Source of file SafeParam.php
Size: 2,144 Bytes - Last Modified: 2021-12-23T10:48:37+00:00
/var/www/docs.ssmods.com/process/src/thirdparty/htmlpurifier/HTMLPurifier/AttrTransform/SafeParam.php
12345678910111213141516171819202122232425262728293031323334353637383940414243444546474849505152535455565758596061626364 | <?php /** * Validates name/value pairs in param tags to be used in safe objects. This * will only allow name values it recognizes, and pre-fill certain attributes * with required values. * * @note * This class only supports Flash. In the future, Quicktime support * may be added. * * @warning * This class expects an injector to add the necessary parameters tags. */ class HTMLPurifier_AttrTransform_SafeParam extends HTMLPurifier_AttrTransform { public $name = "SafeParam"; private $uri; public function __construct() { $this->uri = new HTMLPurifier_AttrDef_URI(true); // embedded } public function transform($attr, $config, $context) { // If we add support for other objects, we'll need to alter the // transforms. switch ($attr['name']) { // application/x-shockwave-flash // Keep this synchronized with Injector/SafeObject.php case 'allowScriptAccess': $attr['value'] = 'never'; break; case 'allowNetworking': $attr['value'] = 'internal'; break; case 'allowFullScreen': if ($config->get('HTML.FlashAllowFullScreen')) { $attr['value'] = ($attr['value'] == 'true') ? 'true' : 'false'; } else { $attr['value'] = 'false'; } break; case 'wmode': $attr['value'] = 'window'; break; case 'movie': case 'src': $attr['name'] = "movie"; $attr['value'] = $this->uri->validate($attr['value'], $config, $context); break; case 'flashvars': // we're going to allow arbitrary inputs to the SWF, on // the reasoning that it could only hack the SWF, not us. break; // add other cases to support other param name/value pairs default: $attr['name'] = $attr['value'] = null; } return $attr; } } // vim: et sw=4 sts=4 |