fanbinit/rhymix
1
0
Fork 0
mirror of https://github.com/Lastorder-DC/rhymix.git synced 2026-01-07 10:41:40 +09:00
Code Issues Projects Releases Packages Wiki Activity

Remove checkXmpTag() and blockWidgetCode() because HTMLPurifier does it better

Browse source
This commit is contained in:
Kijin Sung 2016-03-12 21:33:42 +09:00
parent be882d0c5c
commit 598722b0cd
2 changed files with 14 additions and 41 deletions
Download patch file Download diff file Expand all files Collapse all files

2
common/framework/security/htmlfilter.php
View file

@ -167,11 +167,9 @@ class HTMLFilter
$def->addElement('section', 'Block', 'Flow', 'Common');
$def->addElement('article', 'Block', 'Flow', 'Common');
$def->addElement('aside', 'Block', 'Flow', 'Common');
$def->addElement('address', 'Block', 'Flow', 'Common');
// Add various inline tags.
$def->addElement('s', 'Inline', 'Inline', 'Common');
$def->addElement('var', 'Inline', 'Inline', 'Common');
$def->addElement('sub', 'Inline', 'Inline', 'Common');
$def->addElement('sup', 'Inline', 'Inline', 'Common');
$def->addElement('mark', 'Inline', 'Inline', 'Common');

53
common/legacy.php
View file

@ -840,28 +840,33 @@ function removeHackTag($content)
* - Issue reported by Sangwon Kim
*/
$content = preg_replace_callback('@<(/?)([a-z]+[0-9]?)((?>"[^"]*"|\'[^\']*\'|[^>])*?\b(?:on[a-z]+|data|style|background|href|(?:dyn|low)?src)\s*=[\s\S]*?)(/?)($|>|<)@i', 'removeSrcHack', $content);
$content = checkXmpTag($content);
$content = blockWidgetCode($content);
return $content;
}
/**
* blocking widget code
* Check xmp tag (Deprecated)
*
* @param string $content Target content
* @return string
*/
function checkXmpTag($content)
{
return $content;
}
/**
* Block widget code (Deprecated)
*
* @param string $content Taget content
* @return string
**/
function blockWidgetCode($content)
{
$content = preg_replace('/(<(?:img|div)(?:[^>]*))(widget)(?:(=([^>]*?)>))/is', '$1blocked-widget$3', $content);
return $content;
return preg_replace('/(<(?:img|div)(?:[^>]*))(widget)(?:(=([^>]*?)>))/is', '$1blocked-widget$3', $content);
}
/**
* check uploaded file which may be hacking attempts
* Check uploaded file (Deprecated)
*
* @param string $file Taget file path
* @return bool
@ -871,31 +876,6 @@ function checkUploadedFile($file)
return true;
}
/**
* Check xmp tag, close it.
*
* @param string $content Target content
* @return string
*/
function checkXmpTag($content)
{
$content = preg_replace('@<(/?)xmp.*?>@i', '<\1xmp>', $content);
if(($start_xmp = strrpos($content, '<xmp>')) !== FALSE)
{
if(($close_xmp = strrpos($content, '</xmp>')) === FALSE)
{
$content .= '</xmp>';
}
else if($close_xmp < $start_xmp)
{
$content .= '</xmp>';
}
}
return $content;
}
/**
* Remove src hack(preg_replace_callback)
*
@ -906,11 +886,6 @@ function removeSrcHack($match)
{
$tag = strtolower($match[2]);
// xmp tag ?뺣━
if($tag == 'xmp')
{
return "<{$match[1]}xmp>";
}
if($match[1])
{
return $match[0];