sydney/IPB
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Version 5.0.0 beta 1

Browse Source
This commit is contained in:
Neo committed 2025-12-19 16:27:35 -08:00
1 parent 25ddeb65d6
commit 15c7beabc5
6736 files changed
+627902 -497943
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

system/Text/HtmlPurifierInternalLinkDef.php
+36 -32
View File
@@ -11,29 +11,40 @@
namespace IPS\Text;
/* To prevent PHP errors (extending class does not exist) revealing path */
if ( !\defined( '\IPS\SUITE_UNIQUE_KEY' ) )
use HTMLPurifier_AttrDef_URI;
use HTMLPurifier_Config;
use HTMLPurifier_Context;
use IPS\File;
use IPS\Http\Url;
use IPS\Http\Url\Friendly;
use IPS\Http\Url\Internal;
use IPS\Settings;
use function defined;
if ( !defined( '\IPS\SUITE_UNIQUE_KEY' ) )
{
header( ( isset( $_SERVER['SERVER_PROTOCOL'] ) ? $_SERVER['SERVER_PROTOCOL'] : 'HTTP/1.0' ) . ' 403 Forbidden' );
header( ( $_SERVER['SERVER_PROTOCOL'] ?? 'HTTP/1.0' ) . ' 403 Forbidden' );
exit;
}
/**
* A HTMLPurifier Attribute Definition used for attributes which must be internal URLs
*/
class _HtmlPurifierInternalLinkDef extends \HTMLPurifier_AttrDef_URI
class HtmlPurifierInternalLinkDef extends HTMLPurifier_AttrDef_URI
{
/**
* @brief Allowed bases
*/
protected $allowedBases = NULL;
protected ?array $allowedBases = NULL;
/**
* Constructor
*
* @param bool $embeds_resource Does the URI here result in an extra HTTP request?
* @param array|null $allowedBases If an array is provided, only URLs with the query strings set allowed - for example array( array( 'app' => 'core', 'module' => 'members', 'controller' => 'profile' ) ) will only allow URLs to profiles. If NULL, any internal URL beside the open proxy and attachment downloads is allowed
* @param array|null $allowedBases If an array is provided, only URLs with the query strings set allowed - for example array( array( 'app' => 'core', 'module' => 'members', 'controller' => 'profile' ) ) will only allow URLs to profiles. If NULL, any internal URL beside the open proxy and attachment downloads is allowed
*/
public function __construct( $embeds_resource = false, $allowedBases = NULL )
public function __construct( bool $embeds_resource=FALSE, array $allowedBases = NULL )
{
$this->allowedBases = $allowedBases;
return parent::__construct( $embeds_resource );
@@ -43,24 +54,17 @@ class _HtmlPurifierInternalLinkDef extends \HTMLPurifier_AttrDef_URI
* Validate
*
* @param string $uri
* @param \HTMLPurifier_Config $config
* @param \HTMLPurifier_Context $context
* @param HTMLPurifier_Config $config
* @param HTMLPurifier_Context $context
* @return bool|string
*/
public function validate($uri, $config, $context)
{
public function validate($uri, $config, $context): bool|string
{
/* Create the URL */
try
{
$url = \IPS\Http\Url::createFromString( str_replace( array( '%7B___base_url___%7D/', '{___base_url___}/' ), \IPS\Settings::i()->base_url, $uri ) );
}
catch( \IPS\Http\Url\Exception $e )
{
return FALSE;
}
$url = Url::createFromString( str_replace( array( '%7B___base_url___%7D/', '{___base_url___}/' ), Settings::i()->base_url, $uri ) );
/* If it's not internal, we can stop now */
if ( !( $url instanceof \IPS\Http\Url\Internal ) )
if ( !( $url instanceof Internal ) )
{
return FALSE;
}
@@ -69,7 +73,7 @@ class _HtmlPurifierInternalLinkDef extends \HTMLPurifier_AttrDef_URI
if ( $this->allowedBases )
{
$isOkay = FALSE;
$queryString = ( $url instanceof \IPS\Http\Url\Friendly ) ? ( $url->hiddenQueryString + $url->queryString ) : $url->queryString;
$queryString = ( $url instanceof Friendly ) ? ( $url->hiddenQueryString + $url->queryString ) : $url->queryString;
foreach ( $this->allowedBases as $requiredQueryString )
{
@@ -117,15 +121,15 @@ class _HtmlPurifierInternalLinkDef extends \HTMLPurifier_AttrDef_URI
/**
* @brief Uploaded file base URLs (i.e. URL to uploads directory)
*/
protected static $uploadUrls = NULL;
protected static ?array $uploadUrls = NULL;
/**
* Fetch and cache upload URLs
*
* @return array
*/
protected static function getUploadUrls()
{
/**
* Fetch and cache upload URLs
*
* @return array|null
*/
protected static function getUploadUrls(): ?array
{
if( static::$uploadUrls !== NULL )
{
return static::$uploadUrls;
@@ -133,15 +137,15 @@ class _HtmlPurifierInternalLinkDef extends \HTMLPurifier_AttrDef_URI
static::$uploadUrls = array();
foreach( \IPS\File::getStore() as $configuration )
foreach( File::getStore() as $configuration )
{
$class = \IPS\File::getClass( $configuration['id'] );
$class = File::getClass( $configuration['id'] );
if( $class->baseUrl() !== NULL )
{
$url = new \IPS\Http\Url( $class->baseUrl() );
$url = new Url( $class->baseUrl() );
if( $url instanceof \IPS\Http\Url\Internal )
if( $url instanceof Internal )
{
static::$uploadUrls[ $class->baseUrl() ] = $class->baseUrl();
}