PHP Sanitize::clean方法代码示例

 /**
  * Clean some text
  *
  * @param   string  $text  Text to clean
  * @return  string
  * @throws  \InvalidArgumentException If no text passed
  */
 public function __invoke($text = null)
 {
     if (null === $text) {
         throw new \InvalidArgumentException(__METHOD__ . '(); No text passed.');
     }
     return Sanitize::clean($text);
 }

 /**
  * Finder before save content method
  * Article is passed by reference, but after the save, so no changes will be saved.
  * Method is called right after the content is saved
  *
  * @param   string The context of the content passed to the plugin
  */
 public function onContentBeforeSave($context, &$article, $isNew)
 {
     if (!$article instanceof \Hubzero\Base\Object || $context == 'com_content.article') {
         return;
     }
     $key = $this->_key($context);
     $content = ltrim($article->get($key));
     if (!$content) {
         return;
     }
     // Is there a format already applied?
     if (preg_match('/^<!-- \\{FORMAT:(.*)\\} -->/i', $content, $matches)) {
         $format = strtolower(trim($matches[1]));
         if ($format != 'html') {
             return;
         }
     } elseif (strstr($content, '</')) {
         // Force apply a format?
         if (!$this->params->get('applyFormat')) {
             return;
         }
     }
     if ($this->params->get('sanitizeBefore', 1)) {
         $content = \Hubzero\Utility\Sanitize::clean($content);
         $content = \Hubzero\Utility\Sanitize::html($content);
     }
     if ($this->params->get('applyFormat')) {
         $content = preg_replace('/^(<!-- \\{FORMAT:HTML\\} -->)/i', '', $content);
         $content = '<!-- {FORMAT:HTML} -->' . $content;
     }
     $article->set($key, $content);
 }

 /**
  * Validate data
  *
  * @return  boolean  True if data is valid
  */
 public function check()
 {
     $this->title = trim($this->title);
     if ($this->title == '') {
         $this->setError(Lang::txt('Missing title for the wish list'));
         return false;
     }
     $this->description = rtrim(stripslashes($this->description));
     $this->description = Sanitize::clean($this->description);
     $this->description = nl2br($this->description);
     return true;
 }

 /**
  * Save an abuse report and displays a "Thank you" message
  *
  * @return  void
  */
 public function saveTask()
 {
     // Check for request forgeries
     Request::checkToken();
     // Incoming
     $this->view->cat = Request::getVar('category', '');
     $this->view->refid = Request::getInt('referenceid', 0);
     $this->view->returnlink = Request::getVar('link', '');
     $no_html = Request::getInt('no_html', 0);
     // Trim and addslashes all posted items
     $incoming = array_map('trim', $_POST);
     // Initiate class and bind posted items to database fields
     $row = new ReportAbuse($this->database);
     if (!$row->bind($incoming)) {
         if ($no_html) {
             echo json_encode(array('success' => false, 'message' => $row->getError(), 'id' => $this->view->refid, 'category' => $this->view->cat));
             return;
         }
         Request::setVar('id', $this->view->refid);
         $this->setError($row->getError());
         $this->displayTask();
         return;
     }
     $row->report = Sanitize::clean($row->report);
     $row->report = nl2br($row->report);
     $row->created_by = User::get('id');
     $row->created = Date::toSql();
     $row->state = 0;
     // Check content
     if (!$row->check()) {
         if ($no_html) {
             echo json_encode(array('success' => false, 'message' => $row->getError(), 'id' => $this->view->refid, 'category' => $this->view->cat));
             return;
         }
         Request::setVar('id', $this->view->refid);
         $this->setError($row->getError());
         $this->displayTask();
         return;
     }
     // Store new content
     if (!$row->store()) {
         if ($no_html) {
             echo json_encode(array('success' => false, 'message' => $row->getError(), 'id' => $this->view->refid, 'category' => $this->view->cat));
             return;
         }
         Request::setVar('id', $this->view->refid);
         $this->setError($row->getError());
         $this->displayTask();
         return;
     }
     // Get the search result totals
     $results = Event::trigger('support.onReportItem', array($this->view->refid, $this->view->cat));
     // Send notification email
     if ($this->config->get('abuse_notify', 1)) {
         $reported = new \stdClass();
         $reported->author = 0;
         // Get the search result totals
         $results = Event::trigger('support.getReportedItem', array($this->view->refid, $this->view->cat, 0));
         // Check the results returned for a reported item
         if ($results) {
             foreach ($results as $result) {
                 if ($result) {
                     $reported = $result[0];
                     break;
                 }
             }
         }
         // Get any set emails that should be notified of ticket submission
         $defs = str_replace("\r", '', $this->config->get('abuse_emails', '{config.mailfrom}'));
         $defs = str_replace('\\n', "\n", $defs);
         $defs = explode("\n", $defs);
         $defs = array_map('trim', $defs);
         $message = new \Hubzero\Mail\Message();
         $message->setSubject(Config::get('sitename') . ' ' . Lang::txt('COM_SUPPORT_ABUSE_REPORT'))->addFrom(Config::get('mailfrom'), Config::get('sitename') . ' ' . Lang::txt(strtoupper($this->_option)))->addHeader('X-Component', 'com_support')->addHeader('X-Component-Object', 'abuse_item_report');
         // Plain text email
         $eview = new \Hubzero\Mail\View(array('name' => 'emails', 'layout' => 'abuse_plain'));
         $eview->option = $this->_option;
         $eview->controller = $this->_controller;
         $eview->report = $row;
         $eview->reported = $reported;
         $eview->author = null;
         $plain = $eview->loadTemplate(false);
         $plain = str_replace("\n", "\r\n", $plain);
         $message->addPart($plain, 'text/plain');
         // HTML email
         $eview->setLayout('abuse_html');
         $html = $eview->loadTemplate();
         $html = str_replace("\n", "\r\n", $html);
         $message->addPart($html, 'text/html');
         // Loop through the addresses
         foreach ($defs as $def) {
             // Check if the address should come from Joomla config
             if ($def == '{config.mailfrom}') {
                 $def = Config::get('mailfrom');
             }
//.........这里部分代码省略.........

 /**
  * Save an event
  *
  * @return     void
  */
 public function saveTask()
 {
     // Check if they are logged in
     if (User::isGuest()) {
         $this->loginTask();
         return;
     }
     // good ol' form validation
     Request::checkToken();
     Request::checkHoneypot() or die('Invalid Field Data Detected. Please try again.');
     $offset = $this->offset;
     // Incoming
     $start_time = Request::getVar('start_time', '08:00', 'post');
     $start_time = $start_time ? $start_time : '08:00';
     $start_pm = Request::getInt('start_pm', 0, 'post');
     $end_time = Request::getVar('end_time', '17:00', 'post');
     $end_time = $end_time ? $end_time : '17:00';
     $end_pm = Request::getInt('end_pm', 0, 'post');
     $time_zone = Request::getVar('time_zone', -5, 'post');
     $tags = Request::getVar('tags', '', 'post');
     // Bind the posted data to an event object
     $row = new Event($this->database);
     if (!$row->bind($_POST)) {
         throw new Exception($row->getError(), 500);
     }
     // New entry or existing?
     if ($row->id) {
         $state = 'edit';
         // Existing - update modified info
         $row->modified = strftime("%Y-%m-%d %H:%M:%S", time() + $offset * 60 * 60);
         if (User::get('id')) {
             $row->modified_by = User::get('id');
         }
     } else {
         $state = 'add';
         // New - set created info
         $row->created = strftime("%Y-%m-%d %H:%M:%S", time() + $offset * 60 * 60);
         if (User::get('id')) {
             $row->created_by = User::get('id');
         }
     }
     // Set some fields and do some cleanup work
     if ($row->catid) {
         $row->catid = intval($row->catid);
     }
     //$row->title = htmlentities($row->title);
     $row->content = $_POST['econtent'];
     $row->content = \Hubzero\Utility\Sanitize::clean($row->content);
     // Get the custom fields defined in the events configuration
     if (isset($_POST['fields'])) {
         $fields = $_POST['fields'];
         $fields = array_map('trim', $fields);
         // Wrap up the content of the field and attach it to the event content
         $fs = $this->config->fields;
         foreach ($fields as $param => $value) {
             if (trim($value) != '') {
                 $row->content .= '<ef:' . $param . '>' . $this->_clean($value) . '</ef:' . $param . '>';
             } else {
                 foreach ($fs as $f) {
                     if ($f[0] == $param && end($f) == 1) {
                         throw new Exception(Lang::txt('EVENTS_REQUIRED_FIELD_CHECK', $f[1]), 500);
                     }
                 }
             }
         }
     }
     // Clean adresse
     $row->adresse_info = $this->_clean($row->adresse_info);
     // Clean contact
     $row->contact_info = $this->_clean($row->contact_info);
     // Clean extra
     $row->extra_info = $this->_clean($row->extra_info);
     // Prepend http:// to URLs without it
     if ($row->extra_info != NULL) {
         if (substr($row->extra_info, 0, 7) != 'http://' && substr($row->extra_info, 0, 8) != 'https://') {
             $row->extra_info = 'http://' . $row->extra_info;
         }
     }
     // Reformat the time into 24hr format if necessary
     if ($this->config->getCfg('calUseStdTime') == 'YES') {
         list($hrs, $mins) = explode(':', $start_time);
         $hrs = intval($hrs);
         $mins = intval($mins);
         if ($hrs != 12 && $start_pm) {
             $hrs += 12;
         } else {
             if ($hrs == 12 && !$start_pm) {
                 $hrs = 0;
             }
         }
         if ($hrs < 10) {
             $hrs = '0' . $hrs;
         }
         if ($mins < 10) {
             $mins = '0' . $mins;
//.........这里部分代码省略.........

 /**
  * Display a feed of comments
  *
  * @return    void
  */
 protected function _feed()
 {
     if (!$this->params->get('comments_feeds')) {
         $this->action = 'view';
         $this->_view();
         return;
     }
     // Set the mime encoding for the document
     Document::setType('feed');
     // Load the comments
     $comment = new \Plugins\Hubzero\Comments\Models\Comment();
     $filters = array('parent' => 0, 'item_type' => $this->obj_type, 'item_id' => $this->obj_id);
     if ($this->obj instanceof \Hubzero\Base\Model) {
         $title = $this->obj->get('title');
     } else {
         $title = $this->obj->title;
     }
     // Start a new feed object
     $doc = Document::instance();
     $doc->link = Route::url($this->url);
     $doc->title = Config::get('sitename') . ' - ' . Lang::txt(strtoupper($this->_option));
     $doc->title .= $title ? ': ' . stripslashes($title) : '';
     $doc->title .= ': ' . Lang::txt('PLG_HUBZERO_COMMENTS');
     $doc->description = Lang::txt('PLG_HUBZERO_COMMENTS_RSS_DESCRIPTION', Config::get('sitename'), stripslashes($title));
     $doc->copyright = Lang::txt('PLG_HUBZERO_COMMENTS_RSS_COPYRIGHT', date("Y"), Config::get('sitename'));
     // Start outputing results if any found
     if ($comment->replies('list', $filters)->total() > 0) {
         foreach ($comment->replies() as $row) {
             // URL link to article
             $link = Route::url('index.php?option=' . $this->_option . '&section=' . $section->alias . '&category=' . $category->alias . '&alias=' . $entry->alias . '#c' . $row->id);
             $author = Lang::txt('PLG_HUBZERO_COMMENTS_ANONYMOUS');
             if (!$row->get('anonymous')) {
                 $author = $row->creator('name');
             }
             // Prepare the title
             $title = Lang::txt('PLG_HUBZERO_COMMENTS_COMMENT_BY', $author) . ' @ ' . $row->created('time') . ' on ' . $row->created('date');
             // Strip html from feed item description text
             if ($row->isReported()) {
                 $description = Lang::txt('PLG_HUBZERO_COMMENTS_REPORTED_AS_ABUSIVE');
             } else {
                 $description = $row->content('clean');
             }
             @($date = $row->created() ? date('r', strtotime($row->created())) : '');
             // Load individual item creator class
             $item = new \Hubzero\Document\Type\Feed\Item();
             $item->title = $title;
             $item->link = $link;
             $item->description = $description;
             $item->date = $date;
             $item->category = '';
             $item->author = $author;
             // Loads item info into rss array
             $doc->addItem($item);
             // Check for any replies
             if ($row->replies()->total()) {
                 foreach ($row->replies() as $reply) {
                     // URL link to article
                     $link = Route::url('index.php?option=' . $this->_option . '&section=' . $section->alias . '&category=' . $category->alias . '&alias=' . $entry->alias . '#c' . $reply->id);
                     $author = Lang::txt('PLG_HUBZERO_COMMENTS_ANONYMOUS');
                     if (!$reply->anonymous) {
                         $cuser = User::getInstance($reply->created_by);
                         $author = $cuser->get('name');
                     }
                     // Prepare the title
                     $title = Lang::txt('PLG_HUBZERO_COMMENTS_REPLY_TO_COMMENT', $row->id, $author) . ' @ ' . Date::of($reply->created)->toLocal(Lang::txt('TIME_FORMAT_HZ1')) . ' ' . Lang::txt('PLG_HUBZERO_COMMENTS_ON') . ' ' . Date::of($reply->created)->toLocal(Lang::txt('DATE_FORMAT_HZ1'));
                     // Strip html from feed item description text
                     if ($reply->reports) {
                         $description = Lang::txt('PLG_HUBZERO_COMMENTS_REPORTED_AS_ABUSIVE');
                     } else {
                         $description = is_object($p) ? $p->parse(stripslashes($reply->content)) : nl2br(stripslashes($reply->content));
                     }
                     $description = html_entity_decode(\Hubzero\Utility\Sanitize::clean($description));
                     @($date = $reply->created ? gmdate('r', strtotime($reply->created)) : '');
                     // Load individual item creator class
                     $item = new \Hubzero\Document\Type\Feed\Item();
                     $item->title = $title;
                     $item->link = $link;
                     $item->description = $description;
                     $item->date = $date;
                     $item->category = '';
                     $item->author = $author;
                     // Loads item info into rss array
                     $doc->addItem($item);
                     if ($reply->replies) {
                         foreach ($reply->replies as $response) {
                             // URL link to article
                             $link = Route::url('index.php?option=' . $this->_option . '&section=' . $section->alias . '&category=' . $category->alias . '&alias=' . $entry->alias . '#c' . $response->id);
                             $author = Lang::txt('PLG_HUBZERO_COMMENTS_ANONYMOUS');
                             if (!$response->anonymous) {
                                 $cuser = User::getInstance($response->created_by);
                                 $author = $cuser->get('name');
                             }
                             // Prepare the title
                             $title = Lang::txt('PLG_HUBZERO_COMMENTS_REPLY_TO_COMMENT', $reply->id, $author) . ' @ ' . Date::of($response->created)->toLocal(Lang::txt('TIME_FORMAT_HZ1')) . ' ' . Lang::txt('PLG_HUBZERO_COMMENTS_ON') . ' ' . Date::of($response->created)->toLocal(Lang::txt('DATE_FORMAT_HZ1'));
                             // Strip html from feed item description text
//.........这里部分代码省略.........

 /**
  * Saves a project
  * Redirects to main listing
  *
  * @param   boolean  $redirect
  * @return  void
  */
 public function saveTask($redirect = false)
 {
     // Check for request forgeries
     Request::checkToken();
     // Config
     $setup_complete = $this->config->get('confirm_step', 0) ? 3 : 2;
     // Incoming
     $formdata = $_POST;
     $id = Request::getVar('id', 0);
     $action = Request::getVar('admin_action', '');
     $message = rtrim(\Hubzero\Utility\Sanitize::clean(Request::getVar('message', '')));
     // Load model
     $model = new Models\Project($id);
     if (!$model->exists()) {
         App::redirect('index.php?option=' . $this->_option, Lang::txt('COM_PROJECTS_NOTICE_ID_NOT_FOUND'), 'error');
     }
     $title = $formdata['title'] ? rtrim($formdata['title']) : $model->get('title');
     $type = isset($formdata['type']) ? $formdata['type'] : 1;
     $model->set('title', $title);
     $model->set('about', rtrim(\Hubzero\Utility\Sanitize::clean($formdata['about'])));
     $model->set('type', $type);
     $model->set('modified', Date::toSql());
     $model->set('modified_by', User::get('id'));
     $model->set('private', Request::getInt('private', 0));
     $this->_message = Lang::txt('COM_PROJECTS_SUCCESS_SAVED');
     // Was project suspended?
     $suspended = false;
     if ($model->isInactive()) {
         $suspended = $model->table('Activity')->checkActivity($id, Lang::txt('COM_PROJECTS_ACTIVITY_PROJECT_SUSPENDED'));
     }
     $subject = Lang::txt('COM_PROJECTS_PROJECT') . ' "' . $model->get('alias') . '" ';
     $sendmail = 0;
     // Get project managers
     $managers = $model->table('Owner')->getIds($id, 1, 1);
     // Admin actions
     if ($action) {
         switch ($action) {
             case 'delete':
                 $model->set('state', 2);
                 $what = Lang::txt('COM_PROJECTS_ACTIVITY_PROJECT_DELETED');
                 $subject .= Lang::txt('COM_PROJECTS_MSG_ADMIN_DELETED');
                 $this->_message = Lang::txt('COM_PROJECTS_SUCCESS_DELETED');
                 break;
             case 'suspend':
                 $model->set('state', 0);
                 $what = Lang::txt('COM_PROJECTS_ACTIVITY_PROJECT_SUSPENDED');
                 $subject .= Lang::txt('COM_PROJECTS_MSG_ADMIN_SUSPENDED');
                 $this->_message = Lang::txt('COM_PROJECTS_SUCCESS_SUSPENDED');
                 break;
             case 'reinstate':
                 $model->set('state', 1);
                 $what = $suspended ? Lang::txt('COM_PROJECTS_ACTIVITY_PROJECT_REINSTATED') : Lang::txt('COM_PROJECTS_ACTIVITY_PROJECT_ACTIVATED');
                 $subject .= $suspended ? Lang::txt('COM_PROJECTS_MSG_ADMIN_REINSTATED') : Lang::txt('COM_PROJECTS_MSG_ADMIN_ACTIVATED');
                 $this->_message = $suspended ? Lang::txt('COM_PROJECTS_SUCCESS_REINSTATED') : Lang::txt('COM_PROJECTS_SUCCESS_ACTIVATED');
                 break;
         }
         // Add activity
         $model->recordActivity($what, 0, '', '', 'project', 0, $admin = 1);
         $sendmail = 1;
     } elseif ($message) {
         $subject .= ' - ' . Lang::txt('COM_PROJECTS_MSG_ADMIN_NEW_MESSAGE');
         $sendmail = 1;
         $this->_message = Lang::txt('COM_PROJECTS_SUCCESS_MESSAGE_SENT');
     }
     // Save changes
     if (!$model->store()) {
         $this->setError($model->getError());
         return false;
     }
     // Incoming tags
     $tags = Request::getVar('tags', '', 'post');
     // Save the tags
     $cloud = new Models\Tags($model->get('id'));
     $cloud->setTags($tags, User::get('id'), 1);
     // Save params
     $incoming = Request::getVar('params', array());
     if (!empty($incoming)) {
         foreach ($incoming as $key => $value) {
             if ($key == 'quota' || $key == 'pubQuota') {
                 // convert GB to bytes
                 $value = Helpers\Html::convertSize(floatval($value), 'GB', 'b');
             }
             $model->saveParam($key, $value);
         }
     }
     // Add members if specified
     $this->model = $model;
     $this->_saveMember();
     // Change ownership
     $this->_changeOwnership();
     // Send message
     if ($this->config->get('messaging', 0) && $sendmail && count($managers) > 0) {
         // Email config
//.........这里部分代码省略.........

 /**
  * Save a review
  *
  * @return     void
  */
 public function savereview()
 {
     // Check for request forgeries
     Request::checkToken();
     // Incoming
     $resource_id = Request::getInt('resource_id', 0);
     // Do we have a resource ID?
     if (!$resource_id) {
         // No ID - fail! Can't do anything else without an ID
         $this->setError(Lang::txt('PLG_RESOURCES_REVIEWS_NO_RESOURCE_ID'));
         return;
     }
     $database = App::get('db');
     // Bind the form data to our object
     $row = new \Components\Resources\Tables\Review($database);
     if (!$row->bind($_POST)) {
         $this->setError($row->getError());
         return;
     }
     // Perform some text cleaning, etc.
     $row->id = Request::getInt('reviewid', 0);
     if (!$row->id) {
         $row->state = 1;
     }
     $row->comment = \Hubzero\Utility\Sanitize::stripImages(\Hubzero\Utility\Sanitize::clean($row->comment));
     $row->anonymous = $row->anonymous == 1 || $row->anonymous == '1' ? $row->anonymous : 0;
     $row->created = $row->created && $row->created != '0000-00-00 00:00:00' ? $row->created : Date::toSql();
     // Check for missing (required) fields
     if (!$row->check()) {
         $this->setError($row->getError());
         return;
     }
     // Save the data
     if (!$row->store()) {
         $this->setError($row->getError());
         return;
     }
     // Calculate the new average rating for the parent resource
     $resource =& $this->resource;
     $resource->calculateRating();
     $resource->updateRating();
     // Process tags
     $tags = trim(Request::getVar('review_tags', ''));
     if ($tags) {
         $rt = new \Components\Resources\Helpers\Tags($resource_id);
         $rt->setTags($tags, $row->user_id);
     }
     // Instantiate a helper object and get all the contributor IDs
     $helper = new \Components\Resources\Helpers\Helper($resource->id, $database);
     $helper->getContributorIDs();
     $users = $helper->contributorIDs;
     // Build the subject
     $subject = Config::get('sitename') . ' ' . Lang::txt('PLG_RESOURCES_REVIEWS_CONTRIBUTIONS');
     // Message
     $eview = new \Hubzero\Plugin\View(array('folder' => 'resources', 'element' => 'reviews', 'name' => 'emails'));
     $eview->option = $this->_option;
     $eview->user = User::getRoot();
     $eview->resource = $resource;
     $eview->review = $row;
     $message = $eview->loadTemplate();
     // Build the "from" data for the e-mail
     $from = array('name' => Config::get('sitename') . ' ' . Lang::txt('PLG_RESOURCES_REVIEWS_CONTRIBUTIONS'), 'email' => Config::get('mailfrom'));
     // Send message
     if (!Event::trigger('xmessage.onSendMessage', array('resources_new_comment', $subject, $message, $from, $users, $this->_option))) {
         $this->setError(Lang::txt('PLG_RESOURCES_REVIEWS_FAILED_TO_MESSAGE'));
     }
 }

 /**
  * Display module content
  *
  * @return  void
  */
 public function display()
 {
     // Field labels
     $this->name_label = $this->params->get('name_label', Lang::txt('MOD_RAPID_CONTACT_FIELD_NAME'));
     $this->email_label = $this->params->get('email_label', Lang::txt('MOD_RAPID_CONTACT_FIELD_EMAIL'));
     $this->subject_label = $this->params->get('subject_label', Lang::txt('MOD_RAPID_CONTACT_FIELD_SUBJECT'));
     $this->message_label = $this->params->get('message_label', Lang::txt('MOD_RAPID_CONTACT_FIELD_MESSAGE'));
     // Button text
     $this->button_text = $this->params->get('button_text', Lang::txt('MOD_RAPID_CONTACT_SEND'));
     // Pre text
     $this->pre_text = $this->params->get('pre_text', '');
     // Thank you message
     $this->page_text = $this->params->get('page_text', Lang::txt('MOD_RAPID_CONTACT_THANK_YOU'));
     // Error messages
     $this->error_text = $this->params->get('error_text', Lang::txt('MOD_RAPID_CONTACT_ERROR_SENDING'));
     $this->no_email = $this->params->get('no_email', Lang::txt('MOD_RAPID_CONTACT_ERROR_NO_EMAIL'));
     $this->invalid_email = $this->params->get('invalid_email', Lang::txt('MOD_RAPID_CONTACT_ERROR_INVALID_EMAIL'));
     // From
     $this->from_name = $this->params->get('from_name', Lang::txt('MOD_RAPID_CONTACT'));
     $this->from_email = $this->params->get('from_email', 'rapid_contact@yoursite.com');
     // To
     $this->recipient = $this->params->get('email_recipient', Config::get('mailfrom'));
     if (!trim($this->recipient)) {
         $this->recipient = Config::get('mailfrom');
     }
     // Enable Anti-spam?
     $this->enable_anti_spam = $this->params->get('enable_anti_spam', true);
     $this->anti_spam_q = $this->params->get('anti_spam_q', Lang::txt('MOD_RAPID_CONTACT_ANTIPSAM'));
     $this->anti_spam_a = $this->params->get('anti_spam_a', '2');
     $this->mod_class_suffix = $this->params->get('moduleclass_sfx', '');
     $disable_https = $this->params->get('disable_https', false);
     $exact_url = $this->params->get('exact_url', true);
     if (!$exact_url) {
         //$this->url = $this->_cleanXss(filter_var(Request::current(), FILTER_SANITIZE_URL));
         $this->url = Request::current();
     } else {
         if (!$disable_https) {
             $this->url = !empty($_SERVER['HTTPS']) ? 'https://' . $_SERVER['SERVER_NAME'] . $_SERVER['REQUEST_URI'] : 'http://' . $_SERVER['SERVER_NAME'] . $_SERVER['REQUEST_URI'];
         } else {
             $this->url = 'http://' . $_SERVER['SERVER_NAME'] . $_SERVER['REQUEST_URI'];
         }
     }
     //$qs = str_replace(array('"', '?'), '', urldecode($_SERVER['QUERY_STRING']));
     //$aqs = explode('?', $this->url);
     //$this->url = $aqs[0] . '?' . urlencode($qs);
     $fixed_url = $this->params->get('fixed_url', true);
     if ($fixed_url) {
         $this->url = $this->params->get('fixed_url_address', '');
     }
     $this->error = '';
     $this->replacement = '';
     $this->posted = array('name' => '', 'email' => '', 'subject' => '', 'message' => '');
     if (isset($_POST['rp'])) {
         $this->posted = Request::getVar('rp', array(), 'post');
         if ($this->enable_anti_spam) {
             if (!isset($this->posted['anti_spam_answer']) || $this->posted['anti_spam_answer'] != $this->anti_spam_a) {
                 $this->error = Lang::txt('MOD_RAPID_CONTACT_INVALID_ANTIPSAM_ANSWER');
             }
         }
         if ($this->posted['email'] === '') {
             $this->error = $this->no_email;
         }
         if (!preg_match("#^[_a-z0-9-]+(\\.[_a-z0-9-]+)*@[a-z0-9-]+(\\.[a-z0-9-]+)*(\\.[a-z]{2,3})\$#i", $this->posted['email'])) {
             $this->error = $this->invalid_email;
         }
         if ($this->error == '') {
             $mySubject = Sanitize::clean($this->posted['subject']);
             $myMessage = Lang::txt('MOD_RAPID_CONTACT_MESSAGE_FROM', $this->posted['name'], $this->posted['email'], Request::getVar('HTTP_REFERER', '', 'SERVER'), Config::get('sitename'));
             $myMessage .= "\n\n" . Sanitize::clean($this->posted['message']);
             $this->from_email = $this->posted['email'];
             $this->from_name = isset($this->posted['name']) && Sanitize::clean($this->posted['name']) ? Sanitize::clean($this->posted['name']) : $this->posted['email'];
             $mailSender = new Message();
             $mailSender->setSubject($mySubject)->addFrom($this->from_email, $this->from_name)->addTo($this->recipient)->addReplyTo($this->posted['email'], $this->posted['name'])->setBody($myMessage);
             if (!$mailSender->send()) {
                 $this->error = $this->error_text;
             } else {
                 $this->replacement = $this->page_text;
             }
         }
     }
     require $this->getLayoutPath($this->params->get('layout', 'default'));
 }

 /**
  * Store changes to this offering
  *
  * @param   boolean  $check  Perform data validation check?
  * @return  boolean  False if error, True on success
  */
 public function store($check = true)
 {
     if (!$this->get('anonymous')) {
         $this->set('anonymous', 0);
     }
     $this->set('about', \Hubzero\Utility\Sanitize::clean($this->get('about')));
     if (!parent::store($check)) {
         return false;
     }
     return true;
 }

 /**
  * Save an entry
  *
  * @return    string
  */
 private function save()
 {
     Request::checkToken();
     //get request vars
     $event = Request::getVar('event', array(), 'post');
     $event['time_zone'] = Request::getVar('time_zone', -5);
     $event['params'] = Request::getVar('params', array());
     $event['content'] = Request::getVar('content', '', 'post', 'STRING', JREQUEST_ALLOWRAW);
     $registration = Request::getVar('include-registration', 0);
     //set vars for saving
     $event['catid'] = '-1';
     $event['state'] = 1;
     $event['scope'] = 'group';
     $event['scope_id'] = $this->group->get('gidNumber');
     $event['modified'] = Date::toSql();
     $event['modified_by'] = $this->user->get('id');
     // repeating rule
     $event['repeating_rule'] = $this->_buildRepeatingRule();
     //if we are updating set modified time and actor
     if (!isset($event['id']) || $event['id'] == 0) {
         $event['created'] = Date::toSql();
         $event['created_by'] = $this->user->get('id');
     }
     // timezone
     $timezone = new DateTimezone(Config::get('offset'));
     //parse publish up date/time
     if (isset($event['publish_up']) && $event['publish_up'] != '') {
         // combine date & time
         if (isset($event['publish_up_time'])) {
             $event['publish_up'] = $event['publish_up'] . ' ' . $event['publish_up_time'];
         }
         $event['publish_up'] = Date::of($event['publish_up'], $timezone)->format("Y-m-d H:i:s");
         unset($event['publish_up_time']);
     }
     //parse publish down date/time
     if (isset($event['publish_down']) && $event['publish_down'] != '') {
         // combine date & time
         if (isset($event['publish_down_time'])) {
             $event['publish_down'] = $event['publish_down'] . ' ' . $event['publish_down_time'];
         }
         $event['publish_down'] = Date::of($event['publish_down'], $timezone)->format("Y-m-d H:i:s");
         unset($event['publish_down_time']);
     }
     //parse register by date/time
     if (isset($event['registerby']) && $event['registerby'] != '') {
         //remove @ symbol
         $event['registerby'] = str_replace("@", "", $event['registerby']);
         $event['registerby'] = Date::of($event['registerby'], $timezone)->format("Y-m-d H:i:s");
     }
     //stringify params
     if (isset($event['params']) && count($event['params']) > 0) {
         $params = new \Hubzero\Config\Registry($event['params']);
         $event['params'] = $params->toString();
     }
     //did we want to turn off registration?
     if (!$registration) {
         $event['registerby'] = '0000-00-00 00:00:00';
     }
     //instantiate new event object
     $eventsModelEvent = new \Components\Events\Models\Event();
     // attempt to bind
     if (!$eventsModelEvent->bind($event)) {
         $this->setError($eventsModelEvent->getError());
         $this->event = $eventsModelEvent;
         return $this->edit();
     }
     if (isset($event['content']) && $event['content']) {
         $event['content'] = \Hubzero\Utility\Sanitize::clean($event['content']);
     }
     if (isset($event['extra_info']) && $event['extra_info'] && !\Hubzero\Utility\Validate::url($event['extra_info'])) {
         $this->setError('Website entered does not appear to be a valid URL.');
         $this->event = $eventsModelEvent;
         return $this->edit();
     }
     //make sure we have both start and end time
     if ($event['publish_up'] == '') {
         $this->setError('You must enter an event start, an end date is optional.');
         $this->event = $eventsModelEvent;
         return $this->edit();
     }
     //check to make sure end time is greater than start time
     if (isset($event['publish_down']) && $event['publish_down'] != '0000-00-00 00:00:00' && $event['publish_down'] != '') {
         $up = strtotime($event['publish_up']);
         $down = strtotime($event['publish_down']);
         $allday = isset($event['allday']) && $event['allday'] == 1 ? true : false;
         // make sure up greater than down when not all day
         // when all day event up can equal down
         if ($up >= $down && !$allday || $allday && $up > $down) {
             $this->setError('You must an event end date greater than the start date.');
             $this->event = $eventsModelEvent;
             return $this->edit();
         }
     }
     //make sure registration email is valid
     if ($registration && isset($event['email']) && $event['email'] != '' && !filter_var($event['email'], FILTER_VALIDATE_EMAIL)) {
//.........这里部分代码省略.........

 /**
  * Display an RSS feed
  *
  * @return     void
  */
 public function feedTask()
 {
     Document::setType('feed');
     // Start a new feed object
     $doc = Document::instance();
     // Incoming
     $id = Request::getInt('id', 0);
     $alias = Request::getVar('alias', '');
     // Ensure we have an ID or alias to work with
     if (!$id && !$alias) {
         App::redirect(Route::url('index.php?option=' . $this->_option));
         return;
     }
     // Load the resource
     $resource = new Resource($this->database);
     if ($alias) {
         $resource->load($alias);
         $id = $resource->id;
     } else {
         $resource->load($id);
         $alias = $resource->alias;
     }
     // Make sure we got a result from the database
     if (!$resource) {
         App::abort(404, Lang::txt('COM_RESOURCES_RESOURCE_NOT_FOUND'));
         return;
     }
     // Make sure the resource is published and standalone
     if ($resource->published == 0 || $resource->standalone != 1) {
         App::abort(403, Lang::txt('COM_RESOURCES_ALERTNOTAUTH'));
         return;
     }
     // Make sure they have access to view this resource
     if ($this->checkGroupAccess($resource)) {
         App::abort(403, Lang::txt('COM_RESOURCES_ALERTNOTAUTH'));
         return;
     }
     // Incoming
     $filters = array();
     if ($resource->type == 2) {
         $filters['sortby'] = Request::getVar('sortby', 'ordering');
     } else {
         $filters['sortby'] = Request::getVar('sortby', 'ranking');
     }
     $filters['limit'] = Request::getInt('limit', 100);
     $filters['start'] = Request::getInt('limitstart', 0);
     $filters['year'] = Request::getInt('year', 0);
     $filters['id'] = $resource->id;
     $feedtype = Request::getVar('content', 'audio');
     // Initiate a resource helper class
     $helper = new Helper($resource->id, $this->database);
     $rows = $helper->getStandaloneChildren($filters);
     $base = rtrim(Request::base(), '/');
     $title = $resource->title;
     $feedtypes_abr = array(" ", "slides", "audio", "video", "sd_video", "hd_video");
     $feedtypes_full = array(" & ", "Slides", "Audio", "Video", "SD full", "HD");
     $type = str_replace($feedtypes_abr, $feedtypes_full, $feedtype);
     $title = '[' . $type . '] ' . $title;
     // Build some basic RSS document information
     $dtitle = \Hubzero\Utility\Sanitize::clean(stripslashes($title));
     $doc->title = trim(\Hubzero\Utility\String::truncate(html_entity_decode($dtitle), 250));
     $doc->description = htmlspecialchars(html_entity_decode(\Hubzero\Utility\Sanitize::clean(stripslashes($resource->introtext))), ENT_COMPAT, 'UTF-8');
     $doc->copyright = \Lang::txt('COM_RESOURCES_RSS_COPYRIGHT', date("Y"), Config::get('sitename'));
     $doc->category = Lang::txt('COM_RESOURCES_RSS_CATEGORY');
     $doc->link = Route::url('index.php?option=' . $this->_option . '&id=' . $resource->id);
     $rt = new Tags($resource->id);
     $rtags = $rt->tags();
     $tagarray = array();
     $categories = array();
     $subcategories = array();
     if ($rtags) {
         foreach ($rtags as $tag) {
             if (substr($tag->get('tag'), 0, 6) == 'itunes') {
                 $tbits = explode(':', $tag->get('raw_tag'));
                 if (count($tbits) > 2) {
                     $subcategories[] = end($tbits);
                 } else {
                     $categories[] = str_replace('itunes:', '', $tag->get('raw_tag'));
                 }
             } elseif ($tag->get('admin') == 0) {
                 $tagarray[] = $tag->get('raw_tag');
             }
         }
     }
     $tags = implode(', ', $tagarray);
     $tags = trim(\Hubzero\Utility\String::truncate($tags, 250));
     $tags = rtrim($tags, ',');
     $helper->getUnlinkedContributors();
     $cons = $helper->ul_contributors;
     $cons = explode(';', $cons);
     $author = '';
     foreach ($cons as $con) {
         if ($con) {
             $author = trim($con);
             break;
//.........这里部分代码省略.........

 /**
  * Saves changes to an order
  *
  * @return void
  */
 public function saveTask()
 {
     // Check for request forgeries
     Request::checkToken();
     $statusmsg = '';
     $data = array_map('trim', $_POST);
     $action = isset($data['action']) ? $data['action'] : '';
     $id = $data['id'] ? $data['id'] : 0;
     $cost = intval($data['total']);
     if ($id) {
         // initiate extended database class
         $row = new Order($this->database);
         $row->load($id);
         $row->notes = \Hubzero\Utility\Sanitize::clean($data['notes']);
         $hold = $row->total;
         $row->total = $cost;
         // get user bank account
         $xprofile = User::getInstance($row->uid);
         $BTL_Q = new Teller($this->database, $xprofile->get('id'));
         switch ($action) {
             case 'complete_order':
                 // adjust credit
                 $credit = $BTL_Q->credit_summary();
                 $adjusted = $credit - $hold;
                 $BTL_Q->credit_adjustment($adjusted);
                 // remove hold
                 $sql = "DELETE FROM `#__users_transactions` WHERE category='store' AND type='hold' AND referenceid='" . $id . "' AND uid=" . intval($row->uid);
                 $this->database->setQuery($sql);
                 if (!$this->database->query()) {
                     throw new Exception($this->database->getErrorMsg(), 500);
                 }
                 // debit account
                 if ($cost > 0) {
                     $BTL_Q->withdraw($cost, Lang::txt('COM_STORE_BANKING_PURCHASE') . ' #' . $id, 'store', $id);
                 }
                 // update order information
                 $row->status_changed = Date::toSql();
                 $row->status = 1;
                 $statusmsg = Lang::txt('COM_STORE_ORDER') . ' #' . $id . ' ' . Lang::txt('COM_STORE_HAS_BEEN') . ' ' . strtolower(Lang::txt('COM_STORE_COMPLETED')) . '.';
                 break;
             case 'cancel_order':
                 // adjust credit
                 $credit = $BTL_Q->credit_summary();
                 $adjusted = $credit - $hold;
                 $BTL_Q->credit_adjustment($adjusted);
                 // remove hold
                 $sql = "DELETE FROM `#__users_transactions` WHERE category='store' AND type='hold' AND referenceid='" . $id . "' AND uid=" . intval($row->uid);
                 $this->database->setQuery($sql);
                 if (!$this->database->query()) {
                     throw new Exception($this->database->getErrorMsg(), 500);
                 }
                 // update order information
                 $row->status_changed = Date::toSql();
                 $row->status = 2;
                 $statusmsg = Lang::txt('COM_STORE_ORDER') . ' #' . $id . ' ' . Lang::txt('COM_STORE_HAS_BEEN') . ' ' . strtolower(Lang::txt('COM_STORE_CANCELLED')) . '.';
                 break;
             case 'message':
                 $statusmsg = Lang::txt('COM_STORE_MSG_SENT') . '.';
                 break;
             default:
                 $statusmsg = Lang::txt('COM_STORE_ORDER_DETAILS_UPDATED') . '.';
                 break;
         }
         // check content
         if (!$row->check()) {
             throw new Exception($row->getError(), 500);
             return;
         }
         // store new content
         if (!$row->store()) {
             throw new Exception($row->getError(), 500);
         }
         // send email
         if ($action || $data['message']) {
             if (\Hubzero\Utility\Validate::email($row->email)) {
                 $message = new \Hubzero\Mail\Message();
                 $message->setSubject(Config::get('sitename') . ' ' . Lang::txt('COM_STORE_EMAIL_UPDATE_SHORT', $id));
                 $message->addFrom(Config::get('mailfrom'), Config::get('sitename') . ' ' . Lang::txt('COM_STORE_STORE'));
                 // Plain text email
                 $eview = new \Hubzero\Mail\View(array('name' => 'emails', 'layout' => '_plain'));
                 $eview->option = $this->_option;
                 $eview->controller = $this->_controller;
                 $eview->orderid = $id;
                 $eview->cost = $cost;
                 $eview->row = $row;
                 $eview->action = $action;
                 $eview->message = \Hubzero\Utility\Sanitize::stripAll($data['message']);
                 $plain = $eview->loadTemplate(false);
                 $plain = str_replace("\n", "\r\n", $plain);
                 $message->addPart($plain, 'text/plain');
                 // HTML email
                 $eview->setLayout('_html');
                 $html = $eview->loadTemplate();
                 $html = str_replace("\n", "\r\n", $html);
                 $message->addPart($html, 'text/html');
//.........这里部分代码省略.........

 /**
  * Save a review
  *
  * @return  void
  */
 public function savereview()
 {
     // Is the user logged in?
     if (User::isGuest()) {
         $this->setError(Lang::txt('PLG_RESOURCES_REVIEWS_LOGIN_NOTICE'));
         return;
     }
     // Check for request forgeries
     Request::checkToken();
     // Incoming
     $data = Request::getVar('review', array(), 'post', 'none', 2);
     // Bind the form data to our object
     $row = \Components\Resources\Reviews\Models\Review::oneOrNew($data['id'])->set($data);
     // Perform some text cleaning, etc.
     if ($row->isNew()) {
         $row->set('state', \Components\Resources\Reviews\Models\Review::STATE_PUBLISHED);
     }
     $row->set('comment', \Hubzero\Utility\Sanitize::stripImages(\Hubzero\Utility\Sanitize::clean($row->get('comment'))));
     $row->set('anonymous', $row->get('anonymous') ? 1 : 0);
     // Save the data
     if (!$row->save()) {
         $this->setError($row->getError());
         return;
     }
     // Calculate the new average rating for the parent resource
     $resource =& $this->resource;
     $resource->calculateRating();
     $resource->updateRating();
     // Instantiate a helper object and get all the contributor IDs
     $database = App::get('db');
     $helper = new \Components\Resources\Helpers\Helper($resource->id, $database);
     $helper->getContributorIDs();
     $users = $helper->contributorIDs;
     // Build the subject
     $subject = Config::get('sitename') . ' ' . Lang::txt('PLG_RESOURCES_REVIEWS_CONTRIBUTIONS');
     // Message
     $eview = new \Hubzero\Plugin\View(array('folder' => 'resources', 'element' => 'reviews', 'name' => 'emails'));
     $eview->option = $this->_option;
     $eview->user = User::getInstance();
     $eview->resource = $resource;
     $eview->review = $row;
     $message = $eview->loadTemplate();
     // Build the "from" data for the e-mail
     $from = array('name' => Config::get('sitename') . ' ' . Lang::txt('PLG_RESOURCES_REVIEWS_CONTRIBUTIONS'), 'email' => Config::get('mailfrom'));
     // Send message
     if (!Event::trigger('xmessage.onSendMessage', array('resources_new_comment', $subject, $message, $from, $users, $this->_option))) {
         $this->setError(Lang::txt('PLG_RESOURCES_REVIEWS_FAILED_TO_MESSAGE'));
     }
 }

 /**
  * Applies filters to Citations model and returns applied filters
  * @param array  $filters array of POST values
  * @return	array sanitized and validated filter values
  */
 private function _filterHandler($filters = array(), $scope_id = 0)
 {
     $citations = \Components\Citations\Models\Citation::all();
     // require citations
     if (!$citations) {
         return false;
     }
     $filterCount = count($filters);
     // see if we have members too
     $config = json_decode($this->group->get('params'));
     $members = $this->group->members;
     // get the ones for this group
     if (isset($config->display) && $config->display == 'member') {
         // if all filter is applied
         if (array_key_exists('filter', $filters) && ($filters['filter'] == '' || $filters['filter'] == 'all')) {
             // get the ID's of the citations of members of the group
             $memberCitations = \Components\Citations\Models\Citation::all()->where('scope', '=', 'member')->whereIn('scope_id', $members)->where('published', '=', $citations::STATE_PUBLISHED);
             // don't include deleted citations
             // push them to an array
             $memberCites = array();
             foreach ($memberCitations as $mC) {
                 array_push($memberCites, $mC->id);
             }
             // Get the group's citations plus member citations.
             $citations->where('scope', '=', self::PLUGIN_SCOPE)->where('scope_id', '=', $scope_id)->orWhereIn('id', $memberCites)->where('published', '!=', $citations::STATE_DELETED);
             // don't include deleted citations
         } elseif (array_key_exists('filter', $filters) && $filters['filter'] == 'member') {
             $citations->where('scope', '=', 'member')->whereIn('scope_id', $members)->where('published', '=', $citations::STATE_PUBLISHED);
             // don't include deleted citations
         } else {
             // get the ID's of the citations of members of the group
             $memberCitations = \Components\Citations\Models\Citation::all()->where('scope', '=', 'member')->whereIn('scope_id', $members)->where('published', '=', $citations::STATE_PUBLISHED);
             // don't include deleted citations
             // push them to an array
             $memberCites = array();
             foreach ($memberCitations as $mC) {
                 array_push($memberCites, $mC->id);
             }
             // Get the group's citations plus member citations.
             $citations->where('scope', '=', self::PLUGIN_SCOPE)->where('scope_id', '=', $scope_id)->orWhereIn('id', $memberCites)->where('published', '!=', $citations::STATE_DELETED);
             // don't include deleted citations
         }
     } else {
         // display only group citations
         $citations->where('scope', '=', self::PLUGIN_SCOPE);
         $citations->where('scope_id', '=', $scope_id);
         $citations->where('published', '!=', $citations::STATE_DELETED);
         // don't include deleted citations
     }
     // apply filters on the set of citations
     if ($filterCount > 0) {
         foreach ($filters as $filter => $value) {
             // sanitization
             $value = \Hubzero\Utility\Sanitize::clean($value);
             // we handle things differently in search and sorting
             if ($filter != 'search' && $filter != 'sort' && $filter != 'tag' && $value != "" && $filter != 'filter') {
                 switch ($filter) {
                     case 'author':
                         $citations->where('author', 'LIKE', "%{$value}%", 'and', 1);
                         break;
                     case 'publishedin':
                         $citations->where('date_publish', 'LIKE', "%{$value}-%");
                         break;
                     case 'year_start':
                         $citations->where('year', '>=', $value);
                         break;
                     case 'year_end':
                         $citations->where('year', '<=', $value);
                         break;
                     default:
                         $citations->where($filter, '=', $value);
                         break;
                 }
             }
             // end if not search & not sort & non-empty value
             // for searching
             if ($filter == "search" && $value != "") {
                 $terms = preg_split('/\\s+/', $value);
                 $value = \Hubzero\Utility\Sanitize::clean($value);
                 $term = $value;
                 $collection = array();
                 $columns = array('author', 'title', 'isbn', 'doi', 'publisher', 'abstract');
                 foreach ($columns as $column) {
                     foreach ($terms as $term) {
                         // copy the original item
                         $cite = clone $citations;
                         // do some searching
                         $cite->where($column, 'LIKE', "%{$term}%");
                         foreach ($cite as $c) {
                             // put for collection later
                             array_push($collection, $c->id);
                         }
                         // end foreach $cite
                     }
                     // end foreach terms
//.........这里部分代码省略.........