summaryrefslogtreecommitdiff
path: root/modules/gallery/helpers
diff options
context:
space:
mode:
Diffstat (limited to 'modules/gallery/helpers')
-rw-r--r--modules/gallery/helpers/MY_html.php91
-rw-r--r--modules/gallery/helpers/gallery.php6
-rw-r--r--modules/gallery/helpers/gallery_rss.php4
-rw-r--r--modules/gallery/helpers/gallery_task.php4
-rw-r--r--modules/gallery/helpers/graphics.php2
-rw-r--r--modules/gallery/helpers/p.php39
6 files changed, 99 insertions, 47 deletions
diff --git a/modules/gallery/helpers/MY_html.php b/modules/gallery/helpers/MY_html.php
new file mode 100644
index 00000000..4522d01c
--- /dev/null
+++ b/modules/gallery/helpers/MY_html.php
@@ -0,0 +1,91 @@
+<?php defined("SYSPATH") or die("No direct script access.");
+/**
+ * Gallery - a web based photo album viewer and editor
+ * Copyright (C) 2000-2009 Bharat Mediratta
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or (at
+ * your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street - Fifth Floor, Boston, MA 02110-1301, USA.
+ */
+class html extends html_Core {
+ /**
+ * Returns a string that is safe to be used in HTML (XSS protection).
+ *
+ * If $html is a string, the returned string will be HTML escaped.
+ * If $html is a SafeString instance, the returned string may contain
+ * unescaped HTML which is assumed to be safe.
+ *
+ * Example:<pre>
+ * <div><?= html::clean($php_var) ?>
+ * </pre>
+ */
+ static function clean($html) {
+ return new SafeString($html);
+ }
+
+ /**
+ * Returns a string that is safe to be used in HTML (XSS protection),
+ * purifying (filtering) the given HTML to ensure that the result contains
+ * only non-malicious HTML.
+ *
+ * Example:<pre>
+ * <div><?= html::purify($item->title) ?>
+ * </pre>
+ */
+ static function purify($html) {
+ return SafeString::purify($html);
+ }
+
+ /**
+ * Flags the given string as safe to be used in HTML (free of malicious HTML/JS).
+ *
+ * Example:<pre>
+ * // Parameters to t() are automatically escaped by default.
+ * // If the parameter is marked as safe, it won't get escaped.
+ * t('Go <a href="%url">there</a>',
+ * array("url" => html::mark_safe(url::current())))
+ * </pre>
+ */
+ static function mark_safe($html) {
+ return SafeString::of_safe_html($html);
+ }
+
+ /**
+ * Escapes the given string for use in JavaScript.
+ *
+ * Example:<pre>
+ * <script type="text/javascript>"
+ * var some_js_string = <?= html::js_string($php_string) ?>;
+ * </script>
+ * </pre>
+ */
+ static function js_string($string) {
+ return SafeString::of($string)->for_js();
+ }
+
+ /**
+ * Returns a string safe for use in HTML element attributes.
+ *
+ * Assumes that the HTML element attribute is already
+ * delimited by single or double quotes
+ *
+ * Example:<pre>
+ * <a title="<?= html::clean_for_attribute($php_var) ?>">;
+ * </script>
+ * </pre>
+ * @return the string escaped for use in HTML attributes.
+ */
+ static function clean_attribute($string) {
+ return self::clean($string)->for_html_attr();
+ }
+}
diff --git a/modules/gallery/helpers/gallery.php b/modules/gallery/helpers/gallery.php
index 122227fc..035ed1da 100644
--- a/modules/gallery/helpers/gallery.php
+++ b/modules/gallery/helpers/gallery.php
@@ -92,7 +92,7 @@ class gallery_Core {
$can_add = $item && access::can("add", $item);
if ($can_add) {
- $menu->append($add_menu = Menu::factory("submenu")
+ $menu->append($add_menu = Menu::factory("submenu")
->id("add_menu")
->label(t("Add")));
$add_menu->append(Menu::factory("dialog")
@@ -100,11 +100,11 @@ class gallery_Core {
->label(t("Add photos"))
->url(url::site("simple_uploader/app/$item->id")));
if ($item->is_album()) {
- $add_menu->append(Menu::factory("dialog")
+ $add_menu->append(Menu::factory("dialog")
->id("add_album_item")
->label(t("Add an album"))
->url(url::site("form/add/albums/$item->id?type=album")));
- }
+ }
}
$menu->append($options_menu = Menu::factory("submenu")
diff --git a/modules/gallery/helpers/gallery_rss.php b/modules/gallery/helpers/gallery_rss.php
index 8e887368..dee6ae40 100644
--- a/modules/gallery/helpers/gallery_rss.php
+++ b/modules/gallery/helpers/gallery_rss.php
@@ -53,9 +53,9 @@ class gallery_rss_Core {
->descendants($limit, $offset, array("type" => "photo"));
$feed->max_pages = ceil(
$item->viewable()->descendants_count(array("type" => "photo")) / $limit);
- $feed->title = p::purify($item->title);
+ $feed->title = html::purify($item->title);
$feed->link = url::abs_site("albums/{$item->id}");
- $feed->description = nl2br(p::purify($item->description));
+ $feed->description = nl2br(html::purify($item->description));
return $feed;
}
diff --git a/modules/gallery/helpers/gallery_task.php b/modules/gallery/helpers/gallery_task.php
index 9edc3acd..c9557324 100644
--- a/modules/gallery/helpers/gallery_task.php
+++ b/modules/gallery/helpers/gallery_task.php
@@ -64,10 +64,10 @@ class gallery_task_Core {
if (!$success) {
$ignored[$item->id] = 1;
$errors[] = t("Unable to rebuild images for '%title'",
- array("title" => p::purify($item->title)));
+ array("title" => html::purify($item->title)));
} else {
$errors[] = t("Successfully rebuilt images for '%title'",
- array("title" => p::purify($item->title)));
+ array("title" => html::purify($item->title)));
}
}
diff --git a/modules/gallery/helpers/graphics.php b/modules/gallery/helpers/graphics.php
index a20c58dd..787f8dc3 100644
--- a/modules/gallery/helpers/graphics.php
+++ b/modules/gallery/helpers/graphics.php
@@ -443,7 +443,7 @@ class graphics_Core {
if (!module::get_var("gallery", "graphics_toolkit")) {
site_status::warning(
t("Graphics toolkit missing! Please <a href=\"%url\">choose a toolkit</a>",
- array("url" => url::site("admin/graphics"))),
+ array("url" => html::mark_safe(url::site("admin/graphics")))),
"missing_graphics_toolkit");
}
}
diff --git a/modules/gallery/helpers/p.php b/modules/gallery/helpers/p.php
deleted file mode 100644
index 862c769b..00000000
--- a/modules/gallery/helpers/p.php
+++ /dev/null
@@ -1,39 +0,0 @@
-<?php defined("SYSPATH") or die("No direct script access.");
-/**
- * Gallery - a web based photo album viewer and editor
- * Copyright (C) 2000-2009 Bharat Mediratta
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 2 of the License, or (at
- * your option) any later version.
- *
- * This program is distributed in the hope that it will be useful, but
- * WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
- * General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street - Fifth Floor, Boston, MA 02110-1301, USA.
- */
-class p_Core {
- private static $_purifier = null;
- static function clean($dirty_html) {
- return html::specialchars($dirty_html);
- }
-
- static function purify($dirty_html) {
- if (empty(self::$_purifier)) {
- require_once(dirname(__file__) . "/../lib/HTMLPurifier/HTMLPurifier.auto.php");
- $config = HTMLPurifier_Config::createDefault();
- foreach (Kohana::config('purifier') as $category => $key_value) {
- foreach ($key_value as $key => $value) {
- $config->set("$category.$key", $value);
- }
- }
- self::$_purifier = new HTMLPurifier($config);
- }
- return self::$_purifier->purify($dirty_html);
- }
-}
generated by cgit v1.2.3 (git 2.46.0) at 2025-10-13 23:39:34 +0000