From a9b8e1b7dd3dded5a017dc282e300f6616c04f58 Mon Sep 17 00:00:00 2001 From: Christian Ernst Date: Tue, 6 Dec 2022 16:33:08 +0100 Subject: [PATCH 1/7] feature: enable viewer.js for individual moduels; --- func/classes.new/ESModule.php | 7 +++++-- func/classes.new/ESRender/Module/ContentNode/Abstract.php | 7 ++++--- modules/doc/mod_doc.php | 4 +++- modules/office/mod_office.php | 4 +++- modules/office_spreadsheet/mod_office_spreadsheet.php | 4 +++- theme/default/module/doc/pdf/dynamic.phtml | 4 ++-- 6 files changed, 20 insertions(+), 10 deletions(-) diff --git a/func/classes.new/ESModule.php b/func/classes.new/ESModule.php index 161a388d..d09b4687 100644 --- a/func/classes.new/ESModule.php +++ b/func/classes.new/ESModule.php @@ -129,6 +129,8 @@ final public function setName($ESMODULE_NAME) */ final public function setModuleByMimetype($p_mimetype) { + global $VIEWER_JS_CONFIG; + // use only MIME's "type/subtype" specification, skip optional parameters $MimeTypeParts = explode(';', $p_mimetype); $MimeType = $MimeTypeParts[0]; @@ -150,8 +152,9 @@ final public function setModuleByMimetype($p_mimetype) } $modName = $result -> ESMODULE_NAME; - if (!ENABLE_VIEWER_JS && $modName == 'office'){ - $modName = 'doc'; + if (!ENABLE_VIEWER_JS && $modName == 'office' || + ENABLE_VIEWER_JS && !in_array($modName, $VIEWER_JS_CONFIG) ){ + $modName = 'doc'; } Logger::getLogger('de.metaventis.esrender.index') -> info('Mimetype is "'.$MimeType.'", using module "'.$modName.'".'); diff --git a/func/classes.new/ESRender/Module/ContentNode/Abstract.php b/func/classes.new/ESRender/Module/ContentNode/Abstract.php index 5062c977..52120cac 100644 --- a/func/classes.new/ESRender/Module/ContentNode/Abstract.php +++ b/func/classes.new/ESRender/Module/ContentNode/Abstract.php @@ -31,7 +31,7 @@ protected function getCacheFileName() * @see ESRender_Module_Base::createInstance() */ public function createInstance() { - global $CC_RENDER_PATH; + global $CC_RENDER_PATH, $VIEWER_JS_CONFIG;; ini_set('memory_limit', '4000M'); $Logger = $this->getLogger(); @@ -43,8 +43,9 @@ public function createInstance() { $this->filename = $this-> esObject ->getObjectIdVersion(); $module = $this->esObject->module->getName(); - if (!ENABLE_VIEWER_JS && strpos($module, 'office') !== false){ - $module = 'doc'; + if (!ENABLE_VIEWER_JS && strpos($module, 'office') !== false || + ENABLE_VIEWER_JS && !in_array($module, $VIEWER_JS_CONFIG) ){ + $module = 'doc'; } // real path diff --git a/modules/doc/mod_doc.php b/modules/doc/mod_doc.php index 1591187b..90ed58ae 100644 --- a/modules/doc/mod_doc.php +++ b/modules/doc/mod_doc.php @@ -58,13 +58,15 @@ public function __construct($Name, ESRender_Application_Interface $RenderApplica protected function renderTemplate($TemplateName, $showMetadata = true) { + global $VIEWER_JS_CONFIG; + $template_data = parent::prepareRenderData($showMetadata); $template_data['previewUrl'] = $this -> esObject->getPreviewUrl(); if(Config::get('hasContentLicense') === true) { if($this->getDoctype() == DOCTYPE_PDF) { - if (ENABLE_VIEWER_JS){ + if (ENABLE_VIEWER_JS && in_array('pdf', $VIEWER_JS_CONFIG)){ $template_data['content'] = ($this->convertedPath ? $this->convertedPath : $this -> esObject -> getPath()) . '?' . session_name() . '=' . session_id().'&token=' . Config::get('token'); }else{ diff --git a/modules/office/mod_office.php b/modules/office/mod_office.php index d958656c..8bb4d1fe 100644 --- a/modules/office/mod_office.php +++ b/modules/office/mod_office.php @@ -123,7 +123,9 @@ private function getReader($src) { } public static function canProcess($esObject) { - if (ENABLE_VIEWER_JS){ + global $VIEWER_JS_CONFIG; + + if (ENABLE_VIEWER_JS && in_array('office', $VIEWER_JS_CONFIG)){ // echo $esObject->getMimetype(); $supported = [ 'application/vnd.oasis.opendocument.text', diff --git a/modules/office_spreadsheet/mod_office_spreadsheet.php b/modules/office_spreadsheet/mod_office_spreadsheet.php index 77fe9d0b..c7bd6db5 100644 --- a/modules/office_spreadsheet/mod_office_spreadsheet.php +++ b/modules/office_spreadsheet/mod_office_spreadsheet.php @@ -92,7 +92,9 @@ private function getReader($src) { } public static function canProcess($esObject) { - if (ENABLE_VIEWER_JS){ + global $VIEWER_JS_CONFIG; + + if (ENABLE_VIEWER_JS && in_array('spreadsheet', $VIEWER_JS_CONFIG)){ $supported = [ 'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet', 'application/vnd.ms-excel', diff --git a/theme/default/module/doc/pdf/dynamic.phtml b/theme/default/module/doc/pdf/dynamic.phtml index 8f784460..1afcff99 100644 --- a/theme/default/module/doc/pdf/dynamic.phtml +++ b/theme/default/module/doc/pdf/dynamic.phtml @@ -1,5 +1,5 @@ -

' . $msg['cannotOpenObject']->localize($Locale, $Translate) . '

' . From 0a674c0d5ba19628688a5980ce335234b78da90e Mon Sep 17 00:00:00 2001 From: Christian Ernst Date: Wed, 7 Dec 2022 12:39:00 +0100 Subject: [PATCH 2/7] update: HTML Purifier; --- .../htmlpurifier/HTMLPurifier.standalone.php | 390 +++++++++++++----- .../HTMLPurifier/ConfigSchema/schema.ser | Bin 15923 -> 24190 bytes .../AutoFormat.RemoveEmpty.RemoveNbsp.txt | 2 +- .../schema/Core.AllowParseManyTags.txt | 12 + .../schema/Core.ColorKeywords.txt | 157 ++++++- .../ConfigSchema/schema/HTML.Forms.txt | 11 + ...529d2d2aa4f137a4d6d6292a92e3ee82eb86,1.ser | Bin 93685 -> 0 bytes ...e2120beac0ea47b312955efdbd2ae957c8b2,1.ser | Bin 6038 -> 0 bytes ...554cb95d7c0d9fd45cd72cfd8ed7405cc0a5,1.ser | Bin 98959 -> 0 bytes ...238e680361cd87bf880f5b3cc50a1e7abc6c,1.ser | Bin 516 -> 0 bytes .../Language/classes/en-x-test.php | 9 - .../Language/messages/en-x-test.php | 11 - .../Language/messages/en-x-testmini.php | 12 - .../standalone/HTMLPurifier/Lexer/PH5P.php | 6 +- .../HTMLPurifier/Printer/ConfigForm.php | 4 +- .../HTMLPurifier/Printer/HTMLDefinition.php | 4 +- 16 files changed, 464 insertions(+), 154 deletions(-) create mode 100644 src/main/php/func/extern/htmlpurifier/standalone/HTMLPurifier/ConfigSchema/schema/Core.AllowParseManyTags.txt create mode 100644 src/main/php/func/extern/htmlpurifier/standalone/HTMLPurifier/ConfigSchema/schema/HTML.Forms.txt delete mode 100644 src/main/php/func/extern/htmlpurifier/standalone/HTMLPurifier/DefinitionCache/Serializer/HTML/4.9.3,42d2529d2d2aa4f137a4d6d6292a92e3ee82eb86,1.ser delete mode 100644 src/main/php/func/extern/htmlpurifier/standalone/HTMLPurifier/DefinitionCache/Serializer/HTML/4.9.3,478ce2120beac0ea47b312955efdbd2ae957c8b2,1.ser delete mode 100644 src/main/php/func/extern/htmlpurifier/standalone/HTMLPurifier/DefinitionCache/Serializer/HTML/4.9.3,719c554cb95d7c0d9fd45cd72cfd8ed7405cc0a5,1.ser delete mode 100644 src/main/php/func/extern/htmlpurifier/standalone/HTMLPurifier/DefinitionCache/Serializer/URI/4.9.3,3478238e680361cd87bf880f5b3cc50a1e7abc6c,1.ser delete mode 100644 src/main/php/func/extern/htmlpurifier/standalone/HTMLPurifier/Language/classes/en-x-test.php delete mode 100644 src/main/php/func/extern/htmlpurifier/standalone/HTMLPurifier/Language/messages/en-x-test.php delete mode 100644 src/main/php/func/extern/htmlpurifier/standalone/HTMLPurifier/Language/messages/en-x-testmini.php diff --git a/src/main/php/func/extern/htmlpurifier/HTMLPurifier.standalone.php b/src/main/php/func/extern/htmlpurifier/HTMLPurifier.standalone.php index 754d6938..8f138bec 100644 --- a/src/main/php/func/extern/htmlpurifier/HTMLPurifier.standalone.php +++ b/src/main/php/func/extern/htmlpurifier/HTMLPurifier.standalone.php @@ -7,7 +7,7 @@ * primary concern and you are using an opcode cache. PLEASE DO NOT EDIT THIS * FILE, changes will be overwritten the next time the script is run. * - * @version 4.9.3 + * @version 4.15.0 * * @warning * You must *not* include any other HTML Purifier files before this file, @@ -39,7 +39,7 @@ */ /* - HTML Purifier 4.9.3 - Standards Compliant HTML Filtering + HTML Purifier 4.15.0 - Standards Compliant HTML Filtering Copyright (C) 2006-2008 Edward Z. Yang This library is free software; you can redistribute it and/or @@ -78,12 +78,12 @@ class HTMLPurifier * Version of HTML Purifier. * @type string */ - public $version = '4.9.3'; + public $version = '4.15.0'; /** * Constant with version of HTML Purifier. */ - const VERSION = '4.9.3'; + const VERSION = '4.15.0'; /** * Global configuration object. @@ -260,12 +260,17 @@ public function purify($html, $config = null) public function purifyArray($array_of_html, $config = null) { $context_array = array(); - foreach ($array_of_html as $key => $html) { - $array_of_html[$key] = $this->purify($html, $config); + $array = array(); + foreach($array_of_html as $key=>$value){ + if (is_array($value)) { + $array[$key] = $this->purifyArray($value, $config); + } else { + $array[$key] = $this->purify($value, $config); + } $context_array[$key] = $this->context; } $this->context = $context_array; - return $array_of_html; + return $array; } /** @@ -781,6 +786,7 @@ public function __construct() $this->info['IAlign'] = self::makeEnum('top,middle,bottom,left,right'); $this->info['LAlign'] = self::makeEnum('top,bottom,left,right'); $this->info['FrameTarget'] = new HTMLPurifier_AttrDef_HTML_FrameTarget(); + $this->info['ContentEditable'] = new HTMLPurifier_AttrDef_HTML_ContentEditable(); // unimplemented aliases $this->info['ContentType'] = new HTMLPurifier_AttrDef_Text(); @@ -1307,6 +1313,22 @@ protected function doSetup($config) ); $this->info['background-position'] = new HTMLPurifier_AttrDef_CSS_BackgroundPosition(); + $this->info['background-size'] = new HTMLPurifier_AttrDef_CSS_Composite( + array( + new HTMLPurifier_AttrDef_Enum( + array( + 'auto', + 'cover', + 'contain', + 'initial', + 'inherit', + ) + ), + new HTMLPurifier_AttrDef_CSS_Percentage(), + new HTMLPurifier_AttrDef_CSS_Length() + ) + ); + $border_color = $this->info['border-top-color'] = $this->info['border-bottom-color'] = @@ -1418,15 +1440,25 @@ protected function doSetup($config) array( new HTMLPurifier_AttrDef_CSS_Length('0'), new HTMLPurifier_AttrDef_CSS_Percentage(true), - new HTMLPurifier_AttrDef_Enum(array('auto')) + new HTMLPurifier_AttrDef_Enum(array('auto', 'initial', 'inherit')) + ) + ); + $trusted_min_wh = new HTMLPurifier_AttrDef_CSS_Composite( + array( + new HTMLPurifier_AttrDef_CSS_Length('0'), + new HTMLPurifier_AttrDef_CSS_Percentage(true), + new HTMLPurifier_AttrDef_Enum(array('initial', 'inherit')) + ) + ); + $trusted_max_wh = new HTMLPurifier_AttrDef_CSS_Composite( + array( + new HTMLPurifier_AttrDef_CSS_Length('0'), + new HTMLPurifier_AttrDef_CSS_Percentage(true), + new HTMLPurifier_AttrDef_Enum(array('none', 'initial', 'inherit')) ) ); $max = $config->get('CSS.MaxImgLength'); - $this->info['min-width'] = - $this->info['max-width'] = - $this->info['min-height'] = - $this->info['max-height'] = $this->info['width'] = $this->info['height'] = $max === null ? @@ -1443,6 +1475,38 @@ protected function doSetup($config) // For everyone else: $trusted_wh ); + $this->info['min-width'] = + $this->info['min-height'] = + $max === null ? + $trusted_min_wh : + new HTMLPurifier_AttrDef_Switch( + 'img', + // For img tags: + new HTMLPurifier_AttrDef_CSS_Composite( + array( + new HTMLPurifier_AttrDef_CSS_Length('0', $max), + new HTMLPurifier_AttrDef_Enum(array('initial', 'inherit')) + ) + ), + // For everyone else: + $trusted_min_wh + ); + $this->info['max-width'] = + $this->info['max-height'] = + $max === null ? + $trusted_max_wh : + new HTMLPurifier_AttrDef_Switch( + 'img', + // For img tags: + new HTMLPurifier_AttrDef_CSS_Composite( + array( + new HTMLPurifier_AttrDef_CSS_Length('0', $max), + new HTMLPurifier_AttrDef_Enum(array('none', 'initial', 'inherit')) + ) + ), + // For everyone else: + $trusted_max_wh + ); $this->info['text-decoration'] = new HTMLPurifier_AttrDef_CSS_TextDecoration(); @@ -1764,7 +1828,7 @@ class HTMLPurifier_Config * HTML Purifier's version * @type string */ - public $version = '4.9.3'; + public $version = '4.15.0'; /** * Whether or not to automatically finalize @@ -2151,7 +2215,7 @@ private function _listify($lookup) * maybeGetRawHTMLDefinition, which is more explicitly * named, instead. * - * @return HTMLPurifier_HTMLDefinition + * @return HTMLPurifier_HTMLDefinition|null */ public function getHTMLDefinition($raw = false, $optimized = false) { @@ -2170,7 +2234,7 @@ public function getHTMLDefinition($raw = false, $optimized = false) * maybeGetRawCSSDefinition, which is more explicitly * named, instead. * - * @return HTMLPurifier_CSSDefinition + * @return HTMLPurifier_CSSDefinition|null */ public function getCSSDefinition($raw = false, $optimized = false) { @@ -2189,7 +2253,7 @@ public function getCSSDefinition($raw = false, $optimized = false) * maybeGetRawURIDefinition, which is more explicitly * named, instead. * - * @return HTMLPurifier_URIDefinition + * @return HTMLPurifier_URIDefinition|null */ public function getURIDefinition($raw = false, $optimized = false) { @@ -2211,7 +2275,7 @@ public function getURIDefinition($raw = false, $optimized = false) * maybe semantics is the "right thing to do." * * @throws HTMLPurifier_Exception - * @return HTMLPurifier_Definition + * @return HTMLPurifier_Definition|null */ public function getDefinition($type, $raw = false, $optimized = false) { @@ -2390,7 +2454,7 @@ public function maybeGetRawDefinition($name) } /** - * @return HTMLPurifier_HTMLDefinition + * @return HTMLPurifier_HTMLDefinition|null */ public function maybeGetRawHTMLDefinition() { @@ -2398,7 +2462,7 @@ public function maybeGetRawHTMLDefinition() } /** - * @return HTMLPurifier_CSSDefinition + * @return HTMLPurifier_CSSDefinition|null */ public function maybeGetRawCSSDefinition() { @@ -2406,7 +2470,7 @@ public function maybeGetRawCSSDefinition() } /** - * @return HTMLPurifier_URIDefinition + * @return HTMLPurifier_URIDefinition|null */ public function maybeGetRawURIDefinition() { @@ -2546,7 +2610,7 @@ public static function prepareArrayFromForm($array, $index = false, $allowed = t if ($index !== false) { $array = (isset($array[$index]) && is_array($array[$index])) ? $array[$index] : array(); } - $mq = $mq_fix && function_exists('get_magic_quotes_gpc') && get_magic_quotes_gpc(); + $mq = $mq_fix && version_compare(PHP_VERSION, '7.4.0', '<') && function_exists('get_magic_quotes_gpc') && get_magic_quotes_gpc(); $allowed = HTMLPurifier_Config::getAllowedDirectivesForForm($allowed, $schema); $ret = array(); @@ -2633,7 +2697,7 @@ protected function triggerError($msg, $no) // zip(tail(trace), trace) -- but PHP is not Haskell har har for ($i = 0, $c = count($trace); $i < $c - 1; $i++) { // XXX this is not correct on some versions of HTML Purifier - if ($trace[$i + 1]['class'] === 'HTMLPurifier_Config') { + if (isset($trace[$i + 1]['class']) && $trace[$i + 1]['class'] === 'HTMLPurifier_Config') { continue; } $frame = $trace[$i]; @@ -2764,7 +2828,7 @@ public static function instance($prototype = null) * @param string $key Name of directive * @param mixed $default Default value of directive * @param string $type Allowed type of the directive. See - * HTMLPurifier_DirectiveDef::$type for allowed values + * HTMLPurifier_VarParser::$types for allowed values * @param bool $allow_null Whether or not to allow null values */ public function add($key, $default, $type, $allow_null) @@ -3738,7 +3802,7 @@ public function mergeIn($def) if (!empty($def->content_model)) { $this->content_model = - str_replace("#SUPER", $this->content_model, $def->content_model); + str_replace("#SUPER", (string)$this->content_model, $def->content_model); $this->child = false; } if (!empty($def->content_model_type)) { @@ -3938,7 +4002,7 @@ public static function cleanUTF8($str, $force_php = false) $len = strlen($str); for ($i = 0; $i < $len; $i++) { - $in = ord($str{$i}); + $in = ord($str[$i]); $char .= $str[$i]; // append byte to char if (0 == $mState) { // When mState is zero we expect either a US-ASCII character @@ -4177,8 +4241,8 @@ public static function convertToUTF8($str, $config, $context) // characters to their true byte-wise ASCII/UTF-8 equivalents. $str = strtr($str, self::testEncodingSupportsASCII($encoding)); return $str; - } elseif ($encoding === 'iso-8859-1') { - $str = utf8_encode($str); + } elseif ($encoding === 'iso-8859-1' && function_exists('mb_convert_encoding')) { + $str = mb_convert_encoding($str, 'UTF-8', 'ISO-8859-1'); return $str; } $bug = HTMLPurifier_Encoder::testIconvTruncateBug(); @@ -4229,8 +4293,8 @@ public static function convertFromUTF8($str, $config, $context) // Normal stuff $str = self::iconv('utf-8', $encoding . '//IGNORE', $str); return $str; - } elseif ($encoding === 'iso-8859-1') { - $str = utf8_decode($str); + } elseif ($encoding === 'iso-8859-1' && function_exists('mb_convert_encoding')) { + $str = mb_convert_encoding($str, 'ISO-8859-1', 'UTF-8'); return $str; } trigger_error('Encoding not supported', E_USER_ERROR); @@ -4564,7 +4628,7 @@ protected function entityCallback($matches) $entity = $matches[0]; $hex_part = @$matches[1]; $dec_part = @$matches[2]; - $named_part = empty($matches[3]) ? @$matches[4] : $matches[3]; + $named_part = empty($matches[3]) ? (empty($matches[4]) ? "" : $matches[4]) : $matches[3]; if ($hex_part !== NULL && $hex_part !== "") { return HTMLPurifier_Encoder::unichr(hexdec($hex_part)); } elseif ($dec_part !== NULL && $dec_part !== "") { @@ -6035,9 +6099,9 @@ public function getChildDef($def) * @param string $element Name of element to add * @param string|bool $type What content set should element be registered to? * Set as false to skip this step. - * @param string $contents Allowed children in form of: + * @param string|HTMLPurifier_ChildDef $contents Allowed children in form of: * "$content_model_type: $content_model" - * @param array $attr_includes What attribute collections to register to + * @param array|string $attr_includes What attribute collections to register to * element? * @param array $attr What unique attributes does the element define? * @see HTMLPurifier_ElementDef:: for in-depth descriptions of these parameters. @@ -6160,8 +6224,9 @@ public function mergeInAttrIncludes(&$attr, $attr_includes) */ public function makeLookup($list) { + $args = func_get_args(); if (is_string($list)) { - $list = func_get_args(); + $list = $args; } $ret = array(); foreach ($list as $value) { @@ -6871,11 +6936,13 @@ public function allowsElement($name) return false; } // check for exclusion - for ($i = count($this->currentNesting) - 2; $i >= 0; $i--) { - $node = $this->currentNesting[$i]; - $def = $this->htmlDefinition->info[$node->name]; - if (isset($def->excludes[$name])) { - return false; + if (!empty($this->currentNesting)) { + for ($i = count($this->currentNesting) - 2; $i >= 0; $i--) { + $node = $this->currentNesting[$i]; + $def = $this->htmlDefinition->info[$node->name]; + if (isset($def->excludes[$name])) { + return false; + } } } return true; @@ -7437,12 +7504,14 @@ class HTMLPurifier_Length protected $isValid; /** - * Array Lookup array of units recognized by CSS 2.1 + * Array Lookup array of units recognized by CSS 3 * @type array */ protected static $allowedUnits = array( 'em' => true, 'ex' => true, 'px' => true, 'in' => true, - 'cm' => true, 'mm' => true, 'pt' => true, 'pc' => true + 'cm' => true, 'mm' => true, 'pt' => true, 'pc' => true, + 'ch' => true, 'rem' => true, 'vw' => true, 'vh' => true, + 'vmin' => true, 'vmax' => true ); /** @@ -7487,7 +7556,7 @@ protected function validate() if ($this->n === '0' && $this->unit === false) { return true; } - if (!ctype_lower($this->unit)) { + if ($this->unit === false || !ctype_lower($this->unit)) { $this->unit = strtolower($this->unit); } if (!isset(HTMLPurifier_Length::$allowedUnits[$this->unit])) { @@ -7620,6 +7689,11 @@ class HTMLPurifier_Lexer */ public $tracksLineNumbers = false; + /** + * @type HTMLPurifier_EntityParser + */ + private $_entity_parser; + // -- STATIC ---------------------------------------------------------- /** @@ -7878,8 +7952,8 @@ public function normalize($html, $config, $context) { // normalize newlines to \n if ($config->get('Core.NormalizeNewlines')) { - $html = str_replace("\r\n", "\n", $html); - $html = str_replace("\r", "\n", $html); + $html = str_replace("\r\n", "\n", (string)$html); + $html = str_replace("\r", "\n", (string)$html); } if ($config->get('HTML.Trusted')) { @@ -8269,6 +8343,7 @@ public function __construct(Iterator $iterator, $filter = null) /** * @return bool */ + #[\ReturnTypeWillChange] public function accept() { $key = $this->getInnerIterator()->key(); @@ -8387,6 +8462,7 @@ class HTMLPurifier_StringHash extends ArrayObject * @param mixed $index * @return mixed */ + #[\ReturnTypeWillChange] public function offsetGet($index) { $this->accessed[$index] = true; @@ -9887,34 +9963,34 @@ private function scale($r, $scale) class HTMLPurifier_VarParser { - const STRING = 1; + const C_STRING = 1; const ISTRING = 2; const TEXT = 3; const ITEXT = 4; - const INT = 5; - const FLOAT = 6; - const BOOL = 7; + const C_INT = 5; + const C_FLOAT = 6; + const C_BOOL = 7; const LOOKUP = 8; const ALIST = 9; const HASH = 10; - const MIXED = 11; + const C_MIXED = 11; /** * Lookup table of allowed types. Mainly for backwards compatibility, but * also convenient for transforming string type names to the integer constants. */ public static $types = array( - 'string' => self::STRING, + 'string' => self::C_STRING, 'istring' => self::ISTRING, 'text' => self::TEXT, 'itext' => self::ITEXT, - 'int' => self::INT, - 'float' => self::FLOAT, - 'bool' => self::BOOL, + 'int' => self::C_INT, + 'float' => self::C_FLOAT, + 'bool' => self::C_BOOL, 'lookup' => self::LOOKUP, 'list' => self::ALIST, 'hash' => self::HASH, - 'mixed' => self::MIXED + 'mixed' => self::C_MIXED ); /** @@ -9922,7 +9998,7 @@ class HTMLPurifier_VarParser * allowed value lists. */ public static $stringTypes = array( - self::STRING => true, + self::C_STRING => true, self::ISTRING => true, self::TEXT => true, self::ITEXT => true, @@ -9954,7 +10030,7 @@ final public function parse($var, $type, $allow_null = false) // These are basic checks, to make sure nothing horribly wrong // happened in our implementations. switch ($type) { - case (self::STRING): + case (self::C_STRING): case (self::ISTRING): case (self::TEXT): case (self::ITEXT): @@ -9965,17 +10041,17 @@ final public function parse($var, $type, $allow_null = false) $var = strtolower($var); } return $var; - case (self::INT): + case (self::C_INT): if (!is_int($var)) { break; } return $var; - case (self::FLOAT): + case (self::C_FLOAT): if (!is_float($var)) { break; } return $var; - case (self::BOOL): + case (self::C_BOOL): if (!is_bool($var)) { break; } @@ -9999,7 +10075,7 @@ final public function parse($var, $type, $allow_null = false) } } return $var; - case (self::MIXED): + case (self::C_MIXED): return $var; default: $this->errorInconsistent(get_class($this), $type); @@ -10941,7 +11017,13 @@ public function validate($number, $config, $context) return false; } - $left = ltrim($left, '0'); + // Remove leading zeros until positive number or a zero stays left + if (ltrim($left, '0') != '') { + $left = ltrim($left, '0'); + } else { + $left = '0'; + } + $right = rtrim($right, '0'); if ($right === '') { @@ -11017,6 +11099,7 @@ public function __construct($config) $this->info['background-repeat'] = $def->info['background-repeat']; $this->info['background-attachment'] = $def->info['background-attachment']; $this->info['background-position'] = $def->info['background-position']; + $this->info['background-size'] = $def->info['background-size']; } /** @@ -11045,6 +11128,7 @@ public function validate($string, $config, $context) $caught['repeat'] = false; $caught['attachment'] = false; $caught['position'] = false; + $caught['size'] = false; $i = 0; // number of catches @@ -12590,7 +12674,7 @@ class HTMLPurifier_AttrDef_HTML_Bool extends HTMLPurifier_AttrDef { /** - * @type bool + * @type string */ protected $name; @@ -12600,7 +12684,7 @@ class HTMLPurifier_AttrDef_HTML_Bool extends HTMLPurifier_AttrDef public $minimized = true; /** - * @param bool $name + * @param bool|string $name */ public function __construct($name = false) { @@ -12804,6 +12888,23 @@ public function validate($string, $config, $context) +class HTMLPurifier_AttrDef_HTML_ContentEditable extends HTMLPurifier_AttrDef +{ + public function validate($string, $config, $context) + { + $allowed = array('false'); + if ($config->get('HTML.Trusted')) { + $allowed = array('', 'true', 'false'); + } + + $enum = new HTMLPurifier_AttrDef_Enum($allowed); + + return $enum->validate($string, $config, $context); + } +} + + + /** * Special-case enum attribute definition that lazy loads allowed frame targets */ @@ -13343,7 +13444,11 @@ public function validate($string, $config, $context) // PHP 5.3 and later support this functionality natively if (function_exists('idn_to_ascii')) { - $string = idn_to_ascii($string); + if (defined('IDNA_NONTRANSITIONAL_TO_ASCII') && defined('INTL_IDNA_VARIANT_UTS46')) { + $string = idn_to_ascii($string, IDNA_NONTRANSITIONAL_TO_ASCII, INTL_IDNA_VARIANT_UTS46); + } else { + $string = idn_to_ascii($string); + } // If we have Net_IDNA2 support, we can support IRIs by // punycoding them. (This is the most portable thing to do, @@ -14068,6 +14173,11 @@ public function transform($attr, $config, $context) class HTMLPurifier_AttrTransform_NameSync extends HTMLPurifier_AttrTransform { + /** + * @type HTMLPurifier_AttrDef_HTML_ID + */ + public $idDef; + public function __construct() { $this->idDef = new HTMLPurifier_AttrDef_HTML_ID(); @@ -14234,6 +14344,11 @@ class HTMLPurifier_AttrTransform_SafeParam extends HTMLPurifier_AttrTransform */ private $uri; + /** + * @type HTMLPurifier_AttrDef_Enum + */ + public $wmode; + public function __construct() { $this->uri = new HTMLPurifier_AttrDef_URI(true); // embedded @@ -14577,7 +14692,7 @@ public function __construct($dtd_regex) protected function _compileRegex() { $raw = str_replace(' ', '', $this->dtd_regex); - if ($raw{0} != '(') { + if ($raw[0] != '(') { $raw = "($raw)"; } $el = '[#a-zA-Z0-9_.-]+'; @@ -14696,6 +14811,8 @@ class HTMLPurifier_ChildDef_List extends HTMLPurifier_ChildDef // XXX: This whole business with 'wrap' is all a bit unsatisfactory public $elements = array('li' => true, 'ul' => true, 'ol' => true); + public $whitespace; + /** * @param array $children * @param HTMLPurifier_Config $config @@ -15207,7 +15324,7 @@ public function validateChildren($children, $config, $context) } } - if (empty($content)) { + if (empty($content) && $thead === false && $tfoot === false) { return false; } @@ -15675,9 +15792,14 @@ private function _prepareDir($config) $directory = $this->generateDirectoryPath($config); $chmod = $config->get('Cache.SerializerPermissions'); if ($chmod === null) { - // TODO: This races - if (is_dir($directory)) return true; - return mkdir($directory); + if (!@mkdir($directory) && !is_dir($directory)) { + trigger_error( + 'Could not create directory ' . $directory . '', + E_USER_WARNING + ); + return false; + } + return true; } if (!is_dir($directory)) { $base = $this->generateBaseDirectoryPath($config); @@ -15691,7 +15813,7 @@ private function _prepareDir($config) } elseif (!$this->_testPermissions($base, $chmod)) { return false; } - if (!mkdir($directory, $chmod)) { + if (!@mkdir($directory, $chmod) && !is_dir($directory)) { trigger_error( 'Could not create directory ' . $directory . '', E_USER_WARNING @@ -15992,6 +16114,7 @@ class HTMLPurifier_HTMLModule_CommonAttributes extends HTMLPurifier_HTMLModule 'class' => 'Class', 'id' => 'ID', 'title' => 'CDATA', + 'contenteditable' => 'ContentEditable', ), 'Lang' => array(), 'I18N' => array( @@ -16091,6 +16214,10 @@ class HTMLPurifier_HTMLModule_Forms extends HTMLPurifier_HTMLModule */ public function setup($config) { + if ($config->get('HTML.Forms')) { + $this->safe = true; + } + $form = $this->addElement( 'form', 'Form', @@ -17021,13 +17148,13 @@ public function setup($config) $script = $this->addElement( 'script', 'Inline', - 'Empty', + 'Optional:', // Not `Empty` to not allow to autoclose the "; +} + From 5c5e5364c7d530300d20a194840da3249333bba8 Mon Sep 17 00:00:00 2001 From: Christian Ernst Date: Thu, 8 Dec 2022 14:06:18 +0100 Subject: [PATCH 4/7] fix: viewer.js config; --- admin/update/update.php | 9 +++++++++ func/classes.new/ESModule.php | 7 ++++++- .../classes.new/ESRender/Module/ContentNode/Abstract.php | 7 ++++++- version.php | 2 +- 4 files changed, 22 insertions(+), 3 deletions(-) diff --git a/admin/update/update.php b/admin/update/update.php index b296b61e..07e33138 100644 --- a/admin/update/update.php +++ b/admin/update/update.php @@ -473,6 +473,15 @@ function run($installedVersion) { file_put_contents(MC_ROOT_PATH . 'conf/system.conf.php', 'DEFINE("ENABLE_VIEWER_JS", true); # toggle viewer.js for office documents', FILE_APPEND | LOCK_EX); } + if(version_compare ( '6.0.102', $installedVersion ) > 0) { + $viewer_js_conf = "VIEWER_JS_CONFIG = [ + 'pdf', + //'office', + //'spreadsheet' + ];"; + file_put_contents(MC_ROOT_PATH . 'conf/system.conf.php', $viewer_js_conf, FILE_APPEND | LOCK_EX); + } + } catch ( Exception $e ) { error_log ( print_r ( $e, true ) ); diff --git a/func/classes.new/ESModule.php b/func/classes.new/ESModule.php index d09b4687..295feb33 100644 --- a/func/classes.new/ESModule.php +++ b/func/classes.new/ESModule.php @@ -152,8 +152,13 @@ final public function setModuleByMimetype($p_mimetype) } $modName = $result -> ESMODULE_NAME; + $viewer_js_modules = [ + 'pdf', + 'office', + 'spreadsheet' + ]; if (!ENABLE_VIEWER_JS && $modName == 'office' || - ENABLE_VIEWER_JS && !in_array($modName, $VIEWER_JS_CONFIG) ){ + ENABLE_VIEWER_JS && in_array($modName, $viewer_js_modules) && !in_array($modName, $VIEWER_JS_CONFIG) ){ $modName = 'doc'; } diff --git a/func/classes.new/ESRender/Module/ContentNode/Abstract.php b/func/classes.new/ESRender/Module/ContentNode/Abstract.php index 52120cac..434682d5 100644 --- a/func/classes.new/ESRender/Module/ContentNode/Abstract.php +++ b/func/classes.new/ESRender/Module/ContentNode/Abstract.php @@ -43,8 +43,13 @@ public function createInstance() { $this->filename = $this-> esObject ->getObjectIdVersion(); $module = $this->esObject->module->getName(); + $viewer_js_modules = [ + 'pdf', + 'office', + 'spreadsheet' + ]; if (!ENABLE_VIEWER_JS && strpos($module, 'office') !== false || - ENABLE_VIEWER_JS && !in_array($module, $VIEWER_JS_CONFIG) ){ + ENABLE_VIEWER_JS && in_array($module, $viewer_js_modules) && !in_array($module, $VIEWER_JS_CONFIG) ){ $module = 'doc'; } diff --git a/version.php b/version.php index 1496c748..16f579bf 100644 --- a/version.php +++ b/version.php @@ -1,2 +1,2 @@ Date: Fri, 9 Dec 2022 08:04:03 +0100 Subject: [PATCH 5/7] limit access for adminer to loopback network --- src/main/php/admin/vendor/.htaccess | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/main/php/admin/vendor/.htaccess b/src/main/php/admin/vendor/.htaccess index a7cce983..a4a1a399 100644 --- a/src/main/php/admin/vendor/.htaccess +++ b/src/main/php/admin/vendor/.htaccess @@ -1,4 +1,4 @@ Order Deny,Allow Deny from all Allow from localhost -Allow from 127.0.0.1 +Allow from 127.0.0.0/8 ::1 From 0cce8d91809c8f9dcfcfbaaf0d0b45621a7ef44a Mon Sep 17 00:00:00 2001 From: Frank Thomschke Date: Sat, 10 Dec 2022 17:09:17 +0100 Subject: [PATCH 6/7] fix: remove maven multi-treading inside CI-pipelines --- .gitlab-ci.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml index 82e841b3..aa5c09e3 100644 --- a/.gitlab-ci.yml +++ b/.gitlab-ci.yml @@ -1,5 +1,5 @@ variables: - MAVEN_CLI: "-Ddocker.registry=$DOCKER_REGISTRY -Dhelm.deploy.url=$HELM_REGISTRY -Dhelm.deploy.type=$HELM_TYPE -Dmaven.deploy.releases=$MAVEN_DEPLOY_RELEASES -Dmaven.deploy.snapshots=$MAVEN_DEPLOY_SNAPSHOTS --batch-mode --errors --fail-fast --show-version -T 1C" + MAVEN_CLI: "-Ddocker.registry=$DOCKER_REGISTRY -Dhelm.deploy.url=$HELM_REGISTRY -Dhelm.deploy.type=$HELM_TYPE -Dmaven.deploy.releases=$MAVEN_DEPLOY_RELEASES -Dmaven.deploy.snapshots=$MAVEN_DEPLOY_SNAPSHOTS --batch-mode --errors --fail-fast --show-version" MAVEN_OPTS: "-Dmaven.repo.local=.m2/repository" default: From b9b85f85afbb7752a837fbb9386ad7a4fdc71675 Mon Sep 17 00:00:00 2001 From: Frank Thomschke Date: Sat, 10 Dec 2022 17:47:01 +0100 Subject: [PATCH 7/7] fix: php code-check failed due to InvalidThrow --- src/main/php/psalm.xml | 1 + 1 file changed, 1 insertion(+) diff --git a/src/main/php/psalm.xml b/src/main/php/psalm.xml index a0f192ba..37a9a286 100644 --- a/src/main/php/psalm.xml +++ b/src/main/php/psalm.xml @@ -82,6 +82,7 @@ +