summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
Diffstat
-rw-r--r--modules/akismet/helpers/akismet.php2
-rw-r--r--modules/digibug/views/admin_digibug.html.php2
-rw-r--r--modules/exif/helpers/exif.php2
-rw-r--r--modules/g2_import/views/admin_g2_import.html.php10
-rw-r--r--modules/gallery/helpers/MY_url.php24
-rw-r--r--modules/gallery/helpers/graphics.php2
-rw-r--r--modules/gallery/tests/Xss_Security_Test.php15
-rw-r--r--modules/gallery/views/admin_block_welcome.html.php10
-rw-r--r--modules/gallery/views/upgrader.html.php2
-rw-r--r--modules/recaptcha/helpers/recaptcha.php2
-rw-r--r--modules/search/helpers/search.php2
-rw-r--r--modules/server_add/helpers/server_add.php2
-rw-r--r--modules/user/views/reset_password.html.php4
-rw-r--r--system/helpers/request.php2
14 files changed, 35 insertions, 46 deletions
diff --git a/modules/akismet/helpers/akismet.php b/modules/akismet/helpers/akismet.php
index db45a6ab..abca78d2 100644
--- a/modules/akismet/helpers/akismet.php
+++ b/modules/akismet/helpers/akismet.php
@@ -94,7 +94,7 @@ class akismet_Core {
if (empty($api_key)) {
site_status::warning(
t("Akismet is not quite ready! Please provide an <a href=\"%url\">API Key</a>",
- array("url" => url::site("admin/akismet"))),
+ array("url" => SafeString::of_safe_html(url::site("admin/akismet")))),
"akismet_config");
} else {
site_status::clear("akismet_config");
diff --git a/modules/digibug/views/admin_digibug.html.php b/modules/digibug/views/admin_digibug.html.php
index 7e4436ff..5f27a3fd 100644
--- a/modules/digibug/views/admin_digibug.html.php
+++ b/modules/digibug/views/admin_digibug.html.php
@@ -16,7 +16,7 @@
<p>
<?= t("You don't need an account with Digibug, but if you <a href=\"%signup_url\">register with Digibug</a> and enter your Digibug id in the <a href=\"%advanced_settings_url\">Advanced Settings</a> page you can make money off of your photos!",
array("signup_url" => "http://www.digibug.com/signup.php",
- "advanced_settings_url" => url::site("admin/advanced_settings"))) ?>
+ "advanced_settings_url" => SafeString::of_safe_html(url::site("admin/advanced_settings")))) ?>
</p>
</div>
</div>
diff --git a/modules/exif/helpers/exif.php b/modules/exif/helpers/exif.php
index 20ecd0cb..d4e60338 100644
--- a/modules/exif/helpers/exif.php
+++ b/modules/exif/helpers/exif.php
@@ -164,7 +164,7 @@ class exif_Core {
if ($remaining) {
site_status::warning(
t('Your Exif index needs to be updated. <a href="%url" class="gDialogLink">Fix this now</a>',
- array("url" => url::site("admin/maintenance/start/exif_task::update_index?csrf=__CSRF__"))),
+ array("url" => SafeString::of_safe_html(url::site("admin/maintenance/start/exif_task::update_index?csrf=__CSRF__")))),
"exif_index_out_of_date");
}
}
diff --git a/modules/g2_import/views/admin_g2_import.html.php b/modules/g2_import/views/admin_g2_import.html.php
index da2bb5d1..f53510f6 100644
--- a/modules/g2_import/views/admin_g2_import.html.php
+++ b/modules/g2_import/views/admin_g2_import.html.php
@@ -37,9 +37,9 @@
<? if ($g2_sizes["thumb"]["size"] && $thumb_size != $g2_sizes["thumb"]["size"]): ?>
<li class="gWarning">
<?= t("Your most common thumbnail size in Gallery 2 is %g2_pixels pixels, but your Gallery 3 thumbnail size is set to %g3_pixels pixels. <a href=\"%url\">Using the same value</a> will speed up your import.",
- array("g2_pixels" => $g2_sizes["thumb"]["size"],
- "g3_pixels" => $thumb_size,
- "url" => url::site("admin/theme_options"))) ?>
+ array("g2_pixels" => $g2_sizes["thumb"]["size"],
+ "g3_pixels" => $thumb_size,
+ "url" => SafeString::of_safe_html(url::site("admin/theme_options")))) ?>
</li>
<? endif ?>
@@ -47,8 +47,8 @@
<li class="gWarning">
<?= t("Your most common intermediate size in Gallery 2 is %g2_pixels pixels, but your Gallery 3 thumbnail size is set to %g3_pixels pixels. <a href=\"%url\">Using the same value</a> will speed up your import.",
array("g2_pixels" => $g2_sizes["resize"]["size"],
- "g3_pixels" => $resize_size,
- "url" => url::site("admin/theme_options"))) ?>
+ "g3_pixels" => $resize_size,
+ "url" => SafeString::of_safe_html(url::site("admin/theme_options")))) ?>
</li>
<? endif ?>
</ul>
diff --git a/modules/gallery/helpers/MY_url.php b/modules/gallery/helpers/MY_url.php
index 6092a9d8..c4967c52 100644
--- a/modules/gallery/helpers/MY_url.php
+++ b/modules/gallery/helpers/MY_url.php
@@ -30,8 +30,7 @@ class url extends url_Core {
if ($parts[0] == "albums" || $parts[0] == "photos") {
$uri = model_cache::get("item", $parts[1])->relative_path();
}
- $url = parent::site($uri . $query, $protocol);
- return SafeString::of_safe_html($url);
+ return parent::site($uri . $query, $protocol);
}
static function parse_url() {
@@ -100,25 +99,4 @@ class url extends url_Core {
static function abs_current($qs=false) {
return self::abs_site(url::current($qs));
}
-
- public static function base($index=false, $protocol=false) {
- $url = parent::base($index, $protocol);
- return SafeString::of_safe_html($url);
- }
-
- public static function current($qs=false) {
- $url = parent::current($qs);
- return SafeString::of_safe_html($url);
- }
-
- public static function file($file, $index=false) {
- $url = parent::file($file, $index);
- return SafeString::of_safe_html($url);
- }
-
- public static function merge(array $arguments) {
- $url = parent::merge($arguments);
- return SafeString::of_safe_html($url);
- }
-
}
diff --git a/modules/gallery/helpers/graphics.php b/modules/gallery/helpers/graphics.php
index 7dc46eeb..fbb85bec 100644
--- a/modules/gallery/helpers/graphics.php
+++ b/modules/gallery/helpers/graphics.php
@@ -442,7 +442,7 @@ class graphics_Core {
if (!module::get_var("gallery", "graphics_toolkit")) {
site_status::warning(
t("Graphics toolkit missing! Please <a href=\"%url\">choose a toolkit</a>",
- array("url" => url::site("admin/graphics"))),
+ array("url" => SafeString::of_safe_html(url::site("admin/graphics")))),
"missing_graphics_toolkit");
}
}
diff --git a/modules/gallery/tests/Xss_Security_Test.php b/modules/gallery/tests/Xss_Security_Test.php
index 690dc760..a2d3d59b 100644
--- a/modules/gallery/tests/Xss_Security_Test.php
+++ b/modules/gallery/tests/Xss_Security_Test.php
@@ -130,14 +130,14 @@ class Xss_Security_Test extends Unit_Test_Case {
$token = $tokens[$token_number];
}
} else if ($token[1] == "url") {
- // url methods return a SafeString
+ // url methods return safe HTML
if (self::_token_matches(array(T_DOUBLE_COLON, "::"), $tokens, $token_number + 1) &&
self::_token_matches(array(T_STRING), $tokens, $token_number + 2) &&
in_array($tokens[$token_number + 2][1],
array("site", "current", "base", "file", "abs_site", "abs_current",
"abs_file", "merge")) &&
self::_token_matches("(", $tokens, $token_number + 3)) {
- $frame->is_safestring(true);
+ $frame->is_safe_html(true);
$method = $tokens[$token_number + 2][1];
$frame->expr_append("::$method(");
@@ -203,7 +203,8 @@ class Xss_Security_Test extends Unit_Test_Case {
$state = "CLEAN";
}
} else {
- if ($frame->is_safestring() || $frame->purified_html_called() || $frame->for_html_called()) {
+ if ($frame->is_safe_html() || $frame->is_safestring() ||
+ $frame->purified_html_called() || $frame->for_html_called()) {
$state = "CLEAN";
}
}
@@ -259,6 +260,7 @@ class Xss_Security_Test_Frame {
private $_for_html_called = false;
private $_purified_html_called = false;
private $_json_encode_called = false;
+ private $_is_safe_html = false;
private $_line;
function __construct($line_number, $in_script_block) {
@@ -288,6 +290,13 @@ class Xss_Security_Test_Frame {
return $this->_is_safestring;
}
+ function is_safe_html($new_val=NULL) {
+ if ($new_val !== NULL) {
+ $this->_is_safe_html = (bool) $new_val;
+ }
+ return $this->_is_safe_html;
+ }
+
function json_encode_called($new_val=NULL) {
if ($new_val !== NULL) {
$this->_json_encode_called = (bool) $new_val;
diff --git a/modules/gallery/views/admin_block_welcome.html.php b/modules/gallery/views/admin_block_welcome.html.php
index 38d2bd56..c6ccdbf3 100644
--- a/modules/gallery/views/admin_block_welcome.html.php
+++ b/modules/gallery/views/admin_block_welcome.html.php
@@ -5,16 +5,16 @@
<ul>
<li>
<?= t("General Settings - choose your <a href=\"%graphics_url\">graphics</a> and <a href=\"%language_url\">language</a> settings.",
- array("graphics_url" => url::site("admin/graphics"),
- "language_url" => url::site("admin/languages"))) ?>
+ array("graphics_url" => SafeString::of_safe_html(url::site("admin/graphics")),
+ "language_url" => SafeString::of_safe_html(url::site("admin/languages")))) ?>
</li>
<li>
<?= t("Appearance - <a href=\"%theme_url\">choose a theme</a>, or <a href=\"%theme_options_url\">customize the way it looks</a>.",
- array("theme_url" => url::site("admin/themes"),
- "theme_options_url" => url::site("admin/theme_options"))) ?>
+ array("theme_url" => SafeString::of_safe_html(url::site("admin/themes")),
+ "theme_options_url" => SafeString::of_safe_html(url::site("admin/theme_options")))) ?>
</li>
<li>
<?= t("Customize - <a href=\"%modules_url\">install modules</a> to add cool features!",
- array("modules_url" => url::site("admin/modules"))) ?>
+ array("modules_url" => SafeString::of_safe_html(url::site("admin/modules")))) ?>
</li>
</ul>
diff --git a/modules/gallery/views/upgrader.html.php b/modules/gallery/views/upgrader.html.php
index 37578855..ccc86da8 100644
--- a/modules/gallery/views/upgrader.html.php
+++ b/modules/gallery/views/upgrader.html.php
@@ -18,7 +18,7 @@
<h1> <?= t("That's it!") ?> </h1>
<p>
<?= t("Your <a href=\"%url\">Gallery</a> is up to date.",
- array("url" => url::site("albums/1"))) ?>
+ array("url" => SafeString::of_safe_html(url::site("albums/1")))) ?>
</p>
</div>
</div>
diff --git a/modules/recaptcha/helpers/recaptcha.php b/modules/recaptcha/helpers/recaptcha.php
index 501dd972..35d9febd 100644
--- a/modules/recaptcha/helpers/recaptcha.php
+++ b/modules/recaptcha/helpers/recaptcha.php
@@ -43,7 +43,7 @@ class recaptcha_Core {
if (empty($public_key) || empty($private_key)) {
site_status::warning(
t("reCAPTCHA is not quite ready! Please configure the <a href=\"%url\">reCAPTCHA Keys</a>",
- array("url" => url::site("admin/recaptcha"))),
+ array("url" => SafeString::of_safe_html(url::site("admin/recaptcha")))),
"recaptcha_config");
} else {
site_status::clear("recaptcha_config");
diff --git a/modules/search/helpers/search.php b/modules/search/helpers/search.php
index 355c4493..4be04039 100644
--- a/modules/search/helpers/search.php
+++ b/modules/search/helpers/search.php
@@ -58,7 +58,7 @@ class search_Core {
if ($remaining) {
site_status::warning(
t('Your search index needs to be updated. <a href="%url" class="gDialogLink">Fix this now</a>',
- array("url" => url::site("admin/maintenance/start/search_task::update_index?csrf=__CSRF__"))),
+ array("url" => SafeString::of_safe_html(url::site("admin/maintenance/start/search_task::update_index?csrf=__CSRF__")))),
"search_index_out_of_date");
}
}
diff --git a/modules/server_add/helpers/server_add.php b/modules/server_add/helpers/server_add.php
index 74f51ad9..57afac12 100644
--- a/modules/server_add/helpers/server_add.php
+++ b/modules/server_add/helpers/server_add.php
@@ -25,7 +25,7 @@ class server_add_Core {
if (empty($paths)) {
site_status::warning(
t("Server Add needs configuration. <a href=\"%url\">Configure it now!</a>",
- array("url" => url::site("admin/server_add"))),
+ array("url" => SafeString::of_safe_html(url::site("admin/server_add")))),
"server_add_configuration");
} else {
site_status::clear("server_add_configuration");
diff --git a/modules/user/views/reset_password.html.php b/modules/user/views/reset_password.html.php
index 3dc7aebf..6fa92d54 100644
--- a/modules/user/views/reset_password.html.php
+++ b/modules/user/views/reset_password.html.php
@@ -9,7 +9,9 @@
<?= t("Hello, %name,", array("name" => $user->full_name ? $user->full_name : $user->name)) ?>
</p>
<p>
- <?= t("We received a request to reset your password for <a href=\"%site_url\">%site_url</a>. If you made this request, you can confirm it by <a href=\"%confirm_url\">clicking this link</a>. If you didn't request this password reset, it's ok to ignore this mail.", array("site_url" => url::base(false, "http"), "confirm_url" => $confirm_url)) ?>
+ <?= t("We received a request to reset your password for <a href=\"%site_url\">%site_url</a>. If you made this request, you can confirm it by <a href=\"%confirm_url\">clicking this link</a>. If you didn't request this password reset, it's ok to ignore this mail.",
+ array("site_url" => SafeString::of_safe_html(url::base(false, "http")),
+ "confirm_url" => $confirm_url)) ?>
</p>
</body>
</html>
diff --git a/system/helpers/request.php b/system/helpers/request.php
index 15b8edfa..4203d0e5 100644
--- a/system/helpers/request.php
+++ b/system/helpers/request.php
@@ -30,7 +30,7 @@ class request_Core {
// Set referrer
$ref = $_SERVER['HTTP_REFERER'];
- if (strpos($ref, (string) url::base(FALSE)) === 0)
+ if (strpos($ref, url::base(FALSE)) === 0)
{
// Remove the base URL from the referrer
$ref = substr($ref, strlen(url::base(FALSE)));
generated by cgit v1.2.3 (git 2.46.0) at 2025-10-13 06:59:40 +0000