PHP OC_Util::sanitizeHTML方法代码示例

 /**
  * @param array $data
  * @return string
  */
 function getContentHtml($data = array())
 {
     $this->maxStringLen = $data['maxStringLen'];
     $this->startStringLen = $data['startStringLen'];
     // if problem exists
     if (isset($data['msg'])) {
         return '<div class="msg">' . $this->p($data['msg']) . '</div>';
     }
     $html = '';
     $html .= '<table>';
     foreach ($data['activities'] as $activity) {
         $prioritystyle = 'class="activity-section group"';
         if (isset($activity['priority'])) {
             $prioritystyle = 'class="activity-section group priority-' . $this->p($activity['priority']);
         }
         $priority = $this->p($activity['priority']);
         $link = $this->p($activity['link']);
         $subject = $this->p($activity['subject']);
         $sSub = $this->getNiceSmallText($this->p($activity['subject']));
         $smallSubject = \OC_Util::sanitizeHTML($sSub);
         $time = $this->getRelativeTime($this->p($activity['date']));
         $html .= '<tr><td><div ' . $prioritystyle . ' subject"><a class="preview preview-dir-icon" href="' . $link . '" title="' . $subject . '">' . $smallSubject . '</a><br /><span class="hoverInfo" data-opacitynormal="0.5">' . $time . '</span></div></td></tr>';
     }
     $html .= '</table>';
     return $html;
 }

 function testSanitizeHTML()
 {
     $badString = "<script>alert('Hacked!');</script>";
     $result = OC_Util::sanitizeHTML($badString);
     $this->assertEquals("&lt;script&gt;alert(&#039;Hacked!&#039;);&lt;/script&gt;", $result);
     $goodString = "This is an harmless string.";
     $result = OC_Util::sanitizeHTML($goodString);
     $this->assertEquals("This is an harmless string.", $result);
 }

 function testSanitizeHTML()
 {
     $badArray = array('While it is unusual to pass an array', 'this function actually <blink>supports</blink> it.', 'And therefore there needs to be a <script>alert("Unit"+\'test\')</script> for it!');
     $goodArray = array('While it is unusual to pass an array', 'this function actually &lt;blink&gt;supports&lt;/blink&gt; it.', 'And therefore there needs to be a &lt;script&gt;alert(&quot;Unit&quot;+&#039;test&#039;)&lt;/script&gt; for it!');
     $result = OC_Util::sanitizeHTML($badArray);
     $this->assertEquals($goodArray, $result);
     $badString = '<img onload="alert(1)" />';
     $result = OC_Util::sanitizeHTML($badString);
     $this->assertEquals('&lt;img onload=&quot;alert(1)&quot; /&gt;', $result);
     $badString = "<script>alert('Hacked!');</script>";
     $result = OC_Util::sanitizeHTML($badString);
     $this->assertEquals('&lt;script&gt;alert(&#039;Hacked!&#039;);&lt;/script&gt;', $result);
     $goodString = 'This is a good string without HTML.';
     $result = OC_Util::sanitizeHTML($goodString);
     $this->assertEquals('This is a good string without HTML.', $result);
 }

 /**
  * reads input data from get/post and converts the date to a special data-type
  *
  * @param string $method HTTP method to read the key from
  * @param string $key Parameter to read
  * @param string $type Variable type to format data
  * @param string $default Default value to return if the key is not found
  * @return string Data or if the key is not found and no default is set it will exit with a 400 Bad request
  */
 public static function readData($method, $key, $type = 'raw', $default = null)
 {
     $data = false;
     if ($method == 'get') {
         if (isset($_GET[$key])) {
             $data = $_GET[$key];
         } else {
             if (isset($default)) {
                 return $default;
             } else {
                 $data = false;
             }
         }
     } else {
         if ($method == 'post') {
             if (isset($_POST[$key])) {
                 $data = $_POST[$key];
             } else {
                 if (isset($default)) {
                     return $default;
                 } else {
                     $data = false;
                 }
             }
         }
     }
     if ($data === false) {
         echo self::generateXml('', 'fail', 400, 'Bad request. Please provide a valid ' . $key);
         exit;
     } else {
         // NOTE: Is the raw type necessary? It might be a little risky without sanitization
         if ($type == 'raw') {
             return $data;
         } elseif ($type == 'text') {
             return OC_Util::sanitizeHTML($data);
         } elseif ($type == 'int') {
             return (int) $data;
         } elseif ($type == 'float') {
             return (double) $data;
         } elseif ($type == 'array') {
             return OC_Util::sanitizeHTML($data);
         } else {
             return OC_Util::sanitizeHTML($data);
         }
     }
 }

 /**
  * send a message to the client
  * @param string $type
  * @param mixed $data
  *
  * if only one parameter is given, a typeless message will be send with that parameter as data
  */
 public function send($type, $data = null)
 {
     if (is_null($data)) {
         $data = $type;
         $type = null;
     }
     if ($this->fallback) {
         $fallBackId = OC_Util::sanitizeHTML($this->fallBackId);
         $response = '<script type="text/javascript">window.parent.OC.EventSource.fallBackCallBack(' . $fallBackId . ',"' . $type . '",' . json_encode($data) . ')</script>' . PHP_EOL;
         echo $response;
     } else {
         if ($type) {
             echo 'event: ' . $type . PHP_EOL;
         }
         echo 'data: ' . json_encode($data) . PHP_EOL;
     }
     echo PHP_EOL;
     flush();
 }

<?php

/** @var $l OC_L10N */
?>

<!--[if IE 8]><style>input[type="checkbox"]{padding:0;}</style><![endif]-->
<form method="post" name="login">
	<fieldset>
	<?php 
if (!empty($_['redirect_url'])) {
    print_unescaped('<input type="hidden" name="redirect_url" value="' . OC_Util::sanitizeHTML($_['redirect_url']) . '" />');
}
?>
		<?php 
if (isset($_['apacheauthfailed']) && $_['apacheauthfailed']) {
    ?>
			<div class="warning">
				<?php 
    p($l->t('Server side authentication failed!'));
    ?>
<br>
				<small><?php 
    p($l->t('Please contact your administrator.'));
    ?>
</small>
			</div>
		<?php 
}
?>
		<?php 
if (isset($_['internalexception']) && $_['internalexception']) {

 /**
  * Used to sanitize HTML
  *
  * This function is used to sanitize HTML and should be applied on any
  * string or array of strings before displaying it on a web page.
  *
  * @param string|array $value
  * @return string|array an array of sanitized strings or a single sinitized string, depends on the input parameter.
  * @since 4.5.0
  */
 public static function sanitizeHTML($value)
 {
     return \OC_Util::sanitizeHTML($value);
 }

    ?>
" class="svg action delete"
				title="<?php 
    p($l->t('Unshare'));
    ?>
">
		</span>
	</li>
<?php 
}
?>
</ul>
<?php 
if (!$eventsharees) {
    $nobody = $l->t('Nobody');
    print_unescaped('<div id="sharedWithNobody">' . OC_Util::sanitizeHTML($nobody) . '</div>');
}
?>
<br />
<strong><?php 
p($l->t('Shared via calendar'));
?>
</strong>
<ul class="sharedby calendarlist">
<?php 
foreach ($calsharees as $sharee) {
    ?>
	<li data-share-with="<?php 
    p($sharee['share_with']);
    ?>
"

 /**
  * Process the template
  * @return boolean|string
  *
  * This function process the template. If $this->renderAs is set, it
  * will produce a full page.
  */
 public function fetchPage()
 {
     $data = parent::fetchPage();
     if ($this->renderAs) {
         $page = new OC_TemplateLayout($this->renderAs, $this->app);
         // Add custom headers
         $headers = '';
         foreach (OC_Util::$headers as $header) {
             $headers .= '<' . OC_Util::sanitizeHTML($header['tag']);
             foreach ($header['attributes'] as $name => $value) {
                 $headers .= ' ' . OC_Util::sanitizeHTML($name) . '="' . OC_Util::sanitizeHTML($value) . '"';
             }
             if ($header['text'] !== null) {
                 $headers .= '>' . OC_Util::sanitizeHTML($header['text']) . '</' . OC_Util::sanitizeHTML($header['tag']) . '>';
             } else {
                 $headers .= '/>';
             }
         }
         $page->assign('headers', $headers);
         $page->assign('content', $data);
         return $page->fetchPage();
     }
     return $data;
 }

 /**
  * print error page using Exception details
  * @param Exception $exception
  */
 public static function printExceptionErrorPage(Exception $exception)
 {
     $error_msg = $exception->getMessage();
     if ($exception->getCode()) {
         $error_msg = '[' . $exception->getCode() . '] ' . $error_msg;
     }
     if (defined('DEBUG') and DEBUG) {
         $hint = $exception->getTraceAsString();
         if (!empty($hint)) {
             $hint = '<pre>' . OC_Util::sanitizeHTML($hint) . '</pre>';
         }
         while (method_exists($exception, 'previous') && ($exception = $exception->previous())) {
             $error_msg .= '<br/>Caused by:' . ' ';
             if ($exception->getCode()) {
                 $code = $exception->getCode();
                 $error_msg .= '[' . OC_Util::sanitizeHTML($code) . '] ';
             }
             $message = $exception->getMessage();
             $error_msg .= OC_Util::sanitizeHTML($message);
         }
     } else {
         $hint = '';
         if ($exception instanceof \OC\HintException) {
             $hint = $exception->getHint();
             $hint = OC_Util::sanitizeHTML($hint);
         }
     }
     self::printErrorPage($error_msg, $hint);
 }

/**
 * Copyright (c) 2011, Robin Appelman <icewind1991@gmail.com>
 * This file is licensed under the Affero General Public License version 3 or later.
 * See the COPYING-README file.
 */
require_once '../lib/base.php';
OC_Util::checkAdminUser();
OC_Util::addStyle("settings", "settings");
OC_Util::addScript("settings", "admin");
OC_Util::addScript("settings", "log");
OC_App::setActiveNavigationEntry("admin");
$tmpl = new OC_Template('settings', 'admin', 'user');
$forms = OC_App::getForms('admin');
$htaccessworking = OC_Util::ishtaccessworking();
$entries = OC_Log_Owncloud::getEntries(3);
$entriesremain = count(OC_Log_Owncloud::getEntries(4)) > 3 ? true : false;
function compareEntries($a, $b)
{
    return $b->time - $a->time;
}
usort($entries, 'compareEntries');
$tmpl->assign('loglevel', OC_Config::getValue("loglevel", 2));
$tmpl->assign('entries', OC_Util::sanitizeHTML($entries));
$tmpl->assign('entriesremain', $entriesremain);
$tmpl->assign('htaccessworking', $htaccessworking);
$tmpl->assign('forms', array());
foreach ($forms as $form) {
    $tmpl->append('forms', $form);
}
$tmpl->printPage();

 public static function displayLoginPage($errors = array())
 {
     $parameters = array();
     foreach ($errors as $key => $value) {
         $parameters[$value] = true;
     }
     if (!empty($_POST['user'])) {
         $parameters["username"] = OC_Util::sanitizeHTML($_POST['user']) . '"';
         $parameters['user_autofocus'] = false;
     } else {
         $parameters["username"] = '';
         $parameters['user_autofocus'] = true;
     }
     if (isset($_REQUEST['redirect_url'])) {
         $redirect_url = OC_Util::sanitizeHTML($_REQUEST['redirect_url']);
     } else {
         $redirect_url = $_SERVER['REQUEST_URI'];
     }
     $parameters['redirect_url'] = $redirect_url;
     OC_Template::printGuestPage("", "login", $parameters);
 }

		<div id="calendar_import_newcalform">
			<input id="calendar_import_newcalendar_color" class="color-picker" type="hidden" value="<?php 
p(substr($calendarcolor, 1));
?>
">
			<input id="calendar_import_newcalendar"  class="" type="text" placeholder="<?php 
p($l->t('Name of new calendar'));
?>
" value="<?php 
p($guessedcalendarname);
?>
"><br>
			<div id="calendar_import_defaultcolors">
				<?php 
foreach ($defaultcolors as $color) {
    print_unescaped('<span class="calendar-colorpicker-color" rel="' . OC_Util::sanitizeHTML($color) . '" style="background-color: ' . OC_Util::sanitizeHTML($color) . ';"></span>');
}
?>
			</div>
			<!--<input id="calendar_import_generatename" type="button" class="button" value="<?php 
p($l->t('Take an available name!'));
?>
"><br>-->
			<div  id="calendar_import_mergewarning" class="hint"><?php 
p($l->t('A Calendar with this name already exists. If you continue anyhow, these calendars will be merged.'));
?>
</div>
		</div>
		<input type="checkbox" id="calendar_import_overwrite" value="1">
		<label for="calendar_import_overwrite"><?php 
p($l->t('Remove all events from the selected calendar'));

<?php

/**
 * Copyright (c) 2012, Robin Appelman <icewind1991@gmail.com>
 * This file is licensed under the Affero General Public License version 3 or later.
 * See the COPYING-README file.
 */
OC_JSON::checkAdminUser();
$count = isset($_GET['count']) ? $_GET['count'] : 50;
$offset = isset($_GET['offset']) ? $_GET['offset'] : 0;
$entries = OC_Log_Owncloud::getEntries($count, $offset);
OC_JSON::success(array("data" => OC_Util::sanitizeHTML($entries), "remain" => count(OC_Log_Owncloud::getEntries(1, $offset + $offset)) != 0 ? true : false));

    /**
     @NoAdminRequired
    * 
    * @return \OCP\AppFramework\Http\JSONResponse
    */
    public function exportBookmark()
    {
        $file = <<<EOT
<!DOCTYPE NETSCAPE-Bookmark-file-1>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=UTF-8">
<!-- This is an automatically generated file.
It will be read and overwritten.
Do Not Edit! -->
<TITLE>Bookmarks</TITLE>
<H1>Bookmarks</H1>
<DL><p>
EOT;
        $bookmarks = Bookmarks::findBookmarks($this->userId, $this->db, 0, 'id', array(), true, -1);
        foreach ($bookmarks as $bm) {
            $title = $bm['title'];
            if (trim($title) === '') {
                $url_parts = parse_url($bm['url']);
                $title = isset($url_parts['host']) ? OCA\Bookmarks\Controller\Lib\Helper::getDomainWithoutExt($url_parts['host']) : $bm['url'];
            }
            $file .= '<DT><A HREF="' . \OC_Util::sanitizeHTML($bm['url']) . '" TAGS="' . implode(',', \OC_Util::sanitizeHTML($bm['tags'])) . '">';
            $file .= htmlspecialchars($title, ENT_QUOTES, 'UTF-8') . '</A>';
            if ($bm['description']) {
                $file .= '<DD>' . htmlspecialchars($bm['description'], ENT_QUOTES, 'UTF-8');
            }
            $file .= "\n";
        }
        return new ExportResponse($file);
    }