Peter M. Groen / knowledgetree

Commit a8982662fd90d4fd31a9f5fdc685d7fe782286de

Authored by Conrad Vermeulen
1 parent b7dd0a78

KTS-2178 

"cross site scripting"
Implemented.

Reviewed By: Kevin Fourie

git-svn-id: https://kt-dms.svn.sourceforge.net/svnroot/kt-dms/trunk@6912 c91229c3-7414-0410-bfa2-8a42b809f60b
Inline Side-by-side
Showing 1 changed file with 71 additions and 0 deletions
thirdparty/Smarty/plugins/modifier.sanitize.php 0 → 100644
  View file @a898266
  1 +<?php
  2 +
  3 +function smarty_modifier_sanitize($string, $esc_type = 'html', $charset='UTF-8')
  4 +{
  5 + // based on escape, but with charset
  6 + switch ($esc_type) {
  7 + case 'html':
  8 + return htmlspecialchars($string, ENT_QUOTES,$charset);
  9 +
  10 + case 'htmlall':
  11 + return htmlentities($string, ENT_QUOTES,$charset);
  12 +
  13 + case 'url':
  14 + return rawurlencode($string);
  15 +
  16 + case 'quotes':
  17 + // escape unescaped single quotes
  18 + return preg_replace("%(?<!\\\\)'%", "\\'", $string);
  19 +
  20 + case 'hex':
  21 + // escape every character into hex
  22 + $return = '';
  23 + for ($x=0; $x < strlen($string); $x++) {
  24 + $return .= '%' . bin2hex($string[$x]);
  25 + }
  26 + return $return;
  27 +
  28 + case 'hexentity':
  29 + $return = '';
  30 + for ($x=0; $x < strlen($string); $x++) {
  31 + $return .= '&#x' . bin2hex($string[$x]) . ';';
  32 + }
  33 + return $return;
  34 +
  35 + case 'decentity':
  36 + $return = '';
  37 + for ($x=0; $x < strlen($string); $x++) {
  38 + $return .= '&#' . ord($string[$x]) . ';';
  39 + }
  40 + return $return;
  41 +
  42 + case 'javascript':
  43 + // escape quotes and backslashes, newlines, etc.
  44 + return strtr($string, array('\\'=>'\\\\',"'"=>"\\'",'"'=>'\\"',"\r"=>'\\r',"\n"=>'\\n','</'=>'<\/'));
  45 +
  46 + case 'mail':
  47 + // safe way to display e-mail address on a web page
  48 + return str_replace(array('@', '.'),array(' [AT] ', ' [DOT] '), $string);
  49 +
  50 + case 'nonstd':
  51 + // escape non-standard chars, such as ms document quotes
  52 + $_res = '';
  53 + for($_i = 0, $_len = strlen($string); $_i < $_len; $_i++) {
  54 + $_ord = ord($string{$_i});
  55 + // non-standard char, escape it
  56 + if($_ord >= 126){
  57 + $_res .= '&#' . $_ord . ';';
  58 + }
  59 + else {
  60 + $_res .= $string{$_i};
  61 + }
  62 + }
  63 + return $_res;
  64 +
  65 + default:
  66 + return $string;
  67 + }
  68 +}
  69 +
  70 +
  71 +?>
... ...