PHP Sanitize::stripScripts方法代码示例

 /**
  * Save comment
  *
  * @return  void
  */
 protected function _saveComment()
 {
     // Check permission
     if (!$this->model->access('content')) {
         App::abort(403, Lang::txt('ALERTNOTAUTH'));
     }
     // Incoming
     $itemid = Request::getInt('itemid', 0, 'post');
     $tbl = trim(Request::getVar('tbl', 'activity', 'post'));
     $comment = trim(Request::getVar('comment', '', 'post'));
     $parent_activity = Request::getInt('parent_activity', 0, 'post');
     // Clean-up
     $comment = \Hubzero\Utility\Sanitize::stripScripts($comment);
     $comment = \Hubzero\Utility\Sanitize::stripImages($comment);
     // Instantiate comment
     $objC = new \Components\Projects\Tables\Comment($this->_database);
     if ($comment) {
         $objC->itemid = $itemid;
         $objC->tbl = $tbl;
         $objC->parent_activity = $parent_activity;
         $objC->comment = $comment;
         $objC->created = Date::toSql();
         $objC->created_by = $this->_uid;
         if (!$objC->store()) {
             $this->setError($objC->getError());
         } else {
             $this->_msg = Lang::txt('PLG_PROJECTS_BLOG_COMMENT_POSTED');
         }
         // Get new entry ID
         if (!$objC->id) {
             $objC->checkin();
         }
         // Record activity
         if ($objC->id) {
             $what = $tbl == 'blog' ? Lang::txt('COM_PROJECTS_BLOG_POST') : Lang::txt('COM_PROJECTS_AN_ACTIVITY');
             $what = $tbl == 'todo' ? Lang::txt('COM_PROJECTS_TODO_ITEM') : $what;
             $url = $tbl == 'todo' ? Route::url($this->model->link('todo') . '&action=view&todoid=' . $itemid) : Route::url($this->model->link('feed')) . '#tr_' . $parent_activity;
             // same-page link
             $aid = $this->model->recordActivity(Lang::txt('COM_PROJECTS_COMMENTED') . ' ' . Lang::txt('COM_PROJECTS_ON') . ' ' . $what, $objC->id, $what, $url, 'quote', 0);
         }
         // Store activity ID
         if ($aid) {
             $objC->activityid = $aid;
             $objC->store();
         }
     }
     // Pass error or success message
     if ($this->getError()) {
         Notify::message($this->getError(), 'error', 'projects');
     } elseif (!empty($this->_msg)) {
         Notify::message($this->_msg, 'success', 'projects');
     }
     // Redirect
     App::redirect(Route::url($this->model->link()));
 }

 /**
  *  Save group settings
  *
  * @return 		void
  */
 public function saveTask()
 {
     // Check if they're logged in
     if (User::isGuest()) {
         $this->loginTask(Lang::txt('COM_GROUPS_CREATE_MUST_BE_LOGGED_IN'));
         return;
     }
     Request::checkToken();
     // Incoming
     $g_gidNumber = Request::getInt('gidNumber', 0, 'post');
     $c_gidNumber = Request::getVar('gidNumber', 0, 'post');
     if ((string) $g_gidNumber !== (string) $c_gidNumber) {
         App::abort(404, Lang::txt('COM_GROUPS_ERROR_NO_ID'));
     }
     if (!$g_gidNumber && !User::authorise('core.create', $this->_option) || $g_gidNumber && !User::authorise('core.edit', $this->_option)) {
         return App::redirect(Route::url('index.php?option=' . $this->_option), Lang::txt('COM_GROUPS_ERROR_NOT_AUTH'), 'warning');
     }
     $g_cn = trim(Request::getVar('cn', '', 'post'));
     $g_description = preg_replace('/\\s+/', ' ', trim(Request::getVar('description', Lang::txt('NONE'), 'post')));
     $g_discoverability = Request::getInt('discoverability', 0, 'post');
     $g_public_desc = Sanitize::stripScripts(trim(Request::getVar('public_desc', '', 'post', 'none', 2)));
     $g_private_desc = Sanitize::stripScripts(trim(Request::getVar('private_desc', '', 'post', 'none', 2)));
     $g_restrict_msg = Sanitize::stripScripts(trim(Request::getVar('restrict_msg', '', 'post', 'none', 2)));
     $g_join_policy = Request::getInt('join_policy', 0, 'post');
     $tags = trim(Request::getVar('tags', ''));
     $lid = Request::getInt('lid', 0, 'post');
     $customization = Request::getVar('group', '', 'POST', 'none', 2);
     $plugins = Request::getVar('group_plugin', '', 'POST');
     $params = Request::getVar('params', array(), 'POST');
     $g_discussion_email_autosubscribe = Request::getInt('discussion_email_autosubscribe', 0, 'post');
     //Check authorization
     if ($this->_authorize() != 'manager' && $g_gidNumber != 0 && !$this->_authorizedForTask('group.edit')) {
         $this->_errorHandler(403, Lang::txt('COM_GROUPS_ERROR_NOT_AUTH'));
     }
     //are we editing or creating
     if ($g_gidNumber) {
         $group = Group::getInstance($g_gidNumber);
         $this->_task = 'edit';
         $before = Group::getInstance($g_gidNumber);
     } else {
         $this->_task = 'new';
         $group = new Group();
         $before = new Group();
     }
     // Check for any missing info
     if (!$g_cn) {
         $this->setNotification(Lang::txt('COM_GROUPS_SAVE_ERROR_MISSING_INFORMATION') . ': ' . Lang::txt('COM_GROUPS_DETAILS_FIELD_CN'), 'error');
     }
     if (!$g_description) {
         $this->setNotification(Lang::txt('COM_GROUPS_SAVE_ERROR_MISSING_INFORMATION') . ': ' . Lang::txt('COM_GROUPS_DETAILS_FIELD_DESCRIPTION'), 'error');
     }
     // Ensure the data passed is valid
     if ($g_cn == 'new' || $g_cn == 'browse') {
         $this->setNotification(Lang::txt('COM_GROUPS_SAVE_ERROR_INVALID_ID'), 'error');
     }
     if (!$this->_validCn($g_cn)) {
         $this->setNotification(Lang::txt('COM_GROUPS_SAVE_ERROR_INVALID_ID'), 'error');
     }
     if ($this->_task == 'new' && Group::exists($g_cn, true)) {
         $this->setNotification(Lang::txt('COM_GROUPS_SAVE_ERROR_ID_TAKEN'), 'error');
     }
     // Get the logo
     $logo = '';
     if (isset($customization['logo'])) {
         $logo_parts = explode("/", $customization['logo']);
         $logo = array_pop($logo_parts);
     }
     // Plugin settings
     $plugin_access = '';
     foreach ($plugins as $plugin) {
         $plugin_access .= $plugin['name'] . '=' . $plugin['access'] . ',' . "\n";
     }
     // Run content through validation and spam filters
     if (trim($g_public_desc)) {
         $results = Event::trigger('content.onContentBeforeSave', array('com_groups.group.public_desc', &$g_public_desc, $this->_task == 'new'));
         foreach ($results as $result) {
             if ($result === false) {
                 $this->setNotification(Lang::txt('COM_GROUPS_SAVE_ERROR_FAILED_VALIDATION'), 'error');
                 break;
             }
         }
     }
     // Push back into edit mode if any errors
     if ($this->getNotifications()) {
         $group->set('cn', $g_cn);
         $group->set('description', $g_description);
         $group->set('public_desc', $g_public_desc);
         $group->set('private_desc', $g_private_desc);
         $group->set('join_policy', $g_join_policy);
         $group->set('restrict_msg', $g_restrict_msg);
         $group->set('discoverability', $g_discoverability);
         $group->set('discussion_email_autosubscribe', $g_discussion_email_autosubscribe);
         $group->set('logo', $logo);
         $group->set('plugins', $plugin_access);
         $this->lid = $lid;
//.........这里部分代码省略.........

 /**
  * Save comment
  *
  * @return	   void, redirect
  */
 protected function _saveComment()
 {
     // Check for request forgeries
     Request::checkToken();
     // Check permission
     if (!$this->model->access('content')) {
         throw new Exception(Lang::txt('ALERTNOTAUTH'), 403);
         return;
     }
     // Incoming
     $itemid = Request::getInt('itemid', 0, 'post');
     $comment = trim(Request::getVar('comment', '', 'post'));
     $parent_activity = Request::getInt('parent_activity', 0, 'post');
     // Clean-up
     $comment = \Hubzero\Utility\Sanitize::stripScripts($comment);
     $comment = \Hubzero\Utility\Sanitize::stripImages($comment);
     $comment = \Hubzero\Utility\String::truncate($comment, 800);
     // Instantiate comment
     $objC = new \Components\Projects\Tables\Comment($this->_database);
     if ($comment) {
         $objC->itemid = $itemid;
         $objC->tbl = 'todo';
         $objC->parent_activity = $parent_activity;
         $objC->comment = $comment;
         $objC->created = Date::toSql();
         $objC->created_by = $this->_uid;
         if (!$objC->store()) {
             $this->setError($objC->getError());
         } else {
             $this->_msg = Lang::txt('PLG_PROJECTS_TODO_COMMENT_POSTED');
         }
         // Get new entry ID
         if (!$objC->id) {
             $objC->checkin();
         }
         // Record activity
         if ($objC->id) {
             $what = Lang::txt('COM_PROJECTS_TODO_ITEM');
             $url = Route::url($this->model->link('todo') . '&action=view&todoid=' . $itemid);
             $aid = $this->model->recordActivity(Lang::txt('COM_PROJECTS_COMMENTED') . ' ' . Lang::txt('COM_PROJECTS_ON') . ' ' . $what, $objC->id, $what, $url, 'quote', 0);
         }
         // Store activity ID
         if ($aid) {
             $objC->activityid = $aid;
             $objC->store();
         }
     }
     // Pass error or success message
     if ($this->getError()) {
         \Notify::message($this->getError(), 'error', 'projects');
     } elseif (!empty($this->_msg)) {
         \Notify::message($this->_msg, 'success', 'projects');
     }
     // Redirect
     App::redirect(Route::url($this->model->link('todo') . '&action=view&todoid=' . $itemid));
     return;
 }