diff options
Diffstat (limited to 'hugo/libraries/sanitizing.lib.php')
| -rw-r--r-- | hugo/libraries/sanitizing.lib.php | 191 |
1 files changed, 191 insertions, 0 deletions
diff --git a/hugo/libraries/sanitizing.lib.php b/hugo/libraries/sanitizing.lib.php new file mode 100644 index 0000000..7e6e84d --- /dev/null +++ b/hugo/libraries/sanitizing.lib.php @@ -0,0 +1,191 @@ +<?php +/* vim: set expandtab sw=4 ts=4 sts=4: */ +/** + * This is in a separate script because it's called from a number of scripts + * + * @package PhpMyAdmin + */ +if (! defined('PHPMYADMIN')) { + exit; +} + +/** + * Checks whether given link is valid + * + * @param string $url URL to check + * + * @return boolean True if string can be used as link + */ +function PMA_checkLink($url) +{ + $valid_starts = array( + 'http://', + 'https://', + './url.php?url=http%3A%2F%2F', + './url.php?url=https%3A%2F%2F', + './doc/html/', + ); + if (defined('PMA_SETUP')) { + $valid_starts[] = '?page=form&'; + $valid_starts[] = '?page=servers&'; + } + foreach ($valid_starts as $val) { + if (substr($url, 0, strlen($val)) == $val) { + return true; + } + } + return false; +} + +/** + * Callback function for replacing [a@link@target] links in bb code. + * + * @param array $found Array of preg matches + * + * @return string Replaced string + */ +function PMA_replaceBBLink($found) +{ + /* Check for valid link */ + if (! PMA_checkLink($found[1])) { + return $found[0]; + } + /* a-z and _ allowed in target */ + if (! empty($found[3]) && preg_match('/[^a-z_]+/i', $found[3])) { + return $found[0]; + } + + /* Construct target */ + $target = ''; + if (! empty($found[3])) { + $target = ' target="' . $found[3] . '"'; + } + + /* Construct url */ + if (substr($found[1], 0, 4) == 'http') { + $url = PMA_linkURL($found[1]); + } else { + $url = $found[1]; + } + + return '<a href="' . $url . '"' . $target . '>'; +} + +/** + * Callback function for replacing [doc@anchor] links in bb code. + * + * @param array $found Array of preg matches + * + * @return string Replaced string + */ +function PMA_replaceDocLink($found) +{ + $anchor = $found[1]; + if (strncmp('faq', $anchor, 3) == 0) { + $page = 'faq'; + } else if (strncmp('cfg', $anchor, 3) == 0) { + $page = 'cfg'; + } else { + /* Guess */ + $page = 'setup'; + } + $link = PMA_Util::getDocuLink($page, $anchor); + return '<a href="' . $link . '" target="documentation">'; +} + +/** + * Sanitizes $message, taking into account our special codes + * for formatting. + * + * If you want to include result in element attribute, you should escape it. + * + * Examples: + * + * <p><?php echo PMA_sanitize($foo); ?></p> + * + * <a title="<?php echo PMA_sanitize($foo, true); ?>">bar</a> + * + * @param string $message the message + * @param boolean $escape whether to escape html in result + * @param boolean $safe whether string is safe (can keep < and > chars) + * + * @return string the sanitized message + */ +function PMA_sanitize($message, $escape = false, $safe = false) +{ + if (!$safe) { + $message = strtr($message, array('<' => '<', '>' => '>')); + } + + /* Interpret bb code */ + $replace_pairs = array( + '[em]' => '<em>', + '[/em]' => '</em>', + '[strong]' => '<strong>', + '[/strong]' => '</strong>', + '[code]' => '<code>', + '[/code]' => '</code>', + '[kbd]' => '<kbd>', + '[/kbd]' => '</kbd>', + '[br]' => '<br />', + '[/a]' => '</a>', + '[/doc]' => '</a>', + '[sup]' => '<sup>', + '[/sup]' => '</sup>', + // used in common.inc.php: + '[conferr]' => '<iframe src="show_config_errors.php" />', + ); + + $message = strtr($message, $replace_pairs); + + /* Match links in bb code ([a@url@target], where @target is options) */ + $pattern = '/\[a@([^]"@]*)(@([^]"]*))?\]/'; + + /* Find and replace all links */ + $message = preg_replace_callback($pattern, 'PMA_replaceBBLink', $message); + + /* Replace documentation links */ + $message = preg_replace_callback( + '/\[doc@([a-zA-Z0-9_-]+)\]/', + 'PMA_replaceDocLink', + $message + ); + + /* Possibly escape result */ + if ($escape) { + $message = htmlspecialchars($message); + } + + return $message; +} + + +/** + * Sanitize a filename by removing anything besides legit characters + * + * Intended usecase: + * When using a filename in a Content-Disposition header + * the value should not contain ; or " + * + * When exporting, avoiding generation of an unexpected double-extension file + * + * @param string $filename The filename + * @param boolean $replaceDots Whether to also replace dots + * + * @return string the sanitized filename + * + */ +function PMA_sanitizeFilename($filename, $replaceDots = false) +{ + $pattern = '/[^A-Za-z0-9_'; + // if we don't have to replace dots + if (! $replaceDots) { + // then add the dot to the list of legit characters + $pattern .= '.'; + } + $pattern .= '-]/'; + $filename = preg_replace($pattern, '_', $filename); + return $filename; +} + +?> |