Proyectos de Subversion Moodle

<?php

/**

 * Definition of the purified HTML that describes allowed children,

 * attributes, and many other things.

 *

 * Conventions:

 *

 * All member variables that are prefixed with info

 * (including the main $info array) are used by HTML Purifier internals

 * and should not be directly edited when customizing the HTMLDefinition.

 * They can usually be set via configuration directives or custom

 * modules.

 *

 * On the other hand, member variables without the info prefix are used

 * internally by the HTMLDefinition and MUST NOT be used by other HTML

 * Purifier internals. Many of them, however, are public, and may be

 * edited by userspace code to tweak the behavior of HTMLDefinition.

 *

 * @note This class is inspected by Printer_HTMLDefinition; please

 *       update that class if things here change.

 *

 * @warning Directives that change this object's structure must be in

 *          the HTML or Attr namespace!

 */

class HTMLPurifier_HTMLDefinition extends HTMLPurifier_Definition

{

    // FULLY-PUBLIC VARIABLES ---------------------------------------------

    /**

     * Associative array of element names to HTMLPurifier_ElementDef.

     * @type HTMLPurifier_ElementDef[]

     */

    public $info = array();

    /**

     * Associative array of global attribute name to attribute definition.

     * @type array

     */

    public $info_global_attr = array();

    /**

     * String name of parent element HTML will be going into.

     * @type string

     */

    public $info_parent = 'div';

    /**

     * Definition for parent element, allows parent element to be a

     * tag that's not allowed inside the HTML fragment.

     * @type HTMLPurifier_ElementDef

     */

    public $info_parent_def;

    /**

     * String name of element used to wrap inline elements in block context.

     * @type string

     * @note This is rarely used except for BLOCKQUOTEs in strict mode

     */

    public $info_block_wrapper = 'p';

    /**

     * Associative array of deprecated tag name to HTMLPurifier_TagTransform.

     * @type array

     */

    public $info_tag_transform = array();

    /**

     * Indexed list of HTMLPurifier_AttrTransform to be performed before validation.

     * @type HTMLPurifier_AttrTransform[]

     */

    public $info_attr_transform_pre = array();

    /**

     * Indexed list of HTMLPurifier_AttrTransform to be performed after validation.

     * @type HTMLPurifier_AttrTransform[]

     */

    public $info_attr_transform_post = array();

    /**

     * Nested lookup array of content set name (Block, Inline) to

     * element name to whether or not it belongs in that content set.

     * @type array

     */

    public $info_content_sets = array();

    /**

     * Indexed list of HTMLPurifier_Injector to be used.

     * @type HTMLPurifier_Injector[]

     */

    public $info_injector = array();

    /**

     * Doctype object

     * @type HTMLPurifier_Doctype

     */

    public $doctype;

    // RAW CUSTOMIZATION STUFF --------------------------------------------

    /**

     * Adds a custom attribute to a pre-existing element

     * @note This is strictly convenience, and does not have a corresponding

     *       method in HTMLPurifier_HTMLModule

     * @param string $element_name Element name to add attribute to

     * @param string $attr_name Name of attribute

     * @param mixed $def Attribute definition, can be string or object, see

     *             HTMLPurifier_AttrTypes for details

     */

    public function addAttribute($element_name, $attr_name, $def)

    {

        $module = $this->getAnonymousModule();

        if (!isset($module->info[$element_name])) {

            $element = $module->addBlankElement($element_name);

        } else {

            $element = $module->info[$element_name];

        }

        $element->attr[$attr_name] = $def;

    }

    /**

     * Adds a custom element to your HTML definition

     * @see HTMLPurifier_HTMLModule::addElement() for detailed

     *       parameter and return value descriptions.

     */

    public function addElement($element_name, $type, $contents, $attr_collections, $attributes = array())

    {

        $module = $this->getAnonymousModule();

        // assume that if the user is calling this, the element

        // is safe. This may not be a good idea

        $element = $module->addElement($element_name, $type, $contents, $attr_collections, $attributes);

        return $element;

    }

    /**

     * Adds a blank element to your HTML definition, for overriding

     * existing behavior

     * @param string $element_name

     * @return HTMLPurifier_ElementDef

     * @see HTMLPurifier_HTMLModule::addBlankElement() for detailed

     *       parameter and return value descriptions.

     */

    public function addBlankElement($element_name)

    {

        $module  = $this->getAnonymousModule();

        $element = $module->addBlankElement($element_name);

        return $element;

    }

    /**

     * Retrieves a reference to the anonymous module, so you can

     * bust out advanced features without having to make your own

     * module.

     * @return HTMLPurifier_HTMLModule

     */

    public function getAnonymousModule()

    {

        if (!$this->_anonModule) {

            $this->_anonModule = new HTMLPurifier_HTMLModule();

            $this->_anonModule->name = 'Anonymous';

        }

        return $this->_anonModule;

    }

    private $_anonModule = null;

    // PUBLIC BUT INTERNAL VARIABLES --------------------------------------

    /**

     * @type string

     */

    public $type = 'HTML';

    /**

     * @type HTMLPurifier_HTMLModuleManager

     */

    public $manager;

    /**

     * Performs low-cost, preliminary initialization.

     */

    public function __construct()

    {

        $this->manager = new HTMLPurifier_HTMLModuleManager();

    }

    /**

     * @param HTMLPurifier_Config $config

     */

    protected function doSetup($config)

    {

        $this->processModules($config);

        $this->setupConfigStuff($config);

        unset($this->manager);

        // cleanup some of the element definitions

        foreach ($this->info as $k => $v) {

            unset($this->info[$k]->content_model);

            unset($this->info[$k]->content_model_type);

        }

    }

    /**

     * Extract out the information from the manager

     * @param HTMLPurifier_Config $config

     */

    protected function processModules($config)

    {

        if ($this->_anonModule) {

            // for user specific changes

            // this is late-loaded so we don't have to deal with PHP4

            // reference wonky-ness

            $this->manager->addModule($this->_anonModule);

            unset($this->_anonModule);

        }

        $this->manager->setup($config);

        $this->doctype = $this->manager->doctype;

        foreach ($this->manager->modules as $module) {

            foreach ($module->info_tag_transform as $k => $v) {

                if ($v === false) {

                    unset($this->info_tag_transform[$k]);

                } else {

                    $this->info_tag_transform[$k] = $v;

                }

            }

            foreach ($module->info_attr_transform_pre as $k => $v) {

                if ($v === false) {

                    unset($this->info_attr_transform_pre[$k]);

                } else {

                    $this->info_attr_transform_pre[$k] = $v;

                }

            }

            foreach ($module->info_attr_transform_post as $k => $v) {

                if ($v === false) {

                    unset($this->info_attr_transform_post[$k]);

                } else {

                    $this->info_attr_transform_post[$k] = $v;

                }

            }

            foreach ($module->info_injector as $k => $v) {

                if ($v === false) {

                    unset($this->info_injector[$k]);

                } else {

                    $this->info_injector[$k] = $v;

                }

            }

        }

        $this->info = $this->manager->getElements();

        $this->info_content_sets = $this->manager->contentSets->lookup;

    }

    /**

     * Sets up stuff based on config. We need a better way of doing this.

     * @param HTMLPurifier_Config $config

     */

    protected function setupConfigStuff($config)

    {

        $block_wrapper = $config->get('HTML.BlockWrapper');

        if (isset($this->info_content_sets['Block'][$block_wrapper])) {

            $this->info_block_wrapper = $block_wrapper;

        } else {

            trigger_error(

                'Cannot use non-block element as block wrapper',

                E_USER_ERROR

            );

        }

        $parent = $config->get('HTML.Parent');

        $def = $this->manager->getElement($parent, true);

        if ($def) {

            $this->info_parent = $parent;

            $this->info_parent_def = $def;

        } else {

            trigger_error(

                'Cannot use unrecognized element as parent',

                E_USER_ERROR

            );

            $this->info_parent_def = $this->manager->getElement($this->info_parent, true);

        }

        // support template text

        $support = "(for information on implementing this, see the support forums) ";

        // setup allowed elements -----------------------------------------

        $allowed_elements = $config->get('HTML.AllowedElements');

        $allowed_attributes = $config->get('HTML.AllowedAttributes'); // retrieve early

        if (!is_array($allowed_elements) && !is_array($allowed_attributes)) {

            $allowed = $config->get('HTML.Allowed');

            if (is_string($allowed)) {

                list($allowed_elements, $allowed_attributes) = $this->parseTinyMCEAllowedList($allowed);

            }

        }

        if (is_array($allowed_elements)) {

            foreach ($this->info as $name => $d) {

                if (!isset($allowed_elements[$name])) {

                    unset($this->info[$name]);

                }

                unset($allowed_elements[$name]);

            }

            // emit errors

            foreach ($allowed_elements as $element => $d) {

                $element = htmlspecialchars($element); // PHP doesn't escape errors, be careful!

                trigger_error("Element '$element' is not supported $support", E_USER_WARNING);

            }

        }

        // setup allowed attributes ---------------------------------------

        $allowed_attributes_mutable = $allowed_attributes; // by copy!

        if (is_array($allowed_attributes)) {

            // This actually doesn't do anything, since we went away from

            // global attributes. It's possible that userland code uses

            // it, but HTMLModuleManager doesn't!

            foreach ($this->info_global_attr as $attr => $x) {

                $keys = array($attr, "*@$attr", "*.$attr");

                $delete = true;

                foreach ($keys as $key) {

                    if ($delete && isset($allowed_attributes[$key])) {

                        $delete = false;

                    }

                    if (isset($allowed_attributes_mutable[$key])) {

                        unset($allowed_attributes_mutable[$key]);

                    }

                }

                if ($delete) {

                    unset($this->info_global_attr[$attr]);

                }

            }

            foreach ($this->info as $tag => $info) {

                foreach ($info->attr as $attr => $x) {

                    $keys = array("$tag@$attr", $attr, "*@$attr", "$tag.$attr", "*.$attr");

                    $delete = true;

                    foreach ($keys as $key) {

                        if ($delete && isset($allowed_attributes[$key])) {

                            $delete = false;

                        }

                        if (isset($allowed_attributes_mutable[$key])) {

                            unset($allowed_attributes_mutable[$key]);

                        }

                    }

                    if ($delete) {

                        if ($this->info[$tag]->attr[$attr]->required) {

                            trigger_error(

                                "Required attribute '$attr' in element '$tag' " .

                                "was not allowed, which means '$tag' will not be allowed either",

                                E_USER_WARNING

                            );

                        }

                        unset($this->info[$tag]->attr[$attr]);

                    }

                }

            }

            // emit errors

            foreach ($allowed_attributes_mutable as $elattr => $d) {

                $bits = preg_split('/[.@]/', $elattr, 2);

                $c = count($bits);

                switch ($c) {

                    case 2:

                        if ($bits[0] !== '*') {

                            $element = htmlspecialchars($bits[0]);

                            $attribute = htmlspecialchars($bits[1]);

                            if (!isset($this->info[$element])) {

                                trigger_error(

                                    "Cannot allow attribute '$attribute' if element " .

                                    "'$element' is not allowed/supported $support"

                                );

                            } else {

                                trigger_error(

                                    "Attribute '$attribute' in element '$element' not supported $support",

                                    E_USER_WARNING

                                );

                            }

                            break;

                        }

                        // otherwise fall through

                    case 1:

                        $attribute = htmlspecialchars($bits[0]);

                        trigger_error(

                            "Global attribute '$attribute' is not ".

                            "supported in any elements $support",

                            E_USER_WARNING

                        );

                        break;

                }

            }

        }

        // setup forbidden elements ---------------------------------------

        $forbidden_elements   = $config->get('HTML.ForbiddenElements');

        $forbidden_attributes = $config->get('HTML.ForbiddenAttributes');

        foreach ($this->info as $tag => $info) {

            if (isset($forbidden_elements[$tag])) {

                unset($this->info[$tag]);

                continue;

            }

            foreach ($info->attr as $attr => $x) {

                if (isset($forbidden_attributes["$tag@$attr"]) ||

                    isset($forbidden_attributes["*@$attr"]) ||

                    isset($forbidden_attributes[$attr])

                ) {

                    unset($this->info[$tag]->attr[$attr]);

                    continue;

                } elseif (isset($forbidden_attributes["$tag.$attr"])) { // this segment might get removed eventually

                    // $tag.$attr are not user supplied, so no worries!

                    trigger_error(

                        "Error with $tag.$attr: tag.attr syntax not supported for " .

                        "HTML.ForbiddenAttributes; use tag@attr instead",

                        E_USER_WARNING

                    );

                }

            }

        }

        foreach ($forbidden_attributes as $key => $v) {

            if (strlen($key) < 2) {

                continue;

            }

            if ($key[0] != '*') {

                continue;

            }

            if ($key[1] == '.') {

                trigger_error(

                    "Error with $key: *.attr syntax not supported for HTML.ForbiddenAttributes; use attr instead",

                    E_USER_WARNING

                );

            }

        }

        // setup injectors -----------------------------------------------------

        foreach ($this->info_injector as $i => $injector) {

            if ($injector->checkNeeded($config) !== false) {

                // remove injector that does not have it's required

                // elements/attributes present, and is thus not needed.

                unset($this->info_injector[$i]);

            }

        }

    }

    /**

     * Parses a TinyMCE-flavored Allowed Elements and Attributes list into

     * separate lists for processing. Format is element[attr1|attr2],element2...

     * @warning Although it's largely drawn from TinyMCE's implementation,

     *      it is different, and you'll probably have to modify your lists

     * @param array $list String list to parse

     * @return array

     * @todo Give this its own class, probably static interface

     */

    public function parseTinyMCEAllowedList($list)

    {

        $list = str_replace(array(' ', "\t"), '', $list);

        $elements = array();

        $attributes = array();

        $chunks = preg_split('/(,|[\n\r]+)/', $list);

        foreach ($chunks as $chunk) {

            if (empty($chunk)) {

                continue;

            }

            // remove TinyMCE element control characters

            if (!strpos($chunk, '[')) {

                $element = $chunk;

                $attr = false;

            } else {

                list($element, $attr) = explode('[', $chunk);

            }

            if ($element !== '*') {

                $elements[$element] = true;

            }

            if (!$attr) {

                continue;

            }

            $attr = substr($attr, 0, strlen($attr) - 1); // remove trailing ]

            $attr = explode('|', $attr);

            foreach ($attr as $key) {

                $attributes["$element.$key"] = true;

            }

        }

        return array($elements, $attributes);

    }

}

// vim: et sw=4 sts=4