CxTс{"gn6o/W#uIQSH>w1drCEߺe&eCC_ CPJM>Sai)܁ܺq+@*#dZc #m@! 1]cMq *Jlv[X@kt?}lXEݡ|:RP6c^]ݭ@hňy8iyl86/6ȃ]x"sk;en\Wz06Q\-J? >QGYA0Q $q" fYrɀ?U^wqB>Rdط,,6 4ӞoU#o6%iG8_X\o?֧ H8/`zytk"gt nRrGC}|s)?F i9s.D<;s,|]lgw1 ت`{w_?Xz" /;ঊE~9\Ka[=wQrP0/^483秫YGHM%qO": ua4rNj[5{RS%ٝa:(y Uw郗؂I4+h'/WW;pQ}ΌjŌR)!^dfUEk V$E.XGЮM 5͔! G[RON^TAbI=Ti:Kka ʨ*p4?SF>wj'T',rvfF&Krj cc&;ZbL3op U -YT]\!Jis+Q|`tfFDj1p*Xa=EjE?p0cFwf h*p$NO&A6x<:!܂zrDw vw2%+d8g&.6pٲFB_Bs@UeDbL%tS ĢQ$3ݼuPg fRr/RY>*ȄnOJ:3\ZfEݴSC1MKș\q#e<,t[&u S[:^(@RqjO"ȖY'A+/|fyf[6(#/lpws㭹rYq)5>#ټC ? om# :g+` R1zڱ!$~󊏬M`_/v>BT̪ngwOZe9N_ʍpZ#0#˞q׌947XYJd q(gk|"3@i+Dܗ{ d+gd@eԑ`,;ںR%ݦXu"SPue5#A+0 P0Zx_ܤ\j~#0+ NB Y\Tb^q|}}(알:-ɞ ØNHolum@n6o/W#t%aP9hS[)ôd_+aj],ӺOn3i\.9@B'zW2Xޛwwk1=@]uEڂ6PPp .< "<[EN5GtN&n6 ޚlL?}6Mҏ(l2[ֵ*wr_Token) { trigger_error('Cannot generate HTML from non-HTMLPurifier_Token object', E_USER_WARNING); return ''; } elseif ($token instanceof HTMLPurifier_Token_Start) { $attr = $this->generateAttributes($token->attr, $token->name); if ($this->_flashCompat) { if ($token->name == "object") { $flash = new stdClass(); $flash->attr = $token->attr; $flash->param = array(); $this->_flashStack[] = $flash; } } return '<' . $token->name . ($attr ? ' ' : '') . $attr . '>'; } elseif ($token instanceof HTMLPurifier_Token_End) { $_extra = ''; if ($this->_flashCompat) { if ($token->name == "object" && !empty($this->_flashStack)) { // doesn't do anything for now } } return $_extra . 'name . '>'; } elseif ($token instanceof HTMLPurifier_Token_Empty) { if ($this->_flashCompat && $token->name == "param" && !empty($this->_flashStack)) { $this->_flashStack[count($this->_flashStack)-1]->param[$token->attr['name']] = $token->attr['value']; } $attr = $this->generateAttributes($token->attr, $token->name); return '<' . $token->name . ($attr ? ' ' : '') . $attr . ( $this->_xhtml ? ' /': '' ) //
v.
. '>'; } elseif ($token instanceof HTMLPurifier_Token_Text) { return $this->escape($token->data, ENT_NOQUOTES); } elseif ($token instanceof HTMLPurifier_Token_Comment) { return ''; } else { return ''; } } /** * Special case processor for the contents of script tags * @param HTMLPurifier_Token $token HTMLPurifier_Token object. * @return string * @warning This runs into problems if there's already a literal * --> somewhere inside the script contents. */ public function generateScriptFromToken($token) { if (!$token instanceof HTMLPurifier_Token_Text) { return $this->generateFromToken($token); } // Thanks $data = preg_replace('#//\s*$#', '', $token->data); return ''; } /** * Generates attribute declarations from attribute array. * @note This does not include the leading or trailing space. * @param array $assoc_array_of_attributes Attribute array * @param string $element Name of element attributes are for, used to check * attribute minimization. * @return string Generated HTML fragment for insertion. */ public function generateAttributes($assoc_array_of_attributes, $element = '') { $html = ''; if ($this->_sortAttr) { ksort($assoc_array_of_attributes); } foreach ($assoc_array_of_attributes as $key => $value) { if (!$this->_xhtml) { // Remove namespaced attributes if (strpos($key, ':') !== false) { continue; } // Check if we should minimize the attribute: val="val" -> val if ($element && !empty($this->_def->info[$element]->attr[$key]->minimized)) { $html .= $key . ' '; continue; } } // Workaround for Internet Explorer innerHTML bug. // Essentially, Internet Explorer, when calculating // innerHTML, omits quotes if there are no instances of // angled brackets, quotes or spaces. However, when parsing // HTML (for example, when you assign to innerHTML), it // treats backticks as quotes. Thus, // `` // becomes // `` // becomes // // Fortunately, all we need to do is trigger an appropriate // quoting style, which we do by adding an extra space. // This also is consistent with the W3C spec, which states // that user agents may ignore leading or trailing // whitespace (in fact, most don't, at least for attributes // like alt, but an extra space at the end is barely // noticeable). Still, we have a configuration knob for // this, since this transformation is not necesary if you // don't process user input with innerHTML or you don't plan // on supporting Internet Explorer. if ($this->_innerHTMLFix) { if (strpos($value, '`') !== false) { // check if correct quoting style would not already be // triggered if (strcspn($value, '"\' <>') === strlen($value)) { // protect! $value .= ' '; } } } $html .= $key.'="'.$this->escape($value).'" '; } return rtrim($html); } /** * Escapes raw text data. * @todo This really ought to be protected, but until we have a facility * for properly generating HTML here w/o using tokens, it stays * public. * @param string $string String data to escape for HTML. * @param int $quote Quoting style, like htmlspecialchars. ENT_NOQUOTES is * permissible for non-attribute output. * @return string escaped data. */ public function escape($string, $quote = null) { // Workaround for APC bug on Mac Leopard reported by sidepodcast // http://htmlpurifier.org/phorum/read.php?3,4823,4846 if ($quote === null) { $quote = ENT_COMPAT; } return htmlspecialchars($string, $quote, 'UTF-8'); } } // vim: et sw=4 sts=4