Version 3.4.6

upload/admin/sources/classes/editor/composite.php

@@ -3,18 +3,18 @@
 /**
  * <pre>
  * Invision Power Services
- * IP.Board v3.4.5
+ * IP.Board v3.4.6
  * Editor Library: RTE (WYSIWYG) Class
- * Last Updated: $Date: 2013-05-21 20:51:17 -0400 (Tue, 21 May 2013) $
+ * Last Updated: $Date: 2013-10-15 10:08:51 -0400 (Tue, 15 Oct 2013) $
  * </pre>
  *
- * @author 		$Author: bfarber $
+ * @author 		$Author: AndyMillne $
  * @copyright	(c) 2001 - 2009 Invision Power Services, Inc.
  * @license		http://www.invisionpower.com/company/standards.php#license
  * @package		IP.Board
  * @link		http://www.invisionpower.com
  * @since		9th March 2005 11:03
- * @version		$Revision: 12263 $
+ * @version		$Revision: 12378 $
  */
 
 if ( ! defined( 'IN_IPB' ) )
@@ -25,30 +25,30 @@ if ( ! defined( 'IN_IPB' ) )
 
 /**
  * In an effort to simplify all the bbcode routines:
- * 
+ *
  * This class will take CKEditor HTML, clean it up and pass it on.
  * This means [b] will be converted to <strong>, URLs auto-linked and so on.
  * App specific BBCode ([entry] [topic]) and complex BBCode (CODE, QUOTE, MEDIA) are not parsed.
- * 
+ *
  * Likewise, when showing the editor, you should supply it with data in the same format: that is, parsed HTML
  * with complex app specific BBCode unparsed. A good example of this would be:
  * <strong>I am strong!</strong><br />[quote]I am a quote![/quote]
- * 
+ *
  *  -- Legacy Issues --
  * If the setContent method detects legacy markup (that is, unparsed basic BBCode such as [b]) then it
  * will first convert it to the standard that it expects for input (HTML parsed, complex or app specific bbcode not parsed)
- * 
+ *
  * If setLegacyMode is true, this class will return BBCode mark-up as expected of 3.3.x and older.
  * This is recommended for code in transition as it's largely buggy and rather annoying.
- * 
- * 
- * 
- * 
+ *
+ *
+ *
+ *
  * Test input: < > ' " & ¦ $ \ ! &amp; &#39; &quot; &lt; &gt; &para;
  * Should be processed as: &lt; &gt; &#39; &quot; &amp; ¦ $ &#92; ! &amp;amp; &amp;#39; &amp;quot; &amp;lt; &amp;gt; &amp;para;
  */
 /**
- * 
+ *
  * IP.Board PHP work to display an editor
  * @author Matt
  *
@@ -134,7 +134,7 @@ class classes_editor_composite
 	* Registry objects
 	*
 	* @var		object
-	*/	
+	*/
 	protected $registry;
 	protected $DB;
 	protected $settings;
@@ -468,9 +468,9 @@ class classes_editor_composite
 
 		if ( isset( $options['recover'] ) )
 		{
-			$content = $_POST['Post'];
+			$content = IPSText::xssMakeJavascriptSafe( $_POST['Post'] );
 		}
-		
+			
 		/* Try and sniff out entered HTML */
 		if ( IN_ACP AND empty( $options['isHtml'] ) )
 		{
@@ -613,7 +613,7 @@ class classes_editor_composite
 								{
 									$moredetails = "<a href='{$this->registry->getClass('output')->buildUrl( "app=members&amp;module=profile&amp;section=warnings" )}'>{$this->lang->words['warnings_moreinfo']}</a>";
 								}
-								else 
+								else
 								{
 									$moredetails = "<a href='javascript:void(0);' onclick='warningPopup( this, {$warn['wl_id']} )'>{$this->lang->words['warnings_moreinfo']}</a>";
 								}
@@ -687,8 +687,11 @@ class classes_editor_composite
 				$content = $parser->htmlToEditor( $content );
 			}
 			
-			$bbcodeVersion = '';
+			/* Make sure the textarea isn't terminated early */
+			$content = str_ireplace( '</textarea>', '&#60;/textarea>', $content );
 			
+			$bbcodeVersion = '';
+		
 			if ( $content )
 			{
 				$bbcodeVersion = $this->toPlainTextArea( $parser->postEditor( $content ) );
@@ -748,7 +751,7 @@ class classes_editor_composite
 	{
 		$parser = new class_text_parser_legacy();
 		$this->passSettings( $parser );
-
+		
 		$content = $parser->postEditor( $content );
 		
 		// @link http://community.invisionpower.com/resources/bugs.html/_/ip-board/encoded-text-is-replaced-when-quoting-on-mobile-devices-r40540
@@ -781,7 +784,7 @@ class classes_editor_composite
 		{
 			/* Some areas of IPB add quotes as HTML so turn it into BBCode so fromPlainTextArea can convert it back instead of htmlizing the < > chars */
 			if ( stristr( $content, '<blockquote' ) )
-			{ 
+			{
 				$content = $this->toPlainTextArea( $content );
 			}
 			
@@ -836,10 +839,14 @@ class classes_editor_composite
 		$cleanContent = $this->protectMedia( $cleanContent );
 		
 		/* Like nice neat code? Look away now */
-		if ( $this->getIsHtml() AND IN_ACP )
+		if ( $this->getIsHtml() AND IN_ACP AND str_replace( '<!-- isHtml:1 -->', '', $cleanContent ) !== '' )
 		{
 			$cleanContent = '<!-- isHtml:1 -->' . $cleanContent;
 		}
+		else
+		{
+			$cleanContent = str_replace( '<!-- isHtml:1 -->', '', $cleanContent );
+		}
 		
 		/* Reset */
 		$this->setIsHtml( false );
@@ -965,7 +972,7 @@ class classes_editor_composite
 	
 	/**
 	 * Remove auto saved content
-	 * @param array $where options member_id = x , app = x, time = x 
+	 * @param array $where options member_id = x , app = x, time = x
 	 */
 	public function removeAutoSavedContent( $where=array() )
 	{
@@ -1068,9 +1075,7 @@ class classes_editor_composite
 	 */
 	protected function protectMedia( $content )
 	{
-		$content	= preg_replace( '#<a\s+?([^>]*?)href=["\']([^"\']+?)?["\']([^>]*?)?>(.+?)</a>#is', "<a data-ipb='nomediaparse' $1href='$2'$3>$4</a>" , $content );
-
-		//print htmlspecialchars($content);exit;
+		$content = preg_replace( '#<a\s+?([^>|data-ipb=\'nomediaparse\']*?)href=["\']([^"\']+?)?["\']([^>]*?)?>(.+?)</a>#is', "<a data-ipb='nomediaparse' $1href='$2'$3>$4</a>" , $content );
 
 		return $content;
 	}
@@ -1612,7 +1617,7 @@ class classes_editor_composite
 			  . 'b,strong,i,em,u,strike,del,sup,sub,'
 			    /* LISTS */
 			  . 'ol[type|start|class],ul[type|class],li,'
-			  	/* IMG, A */	
+			  	/* IMG, A */
 			  . 'img[src|width|height|title],a[href|target|title|class|rel]';
 		
 		if ( count( $disabledTags ) )
@@ -1715,7 +1720,7 @@ class classes_editor_composite
 	 * @return object
 	 */
 	private function _newParserObject()
-	{	
+	{
 		/* Load parser */
 		$classToLoad = IPSLib::loadLibrary( IPS_ROOT_PATH . 'sources/classes/text/parser.php', 'classes_text_parser' );
 		$parser = new $classToLoad();
@@ -1861,7 +1866,7 @@ class classes_editor_composite
 				if ( stristr( $content, '<' . $tag ) || stristr( $content, '&lt;' . $tag ) )
 				{
 					return true;
-				} 
+				}
 			}
 		}