PHP Sanitizer类代码示例

 public function testSanitize()
 {
     $given = array("field1" => "<p>A <strong>string</strong> with an <script></script>escaped apostrophe: it\\'s</p>", "field2" => array("it\\'s cool", "yeah it\\'s cool"));
     $expected = array("field1" => "<p>A <strong>string</strong> with an escaped apostrophe: it's</p>", "field2" => array("it's cool", "yeah it's cool"));
     $sanitizer = new Sanitizer($given);
     $sanitizer->stripslashes()->striptags(array("<p>", "<strong>"));
     $this->assertEquals($expected, $sanitizer->data);
 }

    function __construct($job_id = false)
    {
        global $db;
        if (is_numeric($job_id)) {
            $sanitizer = new Sanitizer();
            $sql = 'SELECT a.type_id AS type_id, a.category_id AS category_id, a.title AS title, a.summary AS summary, 
			               a.description AS description, a.company AS company, a.url AS url, a.apply AS apply, 
			               DATE_FORMAT(a.created_on, "' . DATE_FORMAT . '") AS created_on, a.created_on AS mysql_date,
			               a.is_temp AS is_temp, a.is_active AS is_active, a.spotlight AS spotlight,
			               a.views_count AS views_count, a.auth AS auth, a.city_id AS city_id, a.outside_location AS outside_location,
			               a.poster_email AS poster_email, a.apply_online AS apply_online, b.name AS category_name,
			               c.var_name as type_var_name, c.name as type_name,
			               DATE_ADD(created_on, INTERVAL 30 DAY) AS closed_on, DATEDIFF(NOW(), created_on) AS days_old, cit.name AS city_name
			               FROM ' . DB_PREFIX . 'jobs a LEFT JOIN ' . DB_PREFIX . 'cities cit on a.city_id = cit.id, ' . DB_PREFIX . 'categories b, ' . DB_PREFIX . 'types c
			               WHERE a.category_id = b.id AND c.id = a.type_id AND a.id = ' . $job_id;
            $result = $db->query($sql);
            $row = $result->fetch_assoc();
            if (!empty($row)) {
                $this->mId = $job_id;
                $this->mTypeId = $row['type_id'];
                $this->mCategoryId = $row['category_id'];
                $this->mCategoryName = $row['category_name'];
                $this->mTitle = str_replace('&', '&', $row['title']);
                $this->mSummary = str_replace('&', '&', $row['summary']);
                $this->mDescription = $row['description'];
                $this->mCompany = $row['company'];
                $this->mUrl = $row['url'];
                $this->mApply = $row['apply'];
                $this->mCreatedOn = $row['created_on'];
                $this->mClosedOn = $row['closed_on'];
                $this->mIsTemp = $row['is_temp'];
                $this->mIsActive = $row['is_active'];
                $this->mViewsCount = $row['views_count'];
                $this->mAuth = $row['auth'];
                $this->mCityId = $row['city_id'];
                $this->mMySqlDate = $row['mysql_date'];
                $this->mLocation = $this->GetLocation($row);
                $this->mLocationOutsideRo = $row['outside_location'];
                $this->mPosterEmail = $row['poster_email'];
                $this->mUrlTitle = $sanitizer->sanitize_title_with_dashes($this->mTitle . ' at ' . $this->mCompany);
                $this->mApplyOnline = $row['apply_online'];
                $this->mDaysOld = $row['days_old'];
                $this->mIsSpotlight = $row['spotlight'];
                $this->mTypeName = $row['type_name'];
                $this->mTypeVarName = $row['type_var_name'];
            }
        }
    }

 public function getDiv($value)
 {
     global $wgOut, $wgPromoterAdPreview;
     if (array_key_exists('language', $this->mParams)) {
         $language = $this->mParams['language'];
     } else {
         $language = $wgOut->getContext()->getLanguage()->getCode();
     }
     $html = Xml::openElement('div', array('id' => Sanitizer::escapeId("pr-ad-list-element-{$this->mParams['ad']}"), 'class' => "pr-ad-list-element"));
     // Make the label; this consists of a text link to the ad editor, and a series of status icons
     if (array_key_exists('withlabel', $this->mParams)) {
         $adName = $this->mParams['ad'];
         $html .= Xml::openElement('div', array('class' => 'pr-ad-list-element-label'));
         $html .= Linker::link(SpecialPage::getTitleFor('PromoterAds', "edit/{$adName}"), htmlspecialchars($adName), array('class' => 'pr-ad-list-element-label-text'));
         $html .= ' (' . Linker::link(SpecialPage::getTitleFor('Randompage'), $this->msg('promoter-live-preview'), array('class' => 'pr-ad-list-element-label-text'), array('ad' => $adName, 'uselang' => $language, 'force' => '1')) . ')';
         // TODO: Output status icons
         $html .= Xml::tags('div', array('class' => 'pr-ad-list-element-label-icons'), '');
         $html .= Xml::closeElement('div');
     }
     // Add the ad preview
     if ($wgPromoterAdPreview) {
         $html .= $this->getInputHTML(null);
     }
     $html .= Xml::closeElement('div');
     return $html;
 }

 function execute()
 {
     global $wgLang, $wgRequest;
     global $wgOut, $wgExtensionsPath;
     global $wgUser, $wgCaptchaClass, $wgJsMimeType;
     $wgOut->addStyle(AssetsManager::getInstance()->getSassCommonURL('extensions/wikia/SpecialContact/SpecialContact.scss'));
     $this->mName = null;
     $this->mRealName = null;
     $this->mWhichWiki = null;
     $this->mProblem = $wgRequest->getText('wpContactSubject');
     //subject
     $this->mProblemDesc = null;
     $this->mPosted = $wgRequest->wasPosted();
     $this->mAction = $wgRequest->getVal('action');
     $this->mEmail = $wgRequest->getText('wpEmail');
     $this->mBrowser = $wgRequest->getText('wpBrowser');
     $this->mAbTestInfo = $wgRequest->getText('wpAbTesting');
     $this->mCCme = $wgRequest->getCheck('wgCC');
     if ($this->mPosted && 'submit' == $this->mAction) {
         if (!$wgUser->isLoggedIn() && class_exists($wgCaptchaClass)) {
             $captchaObj = new $wgCaptchaClass();
             $captchaObj->retrieveCaptcha();
             $info = $captchaObj->retrieveCaptcha();
         }
         #ubrfzy note: these were moved inside to (lazy) prevent some stupid bots
         $this->mName = $wgRequest->getText('wpName');
         $this->mRealName = $wgRequest->getText('wpContactRealName');
         $this->mWhichWiki = $wgRequest->getText('wpContactWikiName');
         #sibject still handled outside of post check, because of existing hardcoded prefill links
         $this->mProblemDesc = $wgRequest->getText('wpContactDesc');
         //body
         #malformed email?
         if (!Sanitizer::validateEmail($this->mEmail)) {
             $this->err[] .= wfMsg('invalidemailaddress');
             $this->errInputs['wpEmail'] = true;
         }
         #empty message text?
         if (empty($this->mProblemDesc)) {
             $this->err[] .= wfMsg('specialcontact-nomessage');
             $this->errInputs['wpContactDesc'] = true;
         }
         #captcha
         if (!$wgUser->isLoggedIn() && class_exists($wgCaptchaClass)) {
             // logged in users don't need the captcha (RT#139647)
             if (!(!empty($info) && $captchaObj->keyMatch($wgRequest->getVal('wpCaptchaWord'), $info))) {
                 $this->err[] .= wfMsg('specialcontact-captchafail');
                 $this->errInputs['wpCaptchaWord'] = true;
             }
         }
         #no errors?
         if (empty($this->err)) {
             #send email
             $this->processCreation();
             #stop here
             return;
         }
         #if there were any ->err s, they will be displayed in ContactForm
     }
     $this->mainContactForm();
 }

function efGPManagerCustomToolboxAppend(&$skin)
{
    global $wgOut, $wgUser;
    $tb = explode("\n", wfMsg('toolbox_append'));
    $new = array();
    foreach ($tb as &$nt) {
        if (strpos($nt, '*') === 0) {
            $nt = trim($nt, '*');
            $parts = explode('|', $nt);
            foreach ($parts as &$part) {
                $part = trim($part);
            }
            $href = wfMsgForContent($parts[0]);
            $text = wfMsgForContent($parts[1]);
            $perm = array_key_exists(2, $parts) ? $parts[2] : 'read';
            if (!$wgUser->isAllowed($perm)) {
                continue;
            }
            if (wfEmptyMsg($parts[0], $href)) {
                $href = $parts[0];
            }
            if (wfEmptyMsg($parts[1], $text)) {
                $text = $parts[1];
            }
            $id = Sanitizer::escapeId($parts[1], 'noninitial');
            $new[] = array($href, $text, $id);
        }
    }
    foreach ($new as $t) {
        echo '<li id="t-' . $t[2] . '"><a href="' . htmlspecialchars($t[0]) . '">' . $t[1] . '</a></li>';
    }
    return true;
}

 /**
  * Builds the HTML code for this component
  *
  * @return String the HTML code
  */
 public function getHtml()
 {
     $element = $this->getDomElement();
     if ($element === null) {
         return '';
     }
     $msgKey = $element->getAttribute('message');
     $menuFactory = new MenuFactory();
     if (empty($msgKey)) {
         $text = $element->textContent;
         $menu = $menuFactory->getMenuFromMessageText($text);
     } else {
         $menu = $menuFactory->getMenuFromMessage($msgKey);
     }
     $menu->setMenuItemFormatter(function ($href, $text, $depth, $subitems) {
         $href = \Sanitizer::cleanUrl($href);
         $text = htmlspecialchars($text);
         if ($depth === 1 && !empty($subitems)) {
             return "<li class=\"dropdown\"><a class=\"dropdown-toggle\" href=\"#\"  data-toggle=\"dropdown\">{$text}<b class=\"caret\"></b></a>{$subitems}</li>";
         } else {
             return "<li><a href=\"{$href}\">{$text}</a>{$subitems}</li>";
         }
     });
     $menu->setItemListFormatter(function ($rawItemsHtml, $depth) {
         if ($depth === 0) {
             return $rawItemsHtml;
         } elseif ($depth === 1) {
             return "<ul class=\"dropdown-menu\">{$rawItemsHtml}</ul>";
         } else {
             return "<ul>{$rawItemsHtml}</ul>";
         }
     });
     return $menu->getHtml();
 }

 /**
  * Main execution point
  *
  * @param null|string $code Confirmation code passed to the page
  * @throws PermissionsError
  * @throws ReadOnlyError
  * @throws UserNotLoggedIn
  */
 function execute($code)
 {
     // Ignore things like master queries/connections on GET requests.
     // It's very convenient to just allow formless link usage.
     $trxProfiler = Profiler::instance()->getTransactionProfiler();
     $this->setHeaders();
     $this->checkReadOnly();
     $this->checkPermissions();
     // This could also let someone check the current email address, so
     // require both permissions.
     if (!$this->getUser()->isAllowed('viewmyprivateinfo')) {
         throw new PermissionsError('viewmyprivateinfo');
     }
     if ($code === null || $code === '') {
         $this->requireLogin('confirmemail_needlogin');
         if (Sanitizer::validateEmail($this->getUser()->getEmail())) {
             $this->showRequestForm();
         } else {
             $this->getOutput()->addWikiMsg('confirmemail_noemail');
         }
     } else {
         $old = $trxProfiler->setSilenced(true);
         $this->attemptConfirm($code);
         $trxProfiler->setSilenced($old);
     }
 }

 /**
  * Strip markup to show plaintext
  * @param string $text
  * @return string
  * @access private
  */
 function _stripMarkup($text)
 {
     global $wgContLang;
     $text = substr($text, 0, 4096);
     // don't bother with long text...
     $text = str_replace("'''", "", $text);
     $text = str_replace("''", "", $text);
     $text = preg_replace('#__[a-z0-9_]+__#i', '', $text);
     // magic words
     $cleanChar = "[^|\\[\\]]";
     $subLink = "\\[\\[{$cleanChar}*(?:\\|{$cleanChar}*)*\\]\\]";
     $pipeContents = "(?:{$cleanChar}|{$subLink})*";
     $text = preg_replace_callback("#\n\t\t\t\\[\\[\n\t\t\t\t({$cleanChar}*)\n\t\t\t\t(?:\\|({$pipeContents}))?\n\t\t\t\t(?:\\|{$pipeContents})*\n\t\t\t\\]\\]\n\t\t\t#six", array($this, '_stripLink'), $text);
     $protocols = wfUrlProtocols();
     $text = preg_replace('#\\[(?:$protocols).*? (.*?)\\]#s', '$1', $text);
     // URL links
     $text = preg_replace('#</?[a-z0-9]+.*?>#s', '', $text);
     // HTML-style tags
     $text = preg_replace('#\\{\\|.*?\\|\\}#s', '', $text);
     // tables
     $text = preg_replace('#^:.*$#m', '', $text);
     // indented lines near start are usually disambigs or notices
     $text = Sanitizer::decodeCharReferences($text);
     return trim($text);
 }

 /**
  * Creates HTML for the given tags
  *
  * @param string $tags Comma-separated list of tags
  * @param string $page A label for the type of action which is being displayed,
  *   for example: 'history', 'contributions' or 'newpages'
  * @return array Array with two items: (html, classes)
  *   - html: String: HTML for displaying the tags (empty string when param $tags is empty)
  *   - classes: Array of strings: CSS classes used in the generated html, one class for each tag
  */
 public static function formatSummaryRow($tags, $page)
 {
     global $wgLang;
     if (!$tags) {
         return array('', array());
     }
     $classes = array();
     $tags = explode(',', $tags);
     $displayTags = array();
     foreach ($tags as $tag) {
         if (!$tag) {
             continue;
         }
         $description = self::tagDescription($tag);
         if ($description === false) {
             continue;
         }
         $displayTags[] = Xml::tags('span', array('class' => 'mw-tag-marker ' . Sanitizer::escapeClass("mw-tag-marker-{$tag}")), $description);
         $classes[] = Sanitizer::escapeClass("mw-tag-{$tag}");
     }
     if (!$displayTags) {
         return array('', array());
     }
     $markers = wfMessage('tag-list-wrapper')->numParams(count($displayTags))->rawParams($wgLang->commaList($displayTags))->parse();
     $markers = Xml::tags('span', array('class' => 'mw-tag-markers'), $markers);
     return array($markers, $classes);
 }

 protected function parseWikitext($title, $newRevId)
 {
     $apiParams = array('action' => 'parse', 'page' => $title->getPrefixedDBkey(), 'oldid' => $newRevId, 'prop' => 'text|revid|categorieshtml|displaytitle|modules|jsconfigvars');
     $api = new ApiMain(new DerivativeRequest($this->getRequest(), $apiParams, false), true);
     $api->execute();
     if (defined('ApiResult::META_CONTENT')) {
         $result = $api->getResult()->getResultData(null, array('BC' => array(), 'Types' => array(), 'Strip' => 'all'));
     } else {
         $result = $api->getResultData();
     }
     $content = isset($result['parse']['text']['*']) ? $result['parse']['text']['*'] : false;
     $categorieshtml = isset($result['parse']['categorieshtml']['*']) ? $result['parse']['categorieshtml']['*'] : false;
     $links = isset($result['parse']['links']) ? $result['parse']['links'] : array();
     $revision = Revision::newFromId($result['parse']['revid']);
     $timestamp = $revision ? $revision->getTimestamp() : wfTimestampNow();
     $displaytitle = isset($result['parse']['displaytitle']) ? $result['parse']['displaytitle'] : false;
     $modules = isset($result['parse']['modules']) ? $result['parse']['modules'] : array();
     $jsconfigvars = isset($result['parse']['jsconfigvars']) ? $result['parse']['jsconfigvars'] : array();
     if ($content === false || strlen($content) && $revision === null) {
         return false;
     }
     if ($displaytitle !== false) {
         // Escape entities as in OutputPage::setPageTitle()
         $displaytitle = Sanitizer::normalizeCharReferences(Sanitizer::removeHTMLtags($displaytitle));
     }
     return array('content' => $content, 'categorieshtml' => $categorieshtml, 'basetimestamp' => $timestamp, 'starttimestamp' => wfTimestampNow(), 'displayTitleHtml' => $displaytitle, 'modules' => $modules, 'jsconfigvars' => $jsconfigvars);
 }

function wfCSSRender(&$parser, $css)
{
    global $wgOut, $wgRequest;
    $parser->mOutput->mCacheTime = -1;
    $url = false;
    if (preg_match('|\\{|', $css)) {
        # Inline CSS
        $css = htmlspecialchars(trim(Sanitizer::checkCss($css)));
        $parser->mOutput->addHeadItem(<<<EOT
<style type="text/css">
/*<![CDATA[*/
{$css}
/*]]>*/
</style>
EOT
);
    } elseif ($css[0] == '/') {
        # File
        $url = $css;
    } else {
        # Article?
        $title = Title::newFromText($css);
        if (is_object($title)) {
            $url = $title->getLocalURL('action=raw&ctype=text/css');
            $url = str_replace("&", "&amp;", $url);
        }
    }
    if ($url) {
        $wgOut->addScript("<link rel=\"stylesheet\" type=\"text/css\" href=\"{$url}\" />");
    }
    return '';
}

function PoemExtension($in, $param = array(), $parser = null)
{
    /* using newlines in the text will cause the parser to add <p> tags,
     * which may not be desired in some cases
     */
    $nl = isset($param['compact']) ? '' : "\n";
    if (method_exists($parser, 'recursiveTagParse')) {
        //new methods in 1.8 allow nesting <nowiki> in <poem>.
        $tag = $parser->insertStripItem("<br />", $parser->mStripState);
        $text = preg_replace(array("/^\n/", "/\n\$/D", "/\n/", "/^( +)/me"), array("", "", "{$tag}\n", "str_replace(' ','&nbsp;','\\1')"), $in);
        $text = $parser->recursiveTagParse($text);
    } else {
        $text = preg_replace(array("/^\n/", "/\n\$/D", "/\n/", "/^( +)/me"), array("", "", "<br />\n", "str_replace(' ','&nbsp;','\\1')"), $in);
        $ret = $parser->parse($text, $parser->getTitle(), $parser->getOptions(), true, false);
        $text = $ret->getText();
    }
    global $wgVersion;
    if (version_compare($wgVersion, "1.7alpha") >= 0) {
        // Pass HTML attributes through to the output.
        $attribs = Sanitizer::validateTagAttributes($param, 'div');
    } else {
        // Can't guarantee safety on 1.6 or older.
        $attribs = array();
    }
    // Wrap output in a <div> with "poem" class.
    if (isset($attribs['class'])) {
        $attribs['class'] = 'poem ' . $attribs['class'];
    } else {
        $attribs['class'] = 'poem';
    }
    return Xml::openElement('div', $attribs) . $nl . trim($text) . "{$nl}</div>";
}

 /**
  * Creates HTML for the given tags
  *
  * @param string $tags Comma-separated list of tags
  * @param string $page A label for the type of action which is being displayed,
  *   for example: 'history', 'contributions' or 'newpages'
  * @param IContextSource|null $context
  * @note Even though it takes null as a valid argument, an IContextSource is preferred
  *       in a new code, as the null value is subject to change in the future
  * @return array Array with two items: (html, classes)
  *   - html: String: HTML for displaying the tags (empty string when param $tags is empty)
  *   - classes: Array of strings: CSS classes used in the generated html, one class for each tag
  */
 public static function formatSummaryRow($tags, $page, IContextSource $context = null)
 {
     if (!$tags) {
         return array('', array());
     }
     if (!$context) {
         $context = RequestContext::getMain();
     }
     $classes = array();
     $tags = explode(',', $tags);
     $displayTags = array();
     foreach ($tags as $tag) {
         if (!$tag) {
             continue;
         }
         $description = self::tagDescription($tag);
         if ($description === false) {
             continue;
         }
         $displayTags[] = Xml::tags('span', array('class' => 'mw-tag-marker ' . Sanitizer::escapeClass("mw-tag-marker-{$tag}")), $description);
         $classes[] = Sanitizer::escapeClass("mw-tag-{$tag}");
     }
     if (!$displayTags) {
         return array('', array());
     }
     $markers = $context->msg('tag-list-wrapper')->numParams(count($displayTags))->rawParams($context->getLanguage()->commaList($displayTags))->parse();
     $markers = Xml::tags('span', array('class' => 'mw-tag-markers'), $markers);
     return array($markers, $classes);
 }

 public static function receiverIsValid($receiver)
 {
     // Returns true if the parameter is a valid e-mail address, false if not
     $receiverIsValid = true;
     // There may be multiple e-mail addresses, divided by commas - which is valid
     // for us, but not for the validation functions we use below. So get the single
     // address into an array first, validate them one by one, and only if all are ok,
     // return true.
     $receiverArray = explode(',', str_replace(', ', ',', $receiver));
     // To make sure some joker doesn't copy in a large number of e-mail addresses
     // and spams them all, lets set a (admittedly arbitrary) limit of 10.
     if (count($receiverArray) > 10) {
         return false;
     }
     if (method_exists('Sanitizer', 'validateEmail')) {
         // User::isValidEmailAddr() has been moved to Sanitizer::validateEmail as of
         // MediaWiki version 1.18 (I think).
         foreach ($receiverArray as $singleEmailAddress) {
             if (!Sanitizer::validateEmail($singleEmailAddress)) {
                 $receiverIsValid = false;
             }
         }
     } else {
         foreach ($receiverArray as $singleEmailAddress) {
             if (!User::isValidEmailAddr($singleEmailAddress)) {
                 $receiverIsValid = false;
             }
         }
     }
     return $receiverIsValid;
 }

 /**
  * Show the special page
  * @param string|null $par
  */
 public function execute($par)
 {
     $this->setHeaders();
     $this->outputHeader();
     $out = $this->getOutput();
     $out->addModuleStyles('mediawiki.special');
     $out->addHTML(\Html::openElement('table', array('class' => 'wikitable mw-listgrouprights-table')) . '<tr>' . \Html::element('th', null, $this->msg('listgrants-grant')->text()) . \Html::element('th', null, $this->msg('listgrants-rights')->text()) . '</tr>');
     foreach ($this->getConfig()->get('GrantPermissions') as $grant => $rights) {
         $descs = array();
         $rights = array_filter($rights);
         // remove ones with 'false'
         foreach ($rights as $permission => $granted) {
             $descs[] = $this->msg('listgrouprights-right-display', \User::getRightDescription($permission), '<span class="mw-listgrants-right-name">' . $permission . '</span>')->parse();
         }
         if (!count($descs)) {
             $grantCellHtml = '';
         } else {
             sort($descs);
             $grantCellHtml = '<ul><li>' . implode("</li>\n<li>", $descs) . '</li></ul>';
         }
         $id = \Sanitizer::escapeId($grant);
         $out->addHTML(\Html::rawElement('tr', array('id' => $id), "<td>" . $this->msg("grant-{$grant}")->escaped() . "</td>" . "<td>" . $grantCellHtml . '</td>'));
     }
     $out->addHTML(\Html::closeElement('table'));
 }