Changeset 324

Timestamp:

02/21/2007 05:27:02 AM (6 years ago)

Author:

JavaWoman

Message:

Last bits of implementing workaround for #427:

• modified implementation of htmlspecialchars_ent() (mainly because the $charset parameter is no longer needed, combined with cleaner and more maintainable code structure)
• various additions of missing (or newly needed) @uses tags
• minor clean up here and there

This leaves only GeSHi - if necessary this can be patched if we want to release before there is a new maintance release of GeSHi 1.0.7.x (which should use the same replacement function we do).

Location:

trunk

Files:

• actions/files.php (modified) (1 diff)
• actions/image.php (modified) (1 diff)
• actions/recentchanges.php (modified) (1 diff)
• actions/textsearchexpanded.php (modified) (2 diffs)
• actions/usersettings.php (modified) (3 diffs)
• formatters/code.php (modified) (1 diff)
• formatters/email.php (modified) (1 diff)
• formatters/ini.php (modified) (2 diffs)
• formatters/wakka.php (modified) (3 diffs)
• handlers/page/edit.php (modified) (5 diffs)
• handlers/page/processcomment.php (modified) (1 diff)
• handlers/page/recentchanges.xml.mm.php (modified) (2 diffs)
• handlers/page/recentchanges.xml.php (modified) (1 diff)
• handlers/page/referrers_sites.php (modified) (2 diffs)
• handlers/page/revisions.xml.php (modified) (1 diff)
• libs/Wakka.class.php (modified) (3 diffs)

trunk/actions/files.php

@@ -28 +28 @@
  * @uses        Wakka::IsAdmin()
  * @uses        Wakka::MiniHref()
+ * @uses        Wakka::htmlspecialchars_ent()
  *
  * @todo security: check file type, not only extension

trunk/actions/image.php

@@ -10 +10 @@
  * @uses        Wakka::Link()
  * @uses        Wakka::ReturnSafeHTML()
+ * @uses        Wakka::htmlspecialchars_ent()
  * @input       string $url mandatory: URL of image to be embedded
  * @input       string $link optional: target link for image (optional). Supports URL, WikiName links, InterWiki links etc.

trunk/actions/recentchanges.php

@@ -17 +17 @@
  * @uses                Wakka::HasAccess()
  * @uses                Wakka::LoadUser()
+ * @uses                Wakka::htmlspecialchars_ent()
  * 
  * @todo                make datetime format configurable;

trunk/actions/textsearchexpanded.php

@@ -82 +82 @@
                                         $matchString[0] = array_splice($matchString[0], SEARCH_MAX_SNIPPETS, count($matchString));
                                 }
-                                $text = $this->htmlspecialchars_ent(implode('<br />', $matchString[0]));
-                                $text = str_replace('&lt;br /&gt;', '&hellip;<br />&hellip;', $text);
+                                $text = $this->htmlspecialchars_ent(implode('<br />', $matchString[0]));        //TODO could be done in a single step
+                                $text = str_replace('&lt;br /&gt;', '&hellip;<br />&hellip;', $text);           //TODO could be done in a single step
                          # CSS-driven highlighting, tse stands for textsearchexpanded. We highlight $text in 2 steps, 
                          #  We do not use <span>..</span> with preg_replace to ensure that the tag `span' won't be replaced if
@@ -107 +107 @@
                         break;
         }
-        printf(SEARCH_RESULTS.": <strong>".$match_str."</strong> for <strong>".$this->htmlspecialchars_ent($phrase)."</strong><br />\n", $total_results); #i18n
+        printf(SEARCH_RESULTS.": <strong>".$match_str."</strong> for <strong>".$this->htmlspecialchars_ent($phrase)."</strong><br />\n", $total_results);
         $result_page_list = $this->ReturnSafeHtml($result_page_list);
         echo '<ol>'.$result_page_list.'</ol>'."\n";

trunk/actions/usersettings.php

@@ -12 +12 @@
  * @author              {@link http://wikkawiki.org/NilsLindenberg Nils Lindenberg} (possibility to restrict registration)
  *
+ * @uses                Wakka::htmlspecialchars_ent()
+ * 
  * @todo                use different actions for registration / login / user settings;
  * @todo                add documentation links or short explanations for each option;
@@ -97 +99 @@
 
                 // validate form input
-                switch(TRUE)
+                switch (TRUE)
                 {
                         case (strlen($email) == 0): //email is empty
@@ -148 +150 @@
         <input type="hidden" name="action" value="update" />
         <?php printf(USER_LOGGED_IN_AS_CAPTION, $this->Link($user['name'])); ?>
-        <input id="logout" type="button" value="<?php echo LOGOUT_BUTTON; ?>" onclick="document.location='<?php echo $this->href('', '', 'action=logout'); ?>'" />
+        <input id="logout" type="button" value="<?php echo LOGOUT_BUTTON; ?>" onclick="document.location='<?php echo $this->Href('', '', 'action=logout'); ?>'" />
         </fieldset>
         

trunk/formatters/code.php

@@ -7 +7 @@
  * @license http://www.gnu.org/copyleft/gpl.html GNU General Public License
  * @filesource
+ * 
+ * @uses        Wakka::hsc_secure()
  */
-print("<pre>".htmlspecialchars($text, ENT_QUOTES)."</pre>");
+echo '<pre>'.$this->hsc_secure($text,ENT_QUOTES).'</pre>';      #427
 ?>

trunk/formatters/email.php

@@ -7 +7 @@
  * @license http://www.gnu.org/copyleft/gpl.html GNU General Public License
  * @filesource
+ * 
+ * @uses        Wakka::htmlspecialchars_ent()
  */
 

trunk/formatters/ini.php

@@ -7 +7 @@
  * @license http://www.gnu.org/copyleft/gpl.html GNU General Public License
  * @filesource
+ * 
+ * @uses        Wakka::hsc_secure()
  */
 
-$text = htmlspecialchars($text, ENT_QUOTES);
+$text = $this->hsc_secure($text,ENT_QUOTES);    #427
 
 $text = preg_replace("/([=,\|]+)/m","<span style=\"color:#4400DD\">\\1</span>",$text);
@@ -16 +18 @@
 $text = preg_replace("/^(\[.*\])/m","<strong style=\"color:#AA0000;background:#EEE0CC\">\\1</strong>",$text);
 print "<pre>".$text."</pre>";
-
 ?>

trunk/formatters/wakka.php

@@ -16 +16 @@
  * @author {@link http://wikkawiki.org/DarTar Dario Taraborelli} (grab handler and filename support for codeblocks)
  * @author {@link http://wikkawiki.org/TormodHaugen Tormod Haugen} (table formatter support)
+ * 
+ * @uses        Wakka::htmlspecialchars_ent()
  * 
  * @todo                add support for formatter plugins;
@@ -488 +490 @@
                                 }
                                 // use GeSHi for highlighting
-                                $output .= $wakka->GeSHi_Highlight($code, $language, $start);
+                                $output .= $wakka->GeSHi_Highlight($code, $language, $start); //TODO make GeSHi_Highlight() add a "\n" at the end (as well as the comments, maybe)
                         }
                         // check Wikka highlighter path is set and if we have an internal Wikka highlighter
@@ -671 +673 @@
                                 // WARNING: JS vulnerability: two minus signs are not allowed in a comment, so we replace any occurence of them by underscore.
                                 // Consider the code ||(p--><font size=1px><a href=...<!--:blabla
-                                // When migrating to utf-8, we could use str_replace('--', '−−', $key) to make things more pretty.
+                                // When migrating to utf-8, we could use str_replace('--', '−−', $key) to make things more pretty. //TODO garbled ... mdash?
                                 echo '<!--Cannot find attribute for key "'.str_replace('--', '__', $key).'" from hints given.-->'."\n";
                         }

trunk/handlers/page/edit.php

@@ -28 +28 @@
  * @uses Wakka::Href()
  * @uses Wakka::htmlspecialchars_ent()
+ * @uses Wakka::hsc_secure()
  * @uses Wakka::LoadSingle()
  * @uses Wakka::Redirect()
@@ -140 +141 @@
         }
 
-         //check if edit_notes are enabled
+        // create edit note field if edit_notes are enabled
         if ($this->config['require_edit_note'] != 2)
         {
-                #$edit_note_field = '<input id="note" size="'.MAX_EDIT_NOTE_LENGTH.'" type="text" name="note" value="'.htmlspecialchars($note).'" '.$highlight_note.'/> <label for="note">'.EDIT_NOTE_LABEL.'</label><br />'."\n";
+                // We need to escape ALL entity refs before display so we display them _as_ entities instead of interpreting them
+                // so we use hsc_secure() on the edit note (as on the body)
                 $edit_note_field = '<input id="note" size="'.MAX_EDIT_NOTE_LENGTH.'" type="text" name="note" value="'.$this->hsc_secure($note).'" '.$highlight_note.'/> <label for="note">'.EDIT_NOTE_LABEL.'</label><br />'."\n";      #427
         }
@@ -164 +166 @@
         if (isset($_POST['submit']) && $_POST['submit'] == EDIT_PREVIEW_BUTTON)
         {
-                // We need to escape ALL entity refs before display so we display them _as_ entities instead of interpreting them
-                // so we use htmlspecialchars on the edit note (as on the body)
                 $preview_buttons =      '<fieldset><legend>'.EDIT_STORE_PAGE_LEGEND.'</legend>'."\n".
                                                         $edit_note_field.
@@ -176 +176 @@
                 $preview_form .= '<input type="hidden" name="previous" value="'.$previous.'" />'."\n".
                         // We need to escape ALL entity refs before display so we display them _as_ entities instead of interpreting them
-                        // hence htmlspecialchars() instead of htmlspecialchars_ent() which UNescapes entities!
-                        #'<input type="hidden" name="body" value="'.htmlspecialchars($body).'" />'."\n";
+                        // hence hsc_secure() instead of htmlspecialchars_ent() which UNescapes entities!
+                        // JW/2007-02-20: why is this? wouldn't it be  easier for the person editing to show actual characters instead of entities?  
                         '<input type="hidden" name="body" value="'.$this->hsc_secure($body).'" />'."\n";        #427
                 $preview_form .= $preview_buttons."\n";
@@ -232 +232 @@
                 $output .= '<input type="hidden" name="previous" value="'.$previous.'" />'."\n".
                         // We need to escape ALL entity refs before display so we display them _as_ entities instead of interpreting them
-                        // hence htmlspecialchars() instead of htmlspecialchars_ent() which UNescapes entities!
-                        #'<textarea id="body" name="body">'.htmlspecialchars($body).'</textarea><br />'."\n";
+                        // hence hsc_secure() instead of htmlspecialchars_ent() which UNescapes entities!
+                        // JW/2007-02-20: why is this? wouldn't it be  easier for the person editing to show actual characters instead of entities?  
                         '<textarea id="body" name="body">'.$this->hsc_secure($body).'</textarea><br />'."\n";   #427
-                        //note add Edit
-                        // We need to escape ALL entity refs before display so we display them _as_ entities instead of interpreting them
-                        // so we use htmlspecialchars on the edit note (as on the body)
-                        // JW/2007-02-20: why is this? wouldn't it be  easier for the preson editing to show actual characters instead of entities?  
                 if ($buttons_position == 'bottom')
                 {

trunk/handlers/page/processcomment.php

@@ -16 +16 @@
  * @uses        Wakka::SaveComment()
  * @uses        Wakka::UserIsOwner()
+ * @uses        Wakka::htmlspecialchars_ent()
+ * 
  * @todo        move main <div> to templating class
  */

trunk/handlers/page/recentchanges.xml.mm.php

@@ -40 +40 @@
                 if (($c <= $max) || !$max)
                 {
-                        $pageuser = $this->htmlspecialchars_ent($page["user"], '', '', 'XML'); #Just in case...
-                        $pagetag = $this->htmlspecialchars_ent($page["tag"], '', '', 'XML');
+                        $pageuser = $this->htmlspecialchars_ent($page['user'],ENT_COMPAT,'XML'); #Just in case...
+                        $pagetag = $this->htmlspecialchars_ent($page['tag'],ENT_COMPAT,'XML');
 
                         // day header
@@ -57 +57 @@
                         $timeformatted = date("H:i T", strtotime($page["time"]));
                         $xml .= "<node LINK=\"$pagelink/revisions\" TEXT=\"Revision time: $timeformatted\"/>\n";
-                        if ($pagenote = $this->htmlspecialchars_ent($page["note"], '', '', 'XML')) {
+                        if ($pagenote = $this->htmlspecialchars_ent($page['note'],ENT_COMPAT,'XML')) {
                                 $xml .= "<node TEXT=\"$pageuser: $pagenote\"/>\n";
                         } else {

trunk/handlers/page/recentchanges.xml.php

@@ -50 +50 @@
                         $xml .= "<title>".$this->htmlspecialchars_ent($page["tag"])."</title>\n";
                         $xml .= "<link>".$this->Href("show", $page["tag"], "time=".urlencode($page["time"]))."</link>\n";
-                        #$xml .= "\t<description>".sprintf(WIKKA_REV_WHEN_BY_WHO, $page['time'], $this->htmlspecialchars_ent($page["user"], '', '', 'XML')).($page['note'] ? ' - '.$this->htmlspecialchars_ent($page['note'], '', '', 'XML') : '')."</description>\n";
                         $xml .= "\t<description>".sprintf(WIKKA_REV_WHEN_BY_WHO, $page['time'], $this->htmlspecialchars_ent($page["user"], '', '', 'XML')).($page['note'] ? ' - '.$this->htmlspecialchars_ent($page['note'],ENT_COMPAT,'XML') : '')."</description>\n";
                         //$xml .= "\t<guid>".$page["id"]."</guid>";

trunk/handlers/page/referrers_sites.php

@@ -16 +16 @@
  * @uses                Wakka::GetUser()
  * @uses                Wakka::Href()
+ * @uses                Wakka::htmlspecialchars_ent()
  * 
  * @todo                move <div> to template
@@ -101 +102 @@
                 foreach ($referrer_sites as $site => $site_count)
                 {
+                        $site_esc = $this->htmlspecialchars_ent($site);
                         print("<tr>");
                         print("<td width=\"30\" align=\"right\" valign=\"top\" style=\"padding-right: 10px\">$site_count</td>");
-                        print("<td valign=\"top\">" . (($site != "unknown") ? "<a href=\"http://".$this->htmlspecialchars_ent($site)."\">".$this->htmlspecialchars_ent($site)."</a>" : $site) . "</a> ".($IsAdmin ? "[<a href=\"".$this->href("delete_referrer", "", "spam_site=").$this->htmlspecialchars_ent($site)."&amp;redirect=".$this->GetMethod().'">'.BLACKLIST_LINK_DESC."</a>]" : "")."</td>");
+                        print("<td valign=\"top\">" . (($site != "unknown") ? "<a href=\"http://".$site_esc."\">".$site_esc."</a>" : $site) . "</a> ".($IsAdmin ? "[<a href=\"".$this->href("delete_referrer", "", "spam_site=").$site_esc."&amp;redirect=".$this->GetMethod().'">'.BLACKLIST_LINK_DESC."</a>]" : "")."</td>");
                         print("</tr>\n");
                 }

trunk/handlers/page/revisions.xml.php

@@ -46 +46 @@
                         $xml .= "<title>".$page["time"]."</title>\n";
                         $xml .= '<link>'.$this->Href('show', '', 'time='.urlencode($page['time'])).'</link>'."\n";
-                        #$xml .= '<description>'.sprintf(REVISIONS_EDITED_BY, $this->htmlspecialchars_ent($page["user"])).($page['note'] ? ' - '.$this->htmlspecialchars_ent($page['note'], '', '', 'XML') : '')."</description>\n";
                         $xml .= '<description>'.sprintf(REVISIONS_EDITED_BY, $this->htmlspecialchars_ent($page["user"])).($page['note'] ? ' - '.$this->htmlspecialchars_ent($page['note'],ENT_COMPAT,'XML') : '')."</description>\n";
                         $xml .= "\t<pubDate>".date("r",strtotime($page["time"]))."</pubDate>\n";               

trunk/libs/Wakka.class.php

@@ -399 +399 @@
 
         /**
-#        * Wrapper around PHP's htmlspecialchars() which preserves (repairs) entity references.
          * Wrapper around hsc_secure() which preserves entity references.
          *
-#        * The function accepts the same parameters as htmlspecialchars() in PHP and passes them on
-#        * to that function.
-         * The function accepts the same parameters as htmlspecialchars() in PHP and 
-         * passes them on to our hsc_secure() replacement for that function.
-         *
-         * One default here is different here from that in htmlspecialchars() in PHP:
-         * charset is set to UTF-8 so we're ready for UTF-8 support (and as long as we don't support
-         * that there should be no difference with Latin-1); on systems where the charset parameter
-         * is not available or UTF-8 is not supported this will revert to Latin-1 (ISO-8859-1).
-         * ### updatee ^^
-         *
-#        * The function first applies htmlspecialchars() to the input string and then "unescapes"
-         * The function first applies hsc_secure() to the input string and then "unescapes"
-         * character entity references and numeric character references (both decimal and hexadecimal).
-         * Entities are recognized also if the ending semicolon is omitted at the end or before a
-         * newline or tag but for consistency the semicolon is always added in the output where it was
-         * omitted.
-         *
-         * NOTE:
-#        * Where code should be rendered _as_code_ the original PHP function should be used so that
-         * Where code should be rendered _as_code_ hsc_secure() should be used directly so that
-         * entity references are also rendered as such instead of as their corresponding characters.
-         * 
-         * NOTE2:
+         * The first two parameters for this function as the same as those for 
+         * htmlspecialchars() in PHP: the text to be treated, and an optional
+         * parameter determining how to handle quotes; both these parameters are 
+         * passed on to our hsc_secure() replacement for htmlspecialchars().
+         * 
+         * Since hsc_secure() does not need a character set parameter, we don't
+         * have that here any more either.
+         * 
+         * A third 'doctype' parameter is for local use only and determines how 
+         * pre-existing entity references are treated after hsc_secure() has done 
+         * its work: numeic entity references are always "unescaped' since they are
+         * valid for both HTML and XML doctypes; for XML the named entity references
+         * for the special characters are unescaped as well, while for for HTML any
+         * named entity reference is unescaped. This parameter is optional and 
+         * defaults to HTML.   
+         *
+         * The function first applies hsc_secure() to the input string and then 
+         * "unescapes" character entity references and numeric character references 
+         * (both decimal and hexadecimal).
+         * Entities are recognized also if the ending semicolon is omitted at the 
+         * end or before a newline or tag but for consistency the semicolon is 
+         * always added in the output where it was omitted.
+         *
+         * Usage note:
+         * Where code should be rendered <em>as code</em> hsc_secure() should be 
+         * used directly so that entity references are also rendered as such instead 
+         * of as their corresponding characters.
+         * 
+         * Documentation note:
          * It seems the $doctype parameter was added in 1.1.6.2; version should have 
          * been bumped up to 1.1, and the param documented. We'll assume the updated
@@ -437 +441 @@
          * @uses        Wakka::hsc_secure()
          * @param       string  $text required: text to be converted
-         * @param       integer $quote_style optional: quoting style - can be ENT_COMPAT (default, escape
-         *                      only double quotes), ENT_QUOTES (escape both double and single quotes) or
-         *                      ENT_NOQUOTES (don't escape any quotes)
-         * @param       string  $charset optional: charset to use while converting; default UTF-8
-         *                      (overriding PHP's default ISO-8859-1)
+         * @param       integer $quote_style optional: quoting style - can be ENT_COMPAT 
+         *                      (default, escape only double quotes), ENT_QUOTES (escape both 
+         *                      double and single quotes) or ENT_NOQUOTES (don't escape any 
+         *                      quotes)
          * @param       string $doctype 'HTML' (default) or 'XML'; for XML only the XML
          *                      standard entities are unescaped so we'll have valid XML content
-         * @return      string  converted string with escaped special characted but entity references intact
-         * 
-         * @todo        rewrite to eliminate the $charset parameter which is suplerflous
-         *                      for our hsc_secure() replacement function.
-         * @todo        extend valid character entities for XML with 'apos'
-         * @todo        (later) support full range of situations where (in SGML) a terminating ; may legally
-         *                      be omitted (end, newline and tag are merely the most common ones).
-         * @todo        (maybe) recognize valid html entities and only leave those alone, thus transform &error; to &amp;error;
-         */
-        function htmlspecialchars_ent($text,$quote_style=ENT_COMPAT,$charset='UTF-8',$doctype='HTML')
-        {
+         * @return      string  converted string with escaped special characted but 
+         *                      entity references intact
+         * 
+         * @todo        (maybe) recognize valid html entities and only leave those 
+         *                      alone, thus transform &error; to &amp;error;
+         * @todo        later - maybe) support full range of situations where (in SGML) 
+         *                      a terminating ; may legally be omitted (end, newline and tag are 
+         *                      merely the most common ones); such usage is quite rare though 
+         *                      and may not be worth the effort
+         */
+        function htmlspecialchars_ent($text,$quote_style=ENT_COMPAT,$doctype='HTML')
+        {
+                // re-establish default if overwritten because of third parameter
+                // [ENT_COMPAT] => 2
+            // [ENT_QUOTES] => 3
+            // [ENT_NOQUOTES] => 0
+                if (!in_array($quote_style,array(ENT_COMPAT,ENT_QUOTES,ENT_NOQUOTES))) {
+                        $quote_style = ENT_COMPAT;      
+                }
+                
                 // define patterns
-                $alpha  = '[a-z]+';                                                     # character entity reference todo: $alpha='eacute|egrave|ccirc|...'
-                $ignore_case = 'i';
-                if ($doctype == 'XML')
+                $terminator = ';|(?=($|[\n<]|&lt;))';   // semicolon; or end-of-string, newline or tag
+                $numdec = '#[0-9]+';                                    // numeric character reference (decimal)
+                $numhex = '#x[0-9a-f]+';                                // numeric character reference (hexadecimal)
+                if ($doctype == 'XML')                                  // pure XML allows only named entities for special chars
                 {
                         // only valid named entities in XML (case-sensitive)
-                        $alpha = 'lt|gt|quot|apos|amp';                 
+                        $named = 'lt|gt|quot|apos|amp';                 
                         $ignore_case = '';
-                        // enforce defaults if defaults were "undefaulted"
-                        if ($quote_style === '') $quote_style = ENT_COMPAT;
-                        if ($charset === '') $charset = 'UTF-8';
-                }
-                $numdec = '#[0-9]+';                                            # numeric character reference (decimal)
-                $numhex = '#x[0-9a-f]+';                                        # numeric character reference (hexadecimal)
-                $terminator = ';|(?=($|[\n<]|&lt;))';           # semicolon; or end-of-string, newline or tag
-                $entitystring = $alpha.'|'.$numdec.'|'.$numhex;
+                        $entitystring = $named.'|'.$numdec.'|'.$numhex;
+                }
+                else                                                                    // (X)HTML
+                {
+                        $alpha  = '[a-z]+';                                     // character entity reference TODO $named='eacute|egrave|ccirc|...'
+                        $ignore_case = 'i';                                     // names can consist of upper and lower case letters
+                        $entitystring = $alpha.'|'.$numdec.'|'.$numhex;
+                }
                 $escaped_entity = '&amp;('.$entitystring.')('.$terminator.')';
 
-                #// execute PHP built-in function, passing on optional parameters
-                #$output = htmlspecialchars($text,$quote_style,$charset);
                 // execute our replacement hsc_secure() function, passing on optional parameters
-                $output = $this->hsc_secure($text,$quote_style,$charset);
+                $output = $this->hsc_secure($text,$quote_style);
+
                 // "repair" escaped entities
                 // modifiers: s = across lines, i = case-insensitive
                 $output = preg_replace('/'.$escaped_entity.'/s'.$ignore_case,"&$1;",$output);
+
                 // return output
                 return $output;
@@ -1280 +1293 @@
                         }
                         if ($ping["history"]) $rpcRequest .= "<member>\n<name>history</name>\n<value>".$ping["history"]."</value>\n</member>\n";
-                        if ($ping["changelog"]) $rpcRequest .= "<member>\n<name>changelog</name>\n<value>".$this->htmlspecialchars_ent($ping["changelog"], '', '', 'XML')."</value>\n</member>\n";
+                        #if ($ping["changelog"]) $rpcRequest .= "<member>\n<name>changelog</name>\n<value>".$this->htmlspecialchars_ent($ping["changelog"], '', '', 'XML')."</value>\n</member>\n";
+                        if ($ping["changelog"]) $rpcRequest .= "<member>\n<name>changelog</name>\n<value>".$this->htmlspecialchars_ent($ping["changelog"],ENT_COMPAT,'XML')."</value>\n</member>\n";
                         $rpcRequest .= "</struct>\n</value>\n</param>\n";
                         $rpcRequest .= "</params>\n";