From 6fc07742f8fca9d32db23243d374ea27e8ee4c1e Mon Sep 17 00:00:00 2001 From: rvelices Date: Thu, 20 Jun 2013 03:38:47 +0000 Subject: smarty 3 - first pass for tests git-svn-id: http://piwigo.org/svn/trunk@23384 68402e56-0260-453c-a942-63ccdbb3a9ee --- include/smarty/libs/plugins/modifier.escape.php | 175 ++++++++++++++++++------ 1 file changed, 135 insertions(+), 40 deletions(-) (limited to 'include/smarty/libs/plugins/modifier.escape.php') diff --git a/include/smarty/libs/plugins/modifier.escape.php b/include/smarty/libs/plugins/modifier.escape.php index a2f52b232..5ca8e7796 100644 --- a/include/smarty/libs/plugins/modifier.escape.php +++ b/include/smarty/libs/plugins/modifier.escape.php @@ -1,93 +1,188 @@ * Name: escape
- * Purpose: Escape the string according to escapement type - * @link http://smarty.php.net/manual/en/language.modifier.escape.php - * escape (Smarty online manual) - * @author Monte Ohrt - * @param string - * @param html|htmlall|url|quotes|hex|hexentity|javascript - * @return string + * Purpose: escape string for output + * + * @link http://www.smarty.net/manual/en/language.modifier.count.characters.php count_characters (Smarty online manual) + * @author Monte Ohrt + * @param string $string input string + * @param string $esc_type escape type + * @param string $char_set character set, used for htmlspecialchars() or htmlentities() + * @param boolean $double_encode encode already encoded entitites again, used for htmlspecialchars() or htmlentities() + * @return string escaped input string */ -function smarty_modifier_escape($string, $esc_type = 'html', $char_set = 'ISO-8859-1') +function smarty_modifier_escape($string, $esc_type = 'html', $char_set = null, $double_encode = true) { + static $_double_encode = null; + if ($_double_encode === null) { + $_double_encode = version_compare(PHP_VERSION, '5.2.3', '>='); + } + + if (!$char_set) { + $char_set = Smarty::$_CHARSET; + } + switch ($esc_type) { case 'html': - return htmlspecialchars($string, ENT_QUOTES, $char_set); + if ($_double_encode) { + // php >=5.3.2 - go native + return htmlspecialchars($string, ENT_QUOTES, $char_set, $double_encode); + } else { + if ($double_encode) { + // php <5.2.3 - only handle double encoding + return htmlspecialchars($string, ENT_QUOTES, $char_set); + } else { + // php <5.2.3 - prevent double encoding + $string = preg_replace('!&(#?\w+);!', '%%%SMARTY_START%%%\\1%%%SMARTY_END%%%', $string); + $string = htmlspecialchars($string, ENT_QUOTES, $char_set); + $string = str_replace(array('%%%SMARTY_START%%%', '%%%SMARTY_END%%%'), array('&', ';'), $string); + return $string; + } + } case 'htmlall': - return htmlentities($string, ENT_QUOTES, $char_set); + if (Smarty::$_MBSTRING) { + // mb_convert_encoding ignores htmlspecialchars() + if ($_double_encode) { + // php >=5.3.2 - go native + $string = htmlspecialchars($string, ENT_QUOTES, $char_set, $double_encode); + } else { + if ($double_encode) { + // php <5.2.3 - only handle double encoding + $string = htmlspecialchars($string, ENT_QUOTES, $char_set); + } else { + // php <5.2.3 - prevent double encoding + $string = preg_replace('!&(#?\w+);!', '%%%SMARTY_START%%%\\1%%%SMARTY_END%%%', $string); + $string = htmlspecialchars($string, ENT_QUOTES, $char_set); + $string = str_replace(array('%%%SMARTY_START%%%', '%%%SMARTY_END%%%'), array('&', ';'), $string); + return $string; + } + } + + // htmlentities() won't convert everything, so use mb_convert_encoding + return mb_convert_encoding($string, 'HTML-ENTITIES', $char_set); + } + + // no MBString fallback + if ($_double_encode) { + return htmlentities($string, ENT_QUOTES, $char_set, $double_encode); + } else { + if ($double_encode) { + return htmlentities($string, ENT_QUOTES, $char_set); + } else { + $string = preg_replace('!&(#?\w+);!', '%%%SMARTY_START%%%\\1%%%SMARTY_END%%%', $string); + $string = htmlentities($string, ENT_QUOTES, $char_set); + $string = str_replace(array('%%%SMARTY_START%%%', '%%%SMARTY_END%%%'), array('&', ';'), $string); + return $string; + } + } case 'url': return rawurlencode($string); case 'urlpathinfo': - return str_replace('%2F','/',rawurlencode($string)); - + return str_replace('%2F', '/', rawurlencode($string)); + case 'quotes': // escape unescaped single quotes return preg_replace("%(?'\\\\',"'"=>"\\'",'"'=>'\\"',"\r"=>'\\r',"\n"=>'\\n',''<\/')); - + return strtr($string, array('\\' => '\\\\', "'" => "\\'", '"' => '\\"', "\r" => '\\r', "\n" => '\\n', ' '<\/')); + case 'mail': - // safe way to display e-mail address on a web page - return str_replace(array('@', '.'),array(' [AT] ', ' [DOT] '), $string); - + if (Smarty::$_MBSTRING) { + require_once(SMARTY_PLUGINS_DIR . 'shared.mb_str_replace.php'); + return smarty_mb_str_replace(array('@', '.'), array(' [AT] ', ' [DOT] '), $string); + } + // no MBString fallback + return str_replace(array('@', '.'), array(' [AT] ', ' [DOT] '), $string); + case 'nonstd': - // escape non-standard chars, such as ms document quotes - $_res = ''; - for($_i = 0, $_len = strlen($string); $_i < $_len; $_i++) { - $_ord = ord(substr($string, $_i, 1)); - // non-standard char, escape it - if($_ord >= 126){ - $_res .= '&#' . $_ord . ';'; - } - else { - $_res .= substr($string, $_i, 1); - } - } - return $_res; + // escape non-standard chars, such as ms document quotes + $return = ''; + if (Smarty::$_MBSTRING) { + require_once(SMARTY_PLUGINS_DIR . 'shared.mb_unicode.php'); + foreach (smarty_mb_to_unicode($string, Smarty::$_CHARSET) as $unicode) { + if ($unicode >= 126) { + $return .= '&#' . $unicode . ';'; + } else { + $return .= chr($unicode); + } + } + return $return; + } + + $_length = strlen($string); + for ($_i = 0; $_i < $_length; $_i++) { + $_ord = ord(substr($string, $_i, 1)); + // non-standard char, escape it + if ($_ord >= 126) { + $return .= '&#' . $_ord . ';'; + } else { + $return .= substr($string, $_i, 1); + } + } + return $return; default: return $string; } } -/* vim: set expandtab: */ - -?> +?> \ No newline at end of file -- cgit v1.2.3