tonyair/silverstripe-framework
1
0
Fork 0
mirror of https://github.com/silverstripe/silverstripe-framework synced 2024-10-03 22:58:24 +02:00
Code Issues Projects Releases Wiki Activity

MINO Switching 'rewriteHashlinks' sanitization from Convert::raw2att() to strip_tags() to make the resulting PHP more portable when mode is set to 'php'

Browse Source
This commit is contained in:
Ingo Schommer 2011-10-18 10:54:30 +02:00
parent 16c32359c6
commit 96bee47ab8
2 changed files with 4 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
core/SSViewer.php
View File

@ -439,10 +439,9 @@ class SSViewer {
if($this->rewriteHashlinks && self::$options['rewriteHashlinks']) {
if(strpos($output, '<base') !== false) {
if(SSViewer::$options['rewriteHashlinks'] === 'php') {
// Emulate Convert::raw2att() without adding this dependency
$thisURLRelativeToBase = "<?php echo str_replace(array('&','\"',\"'\",'<','>'), array('&amp;','&quot;','&#39;','&lt;','&gt;'), \$_SERVER['REQUEST_URI']); ?>";
$thisURLRelativeToBase = "<?php echo strip_tags(\$_SERVER['REQUEST_URI']); ?>";
} else {
$thisURLRelativeToBase = Convert::raw2att($_SERVER['REQUEST_URI']);
$thisURLRelativeToBase = strip_tags($_SERVER['REQUEST_URI']);
}
$output = preg_replace('/(<a[^>]+href *= *)"#/i', '\\1"' . $thisURLRelativeToBase . '#', $output);
}
@ -607,7 +606,7 @@ class SSViewer {
$content = ereg_replace('<!-- +if_end +-->', '<? } ?>', $content);
// Fix link stuff
$content = ereg_replace('href *= *"#', 'href="<?= SSViewer::$options[\'rewriteHashlinks\'] ? Convert::raw2att( $_SERVER[\'REQUEST_URI\'] ) : "" ?>#', $content);
$content = ereg_replace('href *= *"#', 'href="<?= SSViewer::$options[\'rewriteHashlinks\'] ? strip_tags( $_SERVER[\'REQUEST_URI\'] ) : "" ?>#', $content);
// Protect xml header
$content = ereg_replace('<\?xml([^>]+)\?' . '>', '<##xml\\1##>', $content);

2
tests/SSViewerTest.php
View File

@ -193,7 +193,7 @@ SS
$obj->InsertedLink = '<a class="inserted" href="#anchor">InsertedLink</a>';
$result = $tmpl->process($obj);
$this->assertContains(
'<a class="inserted" href="<?php echo str_replace(',
'<a class="inserted" href="<?php echo strip_tags(',
$result
);
// TODO Fix inline links in PHP mode