PageRenderTime 151ms CodeModel.GetById 13ms RepoModel.GetById 0ms app.codeStats 1ms

/common/libraries/plugin/kses-0.2.2/oop/php5.class.kses.php

https://bitbucket.org/renaatdemuynck/chamilo
PHP | 1132 lines | 542 code | 89 blank | 501 comment | 86 complexity | d491471df24a584b78d1e591b4be0499 MD5 | raw file
Possible License(s): BSD-3-Clause, LGPL-2.1, LGPL-3.0, GPL-3.0, MIT, GPL-2.0 
    

  1. <?php

    2. 

  2. 

    3. 

  3. /*

    4. 

  4. 	 * ==========================================================================================

    5. 

  5. 	 *

    6. 

  6. 	 * This program is free software and open source software; you can redistribute

    7. 

  7. 	 * it and/or modify it under the terms of the GNU General Public License as

    8. 

  8. 	 * published by the Free Software Foundation; either version 2 of the License,

    9. 

  9. 	 * or (at your option) any later version.

    10. 

  10. 	 *

    11. 

  11. 	 * This program is distributed in the hope that it will be useful, but WITHOUT

    12. 

  12. 	 * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or

    13. 

  13. 	 * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for

    14. 

  14. 	 * more details.

    15. 

  15. 	 *

    16. 

  16. 	 * You should have received a copy of the GNU General Public License along

    17. 

  17. 	 * with this program; if not, write to the Free Software Foundation, Inc.,

    18. 

  18. 	 * 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA  or visit

    19. 

  19. 	 * http://www.gnu.org/licenses/gpl.html

    20. 

  20. 	 *

    21. 

  21. 	 * ==========================================================================================

    22. 

  22. 	 */

    23. 

  23. 

    24. 

  24. /**

    25. 

  25.  * Class file for PHP5 OOP version of kses

    26. 

  26.  *

    27. 

  27.  * This is an updated version of kses to work with PHP5 that works under E_STRICT.

    28. 

  28.  *

    29. 

  29.  * This version is a bit of a rewrite to match my own coding style and use some of the

    30. 

  30.  * capabilities allowed in PHP5.  Since this was a significant rewrite, but it still

    31. 

  31.  * maintains backward compatibility syntax-wise, the version number is now 1.0.0.  Any

    32. 

  32.  * minor changes that do not break compatibility will be indicated in the second or third

    33. 

  33.  * digits.  Anything that breaks compatibility will change the major version number.

    34. 

  34.  *

    35. 

  35.  * PHP5 specific changes:

    36. 

  36.  * + Private methods are now in place

    37. 

  37.  * + __construct() is now used rather then the standard class name 'kses()'

    38. 

  38.  * + Kses will not load in any version less that PHP5

    39. 

  39.  * Other modifications:

    40. 

  40.  * + PHPdoc style documentation has been added to the class.  See http://www.phpdoc.org/ for more info.

    41. 

  41.  * + Method names have been changed to reflect status as verbs

    42. 

  42.  * + One line methods have been folded into the code

    43. 

  43.  * + Some methods are now deprecated due to nomenclature style change.  See method documentation for specifics.

    44. 

  44.  * + Kses5 now works in E_STRICT

    45. 

  45.  * + Version number is 1.0.0 to reflect serious code changes

    46. 

  46.  * + Addition of methods AddProtocols(), filterKsestextHook(), RemoveProtocol(), RemoveProtocols() and SetProtocols()

    47. 

  47.  * + Deprecated _hook(), Protocols()

    48. 

  48.  *

    49. 

  49.  * @package    kses

    50. 

  50.  * @subpackage kses5

    51. 

  51.  */

    52. 

  52. 

    53. 

  53. if (substr(phpversion(), 0, 1) < 5)

    54. 

  54. {

    55. 

  55.     die("Class kses requires PHP 5 or higher.");

    56. 

  56. }

    57. 

  57. 

    58. 

  58. /**

    59. 

  59.  * Only install KSES5 once

    60. 

  60.  */

    61. 

  61. if (! defined('KSES_CLASS_PHP5'))

    62. 

  62. {

    63. 

  63.     define('KSES_CLASS_PHP5', true);

    64. 

  64.     

    65. 

  65.     /**

    66. 

  66.      * Kses strips evil scripts!

    67. 

  67.      *

    68. 

  68.      * This class provides the capability for removing unwanted HTML/XHTML, attributes from

    69. 

  69.      * tags, and protocols contained in links.  The net result is a much more powerful tool

    70. 

  70.      * than the PHP internal strip_tags()

    71. 

  71.      *

    72. 

  72.      * This is a fork of a slick piece of procedural code called 'kses' written by Ulf Harnhammar.

    73. 

  73.      *

    74. 

  74.      * The original class for PHP4 was basically a wrapper around all of the functions in

    75. 

  75.      * the procedural code written by Ulf, and was released 7/25/2003.

    76. 

  76.      *

    77. 

  77.      * This version is a bit of a rewrite to match my own coding style and use some of the

    78. 

  78.      * capabilities allowed in PHP5.  Since this was a significant rewrite, but it still

    79. 

  79.      * maintains backward compatibility syntax-wise, the version number is now 1.0.0.  Any

    80. 

  80.      * minor changes that do not break compatibility will be indicated in the second or third

    81. 

  81.      * digits.  Anything that breaks compatibility will change the major version number.

    82. 

  82.      *

    83. 

  83.      * PHP5 specific changes:

    84. 

  84.      * + Private methods are now in place

    85. 

  85.      * + __construct() is now used rather then the standard class name 'kses()'

    86. 

  86.      * + Kses5 will not load in any version less that PHP5

    87. 

  87.      * Other modifications:

    88. 

  88.      * + PHPdoc style documentation has been added to the class.  See http://www.phpdoc.org/ for more info.

    89. 

  89.      * + Method names have been changed to reflect status as verbs

    90. 

  90.      * + One line methods have been folded into the code

    91. 

  91.      * + Some methods are now deprecated due to nomenclature style change.  See method documentation for specifics.

    92. 

  92.      * + Kses now works in E_STRICT

    93. 

  93.      * + Initial Version number set to 1.0.0 to reflect serious code changes

    94. 

  94.      * + Addition of methods AddProtocols(), filterKsestextHook(), RemoveProtocol(), RemoveProtocols() and SetProtocols()

    95. 

  95.      * + Deprecated _hook(), Protocols()

    96. 

  96.      * + Integrated code from kses 0.2.2 into class.

    97. 

  97.      * + Added methods DumpProtocols(), DumpMethods()

    98. 

  98.      *

    99. 

  99.      * @author     Richard R. V�squez, Jr. (Original procedural code by Ulf H�rnhammar)

    100. 

  100.      * @link       http://sourceforge.net/projects/kses/ Home Page for Kses

    101. 

  101.      * @link       http://chaos.org/contact/ Contact page with current email address for Richard Vasquez

    102. 

  102.      * @copyright  Richard R. V�squez, Jr. 2005

    103. 

  103.      * @version    PHP5 OOP 1.0.2

    104. 

  104.      * @license    http://www.gnu.org/licenses/gpl.html GNU Public License

    105. 

  105.      * @package    kses

    106. 

  106.      */

    107. 

  107.     class kses5

    108. 

  108.     {

    109. 

  109.         /**#@+

    110. 

  110.          * @access private

    111. 

  111.          * @var array

    112. 

  112.          */

    113. 

  113.         private $allowed_protocols;

    114. 

  114.         private $allowed_html;

    115. 

  115. 

    116. 

  116.         /**#@-*/

    117. 

  117.         

    118. 

  118.         /**

    119. 

  119.          * Constructor for kses.

    120. 

  120.          *

    121. 

  121.          * This sets a default collection of protocols allowed in links, and creates an

    122. 

  122.          * empty set of allowed HTML tags.

    123. 

  123.          * @since PHP5 OOP 1.0.0

    124. 

  124.          */

    125. 

  125.         public function __construct()

    126. 

  126.         {

    127. 

  127.             /**

    128. 

  128.              * You could add protocols such as ftp, new, gopher, mailto, irc, etc.

    129. 

  129.              *

    130. 

  130.              * The base values the original kses provided were:

    131. 

  131.              * 'http', 'https', 'ftp', 'news', 'nntp', 'telnet', 'gopher', 'mailto'

    132. 

  132.              */

    133. 

  133.             $this->allowed_protocols = array('http', 'ftp', 'mailto');

    134. 

  134.             $this->allowed_html = array();

    135. 

  135.         }

    136. 

  136. 

    137. 

  137.         /**

    138. 

  138.          * Basic task of kses - parses $string and strips it as required.

    139. 

  139.          *

    140. 

  140.          * This method strips all the disallowed (X)HTML tags, attributes

    141. 

  141.          * and protocols from the input $string.

    142. 

  142.          *

    143. 

  143.          * @access public

    144. 

  144.          * @param string $string String to be stripped of 'evil scripts'

    145. 

  145.          * @return string The stripped string

    146. 

  146.          * @since PHP4 OOP 0.0.1

    147. 

  147.          */

    148. 

  148.         public function Parse($string = "")

    149. 

  149.         {

    150. 

  150.             if (get_magic_quotes_gpc())

    151. 

  151.             {

    152. 

  152.                 $string = stripslashes($string);

    153. 

  153.             }

    154. 

  154.             $string = $this->removeNulls($string);

    155. 

  155.             //	Remove JavaScript entities from early Netscape 4 versions

    156. 

  156.             $string = preg_replace('%&\s*\{[^}]*(\}\s*;?|$)%', '', $string);

    157. 

  157.             $string = $this->normalizeEntities($string);

    158. 

  158.             $string = $this->filterKsesTextHook($string);

    159. 

  159.             $string = preg_replace('%(<' . '[^>]*' . '(>|$)' . '|>)%e', "\$this->stripTags('\\1')", $string);

    160. 

  160.             return $string;

    161. 

  161.         }

    162. 

  162. 

    163. 

  163.         /**

    164. 

  164.          * Allows for single/batch addition of protocols

    165. 

  165.          *

    166. 

  166.          * This method accepts one argument that can be either a string

    167. 

  167.          * or an array of strings.  Invalid data will be ignored.

    168. 

  168.          *

    169. 

  169.          * The argument will be processed, and each string will be added

    170. 

  170.          * via AddProtocol().

    171. 

  171.          *

    172. 

  172.          * @access public

    173. 

  173.          * @param mixed , A string or array of protocols that will be added to the internal list of allowed protocols.

    174. 

  174.          * @return bool Status of adding valid protocols.

    175. 

  175.          * @see AddProtocol()

    176. 

  176.          * @since PHP5 OOP 1.0.0

    177. 

  177.          */

    178. 

  178.         public function AddProtocols()

    179. 

  179.         {

    180. 

  180.             $c_args = func_num_args();

    181. 

  181.             if ($c_args != 1)

    182. 

  182.             {

    183. 

  183.                 trigger_error("kses5::AddProtocols() did not receive an argument.", E_USER_WARNING);

    184. 

  184.                 return false;

    185. 

  185.             }

    186. 

  186.             

    187. 

  187.             $protocol_data = func_get_arg(0);

    188. 

  188.             

    189. 

  189.             if (is_array($protocol_data) && count($protocol_data) > 0)

    190. 

  190.             {

    191. 

  191.                 foreach ($protocol_data as $protocol)

    192. 

  192.                 {

    193. 

  193.                     $this->AddProtocol($protocol);

    194. 

  194.                 }

    195. 

  195.                 return true;

    196. 

  196.             }

    197. 

  197.             elseif (is_string($protocol_data))

    198. 

  198.             {

    199. 

  199.                 $this->AddProtocol($protocol_data);

    200. 

  200.                 return true;

    201. 

  201.             }

    202. 

  202.             else

    203. 

  203.             {

    204. 

  204.                 trigger_error("kses5::AddProtocols() did not receive a string or an array.", E_USER_WARNING);

    205. 

  205.                 return false;

    206. 

  206.             }

    207. 

  207.         }

    208. 

  208. 

    209. 

  209.         /**

    210. 

  210.          * Allows for single/batch addition of protocols

    211. 

  211.          *

    212. 

  212.          * @deprecated Use AddProtocols()

    213. 

  213.          * @see AddProtocols()

    214. 

  214.          * @return bool

    215. 

  215.          * @since PHP4 OOP 0.0.1

    216. 

  216.          */

    217. 

  217.         public function Protocols()

    218. 

  218.         {

    219. 

  219.             $c_args = func_num_args();

    220. 

  220.             if ($c_args != 1)

    221. 

  221.             {

    222. 

  222.                 trigger_error("kses5::Protocols() did not receive an argument.", E_USER_WARNING);

    223. 

  223.                 return false;

    224. 

  224.             }

    225. 

  225.             

    226. 

  226.             return $this->AddProtocols(func_get_arg(0));

    227. 

  227.         }

    228. 

  228. 

    229. 

  229.         /**

    230. 

  230.          * Adds a single protocol to $this->allowed_protocols.

    231. 

  231.          *

    232. 

  232.          * This method accepts a string argument and adds it to

    233. 

  233.          * the list of allowed protocols to keep when performing

    234. 

  234.          * Parse().

    235. 

  235.          *

    236. 

  236.          * @access public

    237. 

  237.          * @param string $protocol The name of the protocol to be added.

    238. 

  238.          * @return bool Status of adding valid protocol.

    239. 

  239.          * @since PHP4 OOP 0.0.1

    240. 

  240.          */

    241. 

  241.         public function AddProtocol($protocol = "")

    242. 

  242.         {

    243. 

  243.             if (! is_string($protocol))

    244. 

  244.             {

    245. 

  245.                 trigger_error("kses5::AddProtocol() requires a string.", E_USER_WARNING);

    246. 

  246.                 return false;

    247. 

  247.             }

    248. 

  248.             

    249. 

  249.             // Remove any inadvertent ':' at the end of the protocol.

    250. 

  250.             if (substr($protocol, strlen($protocol) - 1, 1) == ":")

    251. 

  251.             {

    252. 

  252.                 $protocol = substr($protocol, 0, strlen($protocol) - 1);

    253. 

  253.             }

    254. 

  254.             

    255. 

  255.             $protocol = strtolower(trim($protocol));

    256. 

  256.             if ($protocol == "")

    257. 

  257.             {

    258. 

  258.                 trigger_error("kses5::AddProtocol() tried to add an empty/NULL protocol.", E_USER_WARNING);

    259. 

  259.                 return false;

    260. 

  260.             }

    261. 

  261.             

    262. 

  262.             //	prevent duplicate protocols from being added.

    263. 

  263.             if (! in_array($protocol, $this->allowed_protocols))

    264. 

  264.             {

    265. 

  265.                 array_push($this->allowed_protocols, $protocol);

    266. 

  266.                 sort($this->allowed_protocols);

    267. 

  267.             }

    268. 

  268.             return true;

    269. 

  269.         }

    270. 

  270. 

    271. 

  271.         /**

    272. 

  272.          * Removes a single protocol from $this->allowed_protocols.

    273. 

  273.          *

    274. 

  274.          * This method accepts a string argument and removes it from

    275. 

  275.          * the list of allowed protocols to keep when performing

    276. 

  276.          * Parse().

    277. 

  277.          *

    278. 

  278.          * @access public

    279. 

  279.          * @param string $protocol The name of the protocol to be removed.

    280. 

  280.          * @return bool Status of removing valid protocol.

    281. 

  281.          * @since PHP5 OOP 1.0.0

    282. 

  282.          */

    283. 

  283.         public function RemoveProtocol($protocol = "")

    284. 

  284.         {

    285. 

  285.             if (! is_string($protocol))

    286. 

  286.             {

    287. 

  287.                 trigger_error("kses5::RemoveProtocol() requires a string.", E_USER_WARNING);

    288. 

  288.                 return false;

    289. 

  289.             }

    290. 

  290.             

    291. 

  291.             // Remove any inadvertent ':' at the end of the protocol.

    292. 

  292.             if (substr($protocol, strlen($protocol) - 1, 1) == ":")

    293. 

  293.             {

    294. 

  294.                 $protocol = substr($protocol, 0, strlen($protocol) - 1);

    295. 

  295.             }

    296. 

  296.             

    297. 

  297.             $protocol = strtolower(trim($protocol));

    298. 

  298.             if ($protocol == "")

    299. 

  299.             {

    300. 

  300.                 trigger_error("kses5::RemoveProtocol() tried to remove an empty/NULL protocol.", E_USER_WARNING);

    301. 

  301.                 return false;

    302. 

  302.             }

    303. 

  303.             

    304. 

  304.             //	Ensures that the protocol exists before removing it.

    305. 

  305.             if (in_array($protocol, $this->allowed_protocols))

    306. 

  306.             {

    307. 

  307.                 $this->allowed_protocols = array_diff($this->allowed_protocols, array($protocol));

    308. 

  308.                 sort($this->allowed_protocols);

    309. 

  309.             }

    310. 

  310.             

    311. 

  311.             return true;

    312. 

  312.         }

    313. 

  313. 

    314. 

  314.         /**

    315. 

  315.          * Allows for single/batch removal of protocols

    316. 

  316.          *

    317. 

  317.          * This method accepts one argument that can be either a string

    318. 

  318.          * or an array of strings.  Invalid data will be ignored.

    319. 

  319.          *

    320. 

  320.          * The argument will be processed, and each string will be removed

    321. 

  321.          * via RemoveProtocol().

    322. 

  322.          *

    323. 

  323.          * @access public

    324. 

  324.          * @param mixed , A string or array of protocols that will be removed from the internal list of allowed protocols.

    325. 

  325.          * @return bool Status of removing valid protocols.

    326. 

  326.          * @see RemoveProtocol()

    327. 

  327.          * @since PHP5 OOP 1.0.0

    328. 

  328.          */

    329. 

  329.         public function RemoveProtocols()

    330. 

  330.         {

    331. 

  331.             $c_args = func_num_args();

    332. 

  332.             if ($c_args != 1)

    333. 

  333.             {

    334. 

  334.                 return false;

    335. 

  335.             }

    336. 

  336.             

    337. 

  337.             $protocol_data = func_get_arg(0);

    338. 

  338.             

    339. 

  339.             if (is_array($protocol_data) && count($protocol_data) > 0)

    340. 

  340.             {

    341. 

  341.                 foreach ($protocol_data as $protocol)

    342. 

  342.                 {

    343. 

  343.                     $this->RemoveProtocol($protocol);

    344. 

  344.                 }

    345. 

  345.             }

    346. 

  346.             elseif (is_string($protocol_data))

    347. 

  347.             {

    348. 

  348.                 $this->RemoveProtocol($protocol_data);

    349. 

  349.                 return true;

    350. 

  350.             }

    351. 

  351.             else

    352. 

  352.             {

    353. 

  353.                 trigger_error("kses5::RemoveProtocols() did not receive a string or an array.", E_USER_WARNING);

    354. 

  354.                 return false;

    355. 

  355.             }

    356. 

  356.         }

    357. 

  357. 

    358. 

  358.         /**

    359. 

  359.          * Allows for single/batch replacement of protocols

    360. 

  360.          *

    361. 

  361.          * This method accepts one argument that can be either a string

    362. 

  362.          * or an array of strings.  Invalid data will be ignored.

    363. 

  363.          *

    364. 

  364.          * Existing protocols will be removed, then the argument will be

    365. 

  365.          * processed, and each string will be added via AddProtocol().

    366. 

  366.          *

    367. 

  367.          * @access public

    368. 

  368.          * @param mixed , A string or array of protocols that will be the new internal list of allowed protocols.

    369. 

  369.          * @return bool Status of replacing valid protocols.

    370. 

  370.          * @since PHP5 OOP 1.0.1

    371. 

  371.          * @see AddProtocol()

    372. 

  372.          */

    373. 

  373.         public function SetProtocols()

    374. 

  374.         {

    375. 

  375.             $c_args = func_num_args();

    376. 

  376.             if ($c_args != 1)

    377. 

  377.             {

    378. 

  378.                 trigger_error("kses5::SetProtocols() did not receive an argument.", E_USER_WARNING);

    379. 

  379.                 return false;

    380. 

  380.             }

    381. 

  381.             

    382. 

  382.             $protocol_data = func_get_arg(0);

    383. 

  383.             

    384. 

  384.             if (is_array($protocol_data) && count($protocol_data) > 0)

    385. 

  385.             {

    386. 

  386.                 $this->allowed_protocols = array();

    387. 

  387.                 foreach ($protocol_data as $protocol)

    388. 

  388.                 {

    389. 

  389.                     $this->AddProtocol($protocol);

    390. 

  390.                 }

    391. 

  391.                 return true;

    392. 

  392.             }

    393. 

  393.             elseif (is_string($protocol_data))

    394. 

  394.             {

    395. 

  395.                 $this->allowed_protocols = array();

    396. 

  396.                 $this->AddProtocol($protocol_data);

    397. 

  397.                 return true;

    398. 

  398.             }

    399. 

  399.             else

    400. 

  400.             {

    401. 

  401.                 trigger_error("kses5::SetProtocols() did not receive a string or an array.", E_USER_WARNING);

    402. 

  402.                 return false;

    403. 

  403.             }

    404. 

  404.         }

    405. 

  405. 

    406. 

  406.         /**

    407. 

  407.          * Raw dump of allowed protocols

    408. 

  408.          *

    409. 

  409.          * This returns an indexed array of allowed protocols for a particular KSES

    410. 

  410.          * instantiation.

    411. 

  411.          *

    412. 

  412.          * @access public

    413. 

  413.          * @return array The list of allowed protocols.

    414. 

  414.          * @since PHP5 OOP 1.0.2

    415. 

  415.          */

    416. 

  416.         public function DumpProtocols()

    417. 

  417.         {

    418. 

  418.             return $this->allowed_protocols;

    419. 

  419.         }

    420. 

  420. 

    421. 

  421.         /**

    422. 

  422.          * Raw dump of allowed (X)HTML elements

    423. 

  423.          *

    424. 

  424.          * This returns an indexed array of allowed (X)HTML elements and attributes

    425. 

  425.          * for a particular KSES instantiation.

    426. 

  426.          *

    427. 

  427.          * @access public

    428. 

  428.          * @return array The list of allowed elements.

    429. 

  429.          * @since PHP5 OOP 1.0.2

    430. 

  430.          */

    431. 

  431.         public function DumpElements()

    432. 

  432.         {

    433. 

  433.             return $this->allowed_html;

    434. 

  434.         }

    435. 

  435. 

    436. 

  436.         /**

    437. 

  437.          * Adds valid (X)HTML with corresponding attributes that will be kept when stripping 'evil scripts'.

    438. 

  438.          *

    439. 

  439.          * This method accepts one argument that can be either a string

    440. 

  440.          * or an array of strings.  Invalid data will be ignored.

    441. 

  441.          *

    442. 

  442.          * @access public

    443. 

  443.          * @param string $tag (X)HTML tag that will be allowed after stripping text.

    444. 

  444.          * @param array $attribs Associative array of allowed attributes - key => attribute name - value => attribute parameter

    445. 

  445.          * @return bool Status of Adding (X)HTML and attributes.

    446. 

  446.          * @since PHP4 OOP 0.0.1

    447. 

  447.          */

    448. 

  448.         public function AddHTML($tag = "", $attribs = array())

    449. 

  449.         {

    450. 

  450.             if (! is_string($tag))

    451. 

  451.             {

    452. 

  452.                 trigger_error("kses5::AddHTML() requires the tag to be a string", E_USER_WARNING);

    453. 

  453.                 return false;

    454. 

  454.             }

    455. 

  455.             

    456. 

  456.             $tag = strtolower(trim($tag));

    457. 

  457.             if ($tag == "")

    458. 

  458.             {

    459. 

  459.                 trigger_error("kses5::AddHTML() tried to add an empty/NULL tag", E_USER_WARNING);

    460. 

  460.                 return false;

    461. 

  461.             }

    462. 

  462.             

    463. 

  463.             if (! is_array($attribs))

    464. 

  464.             {

    465. 

  465.                 trigger_error("kses5::AddHTML() requires an array (even an empty one) of attributes for '$tag'", E_USER_WARNING);

    466. 

  466.                 return false;

    467. 

  467.             }

    468. 

  468.             

    469. 

  469.             $new_attribs = array();

    470. 

  470.             if (is_array($attribs) && count($attribs) > 0)

    471. 

  471.             {

    472. 

  472.                 foreach ($attribs as $idx1 => $val1)

    473. 

  473.                 {

    474. 

  474.                     $new_idx1 = strtolower($idx1);

    475. 

  475.                     $new_val1 = $attribs[$idx1];

    476. 

  476.                     

    477. 

  477.                     if (is_array($new_val1) && count($attribs) > 0)

    478. 

  478.                     {

    479. 

  479.                         $tmp_val = array();

    480. 

  480.                         foreach ($new_val1 as $idx2 => $val2)

    481. 

  481.                         {

    482. 

  482.                             $new_idx2 = strtolower($idx2);

    483. 

  483.                             $tmp_val[$new_idx2] = $val2;

    484. 

  484.                         }

    485. 

  485.                         $new_val1 = $tmp_val;

    486. 

  486.                     }

    487. 

  487.                     

    488. 

  488.                     $new_attribs[$new_idx1] = $new_val1;

    489. 

  489.                 }

    490. 

  490.             }

    491. 

  491.             

    492. 

  492.             $this->allowed_html[$tag] = $new_attribs;

    493. 

  493.             return true;

    494. 

  494.         }

    495. 

  495. 

    496. 

  496.         /**

    497. 

  497.          * This method removes any NULL characters in $string.

    498. 

  498.          *

    499. 

  499.          * @access private

    500. 

  500.          * @param string $string

    501. 

  501.          * @return string String without any NULL/chr(173)

    502. 

  502.          * @since PHP4 OOP 0.0.1

    503. 

  503.          */

    504. 

  504.         private function removeNulls($string)

    505. 

  505.         {

    506. 

  506.             $string = preg_replace('/\0+/', '', $string);

    507. 

  507.             $string = preg_replace('/(\\\\0)+/', '', $string);

    508. 

  508.             return $string;

    509. 

  509.         }

    510. 

  510. 

    511. 

  511.         /**

    512. 

  512.          * Normalizes HTML entities

    513. 

  513.          *

    514. 

  514.          * This function normalizes HTML entities. It will convert "AT&T" to the correct

    515. 

  515.          * "AT&amp;T", "&#00058;" to "&#58;", "&#XYZZY;" to "&amp;#XYZZY;" and so on.

    516. 

  516.          *

    517. 

  517.          * @access private

    518. 

  518.          * @param string $string

    519. 

  519.          * @return string String with normalized entities

    520. 

  520.          * @since PHP4 OOP 0.0.1

    521. 

  521.          */

    522. 

  522.         private function normalizeEntities($string)

    523. 

  523.         {

    524. 

  524.             # Disarm all entities by converting & to &amp;

    525. 

  525.             $string = str_replace('&', '&amp;', $string);

    526. 

  526.             

    527. 

  527.             #	TODO: Change back (Keep?) the allowed entities in our entity white list

    528. 

  528.             

    529. 

  529. 

    530. 

  530.             #	Keeps entities that start with [A-Za-z]

    531. 

  531.             $string = preg_replace('/&amp;([A-Za-z][A-Za-z0-9]{0,19});/', '&\\1;', $string);

    532. 

  532.             

    533. 

  533.             #	Change numeric entities to valid 16 bit values

    534. 

  534.             

    535. 

  535. 

    536. 

  536.             $string = preg_replace('/&amp;#0*([0-9]{1,5});/e', '\$this->normalizeEntities16bit("\\1")', $string);

    537. 

  537.             

    538. 

  538.             #	Change &XHHHHHHH (Hex digits) to 16 bit hex values

    539. 

  539.             $string = preg_replace('/&amp;#([Xx])0*(([0-9A-Fa-f]{2}){1,2});/', '&#\\1\\2;', $string);

    540. 

  540.             

    541. 

  541.             return $string;

    542. 

  542.         }

    543. 

  543. 

    544. 

  544.         /**

    545. 

  545.          * Helper method used by normalizeEntites()

    546. 

  546.          *

    547. 

  547.          * This method helps normalizeEntities() to only accept 16 bit values

    548. 

  548.          * and nothing more for &#number; entities.

    549. 

  549.          *

    550. 

  550.          * This method helps normalize_entities() during a preg_replace()

    551. 

  551.          * where a &#(0)*XXXXX; occurs.  The '(0)*XXXXXX' value is converted to

    552. 

  552.          * a number and the result is returned as a numeric entity if the number

    553. 

  553.          * is less than 65536.  Otherwise, the value is returned 'as is'.

    554. 

  554.          *

    555. 

  555.          * @access private

    556. 

  556.          * @param string $i

    557. 

  557.          * @return string Normalized numeric entity

    558. 

  558.          * @see normalizeEntities()

    559. 

  559.          * @since PHP4 OOP 0.0.1

    560. 

  560.          */

    561. 

  561.         private function normalizeEntities16bit($i)

    562. 

  562.         {

    563. 

  563.             return (($i > 65535) ? "&amp;#$i;" : "&#$i;");

    564. 

  564.         }

    565. 

  565. 

    566. 

  566.         /**

    567. 

  567.          * Allows for additional user defined modifications to text.

    568. 

  568.          *

    569. 

  569.          * This method allows for additional modifications to be performed on

    570. 

  570.          * a string that's being run through Parse().  Currently, it returns the

    571. 

  571.          * input string 'as is'.

    572. 

  572.          *

    573. 

  573.          * This method is provided for users to extend the kses class for their own

    574. 

  574.          * requirements.

    575. 

  575.          *

    576. 

  576.          * @access public

    577. 

  577.          * @param string $string String to perfrom additional modifications on.

    578. 

  578.          * @return string User modified string.

    579. 

  579.          * @see Parse()

    580. 

  580.          * @since PHP5 OOP 1.0.0

    581. 

  581.          */

    582. 

  582.         private function filterKsesTextHook($string)

    583. 

  583.         {

    584. 

  584.             return $string;

    585. 

  585.         }

    586. 

  586. 

    587. 

  587.         /**

    588. 

  588.          * Allows for additional user defined modifications to text.

    589. 

  589.          *

    590. 

  590.          * @deprecated use filterKsesTextHook()

    591. 

  591.          * @param string $string

    592. 

  592.          * @return string

    593. 

  593.          * @see filterKsesTextHook()

    594. 

  594.          * @since PHP4 OOP 0.0.1

    595. 

  595.          */

    596. 

  596.         private function _hook($string)

    597. 

  597.         {

    598. 

  598.             return $this->filterKsesTextHook($string);

    599. 

  599.         }

    600. 

  600. 

    601. 

  601.         /**

    602. 

  602.          * This method goes through an array, and changes the keys to all lower case.

    603. 

  603.          *

    604. 

  604.          * @access private

    605. 

  605.          * @param array $in_array Associative array

    606. 

  606.          * @return array Modified array

    607. 

  607.          * @since PHP4 OOP 0.0.1

    608. 

  608.          */

    609. 

  609.         private function makeArrayKeysLowerCase($in_array)

    610. 

  610.         {

    611. 

  611.             $out_array = array();

    612. 

  612.             

    613. 

  613.             if (is_array($in_array) && count($in_array) > 0)

    614. 

  614.             {

    615. 

  615.                 foreach ($in_array as $in_key => $in_val)

    616. 

  616.                 {

    617. 

  617.                     $out_key = strtolower($in_key);

    618. 

  618.                     $out_array[$out_key] = array();

    619. 

  619.                     

    620. 

  620.                     if (is_array($in_val) && count($in_val) > 0)

    621. 

  621.                     {

    622. 

  622.                         foreach ($in_val as $in_key2 => $in_val2)

    623. 

  623.                         {

    624. 

  624.                             $out_key2 = strtolower($in_key2);

    625. 

  625.                             $out_array[$out_key][$out_key2] = $in_val2;

    626. 

  626.                         }

    627. 

  627.                     }

    628. 

  628.                 }

    629. 

  629.             }

    630. 

  630.             

    631. 

  631.             return $out_array;

    632. 

  632.         }

    633. 

  633. 

    634. 

  634.         /**

    635. 

  635.          * This method strips out disallowed and/or mangled (X)HTML tags along with assigned attributes.

    636. 

  636.          *

    637. 

  637.          * This method does a lot of work. It rejects some very malformed things

    638. 

  638.          * like <:::>. It returns an empty string if the element isn't allowed (look

    639. 

  639.          * ma, no strip_tags()!). Otherwise it splits the tag into an element and an

    640. 

  640.          * allowed attribute list.

    641. 

  641.          *

    642. 

  642.          * @access private

    643. 

  643.          * @param string $string

    644. 

  644.          * @return string Modified string minus disallowed/mangled (X)HTML and attributes

    645. 

  645.          * @since PHP4 OOP 0.0.1

    646. 

  646.          */

    647. 

  647.         private function stripTags($string)

    648. 

  648.         {

    649. 

  649.             $string = preg_replace('%\\\\"%', '"', $string);

    650. 

  650.             

    651. 

  651.             if (substr($string, 0, 1) != '<')

    652. 

  652.             {

    653. 

  653.                 # It matched a ">" character

    654. 

  654.                 return '&gt;';

    655. 

  655.             }

    656. 

  656.             

    657. 

  657.             if (! preg_match('%^<\s*(/\s*)?([a-zA-Z0-9]+)([^>]*)>?$%', $string, $matches))

    658. 

  658.             {

    659. 

  659.                 # It's seriously malformed

    660. 

  660.                 return '';

    661. 

  661.             }

    662. 

  662.             

    663. 

  663.             $slash = trim($matches[1]);

    664. 

  664.             $elem = $matches[2];

    665. 

  665.             $attrlist = $matches[3];

    666. 

  666.             

    667. 

  667.             if (! isset($this->allowed_html[strtolower($elem)]) || ! is_array($this->allowed_html[strtolower($elem)]))

    668. 

  668.             {

    669. 

  669.                 #	Found an HTML element not in the white list

    670. 

  670.                 return '';

    671. 

  671.             }

    672. 

  672.             

    673. 

  673.             if ($slash != '')

    674. 

  674.             {

    675. 

  675.                 return "<$slash$elem>";

    676. 

  676.             }

    677. 

  677.             # No attributes are allowed for closing elements

    678. 

  678.             

    679. 

  679. 

    680. 

  680.             return $this->stripAttributes("$slash$elem", $attrlist);

    681. 

  681.         }

    682. 

  682. 

    683. 

  683.         /**

    684. 

  684.          * This method strips out disallowed attributes for (X)HTML tags.

    685. 

  685.          *

    686. 

  686.          * This method removes all attributes if none are allowed for this element.

    687. 

  687.          * If some are allowed it calls combAttributes() to split them further, and then it

    688. 

  688.          * builds up new HTML code from the data that combAttributes() returns. It also

    689. 

  689.          * removes "<" and ">" characters, if there are any left. One more thing it

    690. 

  690.          * does is to check if the tag has a closing XHTML slash, and if it does,

    691. 

  691.          * it puts one in the returned code as well.

    692. 

  692.          *

    693. 

  693.          * @access private

    694. 

  694.          * @param string $element (X)HTML tag to check

    695. 

  695.          * @param string $attr Text containing attributes to check for validity.

    696. 

  696.          * @return string Resulting valid (X)HTML or ''

    697. 

  697.          * @see combAttributes()

    698. 

  698.          * @since PHP4 OOP 0.0.1

    699. 

  699.          */

    700. 

  700.         private function stripAttributes($element, $attr)

    701. 

  701.         {

    702. 

  702.             # Is there a closing XHTML slash at the end of the attributes?

    703. 

  703.             $xhtml_slash = '';

    704. 

  704.             if (preg_match('%\s/\s*$%', $attr))

    705. 

  705.             {

    706. 

  706.                 $xhtml_slash = ' /';

    707. 

  707.             }

    708. 

  708.             

    709. 

  709.             # Are any attributes allowed at all for this element?

    710. 

  710.             if (! isset($this->allowed_html[strtolower($element)]) || count($this->allowed_html[strtolower($element)]) == 0)

    711. 

  711.             {

    712. 

  712.                 return "<$element$xhtml_slash>";

    713. 

  713.             }

    714. 

  714.             

    715. 

  715.             # Split it

    716. 

  716.             $attrarr = $this->combAttributes($attr);

    717. 

  717.             

    718. 

  718.             # Go through $attrarr, and save the allowed attributes for this element

    719. 

  719.             # in $attr2

    720. 

  720.             $attr2 = '';

    721. 

  721.             if (is_array($attrarr) && count($attrarr) > 0)

    722. 

  722.             {

    723. 

  723.                 foreach ($attrarr as $arreach)

    724. 

  724.                 {

    725. 

  725.                     if (! isset($this->allowed_html[strtolower($element)][strtolower($arreach['name'])]))

    726. 

  726.                     {

    727. 

  727.                         continue;

    728. 

  728.                     }

    729. 

  729.                     

    730. 

  730.                     $current = $this->allowed_html[strtolower($element)][strtolower($arreach['name'])];

    731. 

  731.                     

    732. 

  732.                     if (! is_array($current))

    733. 

  733.                     {

    734. 

  734.                         # there are no checks

    735. 

  735.                         $attr2 .= ' ' . $arreach['whole'];

    736. 

  736.                     }

    737. 

  737.                     else

    738. 

  738.                     {

    739. 

  739.                         # there are some checks

    740. 

  740.                         $ok = true;

    741. 

  741.                         if (is_array($current) && count($current) > 0)

    742. 

  742.                         {

    743. 

  743.                             foreach ($current as $currkey => $currval)

    744. 

  744.                             {

    745. 

  745.                                 if (! $this->checkAttributeValue($arreach['value'], $arreach['vless'], $currkey, $currval))

    746. 

  746.                                 {

    747. 

  747.                                     $ok = false;

    748. 

  748.                                     break;

    749. 

  749.                                 }

    750. 

  750.                             }

    751. 

  751.                         }

    752. 

  752.                         

    753. 

  753.                         if ($ok)

    754. 

  754.                         {

    755. 

  755.                             # it passed them

    756. 

  756.                             $attr2 .= ' ' . $arreach['whole'];

    757. 

  757.                         }

    758. 

  758.                     }

    759. 

  759.                 }

    760. 

  760.             }

    761. 

  761.             

    762. 

  762.             # Remove any "<" or ">" characters

    763. 

  763.             $attr2 = preg_replace('/[<>]/', '', $attr2);

    764. 

  764.             return "<$element$attr2$xhtml_slash>";

    765. 

  765.         }

    766. 

  766. 

    767. 

  767.         /**

    768. 

  768.          * This method combs through an attribute list string and returns an associative array of attributes and values.

    769. 

  769.          *

    770. 

  770.          * This method does a lot of work. It parses an attribute list into an array

    771. 

  771.          * with attribute data, and tries to do the right thing even if it gets weird

    772. 

  772.          * input. It will add quotes around attribute values that don't have any quotes

    773. 

  773.          * or apostrophes around them, to make it easier to produce HTML code that will

    774. 

  774.          * conform to W3C's HTML specification. It will also remove bad URL protocols

    775. 

  775.          * from attribute values.

    776. 

  776.          *

    777. 

  777.          * @access private

    778. 

  778.          * @param string $attr Text containing tag attributes for parsing

    779. 

  779.          * @return array Associative array containing data on attribute and value

    780. 

  780.          * @since PHP4 OOP 0.0.1

    781. 

  781.          */

    782. 

  782.         private function combAttributes($attr)

    783. 

  783.         {

    784. 

  784.             $attrarr = array();

    785. 

  785.             $mode = 0;

    786. 

  786.             $attrname = '';

    787. 

  787.             

    788. 

  788.             # Loop through the whole attribute list

    789. 

  789.             

    790. 

  790. 

    791. 

  791.             while (strlen($attr) != 0)

    792. 

  792.             {

    793. 

  793.                 # Was the last operation successful?

    794. 

  794.                 $working = 0;

    795. 

  795.                 

    796. 

  796.                 switch ($mode)

    797. 

  797.                 {

    798. 

  798.                     case 0 : # attribute name, href for instance

    799. 

  799.                         if (preg_match('/^([-a-zA-Z]+)/', $attr, $match))

    800. 

  800.                         {

    801. 

  801.                             $attrname = $match[1];

    802. 

  802.                             $working = $mode = 1;

    803. 

  803.                             $attr = preg_replace('/^[-a-zA-Z]+/', '', $attr);

    804. 

  804.                         }

    805. 

  805.                         break;

    806. 

  806.                     case 1 : # equals sign or valueless ("selected")

    807. 

  807.                         if (preg_match('/^\s*=\s*/', $attr)) # equals sign

    808. 

  808.                         {

    809. 

  809.                             $working = 1;

    810. 

  810.                             $mode = 2;

    811. 

  811.                             $attr = preg_replace('/^\s*=\s*/', '', $attr);

    812. 

  812.                             break;

    813. 

  813.                         }

    814. 

  814.                         if (preg_match('/^\s+/', $attr)) # valueless

    815. 

  815.                         {

    816. 

  816.                             $working = 1;

    817. 

  817.                             $mode = 0;

    818. 

  818.                             $attrarr[] = array('name' => $attrname, 'value' => '', 'whole' => $attrname, 'vless' => 'y');

    819. 

  819.                             $attr = preg_replace('/^\s+/', '', $attr);

    820. 

  820.                         }

    821. 

  821.                         break;

    822. 

  822.                     case 2 : # attribute value, a URL after href= for instance

    823. 

  823.                         if (preg_match('/^"([^"]*)"(\s+|$)/', $attr, $match)) # "value"

    824. 

  824.                         {

    825. 

  825.                             $thisval = $this->removeBadProtocols($match[1]);

    826. 

  826.                             $attrarr[] = array('name' => $attrname, 'value' => $thisval, 

    827. 

  827.                                     'whole' => $attrname . '="' . $thisval . '"', 'vless' => 'n');

    828. 

  828.                             $working = 1;

    829. 

  829.                             $mode = 0;

    830. 

  830.                             $attr = preg_replace('/^"[^"]*"(\s+|$)/', '', $attr);

    831. 

  831.                             break;

    832. 

  832.                         }

    833. 

  833.                         if (preg_match("/^'([^']*)'(\s+|$)/", $attr, $match)) # 'value'

    834. 

  834.                         {

    835. 

  835.                             $thisval = $this->removeBadProtocols($match[1]);

    836. 

  836.                             $attrarr[] = array('name' => $attrname, 'value' => $thisval, 

    837. 

  837.                                     'whole' => "$attrname='$thisval'", 'vless' => 'n');

    838. 

  838.                             $working = 1;

    839. 

  839.                             $mode = 0;

    840. 

  840.                             $attr = preg_replace("/^'[^']*'(\s+|$)/", '', $attr);

    841. 

  841.                             break;

    842. 

  842.                         }

    843. 

  843.                         if (preg_match("%^([^\s\"']+)(\s+|$)%", $attr, $match)) # value

    844. 

  844.                         {

    845. 

  845.                             $thisval = $this->removeBadProtocols($match[1]);

    846. 

  846.                             $attrarr[] = array('name' => $attrname, 'value' => $thisval, 

    847. 

  847.                                     'whole' => $attrname . '="' . $thisval . '"', 'vless' => 'n');

    848. 

  848.                             # We add quotes to conform to W3C's HTML spec.

    849. 

  849.                             $working = 1;

    850. 

  850.                             $mode = 0;

    851. 

  851.                             $attr = preg_replace("%^[^\s\"']+(\s+|$)%", '', $attr);

    852. 

  852.                         }

    853. 

  853.                         break;

    854. 

  854.                 }

    855. 

  855.                 

    856. 

  856.                 if ($working == 0) # not well formed, remove and try again

    857. 

  857.                 {

    858. 

  858.                     $attr = preg_replace('/^("[^"]*("|$)|\'[^\']*(\'|$)|\S)*\s*/', '', $attr);

    859. 

  859.                     $mode = 0;

    860. 

  860.                 }

    861. 

  861.             }

    862. 

  862.             

    863. 

  863.             # special case, for when the attribute list ends with a valueless

    864. 

  864.             # attribute like "selected"

    865. 

  865.             if ($mode == 1)

    866. 

  866.             {

    867. 

  867.                 $attrarr[] = array('name' => $attrname, 'value' => '', 'whole' => $attrname, 'vless' => 'y');

    868. 

  868.             }

    869. 

  869.             

    870. 

  870.             return $attrarr;

    871. 

  871.         }

    872. 

  872. 

    873. 

  873.         /**

    874. 

  874.          * This method removes disallowed protocols.

    875. 

  875.          *

    876. 

  876.          * This method removes all non-allowed protocols from the beginning of

    877. 

  877.          * $string. It ignores whitespace and the case of the letters, and it does

    878. 

  878.          * understand HTML entities. It does its work in a while loop, so it won't be

    879. 

  879.          * fooled by a string like "javascript:javascript:alert(57)".

    880. 

  880.          *

    881. 

  881.          * @access private

    882. 

  882.          * @param string $string String to check for protocols

    883. 

  883.          * @return string String with removed protocols

    884. 

  884.          * @since PHP4 OOP 0.0.1

    885. 

  885.          */

    886. 

  886.         private function removeBadProtocols($string)

    887. 

  887.         {

    888. 

  888.             $string = $this->RemoveNulls($string);

    889. 

  889.             $string = preg_replace('/\xad+/', '', $string); # deals with Opera "feature"

    890. 

  890.             $string2 = $string . 'a';

    891. 

  891.             

    892. 

  892.             while ($string != $string2)

    893. 

  893.             {

    894. 

  894.                 $string2 = $string;

    895. 

  895.                 $string = preg_replace('/^((&[^;]*;|[\sA-Za-z0-9])*)' . '(:|&#58;|&#[Xx]3[Aa];)\s*/e', '\$this->filterProtocols("\\1")', $string);

    896. 

  896.             }

    897. 

  897.             

    898. 

  898.             return $string;

    899. 

  899.         }

    900. 

  900. 

    901. 

  901.         /**

    902. 

  902.          * Helper method used by removeBadProtocols()

    903. 

  903.          *

    904. 

  904.          * This function processes URL protocols, checks to see if they're in the white-

    905. 

  905.          * list or not, and returns different data depending on the answer.

    906. 

  906.          *

    907. 

  907.          * @access private

    908. 

  908.          * @param string $string String to check for protocols

    909. 

  909.          * @return string String with removed protocols

    910. 

  910.          * @see removeBadProtocols()

    911. 

  911.          * @since PHP4 OOP 0.0.1

    912. 

  912.          */

    913. 

  913.         private function filterProtocols($string)

    914. 

  914.         {

    915. 

  915.             $string = $this->decodeEntities($string);

    916. 

  916.             $string = preg_replace('/\s/', '', $string);

    917. 

  917.             $string = $this->removeNulls($string);

    918. 

  918.             $string = preg_replace('/\xad+/', '', $string2); # deals with Opera "feature"

    919. 

  919.             $string = strtolower($string);

    920. 

  920.             

    921. 

  921.             if (is_array($this->allowed_protocols) && count($this->allowed_protocols) > 0)

    922. 

  922.             {

    923. 

  923.                 foreach ($this->allowed_protocols as $one_protocol)

    924. 

  924.                 {

    925. 

  925.                     if (strtolower($one_protocol) == $string)

    926. 

  926.                     {

    927. 

  927.                         return "$string:";

    928. 

  928.                     }

    929. 

  929.                 }

    930. 

  930.             }

    931. 

  931.             

    932. 

  932.             return '';

    933. 

  933.         }

    934. 

  934. 

    935. 

  935.         /**

    936. 

  936.          * Controller method for performing checks on attribute values.

    937. 

  937.          *

    938. 

  938.          * This method calls the appropriate method as specified by $checkname with

    939. 

  939.          * the parameters $value, $vless, and $checkvalue, and returns the result

    940. 

  940.          * of the call.

    941. 

  941.          *

    942. 

  942.          * This method's functionality can be expanded by creating new methods

    943. 

  943.          * that would match checkAttributeValue[$checkname].

    944. 

  944.          *

    945. 

  945.          * Current checks implemented are: "maxlen", "minlen", "maxval", "minval" and "valueless"

    946. 

  946.          *

    947. 

  947.          * @access private

    948. 

  948.          * @param string $value The value of the attribute to be checked.

    949. 

  949.          * @param string $vless Indicates whether the the value is supposed to be valueless

    950. 

  950.          * @param string $checkname The check to be performed

    951. 

  951.          * @param string $checkvalue The value that is to be checked against

    952. 

  952.          * @return bool Indicates whether the check passed or not

    953. 

  953.          * @since PHP5 OOP 1.0.0

    954. 

  954.          */

    955. 

  955.         private function checkAttributeValue($value, $vless, $checkname, $checkvalue)

    956. 

  956.         {

    957. 

  957.             $ok = true;

    958. 

  958.             $check_attribute_method_name = 'checkAttributeValue' . ucfirst(strtolower($checkname));

    959. 

  959.             if (method_exists($this, $check_attribute_method_name))

    960. 

  960.             {

    961. 

  961.                 $ok = $this->$check_attribute_method_name($value, $checkvalue, $vless);

    962. 

  962.             }

    963. 

  963.             

    964. 

  964.             return $ok;

    965. 

  965.         }

    966. 

  966. 

    967. 

  967.         /**

    968. 

  968.          * Helper method invoked by checkAttributeValue().

    969. 

  969.          *

    970. 

  970.          * The maxlen check makes sure that the attribute value has a length not

    971. 

  971.          * greater than the given value. This can be used to avoid Buffer Overflows

    972. 

  972.          * in WWW clients and various Internet servers.

    973. 

  973.          *

    974. 

  974.          * @access private

    975. 

  975.          * @param string $value The value of the attribute to be checked.

    976. 

  976.          * @param int $checkvalue The maximum value allowed

    977. 

  977.          * @return bool Indicates whether the check passed or not

    978. 

  978.          * @see checkAttributeValue()

    979. 

  979.          * @since PHP5 OOP 1.0.0

    980. 

  980.          */

    981. 

  981.         private function checkAttributeValueMaxlen($value, $checkvalue)

    982. 

  982.         {

    983. 

  983.             if (strlen($value) > intval($checkvalue))

    984. 

  984.             {

    985. 

  985.                 return false;

    986. 

  986.             }

    987. 

  987.             return true;

    988. 

  988.         }

    989. 

  989. 

    990. 

  990.         /**

    991. 

  991.          * Helper method invoked by checkAttributeValue().

    992. 

  992.          *

    993. 

  993.          * The minlen check makes sure that the attribute value has a length not

    994. 

  994.          * smaller than the given value.

    995. 

  995.          *

    996. 

  996.          * @access private

    997. 

  997.          * @param string $value The value of the attribute to be checked.

    998. 

  998.          * @param int $checkvalue The minimum value allowed

    999. 

  999.          * @return bool Indicates whether the check passed or not

    1000. 

  1000.          * @see checkAttributeValue()

    1001. 

  1001.          * @since PHP5 OOP 1.0.0

    1002. 

  1002.          */

    1003. 

  1003.         private function checkAttributeValueMinlen($value, $checkvalue)

    1004. 

  1004.         {

    1005. 

  1005.             if (strlen($value) < intval($checkvalue))

    1006. 

  1006.             {

    1007. 

  1007.                 return false;

    1008. 

  1008.             }

    1009. 

  1009.             return true;

    1010. 

  1010.         }

    1011. 

  1011. 

    1012. 

  1012.         /**

    1013. 

  1013.          * Helper method invoked by checkAttributeValue().

    1014. 

  1014.          *

    1015. 

  1015.          * The maxval check does two things: it checks that the attribute value is

    1016. 

  1016.          * an integer from 0 and up, without an excessive amount of zeroes or

    1017. 

  1017.          * whitespace (to avoid Buffer Overflows). It also checks that the attribute

    1018. 

  1018.          * value is not greater than the given value.

    1019. 

  1019.          *

    1020. 

  1020.          * This check can be used to avoid Denial of Service attacks.

    1021. 

  1021.          *

    1022. 

  1022.          * @access private

    1023. 

  1023.          * @param int $value The value of the attribute to be checked.

    1024. 

  1024.          * @param int $checkvalue The maximum numeric value allowed

    1025. 

  1025.          * @return bool Indicates whether the check passed or not

    1026. 

  1026.          * @see checkAttributeValue()

    1027. 

  1027.          * @since PHP5 OOP 1.0.0

    1028. 

  1028.          */

    1029. 

  1029.         private function checkAttributeValueMaxval($value, $checkvalue)

    1030. 

  1030.         {

    1031. 

  1031.             if (! preg_match('/^\s{0,6}[0-9]{1,6}\s{0,6}$/', $value))

    1032. 

  1032.             {

    1033. 

  1033.                 return false;

    1034. 

  1034.             }

    1035. 

  1035.             if (intval($value) > intval($checkvalue))

    1036. 

  1036.             {

    1037. 

  1037.                 return false;

    1038. 

  1038.             }

    1039. 

  1039.             return true;

    1040. 

  1040.         }

    1041. 

  1041. 

    1042. 

  1042.         /**

    1043. 

  1043.          * Helper method invoked by checkAttributeValue().

    1044. 

  1044.          *

    1045. 

  1045.          * The minval check checks that the attribute value is a positive integer,

    1046. 

  1046.          * and that it is not smaller than the given value.

    1047. 

  1047.          *

    1048. 

  1048.          * @access private

    1049. 

  1049.          * @param int $value The value of the attribute to be checked.

    1050. 

  1050.          * @param int $checkvalue The minimum numeric value allowed

    1051. 

  1051.          * @return bool Indicates whether the check passed or not

    1052. 

  1052.          * @see checkAttributeValue()

    1053. 

  1053.          * @since PHP5 OOP 1.0.0

    1054. 

  1054.          */

    1055. 

  1055.         private function checkAttributeValueMinval($value, $checkvalue)

    1056. 

  1056.         {

    1057. 

  1057.             if (! preg_match('/^\s{0,6}[0-9]{1,6}\s{0,6}$/', $value))

    1058. 

  1058.             {

    1059. 

  1059.                 return false;

    1060. 

  1060.             }

    1061. 

  1061.             if (intval($value) < ($checkvalue))

    1062. 

  1062.             {

    1063. 

  1063.                 return false;

    1064. 

  1064.             }

    1065. 

  1065.             return true;

    1066. 

  1066.         }

    1067. 

  1067. 

    1068. 

  1068.         /**

    1069. 

  1069.          * Helper method invoked by checkAttributeValue().

    1070. 

  1070.          *

    1071. 

  1071.          * The valueless check checks if the attribute has a value

    1072. 

  1072.          * (like <a href="blah">) or not (<option selected>). If the given value

    1073. 

  1073.          * is a "y" or a "Y", the attribute must not have a value.

    1074. 

  1074.          *

    1075. 

  1075.          * If the given value is an "n" or an "N", the attribute must have one.

    1076. 

  1076.          *

    1077. 

  1077.          * @access private

    1078. 

  1078.          * @param int $value The value of the attribute to be checked.

    1079. 

  1079.          * @param mixed $checkvalue This variable is ignored for this test

    1080. 

  1080.          * @param string $vless Flag indicating if this attribute is not supposed to have an attribute

    1081. 

  1081.          * @return bool Indicates whether the check passed or not

    1082. 

  1082.          * @see checkAttributeValue()

    1083. 

  1083.          * @since PHP5 OOP 1.0.0

    1084. 

  1084.          */

    1085. 

  1085.         private function checkAttributeValueValueless($value, $checkvalue, $vless)

    1086. 

  1086.         {

    1087. 

  1087.             if (strtolower($checkvalue) != $vless)

    1088. 

  1088.             {

    1089. 

  1089.                 return false;

    1090. 

  1090.             }

    1091. 

  1091.             return true;

    1092. 

  1092.         }

    1093. 

  1093. 

    1094. 

  1094.         /**

    1095. 

  1095.          * Decodes numeric HTML entities

    1096. 

  1096.          *

    1097. 

  1097.          * This method decodes numeric HTML entities (&#65; and &#x41;). It doesn't

    1098. 

  1098.          * do anything with other entities like &auml;, but we don't need them in the

    1099. 

  1099.          * URL protocol white listing system anyway.

    1100. 

  1100.          *

    1101. 

  1101.          * @access private

    1102. 

  1102.          * @param string $value The entitiy to be decoded.

    1103. 

  1103.          * @return string Decoded entity

    1104. 

  1104.          * @since PHP4 OOP 0.0.1

    1105. 

  1105.          */

    1106. 

  1106.         private function decodeEntities($string)

    1107. 

  1107.         {

    1108. 

  1108.             $string = preg_replace('/&#([0-9]+);/e', 'chr("\\1")', $string);

    1109. 

  1109.             $string = preg_replace('/&#[Xx]([0-9A-Fa-f]+);/e', 'chr(hexdec("\\1"))', $string);

    1110. 

  1110.             return $string;

    1111. 

  1111.         }

    1112. 

  1112. 

    1113. 

  1113.         /**

    1114. 

  1114.          * Returns PHP5 OOP version # of kses.

    1115. 

  1115.          *

    1116. 

  1116.          * Since this class has been refactored and documented and proven to work,

    1117. 

  1117.          * I'm fixing the version number at 1.0.0.

    1118. 

  1118.          *

    1119. 

  1119.          * This version is syntax compatible with the PHP4 OOP version 0.0.2.  Future

    1120. 

  1120.          * versions may not be syntax compatible.

    1121. 

  1121.          *

    1122. 

  1122.          * @access public

    1123. 

  1123.          * @return string Version number

    1124. 

  1124.          * @since PHP4 OOP 0.0.1

    1125. 

  1125.          */

    1126. 

  1126.         public function Version()

    1127. 

  1127.         {

    1128. 

  1128.             return 'PHP5 OOP 1.0.2';

    1129. 

  1129.         }

    1130. 

  1130.     }

    1131. 

  1131. }

    1132. 

  1132. ?>
    1133.