifier to be
- more relaxed and allow some of the parent domains too.
-
---# vim: et sw=4 sts=4
diff --git a/3rdparty/HTMLPurifier/standalone/HTMLPurifier/ConfigSchema/schema/URI.HostBlacklist.txt b/3rdparty/HTMLPurifier/standalone/HTMLPurifier/ConfigSchema/schema/URI.HostBlacklist.txt
deleted file mode 100644
index 825fef27..00000000
--- a/3rdparty/HTMLPurifier/standalone/HTMLPurifier/ConfigSchema/schema/URI.HostBlacklist.txt
+++ /dev/null
@@ -1,9 +0,0 @@
-URI.HostBlacklist
-TYPE: list
-VERSION: 1.3.0
-DEFAULT: array()
---DESCRIPTION--
-List of strings that are forbidden in the host of any URI. Use it to kill
-domain names of spam, etc. Note that it will catch anything in the domain,
-so moo.com will catch moo.com.example.com.
---# vim: et sw=4 sts=4
diff --git a/3rdparty/HTMLPurifier/standalone/HTMLPurifier/ConfigSchema/schema/URI.MakeAbsolute.txt b/3rdparty/HTMLPurifier/standalone/HTMLPurifier/ConfigSchema/schema/URI.MakeAbsolute.txt
deleted file mode 100644
index eb58c7f1..00000000
--- a/3rdparty/HTMLPurifier/standalone/HTMLPurifier/ConfigSchema/schema/URI.MakeAbsolute.txt
+++ /dev/null
@@ -1,13 +0,0 @@
-URI.MakeAbsolute
-TYPE: bool
-VERSION: 2.1.0
-DEFAULT: false
---DESCRIPTION--
-
-
- Converts all URIs into absolute forms. This is useful when the HTML
- being filtered assumes a specific base path, but will actually be
- viewed in a different context (and setting an alternate base URI is
- not possible). %URI.Base must be set for this directive to work.
-
- Munges all browsable (usually http, https and ftp)
- absolute URIs into another URI, usually a URI redirection service.
- This directive accepts a URI, formatted with a %s where
- the url-encoded original URI should be inserted (sample:
- http://www.google.com/url?q=%s).
-
-
- Uses for this directive:
-
-
-
- Prevent PageRank leaks, while being fairly transparent
- to users (you may also want to add some client side JavaScript to
- override the text in the statusbar). Notice:
- Many security experts believe that this form of protection does not deter spam-bots.
-
-
- Redirect users to a splash page telling them they are leaving your
- website. While this is poor usability practice, it is often mandated
- in corporate environments.
-
-
-
- Prior to HTML Purifier 3.1.1, this directive also enabled the munging
- of browsable external resources, which could break things if your redirection
- script was a splash page or used meta tags. To revert to
- previous behavior, please use %URI.MungeResources.
-
-
- You may want to also use %URI.MungeSecretKey along with this directive
- in order to enforce what URIs your redirector script allows. Open
- redirector scripts can be a security risk and negatively affect the
- reputation of your domain name.
-
-
- Starting with HTML Purifier 3.1.1, there is also these substitutions:
-
-
-
-
-
Key
-
Description
-
Example <a href="">
-
-
-
-
-
%r
-
1 - The URI embeds a resource (blank) - The URI is merely a link
-
-
-
-
%n
-
The name of the tag this URI came from
-
a
-
-
-
%m
-
The name of the attribute this URI came from
-
href
-
-
-
%p
-
The name of the CSS property this URI came from, or blank if irrelevant
-
-
-
-
-
- Admittedly, these letters are somewhat arbitrary; the only stipulation
- was that they couldn't be a through f. r is for resource (I would have preferred
- e, but you take what you can get), n is for name, m
- was picked because it came after n (and I couldn't use a), p is for
- property.
-
- If true, any URI munging directives like %URI.Munge
- will also apply to embedded resources, such as <img src="">.
- Be careful enabling this directive if you have a redirector script
- that does not use the Location HTTP header; all of your images
- and other embedded resources will break.
-
-
- Warning: It is strongly advised you use this in conjunction
- %URI.MungeSecretKey to mitigate the security risk of an open redirector.
-
- This directive enables secure checksum generation along with %URI.Munge.
- It should be set to a secure key that is not shared with anyone else.
- The checksum can be placed in the URI using %t. Use of this checksum
- affords an additional level of protection by allowing a redirector
- to check if a URI has passed through HTML Purifier with this line:
-
- If the output is TRUE, the redirector script should accept the URI.
-
-
-
- Please note that it would still be possible for an attacker to procure
- secure hashes en-mass by abusing your website's Preview feature or the
- like, but this service affords an additional level of protection
- that should be combined with website blacklisting.
-
-
-
- Remember this has no effect if %URI.Munge is not on.
-
---# vim: et sw=4 sts=4
diff --git a/3rdparty/HTMLPurifier/standalone/HTMLPurifier/ConfigSchema/schema/URI.OverrideAllowedSchemes.txt b/3rdparty/HTMLPurifier/standalone/HTMLPurifier/ConfigSchema/schema/URI.OverrideAllowedSchemes.txt
deleted file mode 100644
index 8b387dea..00000000
--- a/3rdparty/HTMLPurifier/standalone/HTMLPurifier/ConfigSchema/schema/URI.OverrideAllowedSchemes.txt
+++ /dev/null
@@ -1,9 +0,0 @@
-URI.OverrideAllowedSchemes
-TYPE: bool
-DEFAULT: true
---DESCRIPTION--
-If this is set to true (which it is by default), you can override
-%URI.AllowedSchemes by simply registering a HTMLPurifier_URIScheme to the
-registry. If false, you will also have to update that directive in order
-to add more schemes.
---# vim: et sw=4 sts=4
diff --git a/3rdparty/HTMLPurifier/standalone/HTMLPurifier/ConfigSchema/schema/URI.SafeIframeRegexp.txt b/3rdparty/HTMLPurifier/standalone/HTMLPurifier/ConfigSchema/schema/URI.SafeIframeRegexp.txt
deleted file mode 100644
index 7e1f227f..00000000
--- a/3rdparty/HTMLPurifier/standalone/HTMLPurifier/ConfigSchema/schema/URI.SafeIframeRegexp.txt
+++ /dev/null
@@ -1,22 +0,0 @@
-URI.SafeIframeRegexp
-TYPE: string/null
-VERSION: 4.4.0
-DEFAULT: NULL
---DESCRIPTION--
-
- A PCRE regular expression that will be matched against an iframe URI. This is
- a relatively inflexible scheme, but works well enough for the most common
- use-case of iframes: embedded video. This directive only has an effect if
- %HTML.SafeIframe is enabled. Here are some example values:
-
%^http://(www.youtube.com/embed/|player.vimeo.com/video/)% - Allow both
-
-
- Note that this directive does not give you enough granularity to, say, disable
- all autoplay videos. Pipe up on the HTML Purifier forums if this
- is a capability you want.
-