HTMLPurifier_Injector_SafeObject Class Reference
Adds important param elements to inside of object in order to make things safe. More...
Inheritance diagram for HTMLPurifier_Injector_SafeObject:
Collaboration diagram for HTMLPurifier_Injector_SafeObject:
Public Member Functions | |
| prepare ($config, $context) | |
| handleElement (&$token) | |
| handleEnd (&$token) | |
| Handler that is called when an end token is processed. More... | |
| Public Member Functions inherited from HTMLPurifier_Injector | |
| rewindOffset ($offset) | |
| Rewind to a spot to re-perform processing. More... | |
| getRewindOffset () | |
| Retrieves rewind offset, and then unsets it. More... | |
| prepare ($config, $context) | |
| Prepares the injector by giving it the config and context objects: this allows references to important variables to be made within the injector. More... | |
| checkNeeded ($config) | |
| This function checks if the HTML environment will work with the Injector: if p tags are not allowed, the Auto-Paragraphing injector should not be enabled. More... | |
| allowsElement ($name) | |
| Tests if the context node allows a certain element. More... | |
| handleText (&$token) | |
| Handler that is called when a text token is processed. More... | |
| handleElement (&$token) | |
| Handler that is called when a start or empty token is processed. More... | |
| handleEnd (&$token) | |
| Handler that is called when an end token is processed. More... | |
| notifyEnd ($token) | |
| Notifier that is called when an end token is processed. More... | |
Data Fields | |
| $name = 'SafeObject' | |
| @type string More... | |
| $needed = array('object', 'param') | |
| @type array More... | |
| Data Fields inherited from HTMLPurifier_Injector | |
| $name | |
| Advisory name of injector, this is for friendly error messages. More... | |
| $needed = array() | |
| Array of elements and attributes this injector creates and therefore need to be allowed by the definition. More... | |
Protected Attributes | |
| $objectStack = array() | |
| @type array More... | |
| $paramStack = array() | |
| @type array More... | |
| $addParam | |
| Keep this synchronized with AttrTransform/SafeParam.php. More... | |
| $allowedParam | |
| These are all lower-case keys. More... | |
| Protected Attributes inherited from HTMLPurifier_Injector | |
| $htmlDefinition | |
| @type HTMLPurifier_HTMLDefinition More... | |
| $currentNesting | |
| Reference to CurrentNesting variable in Context. More... | |
| $currentToken | |
| Reference to current token. More... | |
| $inputZipper | |
| Reference to InputZipper variable in Context. More... | |
| $rewindOffset = false | |
| Number of elements to rewind backwards (relative). More... | |
Additional Inherited Members | |
| Protected Member Functions inherited from HTMLPurifier_Injector | |
| forward (&$i, &$current) | |
| Iterator function, which starts with the next token and continues until you reach the end of the input tokens. More... | |
| forwardUntilEndToken (&$i, &$current, &$nesting) | |
| Similar to _forward, but accepts a third parameter $nesting (which should be initialized at 0) and stops when we hit the end tag for the node $this->inputIndex starts in. More... | |
| backward (&$i, &$current) | |
| Iterator function, starts with the previous token and continues until you reach the beginning of input tokens. More... | |
Detailed Description
Adds important param elements to inside of object in order to make things safe.
Definition at line 7 of file SafeObject.php.
Member Function Documentation
◆ handleElement()
| HTMLPurifier_Injector_SafeObject::handleElement | ( | & | $token | ) |
- Parameters
-
HTMLPurifier_Token $token
Reimplemented from HTMLPurifier_Injector.
Definition at line 63 of file SafeObject.php.
64 {
65 if ($token->name == 'object') {
66 $this->objectStack[] = $token;
67 $this->paramStack[] = array();
68 $new = array($token);
71 }
72 $token = $new;
73 } elseif ($token->name == 'param') {
74 $nest = count($this->currentNesting) - 1;
75 if ($nest >= 0 && $this->currentNesting[$nest]->name === 'object') {
76 $i = count($this->objectStack) - 1;
77 if (!isset($token->attr['name'])) {
78 $token = false;
79 return;
80 }
82 // We need this fix because YouTube doesn't supply a data
83 // attribute, which we need if a type is specified. This is
84 // *very* Flash specific.
85 if (!isset($this->objectStack[$i]->attr['data']) &&
86 ($token->attr['name'] == 'movie' || $token->attr['name'] == 'src')
87 ) {
88 $this->objectStack[$i]->attr['data'] = $token->attr['value'];
89 }
90 // Check if the parameter is the correct value but has not
91 // already been added
93 isset($this->addParam[$n]) &&
95 // keep token, and add to param stack
97 } elseif (isset($this->allowedParam[strtolower($n)])) {
98 // keep token, don't do anything to it
99 // (could possibly check for duplicates here)
100 // Note: In principle, parameters should be case sensitive.
101 // But it seems they are not really; so accept any case.
102 } else {
103 $token = false;
104 }
105 } else {
106 // not directly inside an object, DENY!
107 $token = false;
108 }
109 }
110 }
◆ handleEnd()
| HTMLPurifier_Injector_SafeObject::handleEnd | ( | & | $token | ) |
Handler that is called when an end token is processed.
Reimplemented from HTMLPurifier_Injector.
Definition at line 112 of file SafeObject.php.
113 {
114 // This is the WRONG way of handling the object and param stacks;
115 // we should be inserting them directly on the relevant object tokens
116 // so that the global stack handling handles it.
117 if ($token->name == 'object') {
118 array_pop($this->objectStack);
119 array_pop($this->paramStack);
120 }
121 }
◆ prepare()
| HTMLPurifier_Injector_SafeObject::prepare | ( | $config, | |
| $context | |||
| ) |
- Parameters
-
HTMLPurifier_Config $config HTMLPurifier_Context $context
- Returns
- void
Reimplemented from HTMLPurifier_Injector.
Definition at line 55 of file SafeObject.php.
References $config.
Field Documentation
◆ $addParam
|
protected |
Initial value:
= array(
'allowScriptAccess' => 'never',
'allowNetworking' => 'internal',
)
Keep this synchronized with AttrTransform/SafeParam.php.
@type array
Definition at line 33 of file SafeObject.php.
◆ $allowedParam
|
protected |
Initial value:
= array(
'wmode' => true,
'movie' => true,
'flashvars' => true,
'src' => true,
'allowfullscreen' => true,
)
These are all lower-case keys.
@type array
Definition at line 42 of file SafeObject.php.
◆ $name
| HTMLPurifier_Injector_SafeObject::$name = 'SafeObject' |
◆ $needed
| HTMLPurifier_Injector_SafeObject::$needed = array('object', 'param') |
@type array
Definition at line 17 of file SafeObject.php.
◆ $objectStack
|
protected |
@type array
Definition at line 22 of file SafeObject.php.
◆ $paramStack
|
protected |
@type array
Definition at line 27 of file SafeObject.php.
The documentation for this class was generated from the following file:
- libs/composer/vendor/ezyang/htmlpurifier/library/HTMLPurifier/Injector/SafeObject.php
