fanbinit/rhymix
1
0
Fork 0
mirror of https://github.com/Lastorder-DC/rhymix.git synced 2026-01-17 10:19:55 +09:00
Code Issues Projects Releases Packages Wiki Activity

merge from 1.5.3.2 (~r11225)

Browse source 
git-svn-id: http://xe-core.googlecode.com/svn/trunk@11226 201d5d3c-b55e-5fd7-737f-ddc643e51545
This commit is contained in:
flyskyko 2012-09-13 06:14:45 +00:00
parent 54e3a72065
commit 77f5aa2671
313 changed files with 8058 additions and 14251 deletions
Download patch file Download diff file Expand all files Collapse all files

821
classes/context/Context.class.php
View file

File diff suppressed because it is too large Load diff

3
classes/db/DB.class.php
View file

@ -407,6 +407,7 @@
*/
function executeQuery($query_id, $args = NULL, $arg_columns = NULL) {
static $cache_file = array();
if(!$query_id) return new Object(-1, 'msg_invalid_queryid');
if(!$this->db_type) return;
@ -414,7 +415,7 @@
$this->query_id = $query_id;
if(!isset($cache_file[$query_id])) {
if(!isset($cache_file[$query_id]) || !file_exists($cache_file[$query_id])) {
$id_args = explode('.', $query_id);
if(count($id_args) == 2) {
$target = 'modules';

145
classes/db/DBCubrid.class.php
View file

@ -68,8 +68,8 @@
*/
function isSupported()
{
if (!function_exists('cubrid_connect')) return false;
return true;
if (!function_exists('cubrid_connect')) return FALSE;
return TRUE;
}
/**
@ -112,7 +112,7 @@
{
@cubrid_commit ($connection);
@cubrid_disconnect ($connection);
$this->transaction_started = false;
$this->transaction_started = FALSE;
}
/**
@ -155,7 +155,7 @@
$connection = $this->_getConnection('master');
cubrid_set_autocommit($connection, CUBRID_AUTOCOMMIT_FALSE);
}
return true;
return TRUE;
}
/**
@ -167,7 +167,7 @@
{
$connection = $this->_getConnection('master');
@cubrid_rollback ($connection);
return true;
return TRUE;
}
/**
@ -179,7 +179,7 @@
{
$connection = $this->_getConnection('master');
@cubrid_commit($connection);
return true;
return TRUE;
}
/**
@ -194,6 +194,12 @@
if($this->use_prepared_statements == 'Y')
{
$req = @cubrid_prepare($connection, $query);
if(!$req)
{
$this->_setError();
return false;
}
$position = 0;
if($this->param)
{
@ -219,12 +225,22 @@
if(is_array($value)){
foreach($value as $v)
{
cubrid_bind($req, ++$position, $v, $bind_type);
$bound = @cubrid_bind($req, ++$position, $v, $bind_type);
if(!$bound)
{
$this->_setError();
return false;
}
}
}
else
{
cubrid_bind($req, ++$position, $value, $bind_type);
$bound = @cubrid_bind($req, ++$position, $value, $bind_type);
if(!$bound)
{
$this->_setError();
return false;
}
}
}
}
@ -232,10 +248,8 @@
$result = @cubrid_execute($req);
if(!$result)
{
$code = cubrid_error_code ();
$msg = cubrid_error_msg ();
$this->setError ($code, $msg);
$this->_setError();
return false;
}
return $req;
@ -243,16 +257,27 @@
// Execute the query
$result = @cubrid_execute ($connection, $query);
// error check
if (cubrid_error_code ()) {
$code = cubrid_error_code ();
$msg = cubrid_error_msg ();
$this->setError ($code, $msg);
if (!$result) {
$this->_setError();
return false;
}
// Return the result
return $result;
}
/**
* Retrieve CUBRID error and set to object
*
* @author Corina Udrescu (dev@xpressengine.org)
*/
function _setError()
{
$code = cubrid_error_code ();
$msg = cubrid_error_msg ();
$this->setError ($code, $msg);
}
/**
* Fetch the result
* @param resource $result
@ -360,7 +385,7 @@
$this->_query($query);
}
$_GLOBALS['XE_EXISTS_SEQUENCE'] = true;
$_GLOBALS['XE_EXISTS_SEQUENCE'] = TRUE;
}
@ -380,10 +405,10 @@
$result = $this->_query ($query);
if (cubrid_num_rows($result) > 0) {
$output = true;
$output = TRUE;
}
else {
$output = false;
$output = FALSE;
}
if ($result) cubrid_close_request ($result);
@ -401,7 +426,7 @@
* @param boolean $notnull not null status, default value is false
* @return void
*/
function addColumn($table_name, $column_name, $type = 'number', $size = '', $default = '', $notnull = false)
function addColumn($table_name, $column_name, $type = 'number', $size = '', $default = '', $notnull = FALSE)
{
$type = strtoupper($this->column_type[$type]);
if ($type == 'INTEGER') $size = '';
@ -457,8 +482,8 @@
$query = sprintf ("select \"attr_name\" from \"db_attribute\" where ". "\"attr_name\" ='%s' and \"class_name\" = '%s%s'", $column_name, $this->prefix, $table_name);
$result = $this->_query ($query);
if (cubrid_num_rows ($result) > 0) $output = true;
else $output = false;
if (cubrid_num_rows ($result) > 0) $output = TRUE;
else $output = FALSE;
if ($result) cubrid_close_request ($result);
@ -475,13 +500,13 @@
* @param boolean $is_unique
* @return void
*/
function addIndex ($table_name, $index_name, $target_columns, $is_unique = false)
function addIndex ($table_name, $index_name, $target_columns, $is_unique = FALSE)
{
if (!is_array ($target_columns)) {
$target_columns = array ($target_columns);
}
$query = sprintf ("create %s index \"%s\" on \"%s%s\" (%s);", $is_unique?'unique':'', $this->prefix .$index_name, $this->prefix, $table_name, '"'.implode('","',$target_columns).'"');
$query = sprintf ("create %s index \"%s\" on \"%s%s\" (%s);", $is_unique?'unique':'', $index_name, $this->prefix, $table_name, '"'.implode('","',$target_columns).'"');
$this->_query ($query);
}
@ -493,9 +518,9 @@
* @param boolean $is_unique
* @return void
*/
function dropIndex ($table_name, $index_name, $is_unique = false)
function dropIndex ($table_name, $index_name, $is_unique = FALSE)
{
$query = sprintf ("drop %s index \"%s\" on \"%s%s\"", $is_unique?'unique':'', $this->prefix .$index_name, $this->prefix, $table_name);
$query = sprintf ("drop %s index \"%s\" on \"%s%s\"", $is_unique?'unique':'', $index_name, $this->prefix, $table_name);
$this->_query($query);
}
@ -508,15 +533,15 @@
*/
function isIndexExists ($table_name, $index_name)
{
$query = sprintf ("select \"index_name\" from \"db_index\" where ". "\"class_name\" = '%s%s' and \"index_name\" = '%s' ", $this->prefix, $table_name, $this->prefix .$index_name);
$query = sprintf ("select \"index_name\" from \"db_index\" where ". "\"class_name\" = '%s%s' and (\"index_name\" = '%s' or \"index_name\" = '%s') ", $this->prefix, $table_name, $this->prefix .$index_name, $index_name);
$result = $this->_query ($query);
if ($this->isError ()) return false;
if ($this->isError ()) return FALSE;
$output = $this->_fetch ($result);
if (!$output) return false;
return true;
if (!$output) return FALSE;
return TRUE;
}
/**
@ -551,18 +576,26 @@
);
$result = $this->_query ($query);
if ($this->isError ()) return false;
if ($this->isError ()) return FALSE;
$output = $this->_fetch ($result);
if (!$output) return false;
if (!$output) return FALSE;
if(!is_array($output)) {
$indexes_to_be_deleted = array($output);
}
else {
$indexes_to_be_deleted = $output;
}
$indexes_to_be_deleted = $output->data;
foreach($indexes_to_be_deleted as $index)
{
$this->dropIndex($index->class_name, $index->unprefixed_index_name, $index->is_unique == 'YES' ? true : false);
$this->dropIndex(substr($index->class_name, strlen($this->prefix))
, $this->prefix . $index->unprefixed_index_name
, $index->is_unique == 'YES' ? TRUE : FALSE);
}
return true;
return TRUE;
}
/**
@ -648,10 +681,10 @@
switch ($this->column_type[$type]) {
case 'integer' :
$size = null;
$size = NULL;
break;
case 'text' :
$size = null;
$size = NULL;
break;
}
@ -693,14 +726,14 @@
if (count ($unique_list)) {
foreach ($unique_list as $key => $val) {
$query = sprintf ("create unique index \"%s\" on \"%s\" ". "(%s);", $this->prefix .$key, $table_name, '"'.implode('","', $val).'"');
$query = sprintf ("create unique index \"%s\" on \"%s\" ". "(%s);", $key, $table_name, '"'.implode('","', $val).'"');
$this->_query ($query);
}
}
if (count ($index_list)) {
foreach ($index_list as $key => $val) {
$query = sprintf ("create index \"%s\" on \"%s\" (%s);", $this->prefix .$key, $table_name, '"'.implode('","',$val).'"');
$query = sprintf ("create index \"%s\" on \"%s\" (%s);", $key, $table_name, '"'.implode('","',$val).'"');
$this->_query ($query);
}
}
@ -715,17 +748,17 @@
* @param boolean $with_values
* @return resource
*/
function _executeInsertAct($queryObject, $with_values = true)
function _executeInsertAct($queryObject, $with_values = TRUE)
{
if($this->use_prepared_statements == 'Y')
{
$this->param = $queryObject->getArguments();
$with_values = false;
$with_values = FALSE;
}
$query = $this->getInsertSql($queryObject, $with_values);
if(is_a($query, 'Object')) return;
$query .= (__DEBUG_QUERY__&1 && $queryObject->queryID)?sprintf (' '.$this->comment_syntax, $queryObject->queryID):'';
$query .= (__DEBUG_QUERY__&1 && $this->query_id)?sprintf (' '.$this->comment_syntax, $this->query_id):'';
$result = $this->_query ($query);
if ($result && !$this->transaction_started) {
@ -741,16 +774,18 @@
* @param boolean $with_values
* @return resource
*/
function _executeUpdateAct($queryObject, $with_values = true)
function _executeUpdateAct($queryObject, $with_values = TRUE)
{
if($this->use_prepared_statements == 'Y')
{
$this->param = $queryObject->getArguments();
$with_values = false;
$with_values = FALSE;
}
$query = $this->getUpdateSql($queryObject, $with_values);
if(is_a($query, 'Object')) return;
$query .= (__DEBUG_QUERY__&1 && $this->query_id)?sprintf (' '.$this->comment_syntax, $this->query_id):'';
$result = $this->_query($query);
if ($result && !$this->transaction_started) $this->_commit();
@ -765,16 +800,18 @@
* @param boolean $with_values
* @return resource
*/
function _executeDeleteAct($queryObject, $with_values = true)
function _executeDeleteAct($queryObject, $with_values = TRUE)
{
if($this->use_prepared_statements == 'Y')
{
$this->param = $queryObject->getArguments();
$with_values = false;
$with_values = FALSE;
}
$query = $this->getDeleteSql($queryObject, $with_values);
if(is_a($query, 'Object')) return;
$query .= (__DEBUG_QUERY__&1 && $this->query_id)?sprintf (' '.$this->comment_syntax, $this->query_id):'';
$result = $this->_query ($query);
if ($result && !$this->transaction_started) $this->_commit();
@ -792,10 +829,10 @@
* @param boolean $with_values
* @return Object
*/
function _executeSelectAct($queryObject, $connection = null, $with_values = true) {
function _executeSelectAct($queryObject, $connection = NULL, $with_values = TRUE) {
if ($this->use_prepared_statements == 'Y') {
$this->param = $queryObject->getArguments();
$with_values = false;
$with_values = FALSE;
}
$limit = $queryObject->getLimit();
if ($limit && $limit->isPageHandler())
@ -807,7 +844,7 @@
if (is_a($query, 'Object'))
return;
$query .= (__DEBUG_QUERY__ & 1 && $queryObject->queryID) ? sprintf(' ' . $this->comment_syntax, $queryObject->queryID) : '';
$query .= (__DEBUG_QUERY__ & 1 && $this->query_id) ? sprintf(' ' . $this->comment_syntax, $this->query_id) : '';
$result = $this->_query($query, $connection);
if ($this->isError())
@ -851,12 +888,12 @@
function queryPageLimit($queryObject, $connection, $with_values){
$limit = $queryObject->getLimit();
// Total count
$temp_where = $queryObject->getWhereString($with_values, false);
$temp_where = $queryObject->getWhereString($with_values, FALSE);
$count_query = sprintf('select count(*) as "count" %s %s', 'FROM ' . $queryObject->getFromString($with_values), ($temp_where === '' ? '' : ' WHERE '. $temp_where));
// Check for distinct query and if found update count query structure
$temp_select = $queryObject->getSelectString($with_values);
$uses_distinct = strpos(strtolower($temp_select), "distinct") !== false;
$uses_distinct = strpos(strtolower($temp_select), "distinct") !== FALSE;
$uses_groupby = $queryObject->getGroupByString() != '';
if($uses_distinct || $uses_groupby) {
$count_query = sprintf('select %s %s %s %s'
@ -940,7 +977,7 @@
* @param int $list_count
* @return string select paging sql
*/
function getSelectPageSql($query, $with_values = true, $start_count = 0, $list_count = 0) {
function getSelectPageSql($query, $with_values = TRUE, $start_count = 0, $list_count = 0) {
$select = $query->getSelectString($with_values);
if($select == '') return new Object(-1, "Invalid query");
@ -966,6 +1003,4 @@
return $select . ' ' . $from . ' ' . $where . ' ' . $groupBy . ' ' . $orderBy . ' ' . $limit;
}
}
return new DBCubrid;
?>

2
classes/db/DBFirebird.class.php
View file

@ -865,6 +865,4 @@
}
}
return new DBFireBird;
?>

2
classes/db/DBMssql.class.php
View file

@ -734,6 +734,4 @@
}
}
return new DBMssql;
?>

5
classes/db/DBMysql.class.php
View file

@ -443,6 +443,7 @@ class DBMysql extends DB {
*/
function _executeInsertAct($queryObject, $with_values = true) {
$query = $this->getInsertSql($queryObject, $with_values, true);
$query .= (__DEBUG_QUERY__ & 1 && $this->query_id) ? sprintf(' ' . $this->comment_syntax, $this->query_id) : '';
if(is_a($query, 'Object')) return;
return $this->_query($query);
}
@ -455,6 +456,7 @@ class DBMysql extends DB {
*/
function _executeUpdateAct($queryObject, $with_values = true) {
$query = $this->getUpdateSql($queryObject, $with_values, true);
$query .= (__DEBUG_QUERY__ & 1 && $this->query_id) ? sprintf(' ' . $this->comment_syntax, $this->query_id) : '';
if(is_a($query, 'Object')) return;
return $this->_query($query);
}
@ -467,6 +469,7 @@ class DBMysql extends DB {
*/
function _executeDeleteAct($queryObject, $with_values = true) {
$query = $this->getDeleteSql($queryObject, $with_values, true);
$query .= (__DEBUG_QUERY__ & 1 && $this->query_id) ? sprintf(' ' . $this->comment_syntax, $this->query_id) : '';
if(is_a($query, 'Object')) return;
return $this->_query($query);
}
@ -674,6 +677,4 @@ class DBMysql extends DB {
return $select . ' ' . $from . ' ' . $where . ' ' . $groupBy . ' ' . $orderBy . ' ' . $limit;
}
}
return new DBMysql;
?>

2
classes/db/DBMysql_innodb.class.php
View file

@ -159,6 +159,4 @@
if(!$output) return false;
}
}
return new DBMysql_innodb;
?>

19
classes/db/DBMysqli.class.php
View file

@ -217,8 +217,14 @@
$stmt = $result;
$meta = mysqli_stmt_result_metadata($stmt);
$fields = mysqli_fetch_fields($meta);
foreach($fields as $field)
/**
* Mysqli has a bug that causes LONGTEXT columns not to get loaded
* Unless store_result is called before
* MYSQLI_TYPE for longtext is 252
*/
$longtext_exists = false;
foreach($fields as $field)
{
if(isset($resultArray[$field->name])) // When joined tables are used and the same column name appears twice, we should add it separately, otherwise bind_result fails
$field->name = 'repeat_' . $field->name;
@ -226,9 +232,16 @@
// Array passed needs to contain references, not values
$row[$field->name] = "";
$resultArray[$field->name] = &$row[$field->name];
if($field->type == 252) $longtext_exists = true;
}
$resultArray = array_merge(array($stmt), $resultArray);
if($longtext_exists)
{
mysqli_stmt_store_result($stmt);
}
call_user_func_array('mysqli_stmt_bind_result', $resultArray);
$rows = array();
@ -370,6 +383,4 @@
return mysqli_free_result($result);
}
}
return new DBMysqli;
?>

2
classes/db/DBPostgresql.class.php
View file

@ -597,6 +597,4 @@ class DBPostgresql extends DB
return new DBParser('"', '"', $this->prefix);
}
}
return new DBPostgresql;
?>

2
classes/db/DBSqlite3_pdo.class.php
View file

@ -633,6 +633,4 @@
return $sql;
}
}
return new DBSqlite3_pdo;
?>

62
classes/display/HTMLDisplayHandler.php
View file

@ -11,24 +11,43 @@ class HTMLDisplayHandler {
$oTemplate = &TemplateHandler::getInstance();
// compile module tpl
if ($oModule->module_info->module == $oModule->module)
$skin = $oModule->origin_module_info->skin;
else
$skin = $oModule->module_config->skin;
// deprecated themes skin
if(Context::get('module')!='admin' && strpos(Context::get('act'),'Admin') === false){
if ($skin && is_string($skin)){
$theme_skin = explode('.', $skin);
$template_path = $oModule->getTemplatePath();
if (count($theme_skin) == 2) {
$theme_path = sprintf('./themes/%s',$theme_skin[0]);
if(substr($theme_path,0,strlen($theme_path)) != $theme_path)
$template_path = sprintf('%s/modules/%s/', $theme_path, $theme_skin[1]);
}
}else{
$template_path = $oModule->getTemplatePath();
if(!is_dir($template_path))
{
if ($oModule->module_info->module == $oModule->module)
$skin = $oModule->origin_module_info->skin;
else
$skin = $oModule->module_config->skin;
if(Context::get('module')!='admin' && strpos(Context::get('act'),'Admin') === false)
{
if ($skin && is_string($skin))
{
$theme_skin = explode('|@|', $skin);
$template_path = $oModule->getTemplatePath();
if (count($theme_skin) == 2)
{
$theme_path = sprintf('./themes/%s',$theme_skin[0]);
if(substr($theme_path,0,strlen($theme_path)) != $theme_path)
{
$template_path = sprintf('%s/modules/%s/', $theme_path, $theme_skin[1]);
}
}
}
else
{
$template_path = $oModule->getTemplatePath();
}
}
else
{
$template_path = $oModule->getTemplatePath();
}
}else $template_path = $oModule->getTemplatePath();
}
$tpl_file = $oModule->getTemplateFile();
$output = $oTemplate->compile($template_path, $tpl_file);
@ -93,6 +112,9 @@ class HTMLDisplayHandler {
// move <style ..></style> in body to the header
$output = preg_replace_callback('!<style(.*?)<\/style>!is', array($this,'_moveStyleToHeader'), $output);
// move <meta ../> in body to the header
$output = preg_replace_callback('!<meta(.*?)(?:\/|)>!is', array($this,'_moveMetaToHeader'), $output);
// change a meta fine(widget often put the tag like <!--Meta:path--> to the content because of caching)
$output = preg_replace_callback('/<!--(#)?Meta:([a-z0-9\_\/\.\@]+)-->/is', array($this,'_transMeta'), $output);
@ -238,6 +260,16 @@ class HTMLDisplayHandler {
Context::addHtmlHeader($matches[0]);
}
/**
* add meta code extracted from html body to Context, which will be
* printed inside <header></header> later.
* @param array $matches
* @return void
**/
function _moveMetaToHeader($matches) {
Context::addHtmlHeader($matches[0]);
}
/**
* add given .css or .js file names in widget code to Context
* @param array $matches

6
classes/editor/EditorHandler.class.php
View file

@ -1,10 +1,10 @@
<?php
/**
* Superclass of the edit component.
* Set up the component variables
*
* @class EditorHandler
* @author NHN (developers@xpressengine.com)
* @brief superclass of the edit component
*
* set up the component variables
**/
class EditorHandler extends Object {

11
classes/extravar/Extravar.class.php
View file

@ -206,6 +206,7 @@
if(is_array($value)) $values = $value;
elseif(strpos($value,'|@|')!==false) $values = explode('|@|', $value);
elseif(strpos($value,',')!==false) $values = explode(',', $value);
else $values = array($value);
return $values;
break;
//case 'date' :
@ -287,9 +288,9 @@
// Phone Number
case 'tel' :
$buff .=
'<input type="text" name="'.$column_name.'[]" value="'.$value[0].'" size="4" class="tel" />'.
'<input type="text" name="'.$column_name.'[]" value="'.$value[1].'" size="4" class="tel" />'.
'<input type="text" name="'.$column_name.'[]" value="'.$value[2].'" size="4" class="tel" />';
'<input type="text" name="'.$column_name.'[]" value="'.$value[0].'" size="4" maxlength="4" class="tel" />'.
'<input type="text" name="'.$column_name.'[]" value="'.$value[1].'" size="4" maxlength="4" class="tel" />'.
'<input type="text" name="'.$column_name.'[]" value="'.$value[2].'" size="4" maxlength="4" class="tel" />';
break;
// textarea
@ -366,7 +367,7 @@
$buff .=
'<div id="addr_searched_'.$column_name.'" style="display:'.($value[0]?'block':'none').';">'.
'<input type="text" readonly="readonly" name="'.$column_name.'" value="'.$value[0].'" class="address" />'.
'<input type="text" readonly="readonly" name="'.$column_name.'[]" value="'.$value[0].'" class="address" />'.
'<a href="#" onclick="doShowKrZipSearch(this, \''.$column_name.'\'); return false;" class="button red"><span>'.Context::getLang('cmd_cancel').'</span></a>'.
'</div>'.
@ -381,7 +382,7 @@
'<a href="#" onclick="doSearchKrZip(this, \''.$column_name.'\'); return false;" class="button green"><span>'.Context::getLang('cmd_search').'</span></a>'.
'</div>'.
'<input type="text" name="'.$column_name.'" value="'.htmlspecialchars($value[1]).'" class="address" />'.
'<input type="text" name="'.$column_name.'[]" value="'.htmlspecialchars($value[1]).'" class="address" />'.
'';
break;
// General text

18
classes/frontendfile/FrontEndFileHandler.class.php
View file

@ -141,7 +141,8 @@
$key = $file->filePath . $file->fileName . "\t" . $file->targetIe;
}
if (!isset($map[$key]) || $mapIndex[$key] != $file->index)
(is_null($file->index))?$file->index=0:$file->index=$file->index;
if (!isset($map[$file->index][$key]) || $mapIndex[$key] != $file->index)
{
$this->unloadFile($args[0], $args[2], $args[1]);
$map[$file->index][$key] = $file;
@ -207,16 +208,16 @@
{
if ($type == 'css' || $type == 'all')
{
$cssMap = array();
$cssMapIndex = array();
$this->cssMap = array();
$this->cssMapIndex = array();
}
if ($type == 'js' || $type == 'all')
{
$jsHeadMap = array();
$jsBodyMap = array();
$jsHeadMapIndex = array();
$jsBodyMapIndex = array();
$this->jsHeadMap = array();
$this->jsBodyMap = array();
$this->jsHeadMapIndex = array();
$this->jsBodyMapIndex = array();
}
}
@ -246,7 +247,8 @@
}
else
{
$fullFilePath = $file->filePath . '/' . $file->fileName;
$noneCache = (is_readable($file->cdnPath.'/'.$file->fileName))?'?'.date('YmdHis', filemtime($file->cdnPath.'/'.$file->fileName)):'';
$fullFilePath = $file->filePath . '/' . $file->fileName.$noneCache;
}
$result[] = array('file' => $fullFilePath, 'media' => $file->media, 'targetie' => $file->targetIe);
}

28
classes/module/ModuleHandler.class.php
View file

@ -60,6 +60,15 @@
exit;
}
if(isset($this->act) && substr($this->act, 0, 4) == 'disp')
{
if(Context::get('_use_ssl') == 'optional' && Context::isExistsSSLAction($this->act) && $_SERVER['HTTPS'] != 'on')
{
header('location:https://'.$_SERVER['HTTP_HOST'].$_SERVER['REQUEST_URI']);
return;
}
}
// execute addon (before module initialization)
$called_position = 'before_module_init';
$oAddonController = &getController('addon');
@ -407,6 +416,16 @@
$rulesetFile = $oModuleModel->getValidatorFilePath($rulesetModule, $ruleset, $this->mid);
if(!empty($rulesetFile))
{
if($_SESSION['XE_VALIDATOR_ERROR_LANG'])
{
$errorLang = $_SESSION['XE_VALIDATOR_ERROR_LANG'];
foreach($errorLang as $key => $val)
{
Context::setLang($key, $val);
}
unset($_SESSION['XE_VALIDATOR_ERROR_LANG']);
}
$Validator = new Validator($rulesetFile);
$result = $Validator->validate();
if(!$result)
@ -484,7 +503,11 @@
$_SESSION['XE_VALIDATOR_ERROR'] = $error;
if ($message != 'success') $_SESSION['XE_VALIDATOR_MESSAGE'] = $message;
$_SESSION['XE_VALIDATOR_MESSAGE_TYPE'] = $messageType;
$_SESSION['XE_VALIDATOR_RETURN_URL'] = $redirectUrl;
if(Context::get('xeVirtualRequestMethod') != 'xml')
{
$_SESSION['XE_VALIDATOR_RETURN_URL'] = $redirectUrl;
}
}
unset($logged_info);
@ -555,6 +578,9 @@
if($_SESSION['XE_VALIDATOR_RETURN_URL'])
{
$display_handler = new DisplayHandler();
$display_handler->_debugOutput();
header('location:'.$_SESSION['XE_VALIDATOR_RETURN_URL']);
return;
}

4
classes/module/ModuleObject.class.php
View file

@ -174,7 +174,7 @@
switch($permission_target) {
case 'root' :
case 'manager' :
$this->stop('msg_not_permitted_act');
$this->stop('msg_is_not_administrator');
return;
case 'member' :
if(!$is_logged)
@ -334,7 +334,7 @@
if(isset($this->xml_info->action->{$this->act}) && method_exists($this, $this->act)) {
// Check permissions
if(!$this->grant->access){
if($this->module_srl && !$this->grant->access){
$this->stop("msg_not_permitted_act");
return FALSE;
}

598
classes/security/EmbedFilter.class.php Normal file
View file

@ -0,0 +1,598 @@
<?php
include "phphtmlparser/src/htmlparser.inc";
class EmbedFilter
{
var $whiteUrlXmlFile = './classes/security/conf/embedWhiteUrl.xml';
var $whiteUrlCacheFile = './files/cache/embedfilter/embedWhiteUrl.php';
var $whiteUrlList = array();
var $whiteIframeUrlList = array();
var $parser = NULL;
var $mimeTypeList = array('application/andrew-inset'=>1, 'application/applixware'=>1, 'application/atom+xml'=>1, 'application/atomcat+xml'=>1, 'application/atomsvc+xml'=>1,
'application/ccxml+xml'=>1, 'application/cdmi-capability'=>1, 'application/cdmi-container'=>1, 'application/cdmi-domain'=>1, 'application/cdmi-object'=>1,
'application/cdmi-queue'=>1, 'application/cu-seeme'=>1, 'application/davmount+xml'=>1, 'application/docbook+xml'=>1, 'application/dssc+der'=>1, 'application/dssc+xml'=>1,
'application/ecmascript'=>1, 'application/emma+xml'=>1, 'application/epub+zip'=>1, 'application/exi'=>1, 'application/font-tdpfr'=>1, 'application/gml+xml'=>1,
'application/gpx+xml'=>1, 'application/gxf'=>1, 'application/hyperstudio'=>1, 'application/inkml+xml'=>1, 'application/inkml+xml'=>1, 'application/ipfix'=>1,
'application/java-archive'=>1, 'application/java-serialized-object'=>1, 'application/java-vm'=>1, 'application/javascript'=>1, 'application/json'=>1,
'application/jsonml+json'=>1, 'application/lost+xml'=>1, 'application/mac-binhex40'=>1, 'application/mac-compactpro'=>1, 'application/mads+xml'=>1,
'application/marc'=>1, 'application/marcxml+xml'=>1, 'application/mathematica'=>1, 'application/mathematica'=>1, 'application/mathematica'=>1, 'application/mathml+xml'=>1,
'application/mbox'=>1, 'application/mediaservercontrol+xml'=>1, 'application/metalink+xml'=>1, 'application/metalink4+xml'=>1, 'application/mets+xml'=>1,
'application/mods+xml'=>1, 'application/mp21'=>1, 'application/mp4'=>1, 'application/msword'=>1, 'application/mxf'=>1, 'application/octet-stream'=>1,
'application/octet-stream'=>1, 'application/octet-stream'=>1, 'application/octet-stream'=>1, 'application/octet-stream'=>1, 'application/octet-stream'=>1,
'application/octet-stream'=>1, 'application/octet-stream'=>1, 'application/octet-stream'=>1, 'application/octet-stream'=>1, 'application/octet-stream'=>1,
'application/octet-stream'=>1, 'application/oda'=>1, 'application/oebps-package+xml'=>1, 'application/ogg'=>1, 'application/omdoc+xml'=>1, 'application/onenote'=>1,
'application/onenote'=>1, 'application/onenote'=>1, 'application/onenote'=>1, 'application/oxps'=>1, 'application/patch-ops-error+xml'=>1, 'application/pdf'=>1,
'application/pgp-encrypted'=>1, 'application/pgp-signature'=>1, 'application/pgp-signature'=>1, 'application/pics-rules'=>1, 'application/pkcs10'=>1,
'application/pkcs7-mime'=>1, 'application/pkcs7-mime'=>1, 'application/pkcs7-signature'=>1, 'application/pkcs8'=>1, 'application/pkix-attr-cert'=>1,
'application/pkix-cert'=>1, 'application/pkix-crl'=>1, 'application/pkix-pkipath'=>1, 'application/pkixcmp'=>1, 'application/pls+xml'=>1,
'application/postscript'=>1, 'application/postscript'=>1, 'application/postscript'=>1, 'application/prs.cww'=>1, 'application/pskc+xml'=>1,
'application/rdf+xml'=>1, 'application/reginfo+xml'=>1, 'application/relax-ng-compact-syntax'=>1, 'application/resource-lists+xml'=>1,
'application/resource-lists-diff+xml'=>1, 'application/rls-services+xml'=>1, 'application/rpki-ghostbusters'=>1, 'application/rpki-manifest'=>1,
'application/rpki-roa'=>1, 'application/rsd+xml'=>1, 'application/rss+xml'=>1, 'application/rtf'=>1, 'application/sbml+xml'=>1, 'application/scvp-cv-request'=>1,
'application/scvp-cv-response'=>1, 'application/scvp-vp-request'=>1, 'application/scvp-vp-response'=>1, 'application/sdp'=>1, 'application/set-payment-initiation'=>1,
'application/set-registration-initiation'=>1, 'application/shf+xml'=>1, 'application/smil+xml'=>1, 'application/smil+xml'=>1, 'application/sparql-query'=>1,
'application/sparql-results+xml'=>1, 'application/srgs'=>1, 'application/srgs+xml'=>1, 'application/sru+xml'=>1, 'application/ssdl+xml'=>1,
'application/ssml+xml'=>1, 'application/tei+xml'=>1, 'application/tei+xml'=>1, 'application/thraud+xml'=>1, 'application/timestamped-data'=>1,
'application/vnd.3gpp.pic-bw-large'=>1, 'application/vnd.3gpp.pic-bw-small'=>1, 'application/vnd.3gpp.pic-bw-var'=>1, 'application/vnd.3gpp2.tcap'=>1,
'application/vnd.3m.post-it-notes'=>1, 'application/vnd.accpac.simply.aso'=>1, 'application/vnd.accpac.simply.imp'=>1, 'application/vnd.acucobol'=>1,
'application/vnd.acucorp'=>1, 'application/vnd.acucorp'=>1, 'application/vnd.adobe.air-application-installer-package+zip'=>1, 'application/vnd.adobe.formscentral.fcdt'=>1,
'application/vnd.adobe.fxp'=>1, 'application/vnd.adobe.fxp'=>1, 'application/vnd.adobe.xdp+xml'=>1, 'application/vnd.adobe.xfdf'=>1, 'application/vnd.ahead.space'=>1,
'application/vnd.airzip.filesecure.azf'=>1, 'application/vnd.airzip.filesecure.azs'=>1, 'application/vnd.amazon.ebook'=>1, 'application/vnd.americandynamics.acc'=>1,
'application/vnd.amiga.ami'=>1, 'application/vnd.android.package-archive'=>1, 'application/vnd.anser-web-certificate-issue-initiation'=>1,
'application/vnd.anser-web-funds-transfer-initiation'=>1, 'application/vnd.antix.game-component'=>1, 'application/vnd.apple.installer+xml'=>1,
'application/vnd.apple.mpegurl'=>1, 'application/vnd.aristanetworks.swi'=>1, 'application/vnd.astraea-software.iota'=>1, 'application/vnd.audiograph'=>1,
'application/vnd.blueice.multipass'=>1, 'application/vnd.bmi'=>1, 'application/vnd.businessobjects'=>1, 'application/vnd.chemdraw+xml'=>1,
'application/vnd.chipnuts.karaoke-mmd'=>1, 'application/vnd.cinderella'=>1, 'application/vnd.claymore'=>1, 'application/vnd.cloanto.rp9'=>1,
'application/vnd.clonk.c4group'=>1, 'application/vnd.clonk.c4group'=>1, 'application/vnd.clonk.c4group'=>1, 'application/vnd.clonk.c4group'=>1,
'application/vnd.clonk.c4group'=>1, 'application/vnd.cluetrust.cartomobile-config'=>1, 'application/vnd.cluetrust.cartomobile-config-pkg'=>1,
'application/vnd.commonspace'=>1, 'application/vnd.contact.cmsg'=>1, 'application/vnd.cosmocaller'=>1, 'application/vnd.crick.clicker'=>1,
'application/vnd.crick.clicker.keyboard'=>1, 'application/vnd.crick.clicker.palette'=>1, 'application/vnd.crick.clicker.template'=>1,
'application/vnd.crick.clicker.wordbank'=>1, 'application/vnd.criticaltools.wbs+xml'=>1, 'application/vnd.ctc-posml'=>1, 'application/vnd.cups-ppd'=>1,
'application/vnd.curl.car'=>1, 'application/vnd.curl.pcurl'=>1, 'application/vnd.dart'=>1, 'application/vnd.data-vision.rdz'=>1, 'application/vnd.dece.data'=>1,
'application/vnd.dece.data'=>1, 'application/vnd.dece.data'=>1, 'application/vnd.dece.data'=>1, 'application/vnd.dece.ttml+xml'=>1, 'application/vnd.dece.ttml+xml'=>1,
'application/vnd.dece.unspecified'=>1, 'application/vnd.dece.unspecified'=>1, 'application/vnd.dece.zip'=>1, 'application/vnd.dece.zip'=>1,
'application/vnd.denovo.fcselayout-link'=>1, 'application/vnd.dna'=>1, 'application/vnd.dolby.mlp'=>1, 'application/vnd.dpgraph'=>1, 'application/vnd.dreamfactory'=>1,
'application/vnd.ds-keypoint'=>1, 'application/vnd.dvb.ait'=>1, 'application/vnd.dvb.service'=>1, 'application/vnd.dynageo'=>1, 'application/vnd.ecowin.chart'=>1,
'application/vnd.enliven'=>1, 'application/vnd.epson.esf'=>1, 'application/vnd.epson.msf'=>1, 'application/vnd.epson.quickanime'=>1, 'application/vnd.epson.salt'=>1,
'application/vnd.epson.ssf'=>1, 'application/vnd.eszigno3+xml'=>1, 'application/vnd.eszigno3+xml'=>1, 'application/vnd.ezpix-album'=>1, 'application/vnd.ezpix-package'=>1,
'application/vnd.fdf'=>1, 'application/vnd.fdsn.mseed'=>1, 'application/vnd.fdsn.seed'=>1, 'application/vnd.fdsn.seed'=>1, 'application/vnd.flographit'=>1,
'application/vnd.fluxtime.clip'=>1, 'application/vnd.framemaker'=>1, 'application/vnd.framemaker'=>1, 'application/vnd.framemaker'=>1, 'application/vnd.framemaker'=>1,
'application/vnd.frogans.fnc'=>1, 'application/vnd.frogans.ltf'=>1, 'application/vnd.fsc.weblaunch'=>1, 'application/vnd.fujitsu.oasys'=>1,
'application/vnd.fujitsu.oasys2'=>1, 'application/vnd.fujitsu.oasys3'=>1, 'application/vnd.fujitsu.oasysgp'=>1, 'application/vnd.fujitsu.oasysprs'=>1,
'application/vnd.fujixerox.ddd'=>1, 'application/vnd.fujixerox.docuworks'=>1, 'application/vnd.fujixerox.docuworks.binder'=>1, 'application/vnd.fuzzysheet'=>1,
'application/vnd.genomatix.tuxedo'=>1, 'application/vnd.geogebra.file'=>1, 'application/vnd.geogebra.tool'=>1, 'application/vnd.geometry-explorer'=>1,
'application/vnd.geometry-explorer'=>1, 'application/vnd.geonext'=>1, 'application/vnd.geoplan'=>1, 'application/vnd.geospace'=>1, 'application/vnd.gmx'=>1,
'application/vnd.google-earth.kml+xml'=>1, 'application/vnd.google-earth.kmz'=>1, 'application/vnd.grafeq'=>1, 'application/vnd.grafeq'=>1,
'application/vnd.groove-account'=>1, 'application/vnd.groove-help'=>1, 'application/vnd.groove-identity-message'=>1, 'application/vnd.groove-injector'=>1,
'application/vnd.groove-tool-message'=>1, 'application/vnd.groove-tool-template'=>1, 'application/vnd.groove-vcard'=>1, 'application/vnd.hal+xml'=>1,
'application/vnd.handheld-entertainment+xml'=>1, 'application/vnd.hbci'=>1, 'application/vnd.hhe.lesson-player'=>1, 'application/vnd.hp-hpgl'=>1,
'application/vnd.hp-hpid'=>1, 'application/vnd.hp-hps'=>1, 'application/vnd.hp-jlyt'=>1, 'application/vnd.hp-pcl'=>1, 'application/vnd.hp-pclxl'=>1,
'application/vnd.hydrostatix.sof-data'=>1, 'application/vnd.ibm.minipay'=>1, 'application/vnd.ibm.modcap'=>1, 'application/vnd.ibm.modcap'=>1, 'application/vnd.ibm.modcap'=>1,
'application/vnd.ibm.rights-management'=>1, 'application/vnd.ibm.secure-container'=>1, 'application/vnd.iccprofile'=>1, 'application/vnd.iccprofile'=>1,
'application/vnd.igloader'=>1, 'application/vnd.immervision-ivp'=>1, 'application/vnd.immervision-ivu'=>1, 'application/vnd.insors.igm'=>1, 'application/vnd.intercon.formnet'=>1,
'application/vnd.intercon.formnet'=>1, 'application/vnd.intergeo'=>1, 'application/vnd.intu.qbo'=>1, 'application/vnd.intu.qfx'=>1, 'application/vnd.ipunplugged.rcprofile'=>1,
'application/vnd.irepository.package+xml'=>1, 'application/vnd.is-xpr'=>1, 'application/vnd.isac.fcs'=>1, 'application/vnd.jam'=>1, 'application/vnd.jcp.javame.midlet-rms'=>1,
'application/vnd.jisp'=>1, 'application/vnd.joost.joda-archive'=>1, 'application/vnd.kahootz'=>1, 'application/vnd.kahootz'=>1, 'application/vnd.kde.karbon'=>1,
'application/vnd.kde.kchart'=>1, 'application/vnd.kde.kformula'=>1, 'application/vnd.kde.kivio'=>1, 'application/vnd.kde.kontour'=>1, 'application/vnd.kde.kpresenter'=>1,
'application/vnd.kde.kpresenter'=>1, 'application/vnd.kde.kspread'=>1, 'application/vnd.kde.kword'=>1, 'application/vnd.kde.kword'=>1, 'application/vnd.kenameaapp'=>1,
'application/vnd.kidspiration'=>1, 'application/vnd.kinar'=>1, 'application/vnd.kinar'=>1, 'application/vnd.koan'=>1, 'application/vnd.koan'=>1, 'application/vnd.koan'=>1,
'application/vnd.koan'=>1, 'application/vnd.kodak-descriptor'=>1, 'application/vnd.las.las+xml'=>1, 'application/vnd.llamagraphics.life-balance.desktop'=>1,
'application/vnd.llamagraphics.life-balance.exchange+xml'=>1, 'application/vnd.lotus-1-2-3'=>1, 'application/vnd.lotus-approach'=>1, 'application/vnd.lotus-freelance'=>1,
'application/vnd.lotus-notes'=>1, 'application/vnd.lotus-organizer'=>1, 'application/vnd.lotus-screencam'=>1, 'application/vnd.lotus-wordpro'=>1,
'application/vnd.macports.portpkg'=>1, 'application/vnd.mcd'=>1, 'application/vnd.medcalcdata'=>1, 'application/vnd.mediastation.cdkey'=>1, 'application/vnd.mfer'=>1,
'application/vnd.mfmp'=>1, 'application/vnd.micrografx.flo'=>1, 'application/vnd.micrografx.igx'=>1, 'application/vnd.mif'=>1, 'application/vnd.mobius.daf'=>1,
'application/vnd.mobius.dis'=>1, 'application/vnd.mobius.mbk'=>1, 'application/vnd.mobius.mqy'=>1, 'application/vnd.mobius.msl'=>1, 'application/vnd.mobius.plc'=>1,
'application/vnd.mobius.txf'=>1, 'application/vnd.mophun.application'=>1, 'application/vnd.mophun.certificate'=>1, 'application/vnd.mozilla.xul+xml'=>1,
'application/vnd.ms-artgalry'=>1, 'application/vnd.ms-cab-compressed'=>1, 'application/vnd.ms-excel'=>1, 'application/vnd.ms-excel'=>1, 'application/vnd.ms-excel'=>1,
'application/vnd.ms-excel'=>1, 'application/vnd.ms-excel'=>1, 'application/vnd.ms-excel'=>1, 'application/vnd.ms-excel.addin.macroenabled.12'=>1,
'application/vnd.ms-excel.sheet.binary.macroenabled.12'=>1, 'application/vnd.ms-excel.sheet.macroenabled.12'=>1, 'application/vnd.ms-excel.template.macroenabled.12'=>1,
'application/vnd.ms-fontobject'=>1, 'application/vnd.ms-htmlhelp'=>1, 'application/vnd.ms-ims'=>1, 'application/vnd.ms-lrm'=>1, 'application/vnd.ms-officetheme'=>1,
'application/vnd.ms-pki.seccat'=>1, 'application/vnd.ms-pki.stl'=>1, 'application/vnd.ms-powerpoint'=>1, 'application/vnd.ms-powerpoint'=>1,
'application/vnd.ms-powerpoint'=>1, 'application/vnd.ms-powerpoint.addin.macroenabled.12'=>1, 'application/vnd.ms-powerpoint.presentation.macroenabled.12'=>1,
'application/vnd.ms-powerpoint.slide.macroenabled.12'=>1, 'application/vnd.ms-powerpoint.slideshow.macroenabled.12'=>1,
'application/vnd.ms-powerpoint.template.macroenabled.12'=>1, 'application/vnd.ms-project'=>1, 'application/vnd.ms-project'=>1,
'application/vnd.ms-word.document.macroenabled.12'=>1, 'application/vnd.ms-word.template.macroenabled.12'=>1, 'application/vnd.ms-works'=>1,
'application/vnd.ms-works'=>1, 'application/vnd.ms-works'=>1, 'application/vnd.ms-works'=>1, 'application/vnd.ms-wpl'=>1, 'application/vnd.ms-xpsdocument'=>1,
'application/vnd.mseq'=>1, 'application/vnd.musician'=>1, 'application/vnd.muvee.style'=>1, 'application/vnd.mynfc'=>1, 'application/vnd.neurolanguage.nlu'=>1,
'application/vnd.nitf'=>1, 'application/vnd.nitf'=>1, 'application/vnd.noblenet-directory'=>1, 'application/vnd.noblenet-sealer'=>1, 'application/vnd.noblenet-web'=>1,
'application/vnd.nokia.n-gage.data'=>1, 'application/vnd.nokia.n-gage.symbian.install'=>1, 'application/vnd.nokia.radio-preset'=>1, 'application/vnd.nokia.radio-presets'=>1,
'application/vnd.novadigm.edm'=>1, 'application/vnd.novadigm.edx'=>1, 'application/vnd.novadigm.ext'=>1, 'application/vnd.oasis.opendocument.chart'=>1,
'application/vnd.oasis.opendocument.chart-template'=>1, 'application/vnd.oasis.opendocument.database'=>1, 'application/vnd.oasis.opendocument.formula'=>1,
'application/vnd.oasis.opendocument.formula-template'=>1, 'application/vnd.oasis.opendocument.graphics'=>1, 'application/vnd.oasis.opendocument.graphics-template'=>1,
'application/vnd.oasis.opendocument.image'=>1, 'application/vnd.oasis.opendocument.image-template'=>1, 'application/vnd.oasis.opendocument.presentation'=>1,
'application/vnd.oasis.opendocument.presentation-template'=>1, 'application/vnd.oasis.opendocument.spreadsheet'=>1, 'application/vnd.oasis.opendocument.spreadsheet-template'=>1,
'application/vnd.oasis.opendocument.text'=>1, 'application/vnd.oasis.opendocument.text-master'=>1, 'application/vnd.oasis.opendocument.text-template'=>1,
'application/vnd.oasis.opendocument.text-web'=>1, 'application/vnd.olpc-sugar'=>1, 'application/vnd.oma.dd2+xml'=>1, 'application/vnd.openofficeorg.extension'=>1,
'application/vnd.openxmlformats-officedocument.presentationml.presentation'=>1, 'application/vnd.openxmlformats-officedocument.presentationml.slide'=>1,
'application/vnd.openxmlformats-officedocument.presentationml.slideshow'=>1, 'application/vnd.openxmlformats-officedocument.presentationml.template'=>1,
'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet'=>1, 'application/vnd.openxmlformats-officedocument.spreadsheetml.template'=>1,
'application/vnd.openxmlformats-officedocument.wordprocessingml.document'=>1, 'application/vnd.openxmlformats-officedocument.wordprocessingml.template'=>1,
'application/vnd.osgeo.mapguide.package'=>1, 'application/vnd.osgi.dp'=>1, 'application/vnd.osgi.subsystem'=>1, 'application/vnd.palm'=>1, 'application/vnd.palm'=>1,
'application/vnd.palm'=>1, 'application/vnd.pawaafile'=>1, 'application/vnd.pg.format'=>1, 'application/vnd.pg.osasli'=>1, 'application/vnd.picsel'=>1, 'application/vnd.pmi.widget'=>1,
'application/vnd.pocketlearn'=>1, 'application/vnd.powerbuilder6'=>1, 'application/vnd.previewsystems.box'=>1, 'application/vnd.proteus.magazine'=>1,
'application/vnd.publishare-delta-tree'=>1, 'application/vnd.pvi.ptid1'=>1, 'application/vnd.quark.quarkxpress'=>1, 'application/vnd.quark.quarkxpress'=>1,
'application/vnd.quark.quarkxpress'=>1, 'application/vnd.quark.quarkxpress'=>1, 'application/vnd.quark.quarkxpress'=>1, 'application/vnd.quark.quarkxpress'=>1,
'application/vnd.realvnc.bed'=>1, 'application/vnd.recordare.musicxml'=>1, 'application/vnd.recordare.musicxml+xml'=>1, 'application/vnd.rig.cryptonote'=>1,
'application/vnd.rim.cod'=>1, 'application/vnd.rn-realmedia'=>1, 'application/vnd.rn-realmedia-vbr'=>1, 'application/vnd.route66.link66+xml'=>1, 'application/vnd.sailingtracker.track'=>1,
'application/vnd.seemail'=>1, 'application/vnd.sema'=>1, 'application/vnd.semd'=>1, 'application/vnd.semf'=>1, 'application/vnd.shana.informed.formdata'=>1,
'application/vnd.shana.informed.formtemplate'=>1, 'application/vnd.shana.informed.interchange'=>1, 'application/vnd.shana.informed.package'=>1, 'application/vnd.simtech-mindmapper'=>1,
'application/vnd.simtech-mindmapper'=>1, 'application/vnd.smaf'=>1, 'application/vnd.smart.teacher'=>1, 'application/vnd.solent.sdkm+xml'=>1, 'application/vnd.solent.sdkm+xml'=>1,
'application/vnd.spotfire.dxp'=>1, 'application/vnd.spotfire.sfs'=>1, 'application/vnd.stardivision.calc'=>1, 'application/vnd.stardivision.draw'=>1,
'application/vnd.stardivision.impress'=>1, 'application/vnd.stardivision.math'=>1, 'application/vnd.stardivision.writer'=>1, 'application/vnd.stardivision.writer'=>1,
'application/vnd.stardivision.writer-global'=>1, 'application/vnd.stepmania.package'=>1, 'application/vnd.stepmania.stepchart'=>1, 'application/vnd.sun.xml.calc'=>1,
'application/vnd.sun.xml.calc.template'=>1, 'application/vnd.sun.xml.draw'=>1, 'application/vnd.sun.xml.draw.template'=>1, 'application/vnd.sun.xml.impress'=>1,
'application/vnd.sun.xml.impress.template'=>1, 'application/vnd.sun.xml.math'=>1, 'application/vnd.sun.xml.writer'=>1, 'application/vnd.sun.xml.writer.global'=>1,
'application/vnd.sun.xml.writer.template'=>1, 'application/vnd.sus-calendar'=>1, 'application/vnd.sus-calendar'=>1, 'application/vnd.svd'=>1, 'application/vnd.symbian.install'=>1,
'application/vnd.symbian.install'=>1, 'application/vnd.syncml+xml'=>1, 'application/vnd.syncml.dm+wbxml'=>1, 'application/vnd.syncml.dm+xml'=>1,
'application/vnd.tao.intent-module-archive'=>1, 'application/vnd.tcpdump.pcap'=>1, 'application/vnd.tcpdump.pcap'=>1, 'application/vnd.tcpdump.pcap'=>1,
'application/vnd.tmobile-livetv'=>1, 'application/vnd.trid.tpt'=>1, 'application/vnd.triscape.mxs'=>1, 'application/vnd.trueapp'=>1, 'application/vnd.ufdl'=>1, 'application/vnd.ufdl'=>1,
'application/vnd.uiq.theme'=>1, 'application/vnd.umajin'=>1, 'application/vnd.unity'=>1, 'application/vnd.uoml+xml'=>1, 'application/vnd.vcx'=>1, 'application/vnd.visio'=>1,
'application/vnd.visio'=>1, 'application/vnd.visio'=>1, 'application/vnd.visio'=>1, 'application/vnd.visionary'=>1, 'application/vnd.vsf'=>1, 'application/vnd.wap.wbxml'=>1,
'application/vnd.wap.wmlc'=>1, 'application/vnd.wap.wmlscriptc'=>1, 'application/vnd.webturbo'=>1, 'application/vnd.wolfram.player'=>1, 'application/vnd.wordperfect'=>1,
'application/vnd.wqd'=>1, 'application/vnd.wt.stf'=>1, 'application/vnd.xara'=>1, 'application/vnd.xfdl'=>1, 'application/vnd.yamaha.hv-dic'=>1, 'application/vnd.yamaha.hv-script'=>1,
'application/vnd.yamaha.hv-voice'=>1, 'application/vnd.yamaha.openscoreformat'=>1, 'application/vnd.yamaha.openscoreformat.osfpvg+xml'=>1, 'application/vnd.yamaha.smaf-audio'=>1,
'application/vnd.yamaha.smaf-phrase'=>1, 'application/vnd.yellowriver-custom-menu'=>1, 'application/vnd.zul'=>1, 'application/vnd.zul'=>1, 'application/vnd.zzazz.deck+xml'=>1,
'application/voicexml+xml'=>1, 'application/widget'=>1, 'application/winhlp'=>1, 'application/wsdl+xml'=>1, 'application/wspolicy+xml'=>1, 'application/x-7z-compressed'=>1,
'application/x-abiword'=>1, 'application/x-ace-compressed'=>1, 'application/x-apple-diskimage'=>1, 'application/x-authorware-bin'=>1, 'application/x-authorware-bin'=>1,
'application/x-authorware-bin'=>1, 'application/x-authorware-bin'=>1, 'application/x-authorware-map'=>1, 'application/x-authorware-seg'=>1, 'application/x-bcpio'=>1,
'application/x-bittorrent'=>1, 'application/x-blorb'=>1, 'application/x-blorb'=>1, 'application/x-bzip'=>1, 'application/x-bzip2'=>1, 'application/x-bzip2'=>1, 'application/x-cbr'=>1,
'application/x-cbr'=>1, 'application/x-cbr'=>1, 'application/x-cbr'=>1, 'application/x-cbr'=>1, 'application/x-cdlink'=>1, 'application/x-cfs-compressed'=>1, 'application/x-chat'=>1,
'application/x-chess-pgn'=>1, 'application/x-conference'=>1, 'application/x-cpio'=>1, 'application/x-csh'=>1, 'application/x-debian-package'=>1, 'application/x-debian-package'=>1,
'application/x-dgc-compressed'=>1, 'application/x-director'=>1, 'application/x-director'=>1, 'application/x-director'=>1, 'application/x-director'=>1, 'application/x-director'=>1,
'application/x-director'=>1, 'application/x-director'=>1, 'application/x-director'=>1, 'application/x-director'=>1, 'application/x-doom'=>1, 'application/x-dtbncx+xml'=>1,
'application/x-dtbook+xml'=>1, 'application/x-dtbresource+xml'=>1, 'application/x-dvi'=>1, 'application/x-envoy'=>1, 'application/x-eva'=>1, 'application/x-font-bdf'=>1,
'application/x-font-ghostscript'=>1, 'application/x-font-linux-psf'=>1, 'application/x-font-otf'=>1, 'application/x-font-pcf'=>1, 'application/x-font-snf'=>1,
'application/x-font-ttf'=>1, 'application/x-font-ttf'=>1, 'application/x-font-type1'=>1, 'application/x-font-type1'=>1, 'application/x-font-type1'=>1, 'application/x-font-type1'=>1,
'application/x-font-woff'=>1, 'application/x-freearc'=>1, 'application/x-futuresplash'=>1, 'application/x-gca-compressed'=>1, 'application/x-glulx'=>1, 'application/x-gnumeric'=>1,
'application/x-gramps-xml'=>1, 'application/x-gtar'=>1, 'application/x-hdf'=>1, 'application/x-install-instructions'=>1, 'application/x-iso9660-image'=>1,
'application/x-java-jnlp-file'=>1, 'application/x-latex'=>1, 'application/x-lzh-compressed'=>1, 'application/x-lzh-compressed'=>1, 'application/x-mie'=>1,
'application/x-mobipocket-ebook'=>1, 'application/x-mobipocket-ebook'=>1, 'application/x-ms-application'=>1, 'application/x-ms-shortcut'=>1, 'application/x-ms-wmd'=>1,
'application/x-ms-wmz'=>1, 'application/x-ms-xbap'=>1, 'application/x-msaccess'=>1, 'application/x-msbinder'=>1, 'application/x-mscardfile'=>1, 'application/x-msclip'=>1,
'application/x-msdownload'=>1, 'application/x-msdownload'=>1, 'application/x-msdownload'=>1, 'application/x-msdownload'=>1, 'application/x-msdownload'=>1, 'application/x-msmediaview'=>1,
'application/x-msmediaview'=>1, 'application/x-msmediaview'=>1, 'application/x-msmetafile'=>1, 'application/x-msmetafile'=>1, 'application/x-msmetafile'=>1, 'application/x-msmetafile'=>1,
'application/x-msmoney'=>1, 'application/x-mspublisher'=>1, 'application/x-msschedule'=>1, 'application/x-msterminal'=>1, 'application/x-mswrite'=>1, 'application/x-netcdf'=>1,
'application/x-netcdf'=>1, 'application/x-nzb'=>1, 'application/x-pkcs12'=>1, 'application/x-pkcs12'=>1, 'application/x-pkcs7-certificates'=>1, 'application/x-pkcs7-certificates'=>1,
'application/x-pkcs7-certreqresp'=>1, 'application/x-rar-compressed'=>1, 'application/x-research-info-systems'=>1, 'application/x-sh'=>1, 'application/x-shar'=>1,
'application/x-shockwave-flash'=>1, 'application/x-silverlight-app'=>1, 'application/x-silverlight-2'=>1, 'application/x-sql'=>1, 'application/x-stuffit'=>1, 'application/x-stuffitx'=>1,
'application/x-subrip'=>1, 'application/x-sv4cpio'=>1, 'application/x-sv4crc'=>1, 'application/x-t3vm-image'=>1, 'application/x-tads'=>1, 'application/x-tar'=>1, 'application/x-tcl'=>1,
'application/x-tex'=>1, 'application/x-tex-tfm'=>1, 'application/x-texinfo'=>1, 'application/x-texinfo'=>1, 'application/x-tgif'=>1, 'application/x-ustar'=>1, 'application/x-wais-source'=>1,
'application/x-x509-ca-cert'=>1, 'application/x-x509-ca-cert'=>1, 'application/x-xfig'=>1, 'application/x-xliff+xml'=>1, 'application/x-xpinstall'=>1, 'application/x-xz'=>1,
'application/x-zmachine'=>1, 'application/x-zmachine'=>1, 'application/x-zmachine'=>1, 'application/x-zmachine'=>1, 'application/x-zmachine'=>1, 'application/x-zmachine'=>1,
'application/x-zmachine'=>1, 'application/x-zmachine'=>1, 'application/xaml+xml'=>1, 'application/xcap-diff+xml'=>1, 'application/xenc+xml'=>1, 'application/xhtml+xml'=>1,
'application/xhtml+xml'=>1, 'application/xml'=>1, 'application/xml'=>1, 'application/xml-dtd'=>1, 'application/xop+xml'=>1, 'application/xproc+xml'=>1, 'application/xslt+xml'=>1,
'application/xspf+xml'=>1, 'application/xv+xml'=>1, 'application/xv+xml'=>1, 'application/xv+xml'=>1, 'application/xv+xml'=>1, 'application/yang'=>1, 'application/yin+xml'=>1,
'application/zip'=>1, 'audio/adpcm'=>1, 'audio/basic'=>1, 'audio/basic'=>1, 'audio/midi'=>1, 'audio/midi'=>1, 'audio/midi'=>1, 'audio/midi'=>1, 'audio/mp4'=>1, 'audio/mpeg'=>1,
'audio/mpeg'=>1, 'audio/mpeg'=>1, 'audio/mpeg'=>1, 'audio/mpeg'=>1, 'audio/mpeg'=>1, 'audio/ogg'=>1, 'audio/ogg'=>1, 'audio/ogg'=>1, 'audio/s3m'=>1, 'audio/silk'=>1,
'audio/vnd.dece.audio'=>1, 'audio/vnd.dece.audio'=>1, 'audio/vnd.digital-winds'=>1, 'audio/vnd.dra'=>1, 'audio/vnd.dts'=>1, 'audio/vnd.dts.hd'=>1, 'audio/vnd.lucent.voice'=>1,
'audio/vnd.ms-playready.media.pya'=>1, 'audio/vnd.nuera.ecelp4800'=>1, 'audio/vnd.nuera.ecelp7470'=>1, 'audio/vnd.nuera.ecelp9600'=>1, 'audio/vnd.rip'=>1, 'audio/webm'=>1,
'audio/x-aac'=>1, 'audio/x-aiff'=>1, 'audio/x-aiff'=>1, 'audio/x-aiff'=>1, 'audio/x-caf'=>1, 'audio/x-flac'=>1, 'audio/x-matroska'=>1, 'audio/x-mpegurl'=>1, 'audio/x-ms-wax'=>1,
'audio/x-ms-wma'=>1, 'audio/x-pn-realaudio'=>1, 'audio/x-pn-realaudio'=>1, 'audio/x-pn-realaudio-plugin'=>1, 'audio/x-wav'=>1, 'audio/xm'=>1, 'chemical/x-cdx'=>1, 'chemical/x-cif'=>1,
'chemical/x-cmdf'=>1, 'chemical/x-cml'=>1, 'chemical/x-csml'=>1, 'chemical/x-xyz'=>1, 'image/bmp'=>1, 'image/cgm'=>1, 'image/g3fax'=>1, 'image/gif'=>1, 'image/ief'=>1, 'image/jpeg'=>1,
'image/jpeg'=>1, 'image/jpeg'=>1, 'image/ktx'=>1, 'image/png'=>1, 'image/prs.btif'=>1, 'image/sgi'=>1, 'image/svg+xml'=>1, 'image/svg+xml'=>1, 'image/tiff'=>1, 'image/tiff'=>1,
'image/vnd.adobe.photoshop'=>1, 'image/vnd.dece.graphic'=>1, 'image/vnd.dece.graphic'=>1, 'image/vnd.dece.graphic'=>1, 'image/vnd.dece.graphic'=>1, 'image/vnd.dvb.subtitle'=>1,
'image/vnd.djvu'=>1, 'image/vnd.djvu'=>1, 'image/vnd.dwg'=>1, 'image/vnd.dxf'=>1, 'image/vnd.fastbidsheet'=>1, 'image/vnd.fpx'=>1, 'image/vnd.fst'=>1, 'image/vnd.fujixerox.edmics-mmr'=>1,
'image/vnd.fujixerox.edmics-rlc'=>1, 'image/vnd.ms-modi'=>1, 'image/vnd.ms-photo'=>1, 'image/vnd.net-fpx'=>1, 'image/vnd.wap.wbmp'=>1, 'image/vnd.xiff'=>1, 'image/webp'=>1,
'image/x-3ds'=>1, 'image/x-cmu-raster'=>1, 'image/x-cmx'=>1, 'image/x-freehand'=>1, 'image/x-freehand'=>1, 'image/x-freehand'=>1, 'image/x-freehand'=>1, 'image/x-freehand'=>1,
'image/x-icon'=>1, 'image/x-mrsid-image'=>1, 'image/x-pcx'=>1, 'image/x-pict'=>1, 'image/x-pict'=>1, 'image/x-portable-anymap'=>1, 'image/x-portable-bitmap'=>1,
'image/x-portable-graymap'=>1, 'image/x-portable-pixmap'=>1, 'image/x-rgb'=>1, 'image/x-tga'=>1, 'image/x-xbitmap'=>1, 'image/x-xpixmap'=>1, 'image/x-xwindowdump'=>1,
'message/rfc822'=>1, 'message/rfc822'=>1, 'model/iges'=>1, 'model/iges'=>1, 'model/mesh'=>1, 'model/mesh'=>1, 'model/mesh'=>1, 'model/vnd.collada+xml'=>1, 'model/vnd.dwf'=>1,
'model/vnd.gdl'=>1, 'model/vnd.gtw'=>1, 'model/vnd.mts'=>1, 'model/vnd.vtu'=>1, 'model/vrml'=>1, 'model/vrml'=>1, 'model/x3d+binary'=>1, 'model/x3d+binary'=>1, 'model/x3d+vrml'=>1,
'model/x3d+vrml'=>1, 'model/x3d+xml'=>1, 'model/x3d+xml'=>1, 'video/3gpp'=>1, 'video/3gpp2'=>1, 'video/h261'=>1, 'video/h263'=>1, 'video/h264'=>1, 'video/jpeg'=>1, 'video/jpm'=>1,
'video/jpm'=>1, 'video/mj2'=>1, 'video/mj2'=>1, 'video/mp4'=>1, 'video/mp4'=>1, 'video/mp4'=>1, 'video/mpeg'=>1, 'video/mpeg'=>1, 'video/mpeg'=>1, 'video/mpeg'=>1, 'video/mpeg'=>1,
'video/ogg'=>1, 'video/quicktime'=>1, 'video/quicktime'=>1, 'video/vnd.dece.hd'=>1, 'video/vnd.dece.hd'=>1, 'video/vnd.dece.mobile'=>1, 'video/vnd.dece.mobile'=>1, 'video/vnd.dece.pd'=>1,
'video/vnd.dece.pd'=>1, 'video/vnd.dece.sd'=>1, 'video/vnd.dece.sd'=>1, 'video/vnd.dece.video'=>1, 'video/vnd.dece.video'=>1, 'video/vnd.dvb.file'=>1, 'video/vnd.fvt'=>1,
'video/vnd.mpegurl'=>1, 'video/vnd.mpegurl'=>1, 'video/vnd.ms-playready.media.pyv'=>1, 'video/vnd.uvvu.mp4'=>1, 'video/vnd.uvvu.mp4'=>1, 'video/vnd.vivo'=>1, 'video/webm'=>1,
'video/x-f4v'=>1, 'video/x-fli'=>1, 'video/x-flv'=>1, 'video/x-m4v'=>1, 'video/x-matroska'=>1, 'video/x-matroska'=>1, 'video/x-matroska'=>1, 'video/x-mng'=>1, 'video/x-ms-asf'=>1,
'video/x-ms-asf'=>1, 'video/x-ms-vob'=>1, 'video/x-ms-wm'=>1, 'video/x-ms-wmv'=>1, 'video/x-ms-wmx'=>1, 'video/x-ms-wvx'=>1, 'video/x-msvideo'=>1, 'video/x-sgi-movie'=>1,
'video/x-smv'=>1, 'x-conference/x-cooltalk'=>1
);
var $extList = array('ez'=>1, 'aw'=>1, 'atom'=>1, 'atomcat'=>1, 'atomsvc'=>1, 'ccxml'=>1, 'cdmia'=>1, 'cdmic'=>1, 'cdmid'=>1, 'cdmio'=>1, 'cdmiq'=>1, 'cu'=>1, 'davmount'=>1,
'dbk'=>1, 'dssc'=>1, 'xdssc'=>1, 'ecma'=>1, 'emma'=>1, 'epub'=>1, 'exi'=>1, 'pfr'=>1, 'gml'=>1, 'gpx'=>1, 'gxf'=>1, 'stk'=>1, 'ink'=>1, 'inkml'=>1, 'ipfix'=>1, 'jar'=>1,
'ser'=>1, 'class'=>1, 'js'=>1, 'json'=>1, 'jsonml'=>1, 'lostxml'=>1, 'hqx'=>1, 'cpt'=>1, 'mads'=>1, 'mrc'=>1, 'mrcx'=>1, 'ma'=>1, 'nb'=>1, 'mb'=>1, 'mathml'=>1, 'mbox'=>1,
'mscml'=>1, 'metalink'=>1, 'meta4'=>1, 'mets'=>1, 'mods'=>1, 'm21 mp21'=>1, 'mp4s'=>1, 'doc dot'=>1, 'mxf'=>1, 'bin'=>1, 'dms'=>1, 'lrf'=>1, 'mar'=>1, 'so'=>1, 'dist'=>1,
'distz'=>1, 'pkg'=>1, 'bpk'=>1, 'dump'=>1, 'elc'=>1, 'deploy'=>1, 'oda'=>1, 'opf'=>1, 'ogx'=>1, 'omdoc'=>1, 'onetoc'=>1, 'onetoc2'=>1, 'onetmp'=>1, 'onepkg'=>1, 'oxps'=>1,
'xer'=>1, 'pdf'=>1, 'pgp'=>1, 'asc'=>1, 'sig'=>1, 'prf'=>1, 'p10'=>1, 'p7m'=>1, 'p7c'=>1, 'p7s'=>1, 'p8'=>1, 'ac'=>1, 'cer'=>1, 'crl'=>1, 'pkipath'=>1, 'pki'=>1, 'pls'=>1,
'ai'=>1, 'eps'=>1, 'ps'=>1, 'cww'=>1, 'pskcxml'=>1, 'rdf'=>1, 'rif'=>1, 'rnc'=>1, 'rl'=>1, 'rld'=>1, 'rs'=>1, 'gbr'=>1, 'mft'=>1, 'roa'=>1, 'rsd'=>1, 'rss'=>1, 'rtf'=>1,
'sbml'=>1, 'scq'=>1, 'scs'=>1, 'spq'=>1, 'spp'=>1, 'sdp'=>1, 'setpay'=>1, 'setreg'=>1, 'shf'=>1, 'smi'=>1, 'smil'=>1, 'rq'=>1, 'srx'=>1, 'gram'=>1, 'grxml'=>1, 'sru'=>1,
'ssdl'=>1, 'ssml'=>1, 'tei'=>1, 'teicorpus'=>1, 'tfi'=>1, 'tsd'=>1, 'plb'=>1, 'psb'=>1, 'pvb'=>1, 'tcap'=>1, 'pwn'=>1, 'aso'=>1, 'imp'=>1, 'acu'=>1, 'atc'=>1, 'acutc'=>1,
'air'=>1, 'fcdt'=>1, 'fxp'=>1, 'fxpl'=>1, 'xdp'=>1, 'xfdf'=>1, 'ahead'=>1, 'azf'=>1, 'azs'=>1, 'azw'=>1, 'acc'=>1, 'ami'=>1, 'apk'=>1, 'cii'=>1, 'fti'=>1, 'atx'=>1, 'mpkg'=>1,
'm3u8'=>1, 'swi'=>1, 'iota'=>1, 'aep'=>1, 'mpm'=>1, 'bmi'=>1, 'rep'=>1, 'cdxml'=>1, 'mmd'=>1, 'cdy'=>1, 'cla'=>1, 'rp9'=>1, 'c4g'=>1, 'c4d'=>1, 'c4f'=>1, 'c4p'=>1, 'c4u'=>1,
'c11amc'=>1, 'c11amz'=>1, 'csp'=>1, 'cdbcmsg'=>1, 'cmc'=>1, 'clkx'=>1, 'clkk'=>1, 'clkp'=>1, 'clkt'=>1, 'clkw'=>1, 'wbs'=>1, 'pml'=>1, 'ppd'=>1, 'car'=>1, 'pcurl'=>1, 'dart'=>1,
'rdz'=>1, 'uvf'=>1, 'uvvf'=>1, 'uvd'=>1, 'uvvd'=>1, 'uvt'=>1, 'uvvt'=>1, 'uvx'=>1, 'uvvx'=>1, 'uvz'=>1, 'uvvz'=>1, 'fe_launch'=>1, 'dna'=>1, 'mlp'=>1, 'dpg'=>1, 'dfac'=>1,
'kpxx'=>1, 'ait'=>1, 'svc'=>1, 'geo'=>1, 'mag'=>1, 'nml'=>1, 'esf'=>1, 'msf'=>1, 'qam'=>1, 'slt'=>1, 'ssf'=>1, 'es3'=>1, 'et3'=>1, 'ez2'=>1, 'ez3'=>1, 'fdf'=>1, 'mseed'=>1,
'seed'=>1, 'dataless'=>1, 'gph'=>1, 'ftc'=>1, 'fm'=>1, 'frame'=>1, 'maker'=>1, 'book'=>1, 'fnc'=>1, 'ltf'=>1, 'fsc'=>1, 'oas'=>1, 'oa2'=>1, 'oa3'=>1, 'fg5'=>1, 'bh2'=>1, 'ddd'=>1,
'xdw'=>1, 'xbd'=>1, 'fzs'=>1, 'txd'=>1, 'ggb'=>1, 'ggt'=>1, 'gex'=>1, 'gre'=>1, 'gxt'=>1, 'g2w'=>1, 'g3w'=>1, 'gmx'=>1, 'kml'=>1, 'kmz'=>1, 'gqf'=>1, 'gqs'=>1, 'gac'=>1, 'ghf'=>1,
'gim'=>1, 'grv'=>1, 'gtm'=>1, 'tpl'=>1, 'vcg'=>1, 'hal'=>1, 'zmm'=>1, 'hbci'=>1, 'les'=>1, 'hpgl'=>1, 'hpid'=>1, 'hps'=>1, 'jlt'=>1, 'pcl'=>1, 'pclxl'=>1, 'sfd-hdstx'=>1, 'mpy'=>1,
'afp'=>1, 'listafp'=>1, 'list3820'=>1, 'irm'=>1, 'sc'=>1, 'icc'=>1, 'icm'=>1, 'igl'=>1, 'ivp'=>1, 'ivu'=>1, 'igm'=>1, 'xpw'=>1, 'xpx'=>1, 'i2g'=>1, 'qbo'=>1, 'qfx'=>1,
'rcprofile'=>1, 'irp'=>1, 'xpr'=>1, 'fcs'=>1, 'jam'=>1, 'rms'=>1, 'jisp'=>1, 'joda'=>1, 'ktz'=>1, 'ktr'=>1, 'karbon'=>1, 'chrt'=>1, 'kfo'=>1, 'flw'=>1, 'kon'=>1, 'kpr'=>1, 'kpt'=>1,
'ksp'=>1, 'kwd'=>1, 'kwt'=>1, 'htke'=>1, 'kia'=>1, 'kne'=>1, 'knp'=>1, 'skp'=>1, 'skd'=>1, 'skt'=>1, 'skm'=>1, 'sse'=>1, 'lasxml'=>1, 'lbd'=>1, 'lbe'=>1, '123'=>1, 'apr'=>1,
'pre'=>1, 'nsf'=>1, 'org'=>1, 'scm'=>1, 'lwp'=>1, 'portpkg'=>1, 'mcd'=>1, 'mc1'=>1, 'cdkey'=>1, 'mwf'=>1, 'mfm'=>1, 'flo'=>1, 'igx'=>1, 'mif'=>1, 'daf'=>1, 'dis'=>1, 'mbk'=>1,
'mqy'=>1, 'msl'=>1, 'plc'=>1, 'txf'=>1, 'mpn'=>1, 'mpc'=>1, 'xul'=>1, 'cil'=>1, 'cab'=>1, 'xls'=>1, 'xlm'=>1, 'xla'=>1, 'xlc'=>1, 'xlt'=>1, 'xlw'=>1, 'xlam'=>1, 'xlsb'=>1, 'xlsm'=>1,
'xltm'=>1, 'eot'=>1, 'chm'=>1, 'ims'=>1, 'lrm'=>1, 'thmx'=>1, 'cat'=>1, 'stl'=>1, 'ppt'=>1, 'pps'=>1, 'pot'=>1, 'ppam'=>1, 'pptm'=>1, 'sldm'=>1, 'ppsm'=>1, 'potm'=>1, 'mpp'=>1,
'mpt'=>1, 'docm'=>1, 'dotm'=>1, 'wps'=>1, 'wks'=>1, 'wcm'=>1, 'wdb'=>1, 'wpl'=>1, 'xps'=>1, 'mseq'=>1, 'mus'=>1, 'msty'=>1, 'taglet'=>1, 'nlu'=>1, 'nitf'=>1, 'nitf'=>1, 'nnd'=>1,
'nns'=>1, 'nnw'=>1, 'ngdat'=>1, 'n-gage'=>1, 'rpst'=>1, 'rpss'=>1, 'edm'=>1, 'edx'=>1, 'ext'=>1, 'odc'=>1, 'otc'=>1, 'odb'=>1, 'odf'=>1, 'odft'=>1, 'odg'=>1, 'otg'=>1, 'odi'=>1,
'oti'=>1, 'odp'=>1, 'otp'=>1, 'ods'=>1, 'ots'=>1, 'odt'=>1, 'odm'=>1, 'ott'=>1, 'oth'=>1, 'xo'=>1, 'dd2'=>1, 'oxt'=>1, 'pptx'=>1, 'sldx'=>1, 'ppsx'=>1, 'potx'=>1, 'xlsx'=>1, 'xltx'=>1,
'docx'=>1, 'dotx'=>1, 'mgp'=>1, 'dp'=>1, 'esa'=>1, 'pdb'=>1, 'pqa'=>1, 'oprc'=>1, 'paw'=>1, 'str'=>1, 'ei6'=>1, 'efif'=>1, 'wg'=>1, 'plf'=>1, 'pbd'=>1, 'box'=>1, 'mgz'=>1, 'qps'=>1,
'ptid'=>1, 'qxd'=>1, 'qxt'=>1, 'qwd'=>1, 'qwt'=>1, 'qxl'=>1, 'qxb'=>1, 'bed'=>1, 'mxl'=>1, 'musicxml'=>1, 'cryptonote'=>1, 'cod'=>1, 'rm'=>1, 'rmvb'=>1, 'link66'=>1, 'st'=>1, 'see'=>1,
'sema'=>1, 'semd'=>1, 'semf'=>1, 'ifm'=>1, 'itp'=>1, 'iif'=>1, 'ipk'=>1, 'twd'=>1, 'twds'=>1, 'mmf'=>1, 'teacher'=>1, 'sdkm'=>1, 'sdkd'=>1, 'dxp'=>1, 'sfs'=>1, 'sdc'=>1, 'sda'=>1,
'sdd'=>1, 'smf'=>1, 'sdw'=>1, 'vor'=>1, 'sgl'=>1, 'smzip'=>1, 'sm'=>1, 'sxc'=>1, 'stc'=>1, 'sxd'=>1, 'std'=>1, 'sxi'=>1, 'sti'=>1, 'sxm'=>1, 'sxw'=>1, 'sxg'=>1, 'stw'=>1, 'sus'=>1,
'susp'=>1, 'svd'=>1, 'sis'=>1, 'sisx'=>1, 'xsm'=>1, 'bdm'=>1, 'xdm'=>1, 'tao'=>1, 'pcap'=>1, 'cap'=>1, 'dmp'=>1, 'tmo'=>1, 'tpt'=>1, 'mxs'=>1, 'tra'=>1, 'ufd'=>1, 'ufdl'=>1, 'utz'=>1,
'umj'=>1, 'unityweb'=>1, 'uoml'=>1, 'vcx'=>1, 'vsd'=>1, 'vst'=>1, 'vss'=>1, 'vsw'=>1, 'vis'=>1, 'vsf'=>1, 'wbxml'=>1, 'wmlc'=>1, 'wmlsc'=>1, 'wtb'=>1, 'nbp'=>1, 'wpd'=>1, 'wqd'=>1,
'stf'=>1, 'xar'=>1, 'xfdl'=>1, 'hvd'=>1, 'hvs'=>1, 'hvp'=>1, 'osf'=>1, 'osfpvg'=>1, 'saf'=>1, 'spf'=>1, 'cmp'=>1, 'zir'=>1, 'zirz'=>1, 'zaz'=>1, 'vxml'=>1, 'wgt'=>1, 'hlp'=>1, 'wsdl'=>1,
'wspolicy'=>1, '7z'=>1, 'abw'=>1, 'ace'=>1, 'dmg'=>1, 'aab'=>1, 'x32'=>1, 'u32'=>1, 'vox'=>1, 'aam'=>1, 'aas'=>1, 'bcpio'=>1, 'torrent'=>1, 'blb'=>1, 'blorb'=>1, 'bz'=>1, 'bz2'=>1,
'boz'=>1, 'cbr'=>1, 'cba'=>1, 'cbt'=>1, 'cbz'=>1, 'cb7'=>1, 'vcd'=>1, 'cfs'=>1, 'chat'=>1, 'pgn'=>1, 'nsc'=>1, 'cpio'=>1, 'csh'=>1, 'deb'=>1, 'udeb'=>1, 'dgc'=>1, 'dir'=>1, 'dcr'=>1,
'dxr'=>1, 'cst'=>1, 'cct'=>1, 'cxt'=>1, 'w3d'=>1, 'fgd'=>1, 'swa'=>1, 'wad'=>1, 'ncx'=>1, 'dtb'=>1, 'res'=>1, 'dvi'=>1, 'evy'=>1, 'eva'=>1, 'bdf'=>1, 'gsf'=>1, 'psf'=>1, 'otf'=>1,
'pcf'=>1, 'snf'=>1, 'ttf'=>1, 'ttc'=>1, 'pfa'=>1, 'pfb'=>1, 'pfm'=>1, 'afm'=>1, 'woff'=>1, 'arc'=>1, 'spl'=>1, 'gca'=>1, 'ulx'=>1, 'gnumeric'=>1, 'gramps'=>1, 'gtar'=>1, 'hdf'=>1,
'install'=>1, 'iso'=>1, 'jnlp'=>1, 'latex'=>1, 'lzh'=>1, 'lha'=>1, 'mie'=>1, 'prc'=>1, 'mobi'=>1, 'application'=>1, 'lnk'=>1, 'wmd'=>1, 'wmz'=>1, 'xbap'=>1, 'mdb'=>1, 'obd'=>1,
'crd'=>1, 'clp'=>1, 'exe'=>1, 'dll'=>1, 'com'=>1, 'bat'=>1, 'msi'=>1, 'mvb'=>1, 'm13'=>1, 'm14'=>1, 'wmf'=>1, 'wmz'=>1, 'emf'=>1, 'emz'=>1, 'mny'=>1, 'pub'=>1, 'scd'=>1, 'trm'=>1,
'wri'=>1, 'nc'=>1, 'cdf'=>1, 'nzb'=>1, 'p12'=>1, 'pfx'=>1, 'p7b'=>1, 'spc'=>1, 'p7r'=>1, 'rar'=>1, 'ris'=>1, 'sh'=>1, 'shar'=>1, 'swf'=>1, 'xap'=>1, 'sql'=>1, 'sit'=>1, 'sitx'=>1,
'srt'=>1, 'sv4cpio'=>1, 'sv4crc'=>1, 't3'=>1, 'gam'=>1, 'tar'=>1, 'tcl'=>1, 'tex'=>1, 'tfm'=>1, 'texinfo'=>1, 'texi'=>1, 'obj'=>1, 'ustar'=>1, 'src'=>1, 'der'=>1, 'crt'=>1, 'fig'=>1,
'xlf'=>1, 'xpi'=>1, 'xz'=>1, 'z1'=>1, 'z2'=>1, 'z3'=>1, 'z4'=>1, 'z5'=>1, 'z6'=>1, 'z7'=>1, 'z8'=>1, 'xaml'=>1, 'xdf'=>1, 'xenc'=>1, 'xhtml'=>1, 'xht'=>1, 'xml'=>1, 'xsl'=>1, 'dtd'=>1,
'xop'=>1, 'xpl'=>1, 'xslt'=>1, 'xspf'=>1, 'mxml'=>1, 'xhvml'=>1, 'xvml'=>1, 'xvm'=>1, 'yang'=>1, 'yin'=>1, 'zip'=>1, 'adp'=>1, 'au'=>1, 'snd'=>1, 'mid'=>1, 'midi'=>1, 'kar'=>1, 'rmi'=>1,
'mp4a'=>1, 'mpga'=>1, 'mp2'=>1, 'mp2a'=>1, 'mp3'=>1, 'm2a'=>1, 'm3a'=>1, 'oga'=>1, 'ogg'=>1, 'spx'=>1, 's3m'=>1, 'sil'=>1, 'uva'=>1, 'uvva'=>1, 'eol'=>1, 'dra'=>1, 'dts'=>1, 'dtshd'=>1,
'lvp'=>1, 'pya'=>1, 'ecelp4800'=>1, 'ecelp7470'=>1, 'ecelp9600'=>1, 'rip'=>1, 'weba'=>1, 'aac'=>1, 'aif'=>1, 'aiff'=>1, 'aifc'=>1, 'caf'=>1, 'flac'=>1, 'mka'=>1, 'm3u'=>1, 'wax'=>1,
'wma'=>1, 'ram'=>1, 'ra'=>1, 'rmp'=>1, 'wav'=>1, 'xm'=>1, 'cdx'=>1, 'cif'=>1, 'cmdf'=>1, 'cml'=>1, 'csml'=>1, 'xyz'=>1, 'bmp'=>1, 'cgm'=>1, 'g3'=>1, 'gif'=>1, 'ief'=>1, 'jpeg'=>1,
'jpg'=>1, 'jpe'=>1, 'ktx'=>1, 'png'=>1, 'btif'=>1, 'sgi'=>1, 'svg'=>1, 'svgz'=>1, 'tiff'=>1, 'tif'=>1, 'psd'=>1, 'uvi'=>1, 'uvvi'=>1, 'uvg'=>1, 'uvvg'=>1, 'sub'=>1, 'djvu'=>1, 'djv'=>1,
'dwg'=>1, 'dxf'=>1, 'fbs'=>1, 'fpx'=>1, 'fst'=>1, 'mmr'=>1, 'rlc'=>1, 'mdi'=>1, 'wdp'=>1, 'npx'=>1, 'wbmp'=>1, 'xif'=>1, 'webp'=>1, '3ds'=>1, 'ras'=>1, 'cmx'=>1, 'fh'=>1, 'fhc'=>1,
'fh4'=>1, 'fh5'=>1, 'fh7'=>1, 'ico'=>1, 'sid'=>1, 'pcx'=>1, 'pic'=>1, 'pct'=>1, 'pnm'=>1, 'pbm'=>1, 'pgm'=>1, 'ppm'=>1, 'rgb'=>1, 'tga'=>1, 'xbm'=>1, 'xpm'=>1, 'xwd'=>1, 'eml'=>1,
'mime'=>1, 'igs'=>1, 'iges'=>1, 'msh'=>1, 'mesh'=>1, 'silo'=>1, 'dae'=>1, 'dwf'=>1, 'gdl'=>1, 'gtw'=>1, 'mts'=>1, 'vtu'=>1, 'wrl'=>1, 'vrml'=>1, 'x3db'=>1, 'x3dbz'=>1, 'x3dv'=>1,
'x3dvz'=>1, 'x3d'=>1, 'x3dz'=>1, '3gp'=>1, '3g2'=>1, 'h261'=>1, 'h263'=>1, 'h264'=>1, 'jpgv'=>1, 'jpm'=>1, 'jpgm'=>1, 'mj2'=>1, 'mjp2'=>1, 'mp4'=>1, 'mp4v'=>1, 'mpg4'=>1, 'mpeg'=>1,
'mpg'=>1, 'mpe'=>1, 'm1v'=>1, 'm2v'=>1, 'ogv'=>1, 'qt'=>1, 'mov'=>1, 'uvh'=>1, 'uvvh'=>1, 'uvm'=>1, 'uvvm'=>1, 'uvp'=>1, 'uvvp'=>1, 'uvs'=>1, 'uvvs'=>1, 'uvv'=>1, 'uvvv'=>1, 'dvb'=>1,
'fvt'=>1, 'mxu'=>1, 'm4u'=>1, 'pyv'=>1, 'uvu'=>1, 'uvvu'=>1, 'viv'=>1, 'webm'=>1, 'f4v'=>1, 'fli'=>1, 'flv'=>1, 'm4v'=>1, 'mkv'=>1, 'mk3d'=>1, 'mks'=>1, 'mng'=>1, 'asf'=>1, 'asx'=>1,
'vob'=>1, 'wm'=>1, 'wmv'=>1, 'wmx'=>1, 'wvx'=>1, 'avi'=>1, 'movie'=>1, 'smv'=>1, 'ice'=>1,
);
/**
* @constructor
* @return void
*/
function EmbedFilter()
{
$this->_makeWhiteDomainList();
include FileHandler::getRealPath($this->whiteUrlCacheFile);
$this->whiteUrlList = $whiteUrlList;
$this->whiteIframeUrlList = $whiteIframeUrlList;
}
/**
* Return EmbedFilter object
* This method for singleton
* @return EmbedFilter
*/
function getInstance()
{
if(!isset($GLOBALS['__EMBEDFILTER_INSTANCE__']))
{
$GLOBALS['__EMBEDFILTER_INSTANCE__'] = new EmbedFilter();
}
return $GLOBALS['__EMBEDFILTER_INSTANCE__'];
}
/**
* Check the content.
* @return void
*/
function check(&$content)
{
$this->checkObjectTag($content);
$this->checkEmbedTag($content);
$this->checkIframeTag($content);
$this->checkParamTag($content);
}
/**
* Check object tag in the content.
* @return void
*/
function checkObjectTag(&$content)
{
preg_match_all('/<\s*object\s*[^>]+(?:\/?>)/is', $content, $m);
$objectTagList = $m[0];
if($objectTagList)
{
foreach($objectTagList AS $key=>$objectTag)
{
$isWhiteDomain = true;
$isWhiteMimetype = true;
$isWhiteExt = true;
$ext = '';
$parser = new HtmlParser($objectTag);
while($parser->parse())
{
if(is_array($parser->iNodeAttributes))
{
foreach($parser->iNodeAttributes AS $attrName=>$attrValue)
{
// data url check
if($attrValue && strtolower($attrName) == 'data')
{
$ext = strtolower(substr(strrchr($attrValue,"."),1));
$isWhiteDomain = $this->isWhiteDomain($attrValue);
}
// mime type check
if(strtolower($attrName) == 'type' && $attrValue)
{
$isWhiteMimetype = $this->isWhiteMimetype($attrValue);
}
}
}
}
if(!$isWhiteDomain && !$isWhiteMimetype && $ext)
{
$isWhiteExt = $this->isWhiteExt($ext);
}
if(!$isWhiteDomain && !$isWhiteMimetype && !$isWhiteExt)
{
$content = str_replace($objectTag, htmlspecialchars($objectTag), $content);
}
}
}
}
/**
* Check embed tag in the content.
* @return void
*/
function checkEmbedTag(&$content)
{
preg_match_all('/<\s*embed\s*[^>]+(?:\/?>)/is', $content, $m);
$embedTagList = $m[0];
if($embedTagList)
{
foreach($embedTagList AS $key=>$embedTag)
{
$isWhiteDomain = true;
$isWhiteMimetype = true;
$isWhiteExt = true;
$ext = '';
$parser = new HtmlParser($embedTag);
while($parser->parse())
{
if(is_array($parser->iNodeAttributes))
{
foreach($parser->iNodeAttributes AS $attrName=>$attrValue)
{
// src url check
if($attrValue && strtolower($attrName) == 'src')
{
$ext = strtolower(substr(strrchr($attrValue,"."),1));
$isWhiteDomain = $this->isWhiteDomain($attrValue);
}
// mime type check
if(strtolower($attrName) == 'type' && $attrValue)
{
$isWhiteMimetype = $this->isWhiteMimetype($attrValue);
}
}
}
}
if(!$isWhiteDomain && !$isWhiteMimetype && $ext)
{
$isWhiteExt = $this->isWhiteExt($ext);
}
if(!$isWhiteDomain && !$isWhiteMimetype && !$isWhiteExt)
{
$content = str_replace($embedTag, htmlspecialchars($embedTag), $content);
}
}
}
}
/**
* Check iframe tag in the content.
* @return void
*/
function checkIframeTag(&$content)
{
preg_match_all('/<\s*iframe\s*[^>]+(?:\/?>)/is', $content, $m);
$iframeTagList = $m[0];
if($iframeTagList)
{
foreach($iframeTagList AS $key=>$iframeTag)
{
$isWhiteDomain = true;
$ext = '';
$parser = new HtmlParser($iframeTag);
while($parser->parse())
{
if(is_array($parser->iNodeAttributes))
{
foreach($parser->iNodeAttributes AS $attrName=>$attrValue)
{
// src url check
if(strtolower($attrName) == 'src' && $attrValue)
{
$ext = strtolower(substr(strrchr($attrValue,"."),1));
$isWhiteDomain = $this->isWhiteIframeDomain($attrValue);
}
}
}
}
if(!$isWhiteDomain)
{
$content = str_replace($iframeTag, htmlspecialchars($iframeTag), $content);
}
}
}
}
/**
* Check param tag in the content.
* @return void
*/
function checkParamTag(&$content)
{
preg_match_all('/<\s*param\s*[^>]+(?:\/?>)/is', $content, $m);
$paramTagList = $m[0];
if($paramTagList)
{
foreach($paramTagList AS $key=>$paramTag)
{
$isWhiteDomain = true;
$isWhiteExt = true;
$ext = '';
$parser = new HtmlParser($paramTag);
while($parser->parse())
{
if($parser->iNodeAttributes['name'] && $parser->iNodeAttributes['value'])
{
$name = strtolower($parser->iNodeAttributes['name']);
if($name == 'movie' || $name == 'src' || $name == 'href' || $name == 'url' || $name == 'source')
{
$ext = strtolower(substr(strrchr($parser->iNodeAttributes['value'],"."),1));
$isWhiteDomain = $this->isWhiteDomain($parser->iNodeAttributes['value']);
if(!$isWhiteDomain && $ext)
{
$isWhiteExt = $this->isWhiteExt($ext);
}
if(!$isWhiteDomain && !$isWhiteExt)
{
$content = str_replace($paramTag, htmlspecialchars($paramTag), $content);
}
}
}
}
}
}
}
/**
* Check white domain in object data attribute or embed src attribute.
* @return string
*/
function isWhiteDomain($urlAttribute)
{
if(is_array($this->whiteUrlList))
{
foreach($this->whiteUrlList AS $key=>$value)
{
if(preg_match('@^'.preg_quote($value).'@i', $urlAttribute))
{
return true;
}
}
}
return false;
}
/**
* Check white domain in iframe src attribute.
* @return string
*/
function isWhiteIframeDomain($urlAttribute)
{
if(is_array($this->whiteIframeUrlList))
{
foreach($this->whiteIframeUrlList AS $key=>$value)
{
if(preg_match('@^'.preg_quote($value).'@i', $urlAttribute))
{
return true;
}
}
}
return false;
}
/**
* Check white mime type in object type attribute or embed type attribute.
* @return string
*/
function isWhiteMimetype($mimeType)
{
if(isset($this->mimeTypeList[$mimeType]))
{
return true;
}
return false;
}
function isWhiteExt($ext)
{
if(isset($this->extList[$ext]))
{
return true;
}
return false;
}
/**
* Make white domain list cache file from xml config file.
* @return void
*/
function _makeWhiteDomainList()
{
$whiteUrlXmlFile = FileHandler::getRealPath($this->whiteUrlXmlFile);
$whiteUrlCacheFile = FileHandler::getRealPath($this->whiteUrlCacheFile);
$isMake = false;
if(!file_exists($whiteUrlCacheFile))
{
$isMake = true;
}
if( file_exists($whiteUrlCacheFile) && filemtime($whiteUrlCacheFile)<filemtime($whiteUrlXmlFile) )
{
$isMake = true;
}
if($isMake)
{
$xmlBuff = FileHandler::readFile($this->whiteUrlXmlFile);
$xmlParser = new XmlParser();
$domainListObj = $xmlParser->parse($xmlBuff);
$embedDomainList = $domainListObj->whiteurl->embed->domain;
$iframeDomainList = $domainListObj->whiteurl->iframe->domain;
$buff = '<?php if(!defined("__ZBXE__")) exit();';
if(is_array($embedDomainList))
{
foreach($embedDomainList AS $key=>$value)
{
$patternList = $value->pattern;
if(is_array($patternList))
{
foreach($patternList AS $key=>$value)
{
$buff .= sprintf('$whiteUrlList[] = \'%s\';', $value->body);
}
}
else $buff .= sprintf('$whiteUrlList[] = \'%s\';', $patternList->body);
}
}
if(is_array($iframeDomainList))
{
foreach($iframeDomainList AS $key=>$value)
{
$patternList = $value->pattern;
if(is_array($patternList))
{
foreach($patternList AS $key=>$value)
{
$buff .= sprintf('$whiteIframeUrlList[] = \'%s\';', $value->body);
}
}
else $buff .= sprintf('$whiteIframeUrlList[] = \'%s\';', $patternList->body);
}
}
$buff .= '?>';
FileHandler::writeFile($this->whiteUrlCacheFile, $buff);
}
}
}
/* End of file : EmbedFilter.class.php */

233
classes/security/conf/embedWhiteUrl.xml Normal file
View file

@ -0,0 +1,233 @@
<?xml version="1.0" encoding="UTF-8"?>
<whiteurl>
<embed>
<domain name="http://www.naver.com" isNHN="true" desc="네이버">
<pattern>http://serviceapi.nmv.naver.com/</pattern>
<pattern>http://scrap.ad.naver.com/</pattern>
<pattern>http://event.dn.naver.com/sbsplayer/vmplayer.xap</pattern>
</domain>
<domain name="" isNHN="true" desc="네이버 뮤직 서비스">
<pattern>http://test-player.naver.com/naverPlayer/posting/</pattern>
<pattern>http://alpha-player.naver.com/naverPlayer/posting/</pattern>
<pattern>http://beta-player.naver.com/naverPlayer/posting/</pattern>
<pattern>http://musicplayer.naver.com/naverPlayer/posting/</pattern>
<pattern>http://player.music.naver.com/naverPlayer/posting/</pattern>
<pattern>http://dev.player.music.naver.com/</pattern>
<pattern>http://test.player.music.naver.com/</pattern>
<pattern>http://qa.player.music.naver.com/</pattern>
<pattern>http://staging.player.music.naver.com/</pattern>
<pattern>http://alpha.player.music.naver.com/</pattern>
<pattern>http://beta.player.music.naver.com/</pattern>
<pattern>http://stage.player.music.naver.com/</pattern>
</domain>
<domain name="" isNHN="true" desc="네이버 아이두게임">
<pattern>http://dev-idogame.hangame.com/idogame/ClientBin/iDoGamePlayer.xap</pattern>
<pattern>http://idogame.hangame.com/idogame/ClientBin/iDoGamePlayer.xap</pattern>
</domain>
<domain name="http://www.daum.net" desc="다음">
<pattern>http://flvs.daum.net/flvPlayer.swf</pattern>
<pattern>http://api.v.daum.net/</pattern>
<pattern>http://tvpot.daum.net/playlist/playlist.swf</pattern>
</domain>
<domain name="http://www.mncast.com" desc="엠엔캐스트">
<pattern>http://dory.mncast.com/mncHMovie.swf</pattern>
<pattern>http://dory.mncast.com/mncastPlayer.swf</pattern>
</domain>
<domain name="http://www.youtube.com" desc="Youtube">
<pattern>http://www.youtube.com/v/</pattern>
<pattern>http://www.youtube-nocookie.com/</pattern>
</domain>
<domain name="http://www.mgoon.com" desc="엠군">
<pattern>http://play.mgoon.com/Video/</pattern>
<pattern>http://doc.mgoon.com/player/</pattern>
<pattern>http://play.mgoon.com/Game/</pattern>
<pattern>http://play.mgoon.com/Photo/</pattern>
</domain>
<domain name="http://www.pandora.tv" desc="판도라TV">
<pattern>http://flvr.pandora.tv/flv2pan/</pattern>
<pattern>http://imgcdn.pandora.tv/gplayer/pandora_EGplayer.swf</pattern>
<pattern>http://imgcdn.pandora.tv/gplayer/flJal.swf</pattern>
</domain>
<domain name="http://www.tagstory.com" desc="태그스토리">
<pattern>http://play.tagstory.com/player/</pattern>
<pattern>http://www.tagstory.com/player/basic/</pattern>
</domain>
<domain name="http://www.pullbbang.com" desc="풀빵닷컴">
<pattern>http://play.pullbbang.com/</pattern>
</domain>
<domain name="" desc="미래에셋 미디어">
<pattern>http://media.miraeasset.com/swf/</pattern>
</domain>
<domain name="" desc="서울시 인터넷방송">
<pattern>http://tv.seoul.go.kr/common/player/posting/window_media_player.asp</pattern>
<pattern>http://stream.seoul.go.kr</pattern>
</domain>
<domain name="" desc="게임스팟 동영상">
<pattern>mms://vod.gamespot.lgcdn.com/</pattern>
<pattern>http://image.com/</pattern>
</domain>
<domain name="" desc="광고정보센터">
<pattern>mms://media.adic.co.kr/</pattern>
<pattern>http://static.adwaple.net/</pattern>
</domain>
<domain name="" desc="비법닷컴">
<pattern>http://www.vipup.com/scrap/scrap.asp</pattern>
</domain>
<domain name="" desc="영상 역사관">
<pattern>mms://125.60.2.110/e_history/</pattern>
<pattern>mms://218.38.152.33/e_history/</pattern>
<pattern>http://125.60.2.110/e_history/</pattern>
<pattern>http://218.38.152.33/e_history/</pattern>
</domain>
<domain name="" desc="중소기업청">
<pattern>http://www.smba.go.kr/mov/</pattern>
</domain>
<domain name="" desc="트라트라고">
<pattern>http://ucc.tlatlago.com/html/uccPlayer/</pattern>
</domain>
<domain name="" desc="싸이월드">
<pattern>http://dbi.video.cyworld.com/v.sk/</pattern>
</domain>
<domain name="" desc="이글루스 동영상">
<pattern>http://v.egloos.com/v.sk/</pattern>
</domain>
<domain name="" desc="뮤직쉐이크">
<pattern>http://www.musicshake.com/musicshakePlayer.swf</pattern>
<pattern>http://eng.musicshake.com/musicshakePlayer.swf</pattern>
<pattern>http://us.musicshake.com/musicshakePlayer.swf</pattern>
<pattern>http://ip.musicshake.com/musicshakePlayer.swf</pattern>
</domain>
<domain name="" desc="아프리카">
<pattern>http://live.afreeca.com:8057/</pattern>
<pattern>http://afbbs.afreeca.com:8080/</pattern>
</domain>
<domain name="" desc="플레이NC">
<pattern>http://static.plaync.co.kr/plaza/</pattern>
</domain>
<domain name="" desc="XTM">
<pattern>http://img.xtmtv.com/images/</pattern>
</domain>
<domain name="" desc="아이서브">
<pattern>http://tv.co.kr/pum/tvcell_basic.swf</pattern>
<pattern>http://tv.co.kr/pum/tvcell_mini.swf</pattern>
</domain>
<domain name="" desc="UC씽">
<pattern>http://ucsing.mnet.com/L_swf/ucsing_player.swf</pattern>
<pattern>http://flvfile.mnet.com</pattern>
</domain>
<domain name="http://www.snaps.co.kr" desc="SNAPS">
<pattern>http://www.snaps.co.kr/swf/LinkedApp.swf</pattern>
</domain>
<domain name="http://www.nate.com" desc="네이트">
<pattern>http://v.nate.com/v.sk/</pattern>
<pattern>http://w.blogdoc.nate.com/</pattern>
<pattern>http://blogdoc.nate.com/flash/blogdoc_widget_reco.swf</pattern>
</domain>
<domain name="http://www.paoin.com" desc="파오인 신문지면 뷰어">
<pattern>http://www.paoin.com/Common/swf/ArticleViewer02.swf</pattern>
<pattern>http://thumb.paoin.com/paoweb/common/flash/ArticleViewer02.swf</pattern>
<pattern>http://thumb.paoin.com/paoweb/common/flash/ArticleShare.swf</pattern>
</domain>
<domain name="http://www.atzine.com" desc="엣진 서비스">
<pattern>http://www.atzine.com/swf/TakeOutWrapper.swf?</pattern>
</domain>
<domain name="http://www.ohmynews.com" desc="오마이뉴스">
<pattern>http://www.ohmynews.com/</pattern>
</domain>
<domain name="http://www.jjanglive.com" desc="짱라이브 위젯">
<pattern>http://www.jjanglive.com/flash/webClient.swf</pattern>
<pattern>http://www.jjanglive.com/flash/AdShowClient.swf</pattern>
</domain>
<domain name="http://www.pmang.com" desc="피망">
<pattern>http://file.pmang.com/images/pmang/fifaonline/season2/img/squad/squadmaker_ot.swf</pattern>
<pattern>http://fifaonline.pmang.com/squad/t.nwz</pattern>
<pattern>http://file.pmang.com/images/pmang/gamepub/player/pm_player.swf</pattern>
<pattern>http://www.pmang.com/gamepub/media/player.nwz</pattern>
</domain>
<domain name="http://www.ccmpia.com" desc="CCMPIA">
<pattern>http://www.ccmpia.com/scripts/bgm2.php</pattern>
</domain>
<domain name="http://www.kbs.co.kr" desc="KBS">
<pattern>http://www.kbs.co.kr/zzim/vmplayer/vmplayer.xap</pattern>
<pattern>http://vmark.kbs.co.kr/zzim/vmplayer/vmplayer.xap</pattern>
</domain>
<domain name="http://www.sbs.co.kr" desc="SBS">
<pattern>http://netv.sbs.co.kr/sbox/silverlight/ClientBin/NeTVPlayer.xap</pattern>
<pattern>http://news.sbs.co.kr/</pattern>
<pattern>http://wizard2.sbs.co.kr/</pattern>
<pattern>http://sbsplayer.sbs.co.kr/</pattern>
</domain>
<domain name="http://www.imbc.com" desc="MBC">
<pattern>http://onemore.imbc.com/ClientBin/oneplus.xap</pattern>
</domain>
<domain name="http://www.xtmtv.com" desc="XTM">
<pattern>http://www.xtmtv.com/xtmPlayer/javascript/XTM_Scrap_Player.swf</pattern>
</domain>
<domain name="http://www.chtvn.com" desc="TVN">
<pattern>http://player.chtvn.com/tvN_Scrap_Player.swf?</pattern>
</domain>
<domain name="http://www.detailview.co.kr" desc="디테일뷰">
<pattern>http://storage.detailview.co.kr/</pattern>
<pattern>http://beta.detailview.co.kr/</pattern>
</domain>
<domain name="http://www.brightcove.com" desc="Brightcove">
<pattern>http://c.brightcove.com/services/viewer</pattern>
</domain>
<domain name="http://www.hyundai-kiamotors.com" desc="현대기아자동차">
<pattern>http://vod.hyundai-kiamotors.com/Flash/PlayerTest/WebPlayer.swf</pattern>
</domain>
<domain name="http://www.techdays.co.kr" desc="techdays">
<pattern>http://www.techdays.co.kr/2010spring/remix10/ClientBin/MediaPlayerTemplate.xap</pattern>
<pattern>http://www.microsoft.com</pattern>
</domain>
<domain name="http://www.wowplan.co.kr" desc="와우플랜">
<pattern>http://www.wowplan.co.kr/schedule/bin-debug/scheduleBlogPost.swf</pattern>
</domain>
<domain name="http://www.allblet.net" desc="allblet.net">
<pattern>http://showman.allblet.net/abp.swf</pattern>
</domain>
<domain name="http://dotsub.com" desc="dotsub.com">
<pattern>http://dotsub.com/static/players/portalplayer.swf</pattern>
</domain>
<domain name="" isNHN="true" desc="socialsearch">
<pattern>http://static.campaign.naver.com/0/campaign/2010/10/socialsearch/swf/</pattern>
</domain>
</embed>
<iframe>
<domain name="http://www.youtube.com" desc="유튜브 동영상" mobile="true">
<pattern>http://www.youtube.com/</pattern>
<pattern>https://www.youtube.com/</pattern>
<pattern>http://www.youtube-nocookie.com/</pattern>
<pattern>https://www.youtube-nocookie.com/</pattern>
</domain>
<domain name="http://maps.google.com" desc="구글맵스" mobile="true">
<pattern>http://maps.google.com/</pattern>
<pattern>http://maps.google.co.kr/</pattern>
</domain>
<domain name="http://flvs.daum.net" desc="다음 TV 팟 동영상" mobile="false">
<pattern>http://flvs.daum.net/</pattern>
</domain>
<domain name="http://play.pullbbang.com" desc="풀빵 동영상" mobile="false">
<pattern>http://play.pullbbang.com/#.swf</pattern>
</domain>
<domain name="" desc="게임스팟 동영상">
<pattern>http://www.gamespot.com</pattern>
</domain>
<domain name="http://www.sbs.co.kr" desc="SBS">
<pattern>http://sbsplayer.sbs.co.kr/</pattern>
</domain>
<domain name="http://www.techdays.co.kr" desc="techdays">
<pattern>http://www.techdays.co.kr/2010spring/remix10/ClientBin/MediaPlayerTemplate.xap</pattern>
<pattern>http://www.microsoft.com</pattern>
</domain>
<domain name="http://dotsub.com" desc="dotsub.com">
<pattern>http://dotsub.com/</pattern>
</domain>
<domain name="http://www.travelro.co.kr" desc="트래블로">
<pattern>http://www.travelro.co.kr/</pattern>
</domain>
<domain name="http://www.vimeo.com" desc="vimeo.com">
<pattern>http://player.vimeo.com/</pattern>
</domain>
</iframe>
</whiteurl>

4
classes/security/phphtmlparser/CVS/Entries Executable file
View file

@ -0,0 +1,4 @@
/LICENSE/1.3/Tue Apr 13 21:22:43 2004//
/README/1.1.1.1/Mon Oct 6 19:17:41 2003//
/release.sh/1.1.1.1/Mon Oct 6 19:17:41 2003//
D/src////

4
classes/security/phphtmlparser/CVS/Entries.Extra Executable file
View file

@ -0,0 +1,4 @@
/LICENSE////
/README////
/release.sh////
D/src////

3
classes/security/phphtmlparser/CVS/Entries.Extra.Old Executable file
View file

@ -0,0 +1,3 @@
/LICENSE////
/README////
/release.sh////

4
classes/security/phphtmlparser/CVS/Entries.Old Executable file
View file

@ -0,0 +1,4 @@
/LICENSE/1.3/Tue Apr 13 21:22:43 2004//
/README/1.1.1.1/Mon Oct 6 19:17:41 2003//
/release.sh/1.1.1.1/Mon Oct 6 19:17:41 2003//
D

1
classes/security/phphtmlparser/CVS/Repository Executable file
View file

@ -0,0 +1 @@
phphtmlparser

1
classes/security/phphtmlparser/CVS/Root Executable file
View file

@ -0,0 +1 @@
:ext:jhsolorz@cvs.sourceforge.net:/cvsroot/php-html

48
classes/security/phphtmlparser/LICENSE Executable file
View file

@ -0,0 +1,48 @@
/* ====================================================================
* Based on The Apache Software License, Version 1.1
*
* Copyright (c) 2003 Jose Solorzano. All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
*
* 1. Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
*
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in
* the documentation and/or other materials provided with the
* distribution.
*
* 3. The end-user documentation included with the redistribution,
* if any, must include the following acknowledgment:
* "This product includes software developed by
* Jose Solorzano."
* Alternately, this acknowledgment may appear in the software itself,
* if and wherever such third-party acknowledgments normally appear.
*
* 4. The name "Jose Solorzano" must not be used to endorse or promote
* products derived from this software without prior written
* permission.
*
* 5. Products derived from this software may not be called "Jose Solorzano",
* nor may "Jose Solorzano" appear in their name, without prior written
* permission.
*
* THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESSED OR IMPLIED
* WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
* OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
* DISCLAIMED. IN NO EVENT SHALL STARNETSYS, LLC. OR
* ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
* LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF
* USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
* ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
* OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
* OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
* SUCH DAMAGE.
* ====================================================================
*
*/

70
classes/security/phphtmlparser/README Executable file
View file

@ -0,0 +1,70 @@
HTML Parser for PHP 4
---------------------
This is a simple PHP based HTML parser.
How to Use
----------
Simply copy src/htmlparser.inc to a location in your
codebase where you'd like to be able to include it.
The PHP file which uses the parser might look like
this:
<?
include ("htmlparser.inc");
$htmlText = "... HTML text here ...";
HtmlParser parser = new HtmlParser ($htmlText);
while ($parser->parse()) {
// Data you can use here:
//
// $parser->iNodeType
// $parser->iNodeName
// $parser->iNodeValue
// $parser->iNodeAttributes
}
You will find additional documentation for each
field in the source code.
?>
Files of Interest
-----------------
src/htmlparser.inc -- Has HtmlParser class
src/html2text.inc -- Has Html2Text class
src/ex_dumptags.php -- Example: Dumps HTML nodes from test HTML string
src/ex_html2text.php -- Example: Dumps text for test HTML string
Running examples offline
------------------------
On a Unix system, you can run the examples as follows
if you have PHP installed:
cd src
php < ex_dumptags.php
php < ex_html2text.php
License
-------
This is an open source project. The license is
based on the Apache Software License. See the file
named LICENSE.
Author
------
The parser and the HTML-to-text example were written
by Jose Solorzano of Starnetsys, LLC. If you need a
program or website developed, professionally, within
budget, and on time, contact us (http://starnetsys.com)

10
classes/security/phphtmlparser/release.sh Executable file
View file

@ -0,0 +1,10 @@
#!/bin/sh
if [ "$TEMP" = "" ]; then
TEMP="/tmp";
fi
rm -f `find . -name '*~'`
(cd ..; tar cvf $TEMP/phphtmlparser$1.tar phphtmlparser)
gzip $TEMP/phphtmlparser$1.tar

7
classes/security/phphtmlparser/src/CVS/Entries Executable file
View file

@ -0,0 +1,7 @@
/ex_dumptags.php/1.2/Wed Oct 29 16:42:53 2003//
/ex_dumpurl.php/1.3/Fri Apr 16 15:52:39 2004//
/ex_html2text.php/1.2/Fri Apr 16 15:52:39 2004//
/html2text.inc/1.3/Wed Oct 29 16:42:53 2003//
/htmlparser.inc/1.5/Fri Apr 16 15:52:39 2004//
/testfile.html/1.2/Fri Apr 16 15:52:39 2004//
D

6
classes/security/phphtmlparser/src/CVS/Entries.Extra Executable file
View file

@ -0,0 +1,6 @@
/ex_dumptags.php////
/ex_dumpurl.php////
/ex_html2text.php////
/html2text.inc////
/htmlparser.inc////
/testfile.html////

0
classes/security/phphtmlparser/src/CVS/Entries.Extra.Old Executable file
View file

0
classes/security/phphtmlparser/src/CVS/Entries.Old Executable file
View file

1
classes/security/phphtmlparser/src/CVS/Repository Executable file
View file

@ -0,0 +1 @@
phphtmlparser/src

1
classes/security/phphtmlparser/src/CVS/Root Executable file
View file

@ -0,0 +1 @@
:ext:jhsolorz@cvs.sourceforge.net:/cvsroot/php-html

11
classes/security/phphtmlparser/src/ex_dumptags.php Executable file
View file

@ -0,0 +1,11 @@
<?
include ("htmlparser.inc");
$htmlText = "<html><!-- comment --><body>This is the body</body></html>";
$parser = new HtmlParser($htmlText);
while ($parser->parse()) {
echo "-----------------------------------\r\n";
echo "Node type: " . $parser->iNodeType . "\r\n";
echo "Node name: " . $parser->iNodeName . "\r\n";
echo "Node value: " . $parser->iNodeValue . "\r\n";
}
?>

29
classes/security/phphtmlparser/src/ex_dumpurl.php Executable file
View file

@ -0,0 +1,29 @@
<?
// Example:
// Dumps nodes from testfile.html.
// To run: php < ex_dumpurl.php
include ("htmlparser.inc");
$parser = HtmlParser_ForFile ("testfile.html");
//$parser = HtmlParser_ForURL ("http://yahoo.com");
while ($parser->parse()) {
echo "-----------------------------------\r\n";
echo "Name=" . $parser->iNodeName . ";";
echo "Type=" . $parser->iNodeType . ";";
if ($parser->iNodeType == NODE_TYPE_TEXT || $parser->iNodeType == NODE_TYPE_COMMENT) {
echo "Value='" . $parser->iNodeValue . "'";
}
echo "\r\n";
if ($parser->iNodeType == NODE_TYPE_ELEMENT) {
echo "ATTRIBUTES: ";
$attrValues = $parser->iNodeAttributes;
$attrNames = array_keys($attrValues);
$size = count($attrNames);
for ($i = 0; $i < $size; $i++) {
$name = $attrNames[$i];
echo $attrNames[$i] . "=\"" . $attrValues[$name] . "\" ";
}
}
echo "\r\n";
}
?>

18
classes/security/phphtmlparser/src/ex_html2text.php Executable file
View file

@ -0,0 +1,18 @@
<?
// Example: html2text
// Converts HTML to formatted ASCII text.
// Run with: php < ex_html2text.php
include ("html2text.inc");
$htmlText = "Html2text is a tool that allows you to<br>" .
"convert HTML to text.<p>" .
"Does it work?";
$htmlToText = new Html2Text ($htmlText, 15);
$text = $htmlToText->convert();
echo "Conversion follows:\r\n";
echo "-------------------\r\n";
echo $text;
?>

214
classes/security/phphtmlparser/src/html2text.inc Executable file
View file

@ -0,0 +1,214 @@
<?
/*
* Copyright (c) 2003 Jose Solorzano. All rights reserved.
* Redistribution of source must retain this copyright notice.
*/
include ("htmlparser.inc");
/**
* Class Html2Text. (HtmlParser example.)
* Converts HTML to ASCII attempting to preserve
* document structure.
* To use, create an instance of Html2Text passing
* the text to convert and the desired maximum
* number of characters per line. Then invoke
* convert() which returns ASCII text.
*/
class Html2Text {
// Private fields
var $iCurrentLine = "";
var $iCurrentWord = "";
var $iCurrentWordArray;
var $iCurrentWordIndex;
var $iInScript;
var $iListLevel = 0;
var $iHtmlText;
var $iMaxColumns;
var $iHtmlParser;
// Constants
var $TOKEN_BR = 0;
var $TOKEN_P = 1;
var $TOKEN_LI = 2;
var $TOKEN_AFTERLI = 3;
var $TOKEN_UL = 4;
var $TOKEN_ENDUL = 5;
function Html2Text ($aHtmlText, $aMaxColumns) {
$this->iHtmlText = $aHtmlText;
$this->iMaxColumns = $aMaxColumns;
}
function convert() {
$this->iHtmlParser = new HtmlParser($this->iHtmlText);
$wholeText = "";
while (($line = $this->getLine()) !== false) {
$wholeText .= ($line . "\r\n");
}
return $wholeText;
}
function getLine() {
while (true) {
if (!$this->addWordToLine($this->iCurrentWord)) {
$retvalue = $this->iCurrentLine;
$this->iCurrentLine = "";
return $retvalue;
}
$word = $this->getWord();
if ($word === false) {
if ($this->iCurrentLine == "") {
break;
}
$retvalue = $this->iCurrentLine;
$this->iCurrentLine = "";
$this->iInText = false;
$this->iCurrentWord = "";
return $retvalue;
}
}
return false;
}
function addWordToLine ($word) {
if ($this->iInScript) {
return true;
}
$prevLine = $this->iCurrentLine;
if ($word === $this->TOKEN_BR) {
$this->iCurrentWord = "";
return false;
}
if ($word === $this->TOKEN_P) {
$this->iCurrentWord = $this->TOKEN_BR;
return false;
}
if ($word === $this->TOKEN_UL) {
$this->iCurrentWord = $this->TOKEN_BR;
return false;
}
if ($word === $this->TOKEN_ENDUL) {
$this->iCurrentWord = $this->TOKEN_BR;
return false;
}
if ($word === $this->TOKEN_LI) {
$this->iCurrentWord = $this->TOKEN_AFTERLI;
return false;
}
$toAdd = $word;
if ($word === $this->TOKEN_AFTERLI) {
$toAdd = "";
}
if ($prevLine != "") {
$prevLine .= " ";
}
else {
$prevLine = $this->getIndentation($word === $this->TOKEN_AFTERLI);
}
$candidateLine = $prevLine . $toAdd;
if (strlen ($candidateLine) > $this->iMaxColumns && $prevLine != "") {
return false;
}
$this->iCurrentLine = $candidateLine;
return true;
}
function getWord() {
while (true) {
if ($this->iHtmlParser->iNodeType == NODE_TYPE_TEXT) {
if (!$this->iInText) {
$words = $this->splitWords($this->iHtmlParser->iNodeValue);
$this->iCurrentWordArray = $words;
$this->iCurrentWordIndex = 0;
$this->iInText = true;
}
if ($this->iCurrentWordIndex < count($this->iCurrentWordArray)) {
$this->iCurrentWord = $this->iCurrentWordArray[$this->iCurrentWordIndex++];
return $this->iCurrentWord;
}
else {
$this->iInText = false;
}
}
else if ($this->iHtmlParser->iNodeType == NODE_TYPE_ELEMENT) {
if (strcasecmp ($this->iHtmlParser->iNodeName, "br") == 0) {
$this->iHtmlParser->parse();
$this->iCurrentWord = $this->TOKEN_BR;
return $this->iCurrentWord;
}
else if (strcasecmp ($this->iHtmlParser->iNodeName, "p") == 0) {
$this->iHtmlParser->parse();
$this->iCurrentWord = $this->TOKEN_P;
return $this->iCurrentWord;
}
else if (strcasecmp ($this->iHtmlParser->iNodeName, "script") == 0) {
$this->iHtmlParser->parse();
$this->iCurrentWord = "";
$this->iInScript = true;
return $this->iCurrentWord;
}
else if (strcasecmp ($this->iHtmlParser->iNodeName, "ul") == 0 || strcasecmp ($this->iHtmlParser->iNodeName, "ol") == 0) {
$this->iHtmlParser->parse();
$this->iCurrentWord = $this->TOKEN_UL;
$this->iListLevel++;
return $this->iCurrentWord;
}
else if (strcasecmp ($this->iHtmlParser->iNodeName, "li") == 0) {
$this->iHtmlParser->parse();
$this->iCurrentWord = $this->TOKEN_LI;
return $this->iCurrentWord;
}
}
else if ($this->iHtmlParser->iNodeType == NODE_TYPE_ENDELEMENT) {
if (strcasecmp ($this->iHtmlParser->iNodeName, "script") == 0) {
$this->iHtmlParser->parse();
$this->iCurrentWord = "";
$this->iInScript = false;
return $this->iCurrentWord;
}
else if (strcasecmp ($this->iHtmlParser->iNodeName, "ul") == 0 || strcasecmp ($this->iHtmlParser->iNodeName, "ol") == 0) {
$this->iHtmlParser->parse();
$this->iCurrentWord = $this->TOKEN_ENDUL;
if ($this->iListLevel > 0) {
$this->iListLevel--;
}
return $this->iCurrentWord;
}
}
if (!$this->iHtmlParser->parse()) {
break;
}
}
return false;
}
function splitWords ($text) {
$words = split ("[ \t\r\n]+", $text);
for ($idx = 0; $idx < count($words); $idx++) {
$words[$idx] = $this->htmlDecode($words[$idx]);
}
return $words;
}
function htmlDecode ($text) {
// TBD
return $text;
}
function getIndentation ($hasLI) {
$indent = "";
$idx = 0;
for ($idx = 0; $idx < ($this->iListLevel - 1); $idx++) {
$indent .= " ";
}
if ($this->iListLevel > 0) {
$indent = $hasLI ? ($indent . "- ") : ($indent . " ");
}
return $indent;
}
}

365
classes/security/phphtmlparser/src/htmlparser.inc Executable file
View file

@ -0,0 +1,365 @@
<?php
/*
* Copyright (c) 2003 Jose Solorzano. All rights reserved.
* Redistribution of source must retain this copyright notice.
*
* Jose Solorzano (http://jexpert.us) is a software consultant.
*
* Contributions by:
* - Leo West (performance improvements)
*/
define ("NODE_TYPE_START",0);
define ("NODE_TYPE_ELEMENT",1);
define ("NODE_TYPE_ENDELEMENT",2);
define ("NODE_TYPE_TEXT",3);
define ("NODE_TYPE_COMMENT",4);
define ("NODE_TYPE_DONE",5);
/**
* Class HtmlParser.
* To use, create an instance of the class passing
* HTML text. Then invoke parse() until it's false.
* When parse() returns true, $iNodeType, $iNodeName
* $iNodeValue and $iNodeAttributes are updated.
*
* To create an HtmlParser instance you may also
* use convenience functions HtmlParser_ForFile
* and HtmlParser_ForURL.
*/
class HtmlParser {
/**
* Field iNodeType.
* May be one of the NODE_TYPE_* constants above.
*/
var $iNodeType;
/**
* Field iNodeName.
* For elements, it's the name of the element.
*/
var $iNodeName = "";
/**
* Field iNodeValue.
* For text nodes, it's the text.
*/
var $iNodeValue = "";
/**
* Field iNodeAttributes.
* A string-indexed array containing attribute values
* of the current node. Indexes are always lowercase.
*/
var $iNodeAttributes;
// The following fields should be
// considered private:
var $iHtmlText;
var $iHtmlTextLength;
var $iHtmlTextIndex = 0;
var $iHtmlCurrentChar;
var $BOE_ARRAY;
var $B_ARRAY;
var $BOS_ARRAY;
/**
* Constructor.
* Constructs an HtmlParser instance with
* the HTML text given.
*/
function HtmlParser ($aHtmlText) {
$this->iHtmlText = $aHtmlText;
$this->iHtmlTextLength = strlen($aHtmlText);
$this->iNodeAttributes = array();
$this->setTextIndex (0);
$this->BOE_ARRAY = array (" ", "\t", "\r", "\n", "=" );
$this->B_ARRAY = array (" ", "\t", "\r", "\n" );
$this->BOS_ARRAY = array (" ", "\t", "\r", "\n", "/" );
}
/**
* Method parse.
* Parses the next node. Returns false only if
* the end of the HTML text has been reached.
* Updates values of iNode* fields.
*/
function parse() {
$text = $this->skipToElement();
if ($text != "") {
$this->iNodeType = NODE_TYPE_TEXT;
$this->iNodeName = "Text";
$this->iNodeValue = $text;
return true;
}
return $this->readTag();
}
function clearAttributes() {
$this->iNodeAttributes = array();
}
function readTag() {
if ($this->iCurrentChar != "<") {
$this->iNodeType = NODE_TYPE_DONE;
return false;
}
$this->clearAttributes();
$this->skipMaxInTag ("<", 1);
if ($this->iCurrentChar == '/') {
$this->moveNext();
$name = $this->skipToBlanksInTag();
$this->iNodeType = NODE_TYPE_ENDELEMENT;
$this->iNodeName = $name;
$this->iNodeValue = "";
$this->skipEndOfTag();
return true;
}
$name = $this->skipToBlanksOrSlashInTag();
if (!$this->isValidTagIdentifier ($name)) {
$comment = false;
if (strpos($name, "!--") === 0) {
$ppos = strpos($name, "--", 3);
if (strpos($name, "--", 3) === (strlen($name) - 2)) {
$this->iNodeType = NODE_TYPE_COMMENT;
$this->iNodeName = "Comment";
$this->iNodeValue = "<" . $name . ">";
$comment = true;
}
else {
$rest = $this->skipToStringInTag ("-->");
if ($rest != "") {
$this->iNodeType = NODE_TYPE_COMMENT;
$this->iNodeName = "Comment";
$this->iNodeValue = "<" . $name . $rest;
$comment = true;
// Already skipped end of tag
return true;
}
}
}
if (!$comment) {
$this->iNodeType = NODE_TYPE_TEXT;
$this->iNodeName = "Text";
$this->iNodeValue = "<" . $name;
return true;
}
}
else {
$this->iNodeType = NODE_TYPE_ELEMENT;
$this->iNodeValue = "";
$this->iNodeName = $name;
while ($this->skipBlanksInTag()) {
$attrName = $this->skipToBlanksOrEqualsInTag();
if ($attrName != "" && $attrName != "/") {
$this->skipBlanksInTag();
if ($this->iCurrentChar == "=") {
$this->skipEqualsInTag();
$this->skipBlanksInTag();
$value = $this->readValueInTag();
$this->iNodeAttributes[strtolower($attrName)] = $value;
}
else {
$this->iNodeAttributes[strtolower($attrName)] = "";
}
}
}
}
$this->skipEndOfTag();
return true;
}
function isValidTagIdentifier ($name) {
return ereg ("^[A-Za-z0-9_\\-]+$", $name);
}
function skipBlanksInTag() {
return "" != ($this->skipInTag ($this->B_ARRAY));
}
function skipToBlanksOrEqualsInTag() {
return $this->skipToInTag ($this->BOE_ARRAY);
}
function skipToBlanksInTag() {
return $this->skipToInTag ($this->B_ARRAY);
}
function skipToBlanksOrSlashInTag() {
return $this->skipToInTag ($this->BOS_ARRAY);
}
function skipEqualsInTag() {
return $this->skipMaxInTag ("=", 1);
}
function readValueInTag() {
$ch = $this->iCurrentChar;
$value = "";
if ($ch == "\"") {
$this->skipMaxInTag ("\"", 1);
$value = $this->skipToInTag ("\"");
$this->skipMaxInTag ("\"", 1);
}
else if ($ch == "'") {
$this->skipMaxInTag ("'", 1);
$value = $this->skipToInTag ("'");
$this->skipMaxInTag ("'", 1);
}
else {
$value = $this->skipToBlanksInTag();
}
return $value;
}
function setTextIndex ($index) {
$this->iHtmlTextIndex = $index;
if ($index >= $this->iHtmlTextLength) {
$this->iCurrentChar = -1;
}
else {
$this->iCurrentChar = $this->iHtmlText{$index};
}
}
function moveNext() {
if ($this->iHtmlTextIndex < $this->iHtmlTextLength) {
$this->setTextIndex ($this->iHtmlTextIndex + 1);
return true;
}
else {
return false;
}
}
function skipEndOfTag() {
while (($ch = $this->iCurrentChar) !== -1) {
if ($ch == ">") {
$this->moveNext();
return;
}
$this->moveNext();
}
}
function skipInTag ($chars) {
$sb = "";
while (($ch = $this->iCurrentChar) !== -1) {
if ($ch == ">") {
return $sb;
} else {
$match = false;
for ($idx = 0; $idx < count($chars); $idx++) {
if ($ch == $chars[$idx]) {
$match = true;
break;
}
}
if (!$match) {
return $sb;
}
$sb .= $ch;
$this->moveNext();
}
}
return $sb;
}
function skipMaxInTag ($chars, $maxChars) {
$sb = "";
$count = 0;
while (($ch = $this->iCurrentChar) !== -1 && $count++ < $maxChars) {
if ($ch == ">") {
return $sb;
} else {
$match = false;
for ($idx = 0; $idx < count($chars); $idx++) {
if ($ch == $chars[$idx]) {
$match = true;
break;
}
}
if (!$match) {
return $sb;
}
$sb .= $ch;
$this->moveNext();
}
}
return $sb;
}
function skipToInTag ($chars) {
$sb = "";
while (($ch = $this->iCurrentChar) !== -1) {
$match = $ch == ">";
if (!$match) {
for ($idx = 0; $idx < count($chars); $idx++) {
if ($ch == $chars[$idx]) {
$match = true;
break;
}
}
}
if ($match) {
return $sb;
}
$sb .= $ch;
$this->moveNext();
}
return $sb;
}
function skipToElement() {
$sb = "";
while (($ch = $this->iCurrentChar) !== -1) {
if ($ch == "<") {
return $sb;
}
$sb .= $ch;
$this->moveNext();
}
return $sb;
}
/**
* Returns text between current position and $needle,
* inclusive, or "" if not found. The current index is moved to a point
* after the location of $needle, or not moved at all
* if nothing is found.
*/
function skipToStringInTag ($needle) {
$pos = strpos ($this->iHtmlText, $needle, $this->iHtmlTextIndex);
if ($pos === false) {
return "";
}
$top = $pos + strlen($needle);
$retvalue = substr ($this->iHtmlText, $this->iHtmlTextIndex, $top - $this->iHtmlTextIndex);
$this->setTextIndex ($top);
return $retvalue;
}
}
function HtmlParser_ForFile ($fileName) {
return HtmlParser_ForURL($fileName);
}
function HtmlParser_ForURL ($url) {
$fp = fopen ($url, "r");
$content = "";
while (true) {
$data = fread ($fp, 8192);
if (strlen($data) == 0) {
break;
}
$content .= $data;
}
fclose ($fp);
return new HtmlParser ($content);
}
php?>

8
classes/security/phphtmlparser/src/testfile.html Executable file
View file

@ -0,0 +1,8 @@
<!-- first comment --> <!-- second comment -->
<elem attribute1="foobar" attribute2=""/>Text After Elem
<!--comment1-->
<elem2>Text</elem2>
<!-- comment2-->
<elem3 attribute3='insinglequotes'/>
<!--comment3 -->Text between comments<!-- comment4 -->
<elem4/>

17
classes/template/TemplateHandler.class.php
View file

@ -187,7 +187,7 @@ class TemplateHandler {
$buff = preg_replace('@<!--//.*?-->@s', '', $buff);
// replace value of src in img/input/script tag
$buff = preg_replace_callback('/<(?:img|input|script)(?:(?!["\'\/]\s*>).)* src="(?!https?:\/\/|[\/\{])([^"]+)"/is', array($this, '_replacePath'), $buff);
$buff = preg_replace_callback('/<(?:img|input|script)[^<>]*src="(?!https?:\/\/|[\/\{])([^"]+)"/is', array($this, '_replacePath'), $buff);
// replace loop and cond template syntax
$buff = $this->_parseInline($buff);
@ -199,7 +199,11 @@ class TemplateHandler {
$buff = preg_replace('@</?block\s*>@is','',$buff);
// form auto generation
$buff = preg_replace_callback('/(<form(?:<\?php.+?\?>|[^<>]+)*?>)(.*?)(<\/form>)/is', array($this, '_compileFormAuthGeneration'), $buff);
$temp = preg_replace_callback('/(<form(?:<\?php.+?\?>|[^<>]+)*?>)(.*?)(<\/form>)/is', array($this, '_compileFormAuthGeneration'), $buff);
if($temp)
{
$buff = $temp;
}
// prevent from calling directly before writing into file
$buff = '<?php if(!defined("__XE__"))exit;?>'.$buff;
@ -219,6 +223,7 @@ class TemplateHandler {
* @param array $matches
* @return string
**/
function _compileFormAuthGeneration($matches)
{
// form ruleset attribute move to hidden tag
@ -319,6 +324,12 @@ class TemplateHandler {
**/
function _replacePath($match)
{
//return origin code when src value include variable.
if(preg_match('/^[\'|"]\s*\.\s*\$/', $match[1]))
{
return $match[0];
}
$src = preg_replace('@^(\./)+@', '', trim($match[1]));
$src = $this->web_path.$src;
@ -327,7 +338,7 @@ class TemplateHandler {
// for backward compatibility
$src = preg_replace('@/((?:[\w-]+/)+)\1@', '/\1', $src);
while(($tmp=preg_replace('@[^/]+/\.\./@', '', $src))!==$src) $src = $tmp;
while(($tmp=preg_replace('@[^/]+/\.\./@', '', $src, 1))!==$src) $src = $tmp;
return substr($match[0],0,-strlen($match[1])-6)."src=\"{$src}\"";
}

21
classes/validator/Validator.class.php
View file

@ -71,7 +71,7 @@ class Validator
// predefined rules
$this->addRule(array(
'email' => '/^[\w-]+(\.[\w-]+)*@[\w-]+(\.[\w-]+)+$/',
'email' => '/^[\w-]+((?:\.|\+|\~)[\w-]+)*@[\w-]+(\.[\w-]+)+$/',
'userid' => '/^[a-z]+[\w-]*[a-z0-9_]+$/i',
'url' => '/^(https?|ftp|mms):\/\/[0-9a-z-]+(\.[_0-9a-z-]+)+(:\d+)?/',
'alpha' => '/^[a-z]*$/i',
@ -199,7 +199,7 @@ class Validator
$fields = array_map(array($this, 'arrayTrim'), $fields);
$field_names = array_keys($fields);
$filters = $this->_filters;
$filters = array();
// get field names matching patterns
foreach($this->_filters as $key=>$filter) {
@ -210,6 +210,10 @@ class Validator
$filters[substr($key,0,-2)] = $filter;
unset($filters[$key]);
}
else
{
$filters[$key] = $filter;
}
if(!count($names)) continue;
@ -222,9 +226,18 @@ class Validator
foreach($filters as $key=>$filter) {
$fname = preg_replace('/\[\]$/', '', $key);
$exists = array_key_exists($key, $fields);
$filter = array_merge($filter_default, $filter);
$value = $exists ? $fields[$fname] : null;
if(preg_match("/(^[a-z_]*)[\[](?:\'|\")?([a-z_]*)(?:\'|\")?[\]]$/i", $key, $matches))
{
$exists = array_key_exists($matches[1], $fields);
$value = $exists ? $fields[$matches[1]][$matches[2]] : null;
}
else
{
$exists = array_key_exists($key, $fields);
$value = $exists ? $fields[$fname] : null;
}
if(is_array($value)) $value = implode('', $value);

2
classes/xml/xmlquery/argument/Argument.class.php
View file

@ -204,7 +204,7 @@ class Argument {
switch ($filter_type) {
case 'email' :
case 'email_address' :
if (!preg_match('/^[_0-9a-z-]+(\.[_0-9a-z-]+)*@[0-9a-z-]+(\.[0-9a-z-]+)*$/is', $val)) {
if (!preg_match('/^[\w-]+((?:\.|\+|\~)[\w-]+)*@[\w-]+(\.[\w-]+)+$/is', $val)) {
$this->isValid = false;
$this->errorMessage = new Object(-1, sprintf($lang->filter->invalid_email, $lang->{$key} ? $lang->{$key} : $key));
}

87
classes/xml/xmlquery/tags/condition/ConditionTag.class.php
View file

@ -53,50 +53,63 @@
$this->operation = $condition->attrs->operation;
$this->pipe = $condition->attrs->pipe;
$dbParser = DB::getParser();
$this->column_name = $dbParser->parseExpression($condition->attrs->column);
$this->column_name = $dbParser->parseExpression($condition->attrs->column);
// If default value is column name, it should be escaped
if($isColumnName = strpos($condition->attrs->default, '.')){
$condition->attrs->default = $dbParser->parseColumnName($condition->attrs->default);
}
// If default value is column name, it should be escaped
if($isColumnName = (strpos($condition->attrs->default, '.') !== false
&& strpos($condition->attrs->default, '.') !== 0
&& strpos($condition->attrs->default, '%') === false ))
{
$condition->attrs->default = $dbParser->parseExpression($condition->attrs->default);
}
if($condition->node_name == 'query'){
$this->query = new QueryTag($condition, true);
$this->default_column = $this->query->toString();
}
else if($condition->attrs->var && !strpos($condition->attrs->var, '.')){
if($condition->node_name == 'query')
{
$this->query = new QueryTag($condition, TRUE);
$this->default_column = $this->query->toString();
}
else if($condition->attrs->var && !strpos($condition->attrs->var, '.'))
{
$this->argument = new QueryArgument($condition);
$this->argument_name = $this->argument->getArgumentName();
}
else {
if(isset($condition->attrs->default)){
$operationList = array('in'=>1, 'between'=>1, 'not in'=>1);
if(isset($operationList[$this->operation])){
$default_value = $condition->attrs->default;
if(strpos($default_value, "'") !== false)
$default_value = "\"" . $default_value . "\"";
else
$default_value = "'" . $default_value . "'";
}
else {
$default_value_object = new DefaultValue($this->column_name, $condition->attrs->default);
$default_value = $default_value_object->toString();
else
{
if(isset($condition->attrs->default))
{
$operationList = array('in' => 1, 'between' => 1, 'not in' => 1);
if(isset($operationList[$this->operation]))
{
$default_value = $condition->attrs->default;
if(strpos($default_value, "'") !== FALSE)
$default_value = "\"" . $default_value . "\"";
else
{
$default_value = "'" . $default_value . "'";
}
}
else
{
$default_value_object = new DefaultValue($this->column_name, $condition->attrs->default);
$default_value = $default_value_object->toString();
if($default_value_object->isStringFromFunction()){
$default_value = '"\'".' . $default_value . '."\'"';
}
if($default_value_object->isStringFromFunction())
{
$default_value = '"\'".' . $default_value . '."\'"';
}
if($default_value_object->isString() && !$isColumnName && !is_numeric( $condition->attrs->default)){
if(strpos($default_value, "'") !== false)
$default_value = "\"" . $default_value . "\"";
else
$default_value = "'" . $default_value . "'";
}
}
$this->default_column = $default_value;
}
else
$this->default_column = "'" . $dbParser->parseColumnName($condition->attrs->var) . "'" ;
if($default_value_object->isString() && !$isColumnName && !is_numeric($condition->attrs->default))
{
if(strpos($default_value, "'") !== FALSE)
$default_value = "\"" . $default_value . "\"";
else
$default_value = "'" . $default_value . "'";
}
}
$this->default_column = $default_value;
}
else
$this->default_column = "'" . $dbParser->parseColumnName($condition->attrs->var) . "'";
}
}