Commit a8982662fd90d4fd31a9f5fdc685d7fe782286de
1 parent
b7dd0a78
KTS-2178
"cross site scripting" Implemented. Reviewed By: Kevin Fourie git-svn-id: https://kt-dms.svn.sourceforge.net/svnroot/kt-dms/trunk@6912 c91229c3-7414-0410-bfa2-8a42b809f60b
Showing
1 changed file
with
71 additions
and
0 deletions
thirdparty/Smarty/plugins/modifier.sanitize.php
0 → 100644
| 1 | +<?php | ||
| 2 | + | ||
| 3 | +function smarty_modifier_sanitize($string, $esc_type = 'html', $charset='UTF-8') | ||
| 4 | +{ | ||
| 5 | + // based on escape, but with charset | ||
| 6 | + switch ($esc_type) { | ||
| 7 | + case 'html': | ||
| 8 | + return htmlspecialchars($string, ENT_QUOTES,$charset); | ||
| 9 | + | ||
| 10 | + case 'htmlall': | ||
| 11 | + return htmlentities($string, ENT_QUOTES,$charset); | ||
| 12 | + | ||
| 13 | + case 'url': | ||
| 14 | + return rawurlencode($string); | ||
| 15 | + | ||
| 16 | + case 'quotes': | ||
| 17 | + // escape unescaped single quotes | ||
| 18 | + return preg_replace("%(?<!\\\\)'%", "\\'", $string); | ||
| 19 | + | ||
| 20 | + case 'hex': | ||
| 21 | + // escape every character into hex | ||
| 22 | + $return = ''; | ||
| 23 | + for ($x=0; $x < strlen($string); $x++) { | ||
| 24 | + $return .= '%' . bin2hex($string[$x]); | ||
| 25 | + } | ||
| 26 | + return $return; | ||
| 27 | + | ||
| 28 | + case 'hexentity': | ||
| 29 | + $return = ''; | ||
| 30 | + for ($x=0; $x < strlen($string); $x++) { | ||
| 31 | + $return .= '&#x' . bin2hex($string[$x]) . ';'; | ||
| 32 | + } | ||
| 33 | + return $return; | ||
| 34 | + | ||
| 35 | + case 'decentity': | ||
| 36 | + $return = ''; | ||
| 37 | + for ($x=0; $x < strlen($string); $x++) { | ||
| 38 | + $return .= '&#' . ord($string[$x]) . ';'; | ||
| 39 | + } | ||
| 40 | + return $return; | ||
| 41 | + | ||
| 42 | + case 'javascript': | ||
| 43 | + // escape quotes and backslashes, newlines, etc. | ||
| 44 | + return strtr($string, array('\\'=>'\\\\',"'"=>"\\'",'"'=>'\\"',"\r"=>'\\r',"\n"=>'\\n','</'=>'<\/')); | ||
| 45 | + | ||
| 46 | + case 'mail': | ||
| 47 | + // safe way to display e-mail address on a web page | ||
| 48 | + return str_replace(array('@', '.'),array(' [AT] ', ' [DOT] '), $string); | ||
| 49 | + | ||
| 50 | + case 'nonstd': | ||
| 51 | + // escape non-standard chars, such as ms document quotes | ||
| 52 | + $_res = ''; | ||
| 53 | + for($_i = 0, $_len = strlen($string); $_i < $_len; $_i++) { | ||
| 54 | + $_ord = ord($string{$_i}); | ||
| 55 | + // non-standard char, escape it | ||
| 56 | + if($_ord >= 126){ | ||
| 57 | + $_res .= '&#' . $_ord . ';'; | ||
| 58 | + } | ||
| 59 | + else { | ||
| 60 | + $_res .= $string{$_i}; | ||
| 61 | + } | ||
| 62 | + } | ||
| 63 | + return $_res; | ||
| 64 | + | ||
| 65 | + default: | ||
| 66 | + return $string; | ||
| 67 | + } | ||
| 68 | +} | ||
| 69 | + | ||
| 70 | + | ||
| 71 | +?> |