Move over some initial_setup() for Postgres (THIS IS BROKEN, NEEDS REVIEW/WORK FROM...

[lhc/web/wiklou.git] / includes / Sanitizer.php

diff --git a/includes/Sanitizer.php b/includes/Sanitizer.php
index b422c4e..ab67010 100644 (file)
--- a/includes/Sanitizer.php
+++ b/includes/Sanitizer.php
@@ -2,7 +2,7 @@
 /**
  * XHTML sanitizer for MediaWiki
  *
- * Copyright (C) 2002-2005 Brion Vibber <brion@pobox.com> et al
+ * Copyright © 2002-2005 Brion Vibber <brion@pobox.com> et al
  * http://www.mediawiki.org/
  *
  * This program is free software; you can redistribute it and/or modify
@@ -31,8 +31,7 @@
 define( 'MW_CHAR_REFS_REGEX',
        '/&([A-Za-z0-9\x80-\xff]+);
         |&\#([0-9]+);
-        |&\#x([0-9A-Za-z]+);
-        |&\#X([0-9A-Za-z]+);
+        |&\#[xX]([0-9A-Fa-f]+);
         |(&)/x' );
 
 /**
@@ -40,10 +39,11 @@ define( 'MW_CHAR_REFS_REGEX',
  * Allows some... latitude.
  * Used in Sanitizer::fixTagAttributes and Sanitizer::decodeTagAttributes
  */
-$attrib = '[A-Za-z0-9]';
+$attribFirst = '[:A-Z_a-z]';
+$attrib = '[:A-Z_a-z-.0-9]';
 $space = '[\x09\x0a\x0d\x20]';
 define( 'MW_ATTRIBS_REGEX',
-       "/(?:^|$space)((?:xml:|xmlns:)?$attrib+)
+       "/(?:^|$space)({$attribFirst}{$attrib}*)
          ($space*=$space*
                (?:
                 # The attribute value: quoted or alone
@@ -367,7 +367,8 @@ class Sanitizer {
                                'h2', 'h3', 'h4', 'h5', 'h6', 'cite', 'code', 'em', 's',
                                'strike', 'strong', 'tt', 'var', 'div', 'center',
                                'blockquote', 'ol', 'ul', 'dl', 'table', 'caption', 'pre',
-                               'ruby', 'rt' , 'rb' , 'rp', 'p', 'span', 'u', 'abbr'
+                               'ruby', 'rt' , 'rb' , 'rp', 'p', 'span', 'abbr', 'dfn',
+                               'kbd', 'samp'
                        );
                        $htmlsingle = array(
                                'br', 'hr', 'li', 'dt', 'dd'
@@ -626,7 +627,7 @@ class Sanitizer {
         * @todo Check for unique id attribute :P
         */
        static function validateAttributes( $attribs, $whitelist ) {
-               global $wgAllowRdfaAttributes, $wgAllowMicrodataAttributes;
+               global $wgAllowRdfaAttributes, $wgAllowMicrodataAttributes, $wgHtml5;
 
                $whitelist = array_flip( $whitelist );
                $hrefExp = '/^(' . wfUrlProtocols() . ')[^\s]+$/';
@@ -642,7 +643,8 @@ class Sanitizer {
                                continue;
                        }
 
-                       if( !isset( $whitelist[$attribute] ) ) {
+                       # Allow any attribute beginning with "data-", if in HTML5 mode
+                       if ( !($wgHtml5 && preg_match( '/^data-/i', $attribute )) && !isset( $whitelist[$attribute] ) ) {
                                continue;
                        }
 
@@ -747,7 +749,7 @@ class Sanitizer {
 
                // Decode escape sequences and line continuation
                // See the grammar in the CSS 2 spec, appendix D.
-               static $decodeRegex, $reencodeTable;
+               static $decodeRegex;
                if ( !$decodeRegex ) {
                        $space = '[\\x20\\t\\r\\n\\f]';
                        $nl = '(?:\\n|\\r\\n|\\r|\\f)';
@@ -892,7 +894,9 @@ class Sanitizer {
         *
         * To ensure we don't have to bother escaping anything, we also strip ', ",
         * & even if $wgExperimentalIds is true.  TODO: Is this the best tactic?
-        * We also strip # because it upsets IE6.
+        * We also strip # because it upsets IE, and % because it could be
+        * ambiguous if it's part of something that looks like a percent escape
+        * (which don't work reliably in fragments cross-browser).
         *
         * @see http://www.w3.org/TR/html401/types.html#type-name Valid characters
         *                                                          in the id and
@@ -918,7 +922,7 @@ class Sanitizer {
 
                if ( $wgHtml5 && $wgExperimentalHtmlIds && !in_array( 'legacy', $options ) ) {
                        $id = Sanitizer::decodeCharReferences( $id );
-                       $id = preg_replace( '/[ \t\n\r\f_\'"&#]+/', '_', $id );
+                       $id = preg_replace( '/[ \t\n\r\f_\'"&#%]+/', '_', $id );
                        $id = trim( $id, '_' );
                        if ( $id === '' ) {
                                # Must have been all whitespace to start with.
@@ -972,11 +976,10 @@ class Sanitizer {
         * @return String: escaped input
         */
        static function escapeHtmlAllowEntities( $html ) {
+               $html = Sanitizer::decodeCharReferences( $html );
                # It seems wise to escape ' as well as ", as a matter of course.  Can't
                # hurt.
                $html = htmlspecialchars( $html, ENT_QUOTES );
-               $html = str_replace( '&amp;', '&', $html );
-               $html = Sanitizer::normalizeCharReferences( $html );
                return $html;
        }
 
@@ -1079,6 +1082,18 @@ class Sanitizer {
                        $text );
        }
 
+       /**
+        * Normalizes whitespace in a section name, such as might be returned
+        * by Parser::stripSectionName(), for use in the id's that are used for
+        * section links.
+        *
+        * @param $section String
+        * @return String
+        */
+       static function normalizeSectionNameWhitespace( $section ) {
+               return trim( preg_replace( '/[ _]+/', ' ', $section ) );
+       }
+
        /**
         * Ensure that any entities and character references are legal
         * for XML and XHTML specifically. Any stray bits will be
@@ -1111,8 +1126,6 @@ class Sanitizer {
                        $ret = Sanitizer::decCharReference( $matches[2] );
                } elseif( $matches[3] != ''  ) {
                        $ret = Sanitizer::hexCharReference( $matches[3] );
-               } elseif( $matches[4] != '' ) {
-                       $ret = Sanitizer::hexCharReference( $matches[4] );
                }
                if( is_null( $ret ) ) {
                        return htmlspecialchars( $matches[0] );
@@ -1222,8 +1235,6 @@ class Sanitizer {
                        return  Sanitizer::decodeChar( intval( $matches[2] ) );
                } elseif( $matches[3] != ''  ) {
                        return  Sanitizer::decodeChar( hexdec( $matches[3] ) );
-               } elseif( $matches[4] != '' ) {
-                       return  Sanitizer::decodeChar( hexdec( $matches[4] ) );
                }
                # Last case should be an ampersand by itself
                return $matches[0];
@@ -1344,10 +1355,10 @@ class Sanitizer {
                        'em'         => $common,
                        'strong'     => $common,
                        'cite'       => $common,
-                       # dfn
+                       'dfn'        => $common,
                        'code'       => $common,
-                       # samp
-                       # kbd
+                       'samp'       => $common,
+                       'kbd'        => $common,
                        'var'        => $common,
                        'abbr'       => $common,
                        # acronym