* (bug 2780) Fix thumbnail generation with GD for new image schema

[lhc/web/wiklou.git] / includes / Sanitizer.php

diff --git a/includes/Sanitizer.php b/includes/Sanitizer.php
index 9f05ed8..2b59108 100644 (file)
--- a/includes/Sanitizer.php
+++ b/includes/Sanitizer.php
@@ -1,5 +1,4 @@
 <?php
-
 /**
  * (X)HTML sanitizer for MediaWiki
  *
@@ -317,15 +316,18 @@ $wgHtmlEntities = array(
        'zwj'      => 8205,
        'zwnj'     => 8204 );
 
+/** @package MediaWiki */
 class Sanitizer {
        /**
         * Cleans up HTML, removes dangerous tags and attributes, and
         * removes HTML comments
         * @access private
         * @param string $text
+        * @param callback $processCallback to do any variable or parameter replacements in HTML attribute values
+        * @param array $args for the processing callback
         * @return string
         */
-       function removeHTMLtags( $text ) {
+       function removeHTMLtags( $text, $processCallback = null, $args = array() ) {
                global $wgUseTidy, $wgUserHtml;
                $fname = 'Parser::removeHTMLtags';
                wfProfileIn( $fname );
@@ -341,6 +343,9 @@ class Sanitizer {
                        $htmlsingle = array(
                                'br', 'hr', 'li', 'dt', 'dd'
                        );
+                       $htmlsingleonly = array( # Elements that cannot have close tags
+                               'br', 'hr'
+                       );
                        $htmlnest = array( # Tags that can be nested--??
                                'table', 'tr', 'td', 'th', 'div', 'blockquote', 'ol', 'ul',
                                'dl', 'font', 'big', 'small', 'sub', 'sup', 'span'
@@ -367,7 +372,7 @@ class Sanitizer {
                        $tagstack = array(); $tablestack = array();
                        foreach ( $bits as $x ) {
                                $prev = error_reporting( E_ALL & ~( E_NOTICE | E_WARNING ) );
-                               preg_match( '/^(\\/?)(\\w+)([^>]*)(\\/{0,1}>)([^<]*)$/',
+                               preg_match( '/^(\\/?)(\\w+)([^>]*?)(\\/{0,1}>)([^<]*)$/',
                                $x, $regs );
                                list( $qbar, $slash, $t, $params, $brace, $rest ) = $regs;
                                error_reporting( $prev );
@@ -377,7 +382,9 @@ class Sanitizer {
                                        # Check our stack
                                        if ( $slash ) {
                                                # Closing a tag...
-                                               if ( ! in_array( $t, $htmlsingle ) &&
+                                               if( in_array( $t, $htmlsingleonly ) ) {
+                                                       $badtag = 1;
+                                               } elseif( !in_array( $t, $htmlsingle ) &&
                                                ( $ot = @array_pop( $tagstack ) ) != $t ) {
                                                        @array_push( $tagstack, $ot );
                                                        $badtag = 1;
@@ -395,6 +402,9 @@ class Sanitizer {
                                                } else if ( in_array( $t, $tagstack ) &&
                                                ! in_array ( $t , $htmlnest ) ) {
                                                        $badtag = 1 ;
+                                               } elseif( in_array( $t, $htmlsingleonly ) ) {
+                                                       # Hack to force empty tag for uncloseable elements
+                                                       $brace = '/>';
                                                } else if ( ! in_array( $t, $htmlsingle ) ) {
                                                        if ( $t == 'table' ) {
                                                                array_push( $tablestack, $tagstack );
@@ -402,12 +412,20 @@ class Sanitizer {
                                                        }
                                                        array_push( $tagstack, $t );
                                                }
+
+                                               # Replace any variables or template parameters with
+                                               # plaintext results.
+                                               if( is_callable( $processCallback ) ) {
+                                                       call_user_func_array( $processCallback, array( &$params, $args ) );
+                                               }
+
                                                # Strip non-approved attributes from the tag
                                                $newparams = Sanitizer::fixTagAttributes( $params, $t );
                                        }
                                        if ( ! $badtag ) {
                                                $rest = str_replace( '>', '&gt;', $rest );
-                                               $text .= "<$slash$t$newparams$brace$rest";
+                                               $close = ( $brace == '/>' ) ? ' /' : '';
+                                               $text .= "<$slash$t$newparams$close>$rest";
                                                continue;
                                        }
                                }
@@ -421,10 +439,13 @@ class Sanitizer {
                } else {
                        # this might be possible using tidy itself
                        foreach ( $bits as $x ) {
-                               preg_match( '/^(\\/?)(\\w+)([^>]*)(\\/{0,1}>)([^<]*)$/',
+                               preg_match( '/^(\\/?)(\\w+)([^>]*?)(\\/{0,1}>)([^<]*)$/',
                                $x, $regs );
                                @list( $qbar, $slash, $t, $params, $brace, $rest ) = $regs;
                                if ( in_array( $t = strtolower( $t ), $htmlelements ) ) {
+                                       if( is_callable( $processCallback ) ) {
+                                               call_user_func_array( $processCallback, array( &$params, $args ) );
+                                       }
                                        $newparams = Sanitizer::fixTagAttributes( $params, $t );
                                        $rest = str_replace( '>', '&gt;', $rest );
                                        $text .= "<$slash$t$newparams$brace$rest";
@@ -553,9 +574,9 @@ class Sanitizer {
                                '/(' . URL_PROTOCOLS . '):/',
                                '\\1&#58;', $value );
                        
-                       if( !isset( $attribs[$attribute] ) ) {
-                               $attribs[$attribute] = "$attribute=\"$value\"";
-                       }
+                       // If this attribute was previously set, override it.
+                       // Output should only have one attribute of each name.
+                       $attribs[$attribute] = "$attribute=\"$value\"";
                }
                if( empty( $attribs ) ) {
                        return '';