Imported Upstream version 0.3

[roundcube.git] / program / lib / washtml.php

diff --git a/program/lib/washtml.php b/program/lib/washtml.php
index 338baeca6f76a64b7389f4ed11c8ecbf510ba1bb..01b0488fc8bde9e92bca73b1bd8b74fc8d088183 100644 (file)
--- a/program/lib/washtml.php
+++ b/program/lib/washtml.php
@@ -69,18 +69,25 @@
  * Dont be a fool:
  *  - Dont alter data on a GET: '<img src="http://yourhost/mail?action=delete&uid=3267" />'
  *  - ...
+ *
+ * Roundcube Changes:
+ * - added $block_elements
+ * - changed $ignore_elements behaviour
  */
 
 class washtml
 {
   /* Allowed HTML elements (default) */
-  static $html_elements = array('a', 'abbr', 'acronym', 'address', 'area', 'b', 'basefont', 'bdo', 'big', 'blockquote', 'br', 'caption', 'center', 'cite', 'code', 'col', 'colgroup', 'dd', 'del', 'dfn', 'dir', 'div', 'dl', 'dt', 'em', 'fieldset', 'font', 'h1', 'h2', 'h3', 'h4', 'h5', 'h6', 'hr', 'i', 'ins', 'label', 'legend', 'li', 'map', 'menu', 'nobr', 'ol', 'p', 'pre', 'q', 's', 'samp', 'small', 'span', 'strike', 'strong', 'sub', 'sup', 'table', 'tbody', 'td', 'tfoot', 'th', 'thead', 'tr', 'tt', 'u', 'ul', 'var', 'img');
+  static $html_elements = array('a', 'abbr', 'acronym', 'address', 'area', 'b', 'basefont', 'bdo', 'big', 'blockquote', 'br', 'caption', 'center', 'cite', 'code', 'col', 'colgroup', 'dd', 'del', 'dfn', 'dir', 'div', 'dl', 'dt', 'em', 'fieldset', 'font', 'h1', 'h2', 'h3', 'h4', 'h5', 'h6', 'hr', 'i', 'ins', 'label', 'legend', 'li', 'map', 'menu', 'nobr', 'ol', 'p', 'pre', 'q', 's', 'samp', 'small', 'span', 'strike', 'strong', 'sub', 'sup', 'table', 'tbody', 'td', 'tfoot', 'th', 'thead', 'tr', 'tt', 'u', 'ul', 'var', 'wbr', 'img');
   
-  /* Ignore these HTML tags but process their content */
-  static $ignore_elements = array('html', 'head', 'body');
+  /* Ignore these HTML tags and their content */
+  static $ignore_elements = array('script', 'applet', 'embed', 'object', 'style');
   
   /* Allowed HTML attributes */
   static $html_attribs = array('name', 'class', 'title', 'alt', 'width', 'height', 'align', 'nowrap', 'col', 'row', 'id', 'rowspan', 'colspan', 'cellspacing', 'cellpadding', 'valign', 'bgcolor', 'color', 'border', 'bordercolorlight', 'bordercolordark', 'face', 'marginwidth', 'marginheight', 'axis', 'border', 'abbr', 'char', 'charoff', 'clear', 'compact', 'coords', 'vspace', 'hspace', 'cellborder', 'size', 'lang', 'dir');  
+
+  /* Block elements which could be empty but cannot be returned in short form (<tag />) */
+  static $block_elements = array('div', 'p', 'pre', 'blockquote');
   
   /* State for linked objects in HTML */
   public $extlinks = false;
@@ -97,6 +104,9 @@ class washtml
   /* Ignore these HTML tags but process their content */
   private $_ignore_elements = array();
 
+  /* Block elements which could be empty but cannot be returned in short form (<tag />) */
+  private $_block_elements = array();
+
   /* Allowed HTML attributes */
   private $_html_attribs = array();
   
@@ -106,7 +116,8 @@ class washtml
     $this->_html_elements = array_flip((array)$p['html_elements']) + array_flip(self::$html_elements) ;
     $this->_html_attribs = array_flip((array)$p['html_attribs']) + array_flip(self::$html_attribs);
     $this->_ignore_elements = array_flip((array)$p['ignore_elements']) + array_flip(self::$ignore_elements);
-    unset($p['html_elements'], $p['html_attribs'], $p['ignore_elements']);
+    $this->_block_elements = array_flip((array)$p['block_elements']) + array_flip(self::$block_elements);
+    unset($p['html_elements'], $p['html_attribs'], $p['ignore_elements'], $p['block_elements']);
     $this->config = $p + array('show_washed'=>true, 'allow_remote'=>false, 'cid_map'=>array());
   }
   
@@ -160,7 +171,7 @@ class washtml
       $key = strtolower($key);
       $value = $node->getAttribute($key);
       if(isset($this->_html_attribs[$key]) ||
-         ($key == 'href' && preg_match('/^(http|https|ftp|mailto):.+/i', $value)))
+         ($key == 'href' && preg_match('/^(http:|https:|ftp:|mailto:|#).+/i', $value)))
         $t .= ' ' . $key . '="' . htmlspecialchars($value, ENT_QUOTES) . '"';
       else if($key == 'style' && ($style = $this->wash_style($value)))
         $t .= ' style="' . $style . '"';
@@ -202,12 +213,13 @@ class washtml
         } else if(isset($this->_html_elements[$tagName])) {
           $content = $this->dumpHtml($node);
           $dump .= '<' . $tagName . $this->wash_attribs($node) .
-            ($content?">$content</$tagName>":' />');
+            ($content || isset($this->_block_elements[$tagName]) ? ">$content</$tagName>" : ' />');
         } else if(isset($this->_ignore_elements[$tagName])) {
-          $dump .= '<!-- ' . htmlspecialchars($tagName, ENT_QUOTES) . ' ignored -->';
-          $dump .= $this->dumpHtml($node); //Just ignored
-        } else
           $dump .= '<!-- ' . htmlspecialchars($tagName, ENT_QUOTES) . ' not allowed -->';
+        } else {
+          $dump .= '<!-- ' . htmlspecialchars($tagName, ENT_QUOTES) . ' ignored -->';
+          $dump .= $this->dumpHtml($node); // ignore tags not its content
+       }
         break;
       case XML_CDATA_SECTION_NODE:
         $dump .= $node->nodeValue;
@@ -240,4 +252,4 @@ class washtml
 
 }
 
-?>
\ No newline at end of file
+?>