From ab5d8d4e07bb3c8230d0285ef8902ef1979fce51 Mon Sep 17 00:00:00 2001 From: emkael Date: Thu, 18 Oct 2018 02:39:34 +0200 Subject: Updating Smarty --- lib/smarty/plugins/modifier.escape.php | 182 ++++++++++++++++++++++++++------- 1 file changed, 147 insertions(+), 35 deletions(-) (limited to 'lib/smarty/plugins/modifier.escape.php') diff --git a/lib/smarty/plugins/modifier.escape.php b/lib/smarty/plugins/modifier.escape.php index 523d065..150901c 100644 --- a/lib/smarty/plugins/modifier.escape.php +++ b/lib/smarty/plugins/modifier.escape.php @@ -2,70 +2,145 @@ /** * Smarty plugin * - * @package Smarty + * @package Smarty * @subpackage PluginsModifier */ - /** * Smarty escape modifier plugin - * - * Type: modifier
- * Name: escape
+ * Type: modifier + * Name: escape * Purpose: escape string for output * - * @link http://www.smarty.net/manual/en/language.modifier.count.characters.php count_characters (Smarty online manual) + * @link http://www.smarty.net/docs/en/language.modifier.escape * @author Monte Ohrt + * * @param string $string input string * @param string $esc_type escape type * @param string $char_set character set, used for htmlspecialchars() or htmlentities() * @param boolean $double_encode encode already encoded entitites again, used for htmlspecialchars() or htmlentities() + * * @return string escaped input string */ function smarty_modifier_escape($string, $esc_type = 'html', $char_set = null, $double_encode = true) { + static $_double_encode = null; + static $is_loaded_1 = false; + static $is_loaded_2 = false; + if ($_double_encode === null) { + $_double_encode = version_compare(PHP_VERSION, '5.2.3', '>='); + } if (!$char_set) { $char_set = Smarty::$_CHARSET; } - switch ($esc_type) { case 'html': - return htmlspecialchars($string, ENT_QUOTES, $char_set, $double_encode); - + if ($_double_encode) { + // php >=5.3.2 - go native + return htmlspecialchars($string, ENT_QUOTES, $char_set, $double_encode); + } else { + if ($double_encode) { + // php <5.2.3 - only handle double encoding + return htmlspecialchars($string, ENT_QUOTES, $char_set); + } else { + // php <5.2.3 - prevent double encoding + $string = preg_replace('!&(#?\w+);!', '%%%SMARTY_START%%%\\1%%%SMARTY_END%%%', $string); + $string = htmlspecialchars($string, ENT_QUOTES, $char_set); + $string = str_replace( + array( + '%%%SMARTY_START%%%', + '%%%SMARTY_END%%%' + ), + array( + '&', + ';' + ), + $string + ); + return $string; + } + } + // no break case 'htmlall': if (Smarty::$_MBSTRING) { // mb_convert_encoding ignores htmlspecialchars() - $string = htmlspecialchars($string, ENT_QUOTES, $char_set, $double_encode); + if ($_double_encode) { + // php >=5.3.2 - go native + $string = htmlspecialchars($string, ENT_QUOTES, $char_set, $double_encode); + } else { + if ($double_encode) { + // php <5.2.3 - only handle double encoding + $string = htmlspecialchars($string, ENT_QUOTES, $char_set); + } else { + // php <5.2.3 - prevent double encoding + $string = preg_replace('!&(#?\w+);!', '%%%SMARTY_START%%%\\1%%%SMARTY_END%%%', $string); + $string = htmlspecialchars($string, ENT_QUOTES, $char_set); + $string = + str_replace( + array( + '%%%SMARTY_START%%%', + '%%%SMARTY_END%%%' + ), + array( + '&', + ';' + ), + $string + ); + return $string; + } + } // htmlentities() won't convert everything, so use mb_convert_encoding return mb_convert_encoding($string, 'HTML-ENTITIES', $char_set); } - // no MBString fallback - return htmlentities($string, ENT_QUOTES, $char_set, $double_encode); - + if ($_double_encode) { + return htmlentities($string, ENT_QUOTES, $char_set, $double_encode); + } else { + if ($double_encode) { + return htmlentities($string, ENT_QUOTES, $char_set); + } else { + $string = preg_replace('!&(#?\w+);!', '%%%SMARTY_START%%%\\1%%%SMARTY_END%%%', $string); + $string = htmlentities($string, ENT_QUOTES, $char_set); + $string = str_replace( + array( + '%%%SMARTY_START%%%', + '%%%SMARTY_END%%%' + ), + array( + '&', + ';' + ), + $string + ); + return $string; + } + } + // no break case 'url': return rawurlencode($string); - case 'urlpathinfo': return str_replace('%2F', '/', rawurlencode($string)); - case 'quotes': // escape unescaped single quotes return preg_replace("%(? '\\\\', "'" => "\\'", '"' => '\\"', "\r" => '\\r', "\n" => '\\n', ' '<\/')); - + return strtr( + $string, + array( + '\\' => '\\\\', + "'" => "\\'", + '"' => '\\"', + "\r" => '\\r', + "\n" => '\\n', + ' '<\/' + ) + ); case 'mail': if (Smarty::$_MBSTRING) { - require_once(SMARTY_PLUGINS_DIR . 'shared.mb_str_replace.php'); - return smarty_mb_str_replace(array('@', '.'), array(' [AT] ', ' [DOT] '), $string); + if (!$is_loaded_2) { + if (!is_callable('smarty_mb_str_replace')) { + include_once SMARTY_PLUGINS_DIR . 'shared.mb_str_replace.php'; + } + $is_loaded_2 = true; + } + return smarty_mb_str_replace( + array( + '@', + '.' + ), + array( + ' [AT] ', + ' [DOT] ' + ), + $string + ); } // no MBString fallback - return str_replace(array('@', '.'), array(' [AT] ', ' [DOT] '), $string); - + return str_replace( + array( + '@', + '.' + ), + array( + ' [AT] ', + ' [DOT] ' + ), + $string + ); case 'nonstd': // escape non-standard chars, such as ms document quotes $return = ''; if (Smarty::$_MBSTRING) { - require_once(SMARTY_PLUGINS_DIR . 'shared.mb_unicode.php'); + if (!$is_loaded_1) { + if (!is_callable('smarty_mb_to_unicode')) { + include_once SMARTY_PLUGINS_DIR . 'shared.mb_unicode.php'; + } + $is_loaded_1 = true; + } foreach (smarty_mb_to_unicode($string, Smarty::$_CHARSET) as $unicode) { if ($unicode >= 126) { $return .= '&#' . $unicode . ';'; @@ -122,7 +238,6 @@ function smarty_modifier_escape($string, $esc_type = 'html', $char_set = null, $ } return $return; } - $_length = strlen($string); for ($_i = 0; $_i < $_length; $_i++) { $_ord = ord(substr($string, $_i, 1)); @@ -134,10 +249,7 @@ function smarty_modifier_escape($string, $esc_type = 'html', $char_set = null, $ } } return $return; - default: return $string; } } - -?> \ No newline at end of file -- cgit v1.2.3