PHP Jaws_XSS类代码示例

 /**
  * Look for a term and prints it
  *
  * @access  public
  * @return  string  XHTML template content
  */
 function ViewTerm()
 {
     $term = jaws()->request->fetch('term', 'get');
     $term = Jaws_XSS::defilter($term);
     $model = $this->gadget->model->load('Term');
     $term = $model->GetTerm($term);
     if (!Jaws_Error::IsError($term) && isset($term['term'])) {
         $this->SetTitle($term['term']);
         $tpl = $this->gadget->template->load('ViewTerm.html');
         $tpl->SetBlock('definition');
         $tpl->SetVariable('title', $this->gadget->title);
         $date = Jaws_Date::getInstance();
         $tpl->SetBlock('definition/term');
         $tpl->SetVariable('term', $term['term']);
         $tid = empty($term['fast_url']) ? $term['id'] : $term['fast_url'];
         $tpl->SetVariable('url', $this->gadget->urlMap('ViewTerm', array('term' => $tid)));
         $tpl->SetVariable('description', $this->gadget->ParseText($term['description']));
         $tpl->SetVariable('created_in', _t('GLOBAL_CREATETIME'));
         $tpl->SetVariable('updated_in', _t('GLOBAL_UPDATETIME'));
         $tpl->SetVariable('createtime', $date->Format($term['createtime']));
         $tpl->SetVariable('updatetime', $date->Format($term['updatetime']));
         $tpl->ParseBlock('definition/term');
         $tpl->ParseBlock('definition');
     } else {
         return Jaws_HTTPError::Get(404);
     }
     return $tpl->Get();
 }

 /**
  * Builds the NoPermission UI
  *
  * @access  public
  * @param   string  $user    Username
  * @param   string  $gadget  The Gadget user is requesting
  * @param   string  $action  The 'denied' action
  * @return  string  XHTML content
  */
 function ShowNoPermission($user, $gadget, $action)
 {
     // Load the template
     $tpl = $this->gadget->template->load('NoPermission.html');
     $tpl->SetBlock('NoPermission');
     $tpl->SetVariable('nopermission', _t('USERS_NO_PERMISSION_TITLE'));
     $tpl->SetVariable('description', _t('USERS_NO_PERMISSION_DESC', $gadget, $action));
     $tpl->SetVariable('admin_script', BASE_SCRIPT);
     $tpl->SetVariable('site-name', $this->gadget->registry->fetch('site_name', 'Settings'));
     $tpl->SetVariable('site-slogan', $this->gadget->registry->fetch('site_slogan', 'Settings'));
     $tpl->SetVariable('BASE_URL', $GLOBALS['app']->GetSiteURL('/'));
     $tpl->SetVariable('.dir', _t('GLOBAL_LANG_DIRECTION') == 'rtl' ? '.rtl' : '');
     if ($GLOBALS['app']->Session->Logged()) {
         $tpl->SetBlock('NoPermission/known');
         $logoutLink = $this->gadget->urlMap('Logout');
         $referLink = empty($_SERVER['HTTP_REFERER']) ? $GLOBALS['app']->getSiteURL('/') : Jaws_XSS::filter($_SERVER['HTTP_REFERER']);
         $tpl->SetVariable('known_description', _t('USERS_NO_PERMISSION_KNOWN_DESC', $logoutLink, $referLink));
         $tpl->ParseBlock('NoPermission/known');
     } else {
         $tpl->SetBlock('NoPermission/anon');
         $loginLink = $this->gadget->urlMap('LoginBox', array('referrer' => bin2hex(Jaws_Utils::getRequestURL(false))));
         $referLink = empty($_SERVER['HTTP_REFERER']) ? $GLOBALS['app']->getSiteURL('/') : Jaws_XSS::filter($_SERVER['HTTP_REFERER']);
         $tpl->SetVariable('anon_description', _t('USERS_NO_PERMISSION_ANON_DESC', $loginLink, $referLink));
         $tpl->ParseBlock('NoPermission/anon');
     }
     $tpl->ParseBlock('NoPermission');
     return $tpl->Get();
 }

 /**
  * Creates and returns some data
  *
  * @access  public
  * @param   string  $dir
  * @param   int     $offset
  * @param   int     $order
  * @return  array   directory tree array
  */
 function GetDirectory($dir, $offset, $order)
 {
     $model = $this->gadget->model->load('Directory');
     $files = $model->ReadDir($dir, 15, $offset, $order);
     if (Jaws_Error::IsError($files)) {
         return array();
         //Jaws_Error::Fatal($files->getMessage(), __FILE__, __LINE__);
     }
     $tree = array();
     foreach ($files as $file) {
         $item = array();
         //Icon
         $link =& Piwi::CreateWidget('Image', $file['mini_icon']);
         $item['image'] = $link->Get();
         //Title
         $item['title'] = $file['title'];
         $actions = '';
         if ($file['is_dir']) {
             $link =& Piwi::CreateWidget('Link', $file['filename'], "javascript: cwd('{$file['relative']}');");
             $link->setStyle('float: left;');
             $item['name'] = $link->Get();
             if ($this->gadget->GetPermission('ManageDirectories')) {
                 //edit directory properties
                 $link =& Piwi::CreateWidget('Link', _t('GLOBAL_EDIT'), "javascript: editDir(this, '{$file['filename']}');", STOCK_EDIT);
                 $actions .= $link->Get() . ' ';
                 //delete directory
                 $link =& Piwi::CreateWidget('Link', _t('GLOBAL_DELETE'), "javascript: delDir(this, '{$file['filename']}');", STOCK_DELETE);
                 $actions .= $link->Get() . ' ';
             }
         } else {
             if (empty($file['id'])) {
                 $furl = Jaws_XSS::filter($file['url']);
             } else {
                 $fid = empty($file['fast_url']) ? $file['id'] : Jaws_XSS::filter($file['fast_url']);
                 $furl = $this->gadget->urlMap('Download', array('id' => $fid));
             }
             $link =& Piwi::CreateWidget('Link', $file['filename'], $furl);
             $link->setStyle('float: left;');
             $item['name'] = $link->Get();
             if ($this->gadget->GetPermission('ManageFiles')) {
                 //edit file properties
                 $link =& Piwi::CreateWidget('Link', _t('GLOBAL_EDIT'), "javascript: editFile(this, '{$file['filename']}');", STOCK_EDIT);
                 $actions .= $link->Get() . ' ';
                 //delete file
                 $link =& Piwi::CreateWidget('Link', _t('GLOBAL_DELETE'), "javascript: delFile(this, '{$file['filename']}');", STOCK_DELETE);
                 $actions .= $link->Get() . ' ';
             }
         }
         $item['size'] = $file['size'];
         $item['hits'] = $file['hits'];
         $item['actions'] = $actions;
         $tree[] = $item;
     }
     return $tree;
 }

 /**
  * Checks the Agent is blocked or not
  *
  * @access  public
  * @param   string  $agent  Agent
  * @return  bool    True if the Agent is blocked
  */
 function IsAgentBlocked($agent)
 {
     $table = Jaws_ORM::getInstance()->table('policy_agentblock');
     $table->select('blocked:boolean');
     $table->where('agent', Jaws_XSS::filter($agent));
     $blocked = $table->fetchOne();
     if (!Jaws_Error::IsError($blocked) && !is_null($blocked)) {
         return $blocked;
     }
     return $this->gadget->registry->fetch('block_undefined_agent') == 'true';
 }

 /**
  * Displays an Atom feed for a given blog category
  *
  * @access  public
  * @return  string  xml with Atom feed
  */
 function ShowAtomCategory()
 {
     header('Content-type: application/atom+xml; charset=utf-8');
     $id = jaws()->request->fetch('id', 'get');
     $id = Jaws_XSS::defilter($id);
     $model = $this->gadget->model->load('Feeds');
     $xml = $model->MakeCategoryAtom($id);
     if (Jaws_Error::IsError($xml)) {
         return '';
     }
     return $xml;
 }

 /**
  * Displays a block of pages belongs to the specified group
  *
  * @access  public
  * @param   mixed   $gid    ID or fast_url of the group (int/string)
  * @param   int     $orderBy
  * @param   int     $limit    limit show pages
  * @return  string  XHTML content
  */
 function GroupPages($gid = 0, $orderBy = 1, $limit = 0)
 {
     if (empty($gid)) {
         $get = $this->gadget->request->fetch(array('gid', 'order'), 'get');
         $gid = Jaws_XSS::defilter($get['gid']);
         $orderBy = $get['order'];
     }
     $pModel = $this->gadget->model->load('Page');
     $gModel = $this->gadget->model->load('Group');
     $group = $gModel->GetGroup($gid);
     if (Jaws_Error::IsError($group) || $group == null) {
         return false;
     }
     if (!$this->gadget->GetPermission('AccessGroup', $group['id'])) {
         return Jaws_HTTPError::Get(403);
     }
     $GLOBALS['app']->Layout->SetTitle($group['title']);
     $GLOBALS['app']->Layout->AddToMetaKeywords($group['meta_keywords']);
     $GLOBALS['app']->Layout->SetDescription($group['meta_description']);
     if (!is_numeric($gid)) {
         $gid = $group['id'];
     }
     $pages = $pModel->GetPages($gid, $limit, $orderBy, null, true);
     if (Jaws_Error::IsError($pages)) {
         return false;
     }
     $tpl = $this->gadget->template->load('StaticPage.html');
     $tpl->SetBlock('group_pages');
     $tpl->SetVariable('title', $group['title']);
     foreach ($pages as $page) {
         $param = array('gid' => empty($group['fast_url']) ? $group['id'] : $group['fast_url'], 'pid' => empty($page['fast_url']) ? $page['base_id'] : $page['fast_url']);
         $link = $this->gadget->urlMap('Pages', $param);
         $tpl->SetBlock('group_pages/item');
         $tpl->SetVariable('page', $page['title']);
         $tpl->SetVariable('link', $link);
         $tpl->ParseBlock('group_pages/item');
     }
     // parsing read-more block if required
     if (!empty($limit) && count($pages) >= $limit && $GLOBALS['app']->requestedActionMode == ACTION_MODE_LAYOUT) {
         $urlParam = array('gid' => empty($group['fast_url']) ? $group['id'] : $group['fast_url'], 'order' => $orderBy);
         // prevent duplicate content via two different url
         if ($orderBy == 1) {
             unset($urlParam['order']);
         }
         $tpl->SetBlock('group_pages/read-more');
         $tpl->SetVariable('url', $this->gadget->urlMap('GroupPages', $urlParam));
         $tpl->SetVariable('read_more', _t('STATICPAGE_GROUP_PAGES_LIST', $group['title']));
         $tpl->ParseBlock('group_pages/read-more');
     }
     $tpl->ParseBlock('group_pages');
     return $tpl->Get();
 }

 /**
  * Updates the emblem
  *
  * @access  public
  * @return  array   Response array (notice or error)
  */
 function UpdateEmblem()
 {
     @(list($id, $data) = jaws()->request->fetch(array('0', '1:array'), 'post'));
     $data['url'] = Jaws_XSS::defilter($data['url']);
     $model = $this->gadget->model->loadAdmin('Emblems');
     $res = $model->UpdateEmblem($id, $data);
     if (Jaws_Error::IsError($res)) {
         $GLOBALS['app']->Session->PushLastResponse(_t('GLOBAL_ERROR_QUERY_FAILED'), RESPONSE_ERROR);
         return new Jaws_Error($res->getMessage());
     }
     $GLOBALS['app']->Session->PushLastResponse(_t('EMBLEMS_UPDATED'), RESPONSE_NOTICE);
     return $GLOBALS['app']->Session->PopLastResponse();
 }

 /**
  * Fetch WWW-Authentication data
  *
  * @access  public
  * @return  void
  */
 function AssignData()
 {
     if (!empty($_SERVER['PHP_AUTH_USER'])) {
         $this->username = Jaws_XSS::filter($_SERVER['PHP_AUTH_USER']);
     }
     if (!empty($_SERVER['PHP_AUTH_PW'])) {
         $this->password = Jaws_XSS::filter($_SERVER['PHP_AUTH_PW']);
     }
     //Try to get authentication information from IIS
     if (empty($this->username) && empty($this->password) && !empty($_SERVER['HTTP_AUTHORIZATION'])) {
         list($this->username, $this->password) = explode(':', base64_decode(substr($this->server['HTTP_AUTHORIZATION'], 6)));
     }
 }

 /**
  * Create a new Friend
  *
  * @access  public
  * @param   string  $friend Friend name
  * @param   string  $url    Friend's url
  * @return  mixed   True if query is successful, if not, returns Jaws_Error on any error
  */
 function NewFriend($friend, $url)
 {
     $params['friend'] = Jaws_XSS::filter($friend);
     $params['url'] = Jaws_XSS::filter($url);
     $friendTable = Jaws_ORM::getInstance()->table('friend');
     $result = $friendTable->insert($params)->exec();
     if (Jaws_Error::IsError($result)) {
         $GLOBALS['app']->Session->PushLastResponse(_t('FRIENDS_ERROR_NOT_ADDED'), RESPONSE_ERROR);
         return new Jaws_Error(_t('FRIENDS_ERROR_NOT_ADDED'));
     }
     $GLOBALS['app']->Session->PushLastResponse(_t('FRIENDS_ADDED'), RESPONSE_NOTICE);
     return true;
 }

 /**
  * Show links of the category
  *
  * @access  public
  * @return  mixed  XHTML template content or false on error
  */
 function Category($gid = 0)
 {
     if (empty($gid)) {
         $gid = $this->gadget->request->fetch('id', 'get');
         $gid = Jaws_XSS::defilter($gid);
         $limit_count = null;
         $tplFile = 'Category.html';
     } else {
         $limit_count = 10;
         $tplFile = 'LinkDump.html';
     }
     $model = $this->gadget->model->load('Groups');
     $group = $model->GetGroup($gid);
     if (Jaws_Error::IsError($group) || empty($group)) {
         return false;
     }
     $tpl = $this->gadget->template->load($tplFile);
     $tpl->SetBlock('category');
     $tpl->SetVariable('gid', $group['id']);
     $tpl->SetVariable('title', $this->gadget->title);
     $tpl->SetVariable('name', $group['title']);
     $tpl->SetVariable('feed', _t('LINKDUMP_LINKS_FEED'));
     $gid = empty($group['fast_url']) ? $group['id'] : $group['fast_url'];
     $tpl->SetVariable('url_category', $this->gadget->urlMap('Category', array('id' => $gid)));
     $group_id = empty($group['fast_url']) ? $group['id'] : $group['fast_url'];
     $tpl->SetVariable('linkdump_rss', $this->gadget->urlMap('RSS', array('id' => $group_id)));
     $target = $this->gadget->registry->fetch('links_target');
     $target = $target == 'blank' ? '_blank' : '_self';
     $block = $group['link_type'] == 0 ? 'list' : 'link';
     $links = $model->GetGroupLinks($group['id'], empty($limit_count) ? null : $group['limit_count'], $group['order_type']);
     if (!Jaws_Error::IsError($links)) {
         foreach ($links as $link) {
             $tpl->SetBlock("category/{$block}");
             $tpl->SetVariable('target', $target);
             $tpl->SetVariable('title', $link['title']);
             $tpl->SetVariable('description', $link['description']);
             $tpl->SetVariable('url', $link['url']);
             $tpl->SetVariable('clicks', $link['clicks']);
             $tpl->SetVariable('lbl_clicks', _t('LINKDUMP_LINKS_CLICKS'));
             if ($group['link_type'] == 2) {
                 $lid = empty($link['fast_url']) ? $link['id'] : $link['fast_url'];
                 $tpl->SetVariable('visit_url', $this->gadget->urlMap('Link', array('id' => $lid)));
             } else {
                 $tpl->SetVariable('visit_url', $link['url']);
             }
             $tpl->ParseBlock("category/{$block}");
         }
     }
     $tpl->ParseBlock('category');
     return $tpl->Get();
 }

 /**
  * Inserts a Log
  *
  * @access  public
  * @param   string  $gadget     Gadget name
  * @param   string  $action     Action name
  * @param   int     $priority   Priority of log
  * @param   array   $params     Action parameters
  * @param   int     $status     Status code
  * @return  mixed   Log identity or Jaws_Error on failure
  */
 function InsertLog($user, $gadget, $action, $priority = 0, $params = null, $status = 200)
 {
     // ip address
     $ip = 0;
     if (preg_match('/\\b(?:\\d{1,3}\\.){3}\\d{1,3}\\b/', $_SERVER['REMOTE_ADDR'])) {
         $ip = ip2long($_SERVER['REMOTE_ADDR']);
         $ip = $ip < 0 ? $ip + 0xffffffff + 1 : $ip;
     }
     // agent
     $agent = substr(Jaws_XSS::filter($_SERVER['HTTP_USER_AGENT']), 0, 252);
     $logsTable = Jaws_ORM::getInstance()->table('logs');
     $logsTable->insert(array('user' => (int) $user, 'gadget' => $gadget, 'action' => $action, 'priority' => $priority, 'params' => $params, 'apptype' => JAWS_APPTYPE, 'backend' => JAWS_SCRIPT == 'admin', 'ip' => $ip, 'agent' => $agent, 'status' => (int) $status, 'insert_time' => time()));
     return $logsTable->exec();
 }

 /**
  * Displays a concrete category
  *
  * @access  public
  * @return  string  XHTML template content
  */
 function ViewCategory()
 {
     $model = $this->gadget->model->load('Question');
     $cat_id = jaws()->request->fetch('id', 'get');
     $cat_id = Jaws_XSS::defilter($cat_id);
     $this->SetTitle($this->gadget->title . ' - ' . _t('FAQ_CATEGORIES'));
     $questions = $model->GetQuestions($cat_id, true);
     if (is_array($questions) && count($questions) > 0) {
         $tpl = $this->gadget->template->load('Category.html');
         foreach ($questions as $cat) {
             $tpl->SetBlock('faq_category');
             $tpl->SetVariable('title', _t('FAQ_TITLE'));
             $tpl->SetVariable('category', $cat['category']);
             $tpl->SetVariable('description', $this->gadget->ParseText($cat['description']));
             if (isset($cat['questions']) && is_array($cat['questions'])) {
                 $qPos = 0;
             }
             foreach ($cat['questions'] as $q) {
                 $qPos++;
                 $tpl->SetBlock('faq_category/question');
                 $tpl->SetVariable('id', $q['id']);
                 $tpl->SetVariable('pos', $qPos);
                 $tpl->SetVariable('question', $q['question'], 'Faq', false);
                 $tpl->SetVariable('url', $this->gadget->urlMap('ViewCategory', array('id' => $cat_id)));
                 $tpl->ParseBlock('faq_category/question');
             }
             if (isset($cat['questions']) && is_array($cat['questions'])) {
                 $qPos = 0;
             }
             foreach ($cat['questions'] as $q) {
                 $qPos++;
                 $tpl->SetBlock('faq_category/item');
                 $tpl->SetVariable('top_label', _t('FAQ_GO_TO_TOP'));
                 $tpl->SetVariable('top_link', $this->gadget->urlMap('ViewCategory', array('id' => $cat_id)) . '#topfaq');
                 $tpl->SetVariable('id', $q['id']);
                 $tpl->SetVariable('pos', $qPos);
                 $qid = empty($q['fast_url']) ? $q['id'] : $q['fast_url'];
                 $tpl->SetVariable('url', $this->gadget->urlMap('ViewQuestion', array('id' => $qid)));
                 $tpl->SetVariable('question', $q['question']);
                 $tpl->SetVariable('answer', $this->gadget->ParseText($q['answer']));
                 $tpl->ParseBlock('faq_category/item');
             }
             $tpl->ParseBlock('faq_category');
         }
         return $tpl->Get();
     }
     // FIXME: We should return something like "No questions found"
     return '';
 }

 /**
  * Builds the advanced search box
  *
  * @access  public
  * @return  string  XHTML search box
  */
 function AdvancedBox()
 {
     $post = jaws()->request->fetch(array('all', 'exact', 'least', 'exclude', 'gadgets', 'date'), 'get');
     $post['all'] = Jaws_XSS::defilter($post['all']);
     $tpl = $this->gadget->template->load('Search.html');
     $tpl->SetBlock('AdvancedBox');
     $tpl->SetVariable('base_script', BASE_SCRIPT);
     $tpl->SetVariable('title', $this->gadget->title);
     $tpl->SetVariable('lbl_word_filter', _t('SEARCH_WORD_FILTER'));
     $tpl->SetVariable('lbl_all', _t('SEARCH_WORD_FILTER_ALL'));
     $tpl->SetVariable('lbl_exact', _t('SEARCH_WORD_FILTER_EXACT'));
     $tpl->SetVariable('lbl_least', _t('SEARCH_WORD_FILTER_LEAST'));
     $tpl->SetVariable('lbl_exclude', _t('SEARCH_WORD_FILTER_EXCLUDE'));
     $tpl->SetVariable('lbl_data_filter', _t('SEARCH_DATA_FILTER'));
     $tpl->SetVariable('lbl_search_in', _t('SEARCH_SEARCH_IN'));
     $model = $this->gadget->model->load('Search');
     $options = $model->parseSearch($post, $searchable);
     $wordAll =& Piwi::CreateWidget('Entry', 'all', implode(' ', $options['all']));
     $wordExact =& Piwi::CreateWidget('Entry', 'exact', implode(' ', $options['exact']));
     $wordLeast =& Piwi::CreateWidget('Entry', 'least', implode(' ', $options['least']));
     $wordExclude =& Piwi::CreateWidget('Entry', 'exclude', implode(' ', $options['exclude']));
     $tpl->SetVariable('all', $wordAll->Get());
     $tpl->SetVariable('exclude', $wordExclude->Get());
     $tpl->SetVariable('least', $wordLeast->Get());
     $tpl->SetVariable('exact', $wordExact->Get());
     //Gadgets filter combo
     $gadgetList = $model->GetSearchableGadgets();
     $gSearchable = $this->gadget->registry->fetch('searchable_gadgets');
     $searchableGadgets = $gSearchable == '*' ? array_keys($gadgetList) : explode(', ', $gSearchable);
     $gchk =& Piwi::CreateWidget('Combo', 'gadgets');
     $gchk->addOption(_t('GLOBAL_ALL'), '');
     foreach ($searchableGadgets as $gadget) {
         $info = Jaws_Gadget::getInstance($gadget);
         if (Jaws_Error::IsError($info)) {
             continue;
         }
         $gchk->AddOption($info->title, $gadget);
     }
     $default = !is_null($post['gadgets']) ? $post['gadgets'] : '';
     $gchk->SetDefault($default);
     $tpl->SetVariable('gadgets_combo', $gchk->Get());
     //Search button
     $btnSearch =& Piwi::CreateWidget('Button', '', _t('SEARCH_BUTTON'));
     $btnSearch->SetID('btn_search');
     $btnSearch->SetSubmit(true);
     $tpl->SetVariable('btn_search', $btnSearch->Get());
     $tpl->ParseBlock('AdvancedBox');
     return $tpl->Get();
 }

 /**
  * Redirect to the URL and increase the clicks by one
  * 
  * @access  public
  */
 function Link()
 {
     $lid = jaws()->request->fetch('id', 'get');
     $lid = Jaws_XSS::defilter($lid);
     $model = $this->gadget->model->load('Links');
     $link = $model->GetLink($lid);
     if (!Jaws_Error::IsError($link) && !empty($link)) {
         $click = $model->Click($link['id']);
         if (!Jaws_Error::IsError($click)) {
             Jaws_Header::Location($link['url'], null, 301);
         }
     }
     // By default, on the errors stay in the main page
     Jaws_Header::Referrer();
 }

 /**
  * Displays a concrete question & answer
  *
  * @access  public
  * @return  string  XHTML template content
  */
 function ViewQuestion()
 {
     $qid = jaws()->request->fetch('id', 'get');
     $qid = Jaws_XSS::defilter($qid);
     $tpl = $this->gadget->template->load('Question.html');
     $tpl->SetBlock('faq_question');
     $model = $this->gadget->model->load('Question');
     $q = $model->GetQuestion($qid);
     if (!Jaws_Error::IsError($q) && !empty($q)) {
         $this->SetTitle($q['question']);
         $tpl->SetVariable('title', $q['question']);
         $tpl->SetVariable('answer', $this->gadget->ParseText($q['answer']));
     }
     $tpl->ParseBlock('faq_question');
     return $tpl->Get();
 }