| 1 |
efrain |
1 |
<?php
|
|
|
2 |
|
|
|
3 |
/**
|
|
|
4 |
* A "safe" object module. In theory, objects permitted by this module will
|
|
|
5 |
* be safe, and untrusted users can be allowed to embed arbitrary flash objects
|
|
|
6 |
* (maybe other types too, but only Flash is supported as of right now).
|
|
|
7 |
* Highly experimental.
|
|
|
8 |
*/
|
|
|
9 |
class HTMLPurifier_HTMLModule_SafeObject extends HTMLPurifier_HTMLModule
|
|
|
10 |
{
|
|
|
11 |
/**
|
|
|
12 |
* @type string
|
|
|
13 |
*/
|
|
|
14 |
public $name = 'SafeObject';
|
|
|
15 |
|
|
|
16 |
/**
|
|
|
17 |
* @param HTMLPurifier_Config $config
|
|
|
18 |
*/
|
|
|
19 |
public function setup($config)
|
|
|
20 |
{
|
|
|
21 |
// These definitions are not intrinsically safe: the attribute transforms
|
|
|
22 |
// are a vital part of ensuring safety.
|
|
|
23 |
|
|
|
24 |
$max = $config->get('HTML.MaxImgLength');
|
|
|
25 |
$object = $this->addElement(
|
|
|
26 |
'object',
|
|
|
27 |
'Inline',
|
|
|
28 |
'Optional: param | Flow | #PCDATA',
|
|
|
29 |
'Common',
|
|
|
30 |
array(
|
|
|
31 |
// While technically not required by the spec, we're forcing
|
|
|
32 |
// it to this value.
|
|
|
33 |
'type' => 'Enum#application/x-shockwave-flash',
|
|
|
34 |
'width' => 'Pixels#' . $max,
|
|
|
35 |
'height' => 'Pixels#' . $max,
|
|
|
36 |
'data' => 'URI#embedded',
|
|
|
37 |
'codebase' => new HTMLPurifier_AttrDef_Enum(
|
|
|
38 |
array(
|
|
|
39 |
'http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=6,0,40,0'
|
|
|
40 |
)
|
|
|
41 |
),
|
|
|
42 |
)
|
|
|
43 |
);
|
|
|
44 |
$object->attr_transform_post[] = new HTMLPurifier_AttrTransform_SafeObject();
|
|
|
45 |
|
|
|
46 |
$param = $this->addElement(
|
|
|
47 |
'param',
|
|
|
48 |
false,
|
|
|
49 |
'Empty',
|
|
|
50 |
false,
|
|
|
51 |
array(
|
|
|
52 |
'id' => 'ID',
|
|
|
53 |
'name*' => 'Text',
|
|
|
54 |
'value' => 'Text'
|
|
|
55 |
)
|
|
|
56 |
);
|
|
|
57 |
$param->attr_transform_post[] = new HTMLPurifier_AttrTransform_SafeParam();
|
|
|
58 |
$this->info_injector[] = 'SafeObject';
|
|
|
59 |
}
|
|
|
60 |
}
|
|
|
61 |
|
|
|
62 |
// vim: et sw=4 sts=4
|