forked from extern/egroupware
8f797be836
- can be used via html class like:
$clean_html = html::purify($html);
- using it now in eTemplate to remove malicious code from html:
a) when displaying "formatted text"
b) when "formatted text" get's input by the user
51 lines
1.5 KiB
PHP
Executable File
51 lines
1.5 KiB
PHP
Executable File
<?php
|
|
|
|
/**
|
|
* Validates name/value pairs in param tags to be used in safe objects. This
|
|
* will only allow name values it recognizes, and pre-fill certain attributes
|
|
* with required values.
|
|
*
|
|
* @note
|
|
* This class only supports Flash. In the future, Quicktime support
|
|
* may be added.
|
|
*
|
|
* @warning
|
|
* This class expects an injector to add the necessary parameters tags.
|
|
*/
|
|
class HTMLPurifier_AttrTransform_SafeParam extends HTMLPurifier_AttrTransform
|
|
{
|
|
public $name = "SafeParam";
|
|
private $uri;
|
|
|
|
public function __construct() {
|
|
$this->uri = new HTMLPurifier_AttrDef_URI(true); // embedded
|
|
}
|
|
|
|
public function transform($attr, $config, $context) {
|
|
// If we add support for other objects, we'll need to alter the
|
|
// transforms.
|
|
switch ($attr['name']) {
|
|
// application/x-shockwave-flash
|
|
// Keep this synchronized with Injector/SafeObject.php
|
|
case 'allowScriptAccess':
|
|
$attr['value'] = 'never';
|
|
break;
|
|
case 'allowNetworking':
|
|
$attr['value'] = 'internal';
|
|
break;
|
|
case 'wmode':
|
|
$attr['value'] = 'window';
|
|
break;
|
|
case 'movie':
|
|
$attr['value'] = $this->uri->validate($attr['value'], $config, $context);
|
|
break;
|
|
// add other cases to support other param name/value pairs
|
|
default:
|
|
$attr['name'] = $attr['value'] = null;
|
|
}
|
|
return $attr;
|
|
}
|
|
}
|
|
|
|
// vim: et sw=4 sts=4
|