diff options
author | friendica <info@friendica.com> | 2015-01-01 22:18:27 -0800 |
---|---|---|
committer | friendica <info@friendica.com> | 2015-01-01 22:18:27 -0800 |
commit | a0052f0176bd079e6a94baec59fea2ec5a8d651e (patch) | |
tree | c323edd823681bc2e8ca757e7eaf8354d42c7b51 /library/HTMLPurifier/URIFilter/Munge.php | |
parent | 545e47933a0816699c68d98a7742a03260d6a54f (diff) | |
download | volse-hubzilla-a0052f0176bd079e6a94baec59fea2ec5a8d651e.tar.gz volse-hubzilla-a0052f0176bd079e6a94baec59fea2ec5a8d651e.tar.bz2 volse-hubzilla-a0052f0176bd079e6a94baec59fea2ec5a8d651e.zip |
htmlpurifier update - compatibility issue with language library autoloader
Diffstat (limited to 'library/HTMLPurifier/URIFilter/Munge.php')
-rw-r--r-- | library/HTMLPurifier/URIFilter/Munge.php | 91 |
1 files changed, 74 insertions, 17 deletions
diff --git a/library/HTMLPurifier/URIFilter/Munge.php b/library/HTMLPurifier/URIFilter/Munge.php index efa10a645..6e03315a1 100644 --- a/library/HTMLPurifier/URIFilter/Munge.php +++ b/library/HTMLPurifier/URIFilter/Munge.php @@ -2,31 +2,79 @@ class HTMLPurifier_URIFilter_Munge extends HTMLPurifier_URIFilter { + /** + * @type string + */ public $name = 'Munge'; + + /** + * @type bool + */ public $post = true; - private $target, $parser, $doEmbed, $secretKey; + /** + * @type string + */ + private $target; + + /** + * @type HTMLPurifier_URIParser + */ + private $parser; + + /** + * @type bool + */ + private $doEmbed; + + /** + * @type string + */ + private $secretKey; + + /** + * @type array + */ protected $replace = array(); - public function prepare($config) { - $this->target = $config->get('URI.' . $this->name); - $this->parser = new HTMLPurifier_URIParser(); - $this->doEmbed = $config->get('URI.MungeResources'); + /** + * @param HTMLPurifier_Config $config + * @return bool + */ + public function prepare($config) + { + $this->target = $config->get('URI.' . $this->name); + $this->parser = new HTMLPurifier_URIParser(); + $this->doEmbed = $config->get('URI.MungeResources'); $this->secretKey = $config->get('URI.MungeSecretKey'); + if ($this->secretKey && !function_exists('hash_hmac')) { + throw new Exception("Cannot use %URI.MungeSecretKey without hash_hmac support."); + } return true; } - public function filter(&$uri, $config, $context) { - if ($context->get('EmbeddedURI', true) && !$this->doEmbed) return true; - $scheme_obj = $uri->getSchemeObj($config, $context); - if (!$scheme_obj) return true; // ignore unknown schemes, maybe another postfilter did it - if (is_null($uri->host) || empty($scheme_obj->browsable)) { + /** + * @param HTMLPurifier_URI $uri + * @param HTMLPurifier_Config $config + * @param HTMLPurifier_Context $context + * @return bool + */ + public function filter(&$uri, $config, $context) + { + if ($context->get('EmbeddedURI', true) && !$this->doEmbed) { return true; } - // don't redirect if target host is our host - if ($uri->host === $config->getDefinition('URI')->host) { + + $scheme_obj = $uri->getSchemeObj($config, $context); + if (!$scheme_obj) { return true; - } + } // ignore unknown schemes, maybe another postfilter did it + if (!$scheme_obj->browsable) { + return true; + } // ignore non-browseable schemes, since we can't munge those in a reasonable way + if ($uri->isBenign($config, $context)) { + return true; + } // don't redirect if a benign URL $this->makeReplace($uri, $config, $context); $this->replace = array_map('rawurlencode', $this->replace); @@ -35,12 +83,20 @@ class HTMLPurifier_URIFilter_Munge extends HTMLPurifier_URIFilter $new_uri = $this->parser->parse($new_uri); // don't redirect if the target host is the same as the // starting host - if ($uri->host === $new_uri->host) return true; + if ($uri->host === $new_uri->host) { + return true; + } $uri = $new_uri; // overwrite return true; } - protected function makeReplace($uri, $config, $context) { + /** + * @param HTMLPurifier_URI $uri + * @param HTMLPurifier_Config $config + * @param HTMLPurifier_Context $context + */ + protected function makeReplace($uri, $config, $context) + { $string = $uri->toString(); // always available $this->replace['%s'] = $string; @@ -50,9 +106,10 @@ class HTMLPurifier_URIFilter_Munge extends HTMLPurifier_URIFilter $this->replace['%m'] = $context->get('CurrentAttr', true); $this->replace['%p'] = $context->get('CurrentCSSProperty', true); // not always available - if ($this->secretKey) $this->replace['%t'] = sha1($this->secretKey . ':' . $string); + if ($this->secretKey) { + $this->replace['%t'] = hash_hmac("sha256", $string, $this->secretKey); + } } - } // vim: et sw=4 sts=4 |