textfilter.php

Go to the documentation of this file.

<?php
defined('XOOPS_ROOT_PATH') or die('Restricted access');

class MytsTextfilter extends MyTextSanitizerExtension
{
    function load(&$ts, $text, $force = false)
    {
        global $xoopsUser, $xoopsConfig, $xoopsUserIsAdmin;
        if (empty($force) && $xoopsUserIsAdmin) {
            return $text;
        }
        // Built-in fitlers for XSS scripts
        // To be improved
        $text = $ts->filterXss($text);

        if (xoops_load("purifier", "framework")) {
            $text = XoopsPurifier::purify($text);
            return $text;
        }

        $tags = array();
        $search = array();
        $replace = array();
        $config = parent::loadConfig(dirname(__FILE__));
        if (!empty($config["patterns"])) {
            foreach ($config["patterns"] as $pattern) {
                if (empty($pattern['search']))
                    continue;
                $search[] = $pattern['search'];
                $replace[] = $pattern['replace'];
            }
        }
        if (!empty($config["tags"])) {
            $tags = array_map("trim", $config["tags"]);
        }

        // Set embedded tags
        $tags[] = "SCRIPT";
        $tags[] = "VBSCRIPT";
        $tags[] = "JAVASCRIPT";
        foreach ($tags as $tag) {
            $search[] = "/<" . $tag . "[^>]*?>.*?<\/" . $tag . ">/si";
            $replace[] = " [!" . strtoupper($tag) . " FILTERED!] ";
        }
        // Set meta refresh tag
        $search[] = "/<META[^>\/]*HTTP-EQUIV=(['\"])?REFRESH(\\1)[^>\/]*?\/>/si";
        $replace[] = "";
        // Sanitizing scripts in IMG tag
        //$search[]= "/(<IMG[\s]+[^>\/]*SOURCE=)(['\"])?(.*)(\\2)([^>\/]*?\/>)/si";
        //$replace[]="";
        // Set iframe tag
        $search[] = "/<IFRAME[^>\/]*SRC=(['\"])?([^>\/]*)(\\1)[^>\/]*?\/>/si";
        $replace[] = " [!IFRAME FILTERED! \\2] ";
        $search[] = "/<IFRAME[^>]*?>([^<]*)<\/IFRAME>/si";
        $replace[] = " [!IFRAME FILTERED! \\1] ";
        // action
        $text = preg_replace($search, $replace, $text);
        return $text;
    }
}
?>