PHP sensitiveIO::sanitizeHTMLString方法代码示例

 /**
  * Recursive method to add all selected values into a multidimentionnal array representing a formular source
  * 
  * @param multidimentionnal array &$definition : the XML definition to treat (by reference)
  * @param array $fields : all form fields to get default values
  * @param array $fieldsError : all form fields malformed or required
  * @param (inplicit) the current global $_POST values
  * @access private
  * @return void
  */
 protected function _fillSelectedFormValues(&$definition, $fields, $fieldsError)
 {
     global $mod_cms_forms, $cms_user;
     if (is_array($definition) && is_array($definition[0])) {
         //loop on subtags
         foreach (array_keys($definition) as $key) {
             $fieldValue = null;
             if (isset($definition[$key]['attributes']['name'])) {
                 if (in_array($definition[$key]['attributes']['id'], $fieldsError)) {
                     //set class cms_field_error to field
                     $definition[$key]['attributes']['class'] = 'cms_field_error';
                 }
                 if (isset($_POST[$definition[$key]['attributes']['name']])) {
                     //set value from POST
                     $fieldValue = $_POST[$definition[$key]['attributes']['name']];
                 } else {
                     //set value from default field value
                     foreach ($fields as $field) {
                         if ($field->getAttribute('name') == $definition[$key]['attributes']['name'] && $field->getAttribute('value')) {
                             //set current page ID as a parameter
                             $parameters['pageID'] = sensitiveIO::isPositiveInteger($mod_cms_forms['pageID']) ? $mod_cms_forms['pageID'] : 1;
                             //evaluate default value if needed
                             $fieldValue = eval(sensitiveIO::sanitizeExecCommand('return "' . CMS_polymod_definition_parsing::preReplaceVars($field->getAttribute('value')) . '";'));
                         }
                     }
                 }
             }
             if (isset($definition[$key]['nodename']) && $definition[$key]['nodename'] == 'input' && $definition[$key]['attributes']['type'] == 'file') {
                 unset($definition[$key]['attributes']['value']);
             }
             if (isset($fieldValue)) {
                 switch ($definition[$key]['nodename']) {
                     case 'select':
                         foreach (array_keys($definition[$key]['childrens']) as $optionKey) {
                             if (isset($definition[$key]['childrens'][$optionKey]['attributes']['value']) && $definition[$key]['childrens'][$optionKey]['attributes']['value'] == $fieldValue) {
                                 $definition[$key]['childrens'][$optionKey]['attributes']['selected'] = 'selected';
                             }
                         }
                         break;
                     case 'textarea':
                         $definition[$key]['childrens']['0']['textnode'] = sensitiveIO::sanitizeHTMLString($fieldValue);
                         break;
                     case 'input':
                         if ($definition[$key]['attributes']['type'] == 'text' || $definition[$key]['attributes']['type'] == 'hidden') {
                             $definition[$key]['attributes']['value'] = sensitiveIO::sanitizeHTMLString($fieldValue);
                         } elseif ($definition[$key]['attributes']['type'] == 'checkbox') {
                             $definition[$key]['attributes']['checked'] = 'checked';
                         }
                         break;
                 }
             }
             if (isset($definition[$key]['childrens'])) {
                 $this->_fillSelectedFormValues($definition[$key]['childrens'], $fields, $fieldsError);
             }
         }
     } else {
         $this->raiseError("Malformed definition to compute : " . print_r($definition, true));
         return false;
     }
 }

$blockParamsDefinition = $cms_block->getBlockParametersRequirement($data["value"], $cms_page, true);
//instanciate row
$row = new CMS_row($rowId);
$winLabel = sensitiveIO::sanitizeJSString($cms_language->getMessage(MESSAGE_PAGE_TITLE, array($row->getLabel(), $cms_module->getLabel($cms_language)), MOD_POLYMOD_CODENAME));
$items = array();
$rowParams = array();
if (isset($blockParamsDefinition['var'])) {
    $blockVarContent = array();
    foreach ($blockParamsDefinition['var'] as $varId => $variables) {
        foreach ($variables as $varName => $varAttributes) {
            // indicate that a row param is found
            $rowParams[] = $varName;
            // check mandatory attribute
            $mandatory = $varAttributes['mandatory'] == "true" ? '<span class="atm-red">*</span> ' : '';
            // handle description
            $description = isset($varAttributes['description']) ? '<span class="atm-help" ext:qtip="' . sensitiveIO::sanitizeHTMLString(strip_tags($varAttributes['description'])) . '">' . sensitiveIO::sanitizeHTMLString(strip_tags($varAttributes['label'])) . '</span>' : $varAttributes['label'];
            // create label
            $label = $mandatory . $description;
            // retrieve the stored value or the default one, if any
            if (isset($data["value"]['var'][$varId][$varName])) {
                $value = $data["value"]['var'][$varId][$varName];
            } elseif (isset($varAttributes['default'])) {
                $value = $varAttributes['default'];
            } else {
                $value = null;
            }
            //  TODOGF : clean HTML strings for label and descriptions
            if (isset($varAttributes['possibleValues'])) {
                $possibleValues = explode('|', $varAttributes['possibleValues']);
                $extValues = array();
                foreach ($possibleValues as $anOption) {

 /**
  * Get soap values
  *
  * @return string $xml XML definition
  * @access public
  */
 function getSoapValues($fieldID, $language)
 {
     $xml = '<field id="' . $fieldID . '" label="' . sensitiveIO::sanitizeHTMLString($this->getFieldLabel($language)) . '" required="' . $this->_field->getValue('required') . '">' . "\n";
     foreach ($this->_subfields as $subFieldID => $subFieldDefinition) {
         if (is_object($this->_subfieldValues[$subFieldID])) {
             $xml .= '<subfield id="' . $subFieldID . '" name="' . $subFieldDefinition['internalName'] . '" type="' . $subFieldDefinition['type'] . '" required="' . $subFieldDefinition['required'] . '">' . "\n";
             switch ($subFieldDefinition['type']) {
                 case 'integer':
                 case 'date':
                     $xml .= $this->_subfieldValues[$subFieldID]->getValue();
                     break;
                 case 'text':
                 case 'string':
                 default:
                     $xml .= '<![CDATA[' . $this->_subfieldValues[$subFieldID]->getValue() . ']]>';
                     break;
             }
             $xml .= "\n" . '</subfield>' . "\n";
         }
     }
     $xml .= '</field>' . "\n";
     return $xml;
 }

 /**
  * Gets the data in HTML mode.
  *
  * @param CMS_language &$language The language of the administration frontend
  * @param CMS_page &$page The page which contains the client space
  * @param CMS_clientSpace &$clientSpace The client space which contains the row
  * @param CMS_row &$row The row which contains the block
  * @param integer $visualizationMode The visualization mode used
  * @return string the HTML data
  * @access public
  */
 function getData(&$language, &$page, &$clientSpace, &$row, $visualizationMode)
 {
     parent::getData($language, $page, $clientSpace, $row, $visualizationMode);
     //get the data
     switch ($visualizationMode) {
         case PAGE_VISUALMODE_HTML_PUBLIC:
         case PAGE_VISUALMODE_PRINT:
             $data = $this->getRawData($page->getID(), $clientSpace->getTagID(), $row->getTagID(), RESOURCE_LOCATION_USERSPACE, true);
             break;
         case PAGE_VISUALMODE_HTML_EDITED:
             $data = $this->getRawData($page->getID(), $clientSpace->getTagID(), $row->getTagID(), RESOURCE_LOCATION_USERSPACE, false);
             break;
         case PAGE_VISUALMODE_HTML_EDITION:
         case PAGE_VISUALMODE_FORM:
         case PAGE_VISUALMODE_CLIENTSPACES_FORM:
             $data = $this->getRawData($page->getID(), $clientSpace->getTagID(), $row->getTagID(), RESOURCE_LOCATION_EDITION, false);
             break;
     }
     //build the HTML
     $html_attributes = "";
     foreach ($this->_attributes as $name => $value) {
         if ($name != "module" && $name != "type") {
             $html_attributes .= ' ' . $name . '="' . $value . '"';
         }
     }
     $src = '';
     $this->_hasContent = $data && $data["file"] ? true : false;
     switch ($visualizationMode) {
         case PAGE_VISUALMODE_HTML_PUBLIC:
         case PAGE_VISUALMODE_PRINT:
             if ($this->_hasContent) {
                 $language = CMS_languagesCatalog::getByCode($page->getLanguage(true));
                 $src = PATH_MODULES_FILES_STANDARD_WR . '/public/' . $data["file"];
             }
             break;
         case PAGE_VISUALMODE_HTML_EDITED:
             if ($this->_hasContent) {
                 $language = CMS_languagesCatalog::getByCode($page->getLanguage(false));
                 $src = PATH_MODULES_FILES_STANDARD_WR . '/edited/' . $data["file"];
             }
             break;
         case PAGE_VISUALMODE_HTML_EDITION:
             if ($this->_hasContent) {
                 $language = CMS_languagesCatalog::getByCode($page->getLanguage(false));
                 $src = PATH_MODULES_FILES_STANDARD_WR . '/edition/' . $data["file"];
             }
             break;
         case PAGE_VISUALMODE_FORM:
             $this->_editable = true;
             if ($this->_hasContent) {
                 $language = CMS_languagesCatalog::getByCode($page->getLanguage(false));
                 $src = PATH_MODULES_FILES_STANDARD_WR . '/edition/' . $data["file"];
             } else {
                 $html = '<img src="' . PATH_MODULES_FILES_STANDARD_WR . '/flash.gif" alt="X" title="X" />';
                 $form_data = str_replace("{{data}}", $html, $this->_definition);
                 return $this->_getHTMLForm($language, $page, $clientSpace, $row, $this->_tagID, $form_data);
             }
             break;
         case PAGE_VISUALMODE_CLIENTSPACES_FORM:
             $this->_hasContent = false;
             $this->_editable = false;
             $html = '<img src="' . PATH_MODULES_FILES_STANDARD_WR . '/flash.gif" alt="X" title="X" />';
             return $this->_getHTMLForm($language, $page, $clientSpace, $row, $this->_tagID, $form_data);
             break;
     }
     if (!$src) {
         return '';
     }
     $id = $data["name"] ? 'flash-' . sensitiveIO::sanitizeHTMLString($data["name"]) : 'flash-' . md5(mt_rand() . microtime());
     $html = '<div>' . "\n" . '	<script type="text/javascript">' . "\n" . '		swfobject.embedSWF(\'' . $src . '\', \'' . $id . '\', \'' . $data['width'] . '\', \'' . $data['height'] . '\', \'' . $data['version'] . '\', "' . PATH_MAIN_WR . '/swfobject/expressInstall.swf", {' . sensitiveIO::sanitizeJSString($data['flashvars'], false, false) . '}, {' . sensitiveIO::sanitizeJSString($data['params'], false, false) . '}, {' . sensitiveIO::sanitizeJSString($data['attributes'], false, false) . '});' . "\n" . '	</script>' . "\n" . '	<div id="' . $id . '" class="atm-blockflash" style="width:' . $data["width"] . 'px;height:' . $data["height"] . 'px;">' . "\n" . '		<noscript>' . $language->getMessage(self::MESSAGE_PAGE_JAVASCRIPT_MANDATORY) . '</noscript>' . "\n" . '		<p><a href="http://www.adobe.com/go/getflashplayer"><img src="http://www.adobe.com/images/shared/download_buttons/get_flash_player.gif" alt="Get Adobe Flash player" /></a></p>' . "\n" . '	</div>' . '</div>' . "\n";
     $blockinfos = array('blockflash' => array());
     $blockinfos['blockflash'] = true;
     CMS_module::moduleUsage($page->getID(), MOD_STANDARD_CODENAME, $blockinfos);
     if ($visualizationMode != PAGE_VISUALMODE_FORM) {
         return str_replace("{{data}}", $html, $this->_definition);
     } else {
         $form_data = str_replace("{{data}}", $html, $this->_definition);
         return $this->_getHTMLForm($language, $page, $clientSpace, $row, $this->_tagID, $form_data);
     }
 }