PHP cleanAttributes函数代码示例

//.........这里部分代码省略.........
            // so save it through specifying a folder var
            if (!file_exists($PIVOTX['paths']['upload_base_path'] . $thumbname) || $recreate == 1) {
                $ext = strtolower(getExtension($filename));
                if ($ext == "jpeg" || $ext == "jpg" || $ext == "png") {
                    require_once $PIVOTX['paths']['pivotx_path'] . 'modules/module_imagefunctions.php';
                    $folder = $PIVOTX['paths']['upload_base_path'];
                    $dirpart = dirname($filename);
                    $basename = basename($filename);
                    $action = "Fancybox";
                    if ($dirpart != "" && $dirpart != ".") {
                        $folder = $folder . $dirpart . "/";
                    }
                    if (!auto_thumbnail($basename, $folder, $action, $maxthumb)) {
                        debug("Failed to create thumbnail for " . $filename);
                    }
                } else {
                    debug("Unable to create thumbnail for this extension " . $filename);
                }
            }
        }
    }
    if (empty($alt)) {
        $alt = $thumbname;
    }
    if (empty($title)) {
        $title = $alt;
    }
    // special string "null" to get rid of any title/alt
    if ($title == "null" || $alt == "null") {
        $title = "";
        $alt = "";
    }
    // Clean title and alternative text before using in generated html
    $title = cleanAttributes($title);
    $alt = cleanAttributes($alt);
    // If the thumbnail exists, make the HTML for it, else just use the text for a link.
    // use the current settings for uploadwidth/height because thumb can have diff.size
    if (file_exists($PIVOTX['paths']['upload_base_path'] . $thumbname)) {
        $ext = strtolower(getExtension($thumbname));
        if ($ext == "jpg" || $ext == "jpeg" || $ext == "gif" || $ext == "png") {
            // get image dimensions
            list($thumbw, $thumbh) = getimagesize($uplbasepath . $thumbname);
            if ($maxthumb > 0) {
                // specthumbmax specified: calculate the right values (useful for vertical images)
                if ($thumbw > $thumbh) {
                    $imgh = round($thumbh * ($maxthumb / $thumbw));
                    $imgw = $maxthumb;
                } else {
                    $imgw = round($thumbw * ($maxthumb / $thumbh));
                    $imgh = $maxthumb;
                }
            }
            // thumbnail behaviour 2: always use the dimensions of the found thumbnail
            if ($fbthumb == 2) {
                $imgw = $thumbw;
                $imgh = $thumbh;
                //debug("dimensions of found thumb used: " . $thumbw . "/" . $thumbh);
            }
            // if parms width or height have been specified they should be used!
            if (isset($params['width'])) {
                $imgw = $width;
            }
            if (isset($params['height'])) {
                $imgh = $height;
            }
            $thumbname = sprintf("<img src=\"%s%s\" alt=\"%s\" title=\"%s\" class=\"%s\" width=\"%s\" height=\"%s\" />", $PIVOTX['paths']['upload_base_url'], $thumbname, $alt, $title, $fbclass, $imgw, $imgh);

/**
 * Given raw text (eg typed in by a user), this function cleans it up
 * and removes any nasty tags that could mess up Moodle pages.
 *
 * NOTE: the format parameter was deprecated because we can safely clean only HTML.
 *
 * @param string $text The text to be cleaned
 * @param int $format deprecated parameter, should always contain FORMAT_HTML or FORMAT_MOODLE
 * @param array $options Array of options; currently only option supported is 'allowid' (if true,
 *   does not remove id attributes when cleaning)
 * @return string The cleaned up text
 */
function clean_text($text, $format = FORMAT_HTML, $options = array())
{
    global $ALLOWED_TAGS, $CFG;
    if (empty($text) or is_numeric($text)) {
        return (string) $text;
    }
    if ($format != FORMAT_HTML and $format != FORMAT_HTML) {
        // TODO: we need to standardise cleanup of text when loading it into editor first
        //debugging('clean_text() is designed to work only with html');
    }
    if ($format == FORMAT_PLAIN) {
        return $text;
    }
    if (!empty($CFG->enablehtmlpurifier)) {
        $text = purify_html($text, $options);
    } else {
        /// Fix non standard entity notations
        $text = fix_non_standard_entities($text);
        /// Remove tags that are not allowed
        $text = strip_tags($text, $ALLOWED_TAGS);
        /// Clean up embedded scripts and , using kses
        $text = cleanAttributes($text);
        /// Again remove tags that are not allowed
        $text = strip_tags($text, $ALLOWED_TAGS);
    }
    // Remove potential script events - some extra protection for undiscovered bugs in our code
    $text = preg_replace("~([^a-z])language([[:space:]]*)=~i", "\$1Xlanguage=", $text);
    $text = preg_replace("~([^a-z])on([a-z]+)([[:space:]]*)=~i", "\$1Xon\$2=", $text);
    return $text;
}

function clean_text($text, $format = FORMAT_MOODLE)
{
    global $ALLOWED_TAGS;
    switch ($format) {
        case FORMAT_PLAIN:
            return $text;
        default:
            /// Remove tags that are not allowed
            $text = strip_tags($text, $ALLOWED_TAGS);
            /// Add some breaks into long strings of  
            $text = preg_replace('/(( ){10}) /', '\\1 ', $text);
            /// Clean up embedded scripts and , using kses
            $text = cleanAttributes($text);
            /// Remove script events
            $text = eregi_replace("([^a-z])language([[:space:]]*)=", "\\1Xlanguage=", $text);
            $text = eregi_replace("([^a-z])on([a-z]+)([[:space:]]*)=", "\\1Xon\\2=", $text);
            return $text;
    }
}

/**
 * Given raw text (eg typed in by a user), this function cleans it up
 * and removes any nasty tags that could mess up Moodle pages.
 *
 * @uses FORMAT_MOODLE
 * @uses FORMAT_PLAIN
 * @uses ALLOWED_TAGS
 * @param string $text The text to be cleaned
 * @param int $format Identifier of the text format to be used
 *            (FORMAT_MOODLE, FORMAT_HTML, FORMAT_PLAIN, FORMAT_WIKI, FORMAT_MARKDOWN)
 * @return string The cleaned up text
 */
function clean_text($text, $format = FORMAT_MOODLE)
{
    global $ALLOWED_TAGS, $CFG;
    if (empty($text) or is_numeric($text)) {
        return (string) $text;
    }
    switch ($format) {
        case FORMAT_PLAIN:
        case FORMAT_MARKDOWN:
            return $text;
        default:
            if (!empty($CFG->enablehtmlpurifier)) {
                $text = purify_html($text);
            } else {
                /// Fix non standard entity notations
                $text = preg_replace('/(&#[0-9]+)(;?)/', "\\1;", $text);
                $text = preg_replace('/(&#x[0-9a-fA-F]+)(;?)/', "\\1;", $text);
                /// Remove tags that are not allowed
                $text = strip_tags($text, $ALLOWED_TAGS);
                /// Clean up embedded scripts and , using kses
                $text = cleanAttributes($text);
                /// Again remove tags that are not allowed
                $text = strip_tags($text, $ALLOWED_TAGS);
            }
            /// Remove potential script events - some extra protection for undiscovered bugs in our code
            $text = eregi_replace("([^a-z])language([[:space:]]*)=", "\\1Xlanguage=", $text);
            $text = eregi_replace("([^a-z])on([a-z]+)([[:space:]]*)=", "\\1Xon\\2=", $text);
            return $text;
    }
}

/**
 * Inserts a linked list to the the different weblogs.
 *
 * @param array $params
 * @param object $smarty
 * @return string
 */
function smarty_weblog_list($params, &$smarty)
{
    global $PIVOTX;
    $params = cleanParams($params);
    $aExclude = array();
    if (!empty($params['exclude'])) {
        $aExclude = explode(",", $params['exclude']);
        $aExclude = array_map("trim", $aExclude);
        $aExclude = array_map("safe_string", $aExclude);
    }
    $Current_weblog = $PIVOTX['weblogs']->getCurrent();
    $format = getDefault($params['format'], "<li %active%><a href='%link%' title='%payoff%'>%display%</a></li>");
    $active = getDefault($params['current'], "class='activepage'");
    $output = array();
    $weblogs = $PIVOTX['weblogs']->getWeblogs();
    //echo "<pre>\n"; print_r($weblogs); echo "</pre>";
    foreach ($weblogs as $key => $weblog) {
        if (in_array(safeString($weblog['name']), $aExclude)) {
            continue;
        }
        $this_output = $format;
        $this_output = str_replace("%link%", $weblog['link'], $this_output);
        $this_output = str_replace("%name%", $weblog['name'], $this_output);
        $this_output = str_replace("%display%", $weblog['name'], $this_output);
        $this_output = str_replace("%payoff%", cleanAttributes($weblog['payoff']), $this_output);
        $this_output = str_replace("%internal%", $key, $this_output);
        if ($Current_weblog == $key) {
            $this_output = str_replace("%active%", $active, $this_output);
        } else {
            $this_output = str_replace("%active%", "", $this_output);
        }
        $output[$weblog['name']] .= $this_output;
    }
    if ($params['sort'] == "title") {
        ksort($output);
    }
    return stripslashes(implode("\n", $output));
}

//.........这里部分代码省略.........
                if (strpos($entry, ".thumb.") > 0) {
                    continue;
                }
                $entry = $folder . $entry;
                if ($orderby == 'date_asc' || $orderby == 'date_desc') {
                    $key = filemtime($entry) . rand(10000, 99999);
                    $images[$key] = $entry;
                } else {
                    $images[] = $entry;
                }
            }
        }
        $dir->close();
    }
    if ($orderby == 'date_asc') {
        ksort($images);
    } else {
        if ($orderby == 'date_desc') {
            ksort($images);
            $images = array_reverse($images);
        } else {
            if ($orderby == 'alphabet') {
                natcasesort($images);
            } else {
                shuffle($images);
            }
        }
    }
    // Cut it to the desired length..
    $images = array_slice($images, 0, $limit);
    // Built the parms
    $tooltip = getDefault($PIVOTX['config']->get('slideshow_tooltip'), $slideshow_config['slideshow_tooltip']);
    $ttopacity = getDefault($PIVOTX['config']->get('slideshow_ttopacity'), $slideshow_config['slideshow_ttopacity']);
    $uibefore = getDefault($PIVOTX['config']->get('slideshow_uibefore'), $slideshow_config['slideshow_uibefore']);
    $zc = getDefault($PIVOTX['config']->get('slideshow_zc'), $slideshow_config['slideshow_zc']);
    $zcimg = '';
    if (isset($zc)) {
        $zcimg = '&zc=' . $zc;
    }
    if ($tooltip == 1) {
        $parms = "{toolTip: true";
    } else {
        $parms = "{toolTip: false";
    }
    $parms .= ", ttOpacity: " . $ttopacity;
    if ($uibefore == 1) {
        $parms .= ", uiBefore: true}";
    } else {
        $parms .= ", uiBefore: false}";
    }
    $js_insert = str_replace('%timeout%', $timeout, $js_insert);
    $js_insert = str_replace('%count%', $slideshowcount, $js_insert);
    $js_insert = str_replace('%amount%', count($images), $js_insert);
    $js_insert = str_replace('%parms%', $parms, $js_insert);
    $PIVOTX['extensions']->addHook('after_parse', 'insert_before_close_head', $js_insert);
    // If a specific popup type is selected execute the callback.
    if ($popup != 'no') {
        $callback = $popup . "IncludeCallback";
        if (function_exists($callback)) {
            $PIVOTX['extensions']->addHook('after_parse', 'callback', $callback);
        } else {
            debug("There is no function '{$callback}' - the popups won't work.");
        }
    }
    $output = "\n<div id=\"pivotx-slideshow-{$slideshowcount}\" class=\"svw\">\n<ul>\n";
    foreach ($images as $image) {
        $file = $image;
        $image = str_replace($PIVOTX['paths']['upload_base_path'], '', $image);
        $image = str_replace(DIRECTORY_SEPARATOR, '/', $image);
        $nicefilename = formatFilename($image, $nicenamewithdirs);
        $title = false;
        if ($iptcindex) {
            getimagesize($file, $iptc);
            if (is_array($iptc) && $iptc['APP13']) {
                $iptc = iptcparse($iptc['APP13']);
                $title = $iptc[$iptcindex][0];
                if ($iptcencoding) {
                    $title = iconv($iptcencoding, 'UTF-8', $title);
                }
                $title = cleanAttributes($title);
            }
        }
        if (!$title) {
            $title = $nicefilename;
        }
        $line = "<li>\n";
        if ($popup != 'no') {
            $line .= sprintf("<a href=\"%s%s\" class=\"{$popup}\" rel=\"slideshow\" title=\"%s\">\n", $PIVOTX['paths']['upload_base_url'], $image, $title);
        }
        $line .= sprintf("<img src=\"%sincludes/timthumb.php?src=%s&amp;w=%s&amp;h=%s%s\" " . "alt=\"%s\" width=\"%s\" height=\"%s\" />\n", $PIVOTX['paths']['pivotx_url'], rawurlencode($image), $width, $height, $zcimg, $title, $width, $height);
        if ($popup != 'no') {
            $line .= "</a>";
        }
        $line .= "</li>\n";
        $output .= $line;
    }
    $output .= "</ul>\n</div>\n";
    $slideshowcount++;
    return $output;
}

/**
 * Given raw text (eg typed in by a user), this function cleans it up
 * and removes any nasty tags that could mess up Moodle pages.
 *
 * @uses FORMAT_MOODLE
 * @uses FORMAT_PLAIN
 * @uses ALLOWED_TAGS
 * @param string $text The text to be cleaned
 * @param int $format Identifier of the text format to be used
 *            (FORMAT_MOODLE, FORMAT_HTML, FORMAT_PLAIN, FORMAT_WIKI, FORMAT_MARKDOWN)
 * @return string The cleaned up text
 */
function clean_text($text, $format = FORMAT_MOODLE)
{
    global $ALLOWED_TAGS;
    switch ($format) {
        case FORMAT_PLAIN:
        case FORMAT_MARKDOWN:
            return $text;
        default:
            /// Fix non standard entity notations
            $text = preg_replace('/(&#[0-9]+)(;?)/', "\\1;", $text);
            $text = preg_replace('/(&#x[0-9a-fA-F]+)(;?)/', "\\1;", $text);
            /// Remove tags that are not allowed
            $text = strip_tags($text, $ALLOWED_TAGS);
            /// Clean up embedded scripts and , using kses
            $text = cleanAttributes($text);
            /// Again remove tags that are not allowed
            $text = strip_tags($text, $ALLOWED_TAGS);
            /// Remove script events
            $text = eregi_replace("([^a-z])language([[:space:]]*)=", "\\1Xlanguage=", $text);
            $text = eregi_replace("([^a-z])on([a-z]+)([[:space:]]*)=", "\\1Xon\\2=", $text);
            return $text;
    }
}

/**
 * Make a link to an entry's body (if there is a body). If $params['html'] is
 * set to true, the HTML code for the link will be returned.
 *
 * @param array $data
 * @param string $weblog
 * @param array $params
 * @return string
 */
function makeMoreLink($data = "", $weblog = "", $params = array())
{
    global $PIVOTX;
    if ($weblog == "") {
        $weblog = $PIVOTX['weblogs']->getCurrent();
    }
    $weblogdata = $PIVOTX['weblogs']->getWeblog();
    $title = cleanAttributes($params['title']);
    if ('' != $title) {
        $title = 'title="' . $title . '" ';
        $title = str_replace("%title%", $data['title'], $title);
    }
    $anchorname = getDefault($params['anchorname'], 'body-anchor', true);
    $text = getDefault($params['text'], getDefault($weblogdata['read_more'], __('(more)')));
    if (strlen($data['body']) > 5) {
        $morelink = makeFilelink($data['code'], '', $anchorname);
        if ($params['html']) {
            $output = '<a class="pivotx-more-link" href="' . $morelink . "\" {$title}>{$text}</a>";
            $output = str_replace("%title%", $data['title'], $output);
            // Perhaps add the pre- and postfix to the output..
            if (!empty($params['prefix'])) {
                $output = $params['prefix'] . $output;
            }
            if (!empty($params['postfix'])) {
                $output .= $params['postfix'];
            }
        } else {
            $output = $morelink;
        }
    } else {
        $output = '';
    }
    return $output;
}

/**
 * Given raw text (eg typed in by a user), this function cleans it up
 * and removes any nasty tags that could mess up Moodle pages.
 *
 * @uses FORMAT_MOODLE
 * @uses FORMAT_PLAIN
 * @uses ALLOWED_TAGS
 * @param string $text The text to be cleaned
 * @param int $format Identifier of the text format to be used
 *            (FORMAT_MOODLE, FORMAT_HTML, FORMAT_PLAIN, FORMAT_WIKI, FORMAT_MARKDOWN)
 * @return string The cleaned up text
 */
function clean_text($text, $format = FORMAT_MOODLE)
{
    global $ALLOWED_TAGS, $CFG;
    if (empty($text) or is_numeric($text)) {
        return (string) $text;
    }
    switch ($format) {
        case FORMAT_PLAIN:
            return $text;
        default:
            if (!empty($CFG->enablehtmlpurifier)) {
                //this is PHP5 only, the lib/setup.php contains a disabler for PHP4
                $text = purify_html($text);
            } else {
                /// Fix non standard entity notations
                $text = preg_replace('/&#0*([0-9]+);?/', "&#\\1;", $text);
                $text = preg_replace('/&#x0*([0-9a-fA-F]+);?/', "&#x\\1;", $text);
                $text = preg_replace('[\\x00-\\x08\\x0b-\\x0c\\x0e-\\x1f]', '', $text);
                /// Remove tags that are not allowed
                $text = strip_tags($text, $ALLOWED_TAGS);
                /// Clean up embedded scripts and , using kses
                $text = cleanAttributes($text);
                /// Again remove tags that are not allowed
                $text = strip_tags($text, $ALLOWED_TAGS);
            }
            /// Remove potential script events - some extra protection for undiscovered bugs in our code
            $text = eregi_replace("([^a-z])language([[:space:]]*)=", "\\1Xlanguage=", $text);
            $text = eregi_replace("([^a-z])on([a-z]+)([[:space:]]*)=", "\\1Xon\\2=", $text);
            return $text;
    }
}