PHP Util::sanitizeHTML方法代码示例

 /**
  * @param IEvent $event
  * @param string $parameter The parameter to be formatted
  * @param bool $allowHtml   Should HTML be used to format the parameter?
  * @param bool $verbose     Should paths, names, etc be shortened or full length
  * @return string The formatted parameter
  */
 public function format(IEvent $event, $parameter, $allowHtml, $verbose = false)
 {
     $displayName = $parameter;
     try {
         list($user, $server) = Helper::splitUserRemote($parameter);
     } catch (HintException $e) {
         $user = $parameter;
         $server = '';
     }
     if (!$verbose && $server !== '') {
         $displayName = $user . '@…';
     }
     try {
         $displayName = $this->getDisplayNameFromContact($parameter);
     } catch (\OutOfBoundsException $e) {
     }
     if ($allowHtml === null) {
         return '<federated-cloud-id display-name="' . Util::sanitizeHTML($displayName) . '" user="' . $user . '" server="' . $server . '">' . Util::sanitizeHTML($parameter) . '</federated-cloud-id>';
     }
     if ($allowHtml) {
         $title = ' title="' . Util::sanitizeHTML($parameter) . '"';
         return '<strong class="has-tooltip"' . $title . '>' . Util::sanitizeHTML($displayName) . '</strong>';
     } else {
         return $displayName;
     }
 }

 /**
  * @param IEvent $event
  * @param string $parameter The parameter to be formatted
  * @param bool $allowHtml   Should HTML be used to format the parameter?
  * @param bool $verbose     Should paths, names, etc be shortened or full length
  * @return string The formatted parameter
  */
 public function format(IEvent $event, $parameter, $allowHtml, $verbose = false)
 {
     // If the username is empty, the action has been performed by a remote
     // user, or via a public share. We don't know the username in that case
     if ($parameter === '') {
         if ($allowHtml === null) {
             return '<user display-name="' . Util::sanitizeHTML($this->l->t('"remote user"')) . '">' . Util::sanitizeHTML('') . '</user>';
         }
         if ($allowHtml) {
             return '<strong>' . $this->l->t('"remote user"') . '</strong>';
         } else {
             return $this->l->t('"remote user"');
         }
     }
     $user = $this->manager->get($parameter);
     $displayName = $user ? $user->getDisplayName() : $parameter;
     $parameter = Util::sanitizeHTML($parameter);
     if ($allowHtml === null) {
         return '<user display-name="' . Util::sanitizeHTML($displayName) . '">' . Util::sanitizeHTML($parameter) . '</user>';
     }
     if ($allowHtml) {
         $avatarPlaceholder = '';
         if ($this->config->getSystemValue('enable_avatars', true)) {
             $avatarPlaceholder = '<div class="avatar" data-user="' . $parameter . '"></div>';
         }
         return $avatarPlaceholder . '<strong>' . Util::sanitizeHTML($displayName) . '</strong>';
     } else {
         return $displayName;
     }
 }

 /**
  * @param IEvent $event
  * @param string $parameter The parameter to be formatted
  * @return string The formatted parameter
  */
 public function format(IEvent $event, $parameter)
 {
     $param = $this->fixLegacyFilename($parameter);
     // If the activity is about the very same file, we use the current path
     // for the link generation instead of the one that was saved.
     $fileId = '';
     if (is_array($param)) {
         $fileId = key($param);
         $param = $param[$fileId];
         $info = $this->infoCache->getInfoById($this->user, $fileId, $param);
     } elseif ($event->getObjectType() === 'files' && $event->getObjectName() === $param) {
         $fileId = $event->getObjectId();
         $info = $this->infoCache->getInfoById($this->user, $fileId, $param);
     } else {
         $info = $this->infoCache->getInfoByPath($this->user, $param);
     }
     if ($info['is_dir']) {
         $linkData = ['dir' => $info['path']];
     } else {
         $parentDir = substr_count($info['path'], '/') === 1 ? '/' : dirname($info['path']);
         $fileName = basename($info['path']);
         $linkData = ['dir' => $parentDir, 'scrollto' => $fileName];
     }
     if ($info['view'] !== '') {
         $linkData['view'] = $info['view'];
     }
     $param = trim($param, '/');
     $fileLink = $this->urlGenerator->linkToRouteAbsolute('files.view.index', $linkData);
     return '<file link="' . $fileLink . '" id="' . Util::sanitizeHTML($fileId) . '">' . Util::sanitizeHTML($param) . '</file>';
 }

 public static function printAutoLoginPage($user)
 {
     $user = \OCP\Util::sanitizeHTML($user);
     $title = 'Forwarding to ownCloud login page';
     $body = '<form id="auto_login_form" action="' . \OC::$WEBROOT . '/index.php" method="post" enctype="application/x-www-form-urlencoded" target="_self" ><input type="hidden" id="user" name="user" value="' . $user . '"/><input type="hidden" id="password" name="password" value="irrelevant"/><noscript><input type="submit" name="login" value="Log in" /></noscript></form><script type="text/javascript" >document.getElementById("auto_login_form").submit();</script>';
     self::printPage($title, $body);
 }

 /**
  * @param IEvent $event
  * @param string $parameter The parameter to be formatted
  * @param bool $allowHtml   Should HTML be used to format the parameter?
  * @param bool $verbose     Should paths, names, etc be shortened or full length
  * @return string The formatted parameter
  */
 public function format(IEvent $event, $parameter, $allowHtml, $verbose = false)
 {
     if ($allowHtml) {
         return '<strong>' . Util::sanitizeHTML($parameter) . '</strong>';
     } else {
         return $parameter;
     }
 }

 /**
  * @param IEvent $event
  * @param string $parameter The parameter to be formatted
  * @return string The formatted parameter
  */
 public function format(IEvent $event, $parameter)
 {
     // If the username is empty, the action has been performed by a remote
     // user, or via a public share. We don't know the username in that case
     if ($parameter === '') {
         return '<user display-name="' . Util::sanitizeHTML($this->l->t('"remote user"')) . '">' . Util::sanitizeHTML('') . '</user>';
     }
     $user = $this->manager->get($parameter);
     $displayName = $user ? $user->getDisplayName() : $parameter;
     $parameter = Util::sanitizeHTML($parameter);
     return '<user display-name="' . Util::sanitizeHTML($displayName) . '">' . Util::sanitizeHTML($parameter) . '</user>';
 }

 /**
  * @param IEvent $event
  * @param string $parameter The parameter to be formatted
  * @return string The formatted parameter
  */
 public function format(IEvent $event, $parameter)
 {
     $displayName = $parameter;
     try {
         list($user, $server) = Helper::splitUserRemote($parameter);
     } catch (HintException $e) {
         $user = $parameter;
         $server = '';
     }
     if ($server !== '') {
         $displayName = $user . '@…';
     }
     try {
         $displayName = $this->getDisplayNameFromContact($parameter);
     } catch (\OutOfBoundsException $e) {
     }
     return '<federated-cloud-id display-name="' . Util::sanitizeHTML($displayName) . '" user="' . Util::sanitizeHTML($user) . '" server="' . Util::sanitizeHTML($server) . '">' . Util::sanitizeHTML($parameter) . '</federated-cloud-id>';
 }

 /**
  * @param IEvent $event
  * @param string $parameter The parameter to be formatted
  * @param bool $allowHtml   Should HTML be used to format the parameter?
  * @param bool $verbose     Should paths, names, etc be shortened or full length
  * @return string The formatted parameter
  */
 public function format(IEvent $event, $parameter, $allowHtml, $verbose = false)
 {
     $displayName = $parameter;
     if (!$verbose) {
         try {
             list($user, ) = Helper::splitUserRemote($parameter);
             $displayName = $user . '@…';
         } catch (HintException $e) {
         }
     }
     try {
         $displayName = $this->getDisplayNameFromContact($parameter);
     } catch (\OutOfBoundsException $e) {
     }
     if ($allowHtml) {
         $title = ' title="' . Util::sanitizeHTML($parameter) . '"';
         return '<strong class="has-tooltip"' . $title . '>' . Util::sanitizeHTML($displayName) . '</strong>';
     } else {
         return $displayName;
     }
 }

 public function filetype($path)
 {
     $this->init();
     $path = $this->cleanPath($path);
     try {
         $response = $this->client->propfind($this->encodePath($path), array('{DAV:}resourcetype'));
         $responseType = array();
         if (isset($response["{DAV:}resourcetype"])) {
             $responseType = $response["{DAV:}resourcetype"]->resourceType;
         }
         return (count($responseType) > 0 and $responseType[0] == "{DAV:}collection") ? 'dir' : 'file';
     } catch (\Exception $e) {
         error_log($e->getMessage());
         \OCP\Util::writeLog("webdav client", \OCP\Util::sanitizeHTML($e->getMessage()), \OCP\Util::ERROR);
         return false;
     }
 }

 /**
  * @param IEvent $event
  * @param string $parameter The parameter to be formatted
  * @param bool $allowHtml   Should HTML be used to format the parameter?
  * @param bool $verbose     Should paths, names, etc be shortened or full length
  * @return string The formatted parameter
  */
 public function format(IEvent $event, $parameter, $allowHtml, $verbose = false)
 {
     $param = $this->fixLegacyFilename($parameter);
     // If the activity is about the very same file, we use the current path
     // for the link generation instead of the one that was saved.
     if ($event->getObjectType() === 'files' && $event->getObjectName() === $param) {
         $info = $this->infoCache->getInfoById($this->user, $event->getObjectId(), $param);
     } else {
         $info = $this->infoCache->getInfoByPath($this->user, $param);
     }
     if ($info['is_dir']) {
         $linkData = ['dir' => $info['path']];
     } else {
         $parentDir = substr_count($info['path'], '/') === 1 ? '/' : dirname($info['path']);
         $fileName = basename($info['path']);
         $linkData = ['dir' => $parentDir, 'scrollto' => $fileName];
     }
     if ($info['view'] !== '') {
         $linkData['view'] = $info['view'];
     }
     $param = trim($param, '/');
     list($path, $name) = $this->splitPathFromFilename($param);
     if ($verbose || $path === '') {
         if (!$allowHtml) {
             return $param;
         }
         $fileLink = $this->urlGenerator->linkTo('files', 'index.php', $linkData);
         return '<a class="filename" href="' . $fileLink . '">' . Util::sanitizeHTML($param) . '</a>';
     }
     if (!$allowHtml) {
         return $name;
     }
     $title = ' title="' . $this->l->t('in %s', array(Util::sanitizeHTML($path))) . '"';
     $fileLink = $this->urlGenerator->linkTo('files', 'index.php', $linkData);
     return '<a class="filename has-tooltip" href="' . $fileLink . '"' . $title . '>' . Util::sanitizeHTML($name) . '</a>';
 }

<?php

/** @var $l OC_L10N */
vendor_script('jsTimezoneDetect/jstz');
script('core', ['visitortimezone', 'lostpassword', 'login']);
?>

<!--[if IE 8]><style>input[type="checkbox"]{padding:0;}</style><![endif]-->
<form method="post" name="login">
	<fieldset>
	<?php 
if (!empty($_['redirect_url'])) {
    print_unescaped('<input type="hidden" name="redirect_url" value="' . \OCP\Util::sanitizeHTML($_['redirect_url']) . '">');
}
?>
		<?php 
if (isset($_['apacheauthfailed']) && $_['apacheauthfailed']) {
    ?>
			<div class="warning">
				<?php 
    p($l->t('Server side authentication failed!'));
    ?>
<br>
				<small><?php 
    p($l->t('Please contact your administrator.'));
    ?>
</small>
			</div>
		<?php 
}
?>

foreach ($_['timezones'] as $timezone) {
    $ex = explode('/', $timezone, 2);
    //obtain continent,city
    if (!isset($ex[1])) {
        $ex[1] = $ex[0];
        $ex[0] = "Other";
    }
    if ($continent != $ex[0]) {
        if ($continent != "") {
            print_unescaped('</optgroup>');
        }
        print_unescaped('<optgroup label="' . \OCP\Util::sanitizeHTML($ex[0]) . '">');
    }
    $city = strtr($ex[1], '_', ' ');
    $continent = $ex[0];
    print_unescaped('<option value="' . \OCP\Util::sanitizeHTML($timezone) . '"' . ($_['timezone'] == $timezone ? ' selected="selected"' : '') . '>' . \OCP\Util::sanitizeHTML($city) . '</option>');
}
?>
				</select>
	</div>	
	
	
	
	
</div>
<div id="leftcontent">
	<div id="leftcontentInner">
	<div id="datepickerNav"></div>	
	</div>
</div>

        ?>
			<link><?php 
        p($activity['link']);
        ?>
</link>
<?php 
    }
    if (!empty($activity['timestamp'])) {
        ?>
			<pubDate><?php 
        p(date('r', $activity['timestamp']));
        ?>
</pubDate>
<?php 
    }
    if (!empty($activity['message'])) {
        ?>
			<description><![CDATA[<?php 
        print_unescaped(str_replace("\n", '<br />', \OCP\Util::sanitizeHTML($activity['message_prepared'])));
        ?>
]]></description>
<?php 
    }
    ?>
		</item>
<?php 
}
?>
	</channel>
</rss>

 /**
  * @brief Data structure of properties
  * @param object $property
  * @return associative array
  *
  * returns an associative array with
  * ['name'] name of property
  * ['value'] htmlspecialchars escaped value of property
  * ['parameters'] associative array name=>value
  * ['checksum'] checksum of whole property
  * NOTE: $value is not escaped anymore. It shouldn't make any difference
  * but we should look out for any problems.
  */
 public static function structureProperty(\Sabre\VObject\Property $property)
 {
     if (!in_array($property->name, App::$index_properties)) {
         return;
     }
     $value = $property->getValue();
     if ($property->name == 'ADR' || $property->name == 'N' || $property->name == 'ORG' || $property->name == 'CATEGORIES') {
         $value = $property->getParts();
         if ($property->name == 'CATEGORIES') {
             $value = str_replace(';', ',', $value);
         }
         if ($property->name == 'N') {
             //$value = stripslashes($value);
             //	\OCP\Util::writeLog('contactsplus','NAME VAL: '.$value, \OCP\Util::DEBUG);
         }
         $value = array_map('trim', $value);
     } elseif ($property->name == 'BDAY') {
         if (strlen($value) >= 8 && is_int(substr($value, 0, 4)) && is_int(substr($value, 4, 2)) && is_int(substr($value, 6, 2))) {
             $value = substr($value, 0, 4) . '-' . substr($value, 4, 2) . '-' . substr($value, 6, 2);
         } else {
             if ($value[5] !== '-' || $value[7] !== '-') {
                 try {
                     // Skype exports as e.g. Jan 14, 1996
                     $date = new \DateTime($value);
                     $value = $date->format('Y-m-d');
                 } catch (\Exception $e) {
                     \OCP\Util::writeLog('contactsplus', __METHOD__ . ' Error parsing date: ' . $value, \OCP\Util::DEBUG);
                     return;
                 }
             }
         }
     } elseif ($property->name == 'PHOTO') {
         $value = true;
     } elseif ($property->name == 'IMPP') {
         if (strpos($value, ':') !== false) {
             $value = explode(':', $value);
             $protocol = array_shift($value);
             if (!isset($property['X-SERVICE-TYPE'])) {
                 $property['X-SERVICE-TYPE'] = strtoupper($protocol);
             }
             $value = implode('', $value);
         }
     }
     if (is_string($value)) {
         $value = strtr($value, array('\\,' => ',', '\\;' => ';'));
     }
     $temp = array('value' => $value, 'parameters' => array());
     // This cuts around a 3rd off of the json response size.
     if (in_array($property->name, App::$multi_properties)) {
         $temp['checksum'] = substr(md5($property->serialize()), 0, 8);
     }
     foreach ($property->parameters as $parameter) {
         // Faulty entries by kaddressbook
         // Actually TYPE=PREF is correct according to RFC 2426
         // but this way is more handy in the UI. Tanghus.
         if ($parameter->name == 'TYPE' && strtoupper($parameter->getValue()) == 'PREF') {
             $parameter->name = 'PREF';
             $parameter->setValue('1');
         }
         // NOTE: Apparently Sabre_VObject_Reader can't always deal with value list parameters
         // like TYPE=HOME,CELL,VOICE. Tanghus.
         // TODO: Check if parameter is has commas and split + merge if so.
         if ($parameter->name == 'TYPE') {
             $pvalue = $parameter->getValue();
             if (is_string($pvalue) && strpos($pvalue, ',') !== false) {
                 $pvalue = array_map('trim', explode(',', $pvalue));
             }
             $pvalue = is_array($pvalue) ? $pvalue : array($pvalue);
             if (isset($temp['parameters'][$parameter->name])) {
                 $temp['parameters'][$parameter->name][] = \OCP\Util::sanitizeHTML($pvalue);
             } else {
                 $temp['parameters'][$parameter->name] = \OCP\Util::sanitizeHTML($pvalue);
             }
         } else {
             //$value = strtr($value, array('\,' => ',', '\;' => ';'));
             $temp['parameters'][$parameter->name] = \OCP\Util::sanitizeHTML($parameter->getValue());
         }
     }
     return $temp;
 }

 /**
  * Process the template
  * @return boolean|string
  *
  * This function process the template. If $this->renderAs is set, it
  * will produce a full page.
  */
 public function fetchPage()
 {
     $data = parent::fetchPage();
     if ($this->renderAs) {
         $page = new OC_TemplateLayout($this->renderAs, $this->app);
         // Add custom headers
         $headers = '';
         foreach (OC_Util::$headers as $header) {
             $headers .= '<' . \OCP\Util::sanitizeHTML($header['tag']);
             foreach ($header['attributes'] as $name => $value) {
                 $headers .= ' ' . \OCP\Util::sanitizeHTML($name) . '="' . \OCP\Util::sanitizeHTML($value) . '"';
             }
             if ($header['text'] !== null) {
                 $headers .= '>' . \OCP\Util::sanitizeHTML($header['text']) . '</' . \OCP\Util::sanitizeHTML($header['tag']) . '>';
             } else {
                 $headers .= '/>';
             }
         }
         $page->assign('headers', $headers);
         $page->assign('content', $data);
         return $page->fetchPage();
     }
     return $data;
 }