New updateSpecialPages.php script, to update the QueryPage cache. Disabled recache...

[lhc/web/wiklou.git] / includes / Sanitizer.php

diff --git a/includes/Sanitizer.php b/includes/Sanitizer.php
index 2729efc..e6c56e9 100644 (file)
--- a/includes/Sanitizer.php
+++ b/includes/Sanitizer.php
@@ -22,6 +22,7 @@
  * http://www.gnu.org/copyleft/gpl.html
  *
  * @package MediaWiki
+ * @subpackage Parser
  */
 
 class Sanitizer {
@@ -29,6 +30,8 @@ class Sanitizer {
         * Cleans up HTML, removes dangerous tags and attributes, and
         * removes HTML comments
         * @access private
+        * @param string $text
+        * @return string
         */
        function removeHTMLtags( $text ) {
                global $wgUseTidy, $wgUserHtml;
@@ -149,6 +152,8 @@ class Sanitizer {
         * trailing spaces and one of the newlines.
         * 
         * @access private
+        * @param string $text
+        * @return string
         */
        function removeHTMLcomments( $text ) {
                $fname='Parser::removeHTMLcomments';
@@ -239,7 +244,7 @@ class Sanitizer {
                        if( !isset( $whitelist[$attribute] ) ) {
                                continue;
                        }
-                       if( $set[2] == '' ) {
+                       if( !isset( $set[2] ) ) {
                                # In XHTML, attributes must have a value.
                                $value = $set[1];
                        } elseif( $set[3] != '' ) {
@@ -322,7 +327,10 @@ class Sanitizer {
                        array( 'Sanitizer', 'normalizeCharReferencesCallback' ),
                        $text );
        }
-       
+       /**
+        * @param string $matches
+        * @return string
+        */
        function normalizeCharReferencesCallback( $matches ) {
                $ret = null;
                if( $matches[1] != '' ) {
@@ -346,6 +354,7 @@ class Sanitizer {
         * return the named entity reference as is. Otherwise, returns
         * HTML-escaped text of pseudo-entity source (eg &foo;)
         *
+        * @param string $name
         * @return string
         */
        function normalizeEntity( $name ) {
@@ -795,7 +804,32 @@ class Sanitizer {
                        );
                return $whitelist;
        }
+       
+       /**
+        * Take a fragment of (potentially invalid) HTML and return
+        * a version with any tags removed, encoded suitably for literal
+        * inclusion in an attribute value.
+        *
+        * @param string $text HTML fragment
+        * @return string
+        */
+       function stripAllTags( $text ) {
+               # Actual <tags>
+               $text = preg_replace( '/<[^>]*>/', '', $text );
+               
+               # Normalize &entities and whitespace
+               $text = Sanitizer::normalizeAttributeValue( $text );
+               
+               # Will be placed into "double-quoted" attributes,
+               # make sure remaining bits are safe.
+               $text = str_replace(
+                       array('<', '>', '"'),
+                       array('&lt;', '&gt;', '&quot;'),
+                       $text );
+               
+               return $text;
+       }
 
 }
 
-?>
\ No newline at end of file
+?>