Added demos for TExpression, TStatements, TSafeHtml and TTextHighlighter.

14 files changed, 159 insertions, 18 deletions

diff --git a/.gitattributes b/.gitattributes
index 27aea6ff..bfe295c5 100644
--- a/.gitattributes
+++ b/.gitattributes
@@ -186,6 +186,7 @@ demos/quickstart/protected/pages/Controls/Samples/TDropDownList/Home.page -text
 demos/quickstart/protected/pages/Controls/Samples/TDropDownList/Home.php -text
 demos/quickstart/protected/pages/Controls/Samples/TEmailAddressValidator/Home.page -text
 demos/quickstart/protected/pages/Controls/Samples/TEmailAddressValidator/Home.php -text
+demos/quickstart/protected/pages/Controls/Samples/TExpression/Home.page -text
 demos/quickstart/protected/pages/Controls/Samples/THyperLink/Home.page -text
 demos/quickstart/protected/pages/Controls/Samples/THyperLink/hello_world.gif -text
 demos/quickstart/protected/pages/Controls/Samples/TImage/HelloWorld.html -text
@@ -218,11 +219,14 @@ demos/quickstart/protected/pages/Controls/Samples/TRepeater/Sample3.page -text
 demos/quickstart/protected/pages/Controls/Samples/TRepeater/Sample3.php -text
 demos/quickstart/protected/pages/Controls/Samples/TRequiredFieldValidator/Home.page -text
 demos/quickstart/protected/pages/Controls/Samples/TRequiredFieldValidator/Home.php -text
+demos/quickstart/protected/pages/Controls/Samples/TSafeHtml/Home.page -text
+demos/quickstart/protected/pages/Controls/Samples/TStatements/Home.page -text
 demos/quickstart/protected/pages/Controls/Samples/TTable/Home.page -text
 demos/quickstart/protected/pages/Controls/Samples/TTable/Home.php -text
 demos/quickstart/protected/pages/Controls/Samples/TTable/backimage.gif -text
 demos/quickstart/protected/pages/Controls/Samples/TTextBox/Home.page -text
 demos/quickstart/protected/pages/Controls/Samples/TTextBox/Home.php -text
+demos/quickstart/protected/pages/Controls/Samples/TTextHighlighter/Home.page -text
 demos/quickstart/protected/pages/Controls/Samples/TValidationSummary/Home.page -text
 demos/quickstart/protected/pages/Controls/Samples/TValidationSummary/Home.php -text
 demos/quickstart/protected/pages/Controls/Samples/TWizard/Sample1.page -text
diff --git a/HISTORY b/HISTORY
index 6ac5f3fa..5bae4e3e 100644
--- a/HISTORY
+++ b/HISTORY
@@ -7,6 +7,8 @@ BUG: Ticket#95 - Typo in TTemplateControl::registerContentPlaceHolder (Qiang)
 BUG: SF#1446846 - Typo in THead (Qiang)

 BUG: SF#1432624 - Incorrect documentation about caching expiry (Qiang)

 BUG: THttpSession fails when user storage module is used (Qiang)

+CHG: TTextHighlighter.EnableCopyCode defaults to false (Qiang)

+CHG: Reorganized quickstart tutorial demo, added new sections (Qiang)

 ENH: TDataFieldAccessor can access public class variables (Qiang)

 ENH: Pagers in TDataGrid are now enclosed within panels (Qiang)

 ENH: Ticket#92 - Support for user exception message file (Qiang)

diff --git a/UPGRADE b/UPGRADE
index 4940d832..2bfc8c53 100644
--- a/UPGRADE
+++ b/UPGRADE
@@ -10,9 +10,10 @@ for both A and B.
 

 Upgrading from v3.0b

 --------------------

-- THttpSession.Storage is changed to UseCustomStorage

+- THttpSession.UseCustomStorage replaces the previous Storage.

 - Pagers in TDataGrid are now enclosed within panels. The event indicating

   their creation is changed to OnPagerCreated instead of OnItemCreated.

+- TTextHighlighter.EnableCopyCode defaults to false now.

 

 Upgrading from v3.0a

 --------------------

diff --git a/demos/quickstart/protected/pages/Controls/Expression.page b/demos/quickstart/protected/pages/Controls/Expression.page
index efa1ab7a..c87f0ba4 100644
--- a/demos/quickstart/protected/pages/Controls/Expression.page
+++ b/demos/quickstart/protected/pages/Controls/Expression.page
@@ -27,4 +27,6 @@ The context of the expression in a <tt>TExpression</tt> control is the control i
 Be aware, since <tt>TExpression</tt> allows execution of arbitrary PHP code, in general you should not use it to evaluate expressions submitted by your application users.

 </p>

 

+<com:RunBar PagePath="Controls.Samples.TExpression.Home" />

+

 </com:TContent>
\ No newline at end of file
diff --git a/demos/quickstart/protected/pages/Controls/SafeHtml.page b/demos/quickstart/protected/pages/Controls/SafeHtml.page
index 16561672..565c8251 100644
--- a/demos/quickstart/protected/pages/Controls/SafeHtml.page
+++ b/demos/quickstart/protected/pages/Controls/SafeHtml.page
@@ -3,4 +3,23 @@
 <h1>TSafeHtml</h1>

 <com:DocLink ClassPath="System.Web.UI.WebControls.TSafeHtml" />

 

+<p>

+<tt>TSafeHtml</tt> is a control that strips down all potentially dangerous HTML content. It is mainly a wrapper of the <a href="http://pixel-apes.com/safehtml/">SafeHTML</a> project. According to the SafeHTML project, it tries to safeguard the following situations when the string is to be displayed to end-users:

+</p>

+<ul>

+  <li>Opening tag without its closing tag</li>

+  <li>closing tag without its opening tag

+  <li>any of these tags: base, basefont, head, html, body, applet, object, iframe, frame, frameset, script, layer, ilayer, embed, bgsound, link, meta, style, title, blink, xml, etc.</li>

+  <li>any of these attributes: on*, data*, dynsrc</li>

+  <li>javascript:/vbscript:/about: etc. protocols</li>

+  <li>expression/behavior etc. in styles</li>

+  <li>any other active content.</li>

+</ul>

+

+<p>

+To use <tt>TSafeHtml</tt>, simply enclose the content to be secured within the <tt>TSafeHtml</tt> component tag in a template. The content may consist of both static text and PRADO controls. If the latter, the rendering result of the controls will be secured.

+</p>

+

+<com:RunBar PagePath="Controls.Samples.TSafeHtml.Home" />

+

 </com:TContent>
\ No newline at end of file
diff --git a/demos/quickstart/protected/pages/Controls/Samples/TExpression/Home.page b/demos/quickstart/protected/pages/Controls/Samples/TExpression/Home.page
new file mode 100644
index 00000000..2273f3c1
--- /dev/null
+++ b/demos/quickstart/protected/pages/Controls/Samples/TExpression/Home.page
@@ -0,0 +1,21 @@
+<com:TContent ID="body">

+

+<h1>TExpression Sample</h1>

+

+<table class="sampletable">

+

+<tr><td class="samplenote">

+Using expression component tag:

+</td><td class="sampleaction">

+<com:TExpression Expression="$this->Page->Head->Title" />

+</td></tr>

+

+<tr><td class="samplenote">

+Using shortcut expression tag:

+</td><td class="sampleaction">

+<%= $this->Page->PagePath %>

+</td></tr>

+

+</table>

+

+</com:TContent>
\ No newline at end of file
diff --git a/demos/quickstart/protected/pages/Controls/Samples/TSafeHtml/Home.page b/demos/quickstart/protected/pages/Controls/Samples/TSafeHtml/Home.page
new file mode 100644
index 00000000..88f8e162
--- /dev/null
+++ b/demos/quickstart/protected/pages/Controls/Samples/TSafeHtml/Home.page
@@ -0,0 +1,25 @@
+<com:TContent ID="body">

+

+<h1>TSafeHtml Samples</h1>

+

+<table class="sampletable">

+

+<tr><td class="samplenote">

+Safeguard a static string:

+</td><td class="sampleaction">

+<com:TSafeHtml>

+  <a href="javascript:alert();">javascript link stripped</a>

+</com:TSafeHtml>

+</td></tr>

+

+<tr><td class="samplenote">

+Safeguard the control rendering results:

+</td><td class="sampleaction">

+<com:TSafeHtml>

+  <com:TLiteral Text="<a>a nonclosing tag" />

+</com:TSafeHtml>

+</td></tr>

+

+</table>

+

+</com:TContent>
\ No newline at end of file
diff --git a/demos/quickstart/protected/pages/Controls/Samples/TStatements/Home.page b/demos/quickstart/protected/pages/Controls/Samples/TStatements/Home.page
new file mode 100644
index 00000000..66734ce0
--- /dev/null
+++ b/demos/quickstart/protected/pages/Controls/Samples/TStatements/Home.page
@@ -0,0 +1,29 @@
+<com:TContent ID="body">

+

+<h1>TStatements Sample</h1>

+

+<table class="sampletable">

+

+<tr><td class="samplenote">

+Using TStatements component tag:

+</td><td class="sampleaction">

+<com:TStatements>

+  <prop:Statements>

+  $uid=$this->UniqueID;

+  echo "UniqueID is '$uid'.";

+  </prop:Statements>

+</com:TStatements>

+</td></tr>

+

+<tr><td class="samplenote">

+Using shortcut statements tag:

+</td><td class="sampleaction">

+<%%

+  $uid=$this->UniqueID;

+  echo "UniqueID is '$uid'.";

+%>

+</td></tr>

+

+</table>

+

+</com:TContent>
\ No newline at end of file
diff --git a/demos/quickstart/protected/pages/Controls/Samples/TTextHighlighter/Home.page b/demos/quickstart/protected/pages/Controls/Samples/TTextHighlighter/Home.page
new file mode 100644
index 00000000..f220ce84
--- /dev/null
+++ b/demos/quickstart/protected/pages/Controls/Samples/TTextHighlighter/Home.page
@@ -0,0 +1,29 @@
+<com:TContent ID="body">

+

+<h1>TTextHighlighter Samples</h1>

+

+<table class="sampletable">

+

+<tr><td class="samplenote">

+Highlighting PHP statements:

+</td><td class="sampleaction">

+<com:TTextHighlighter ShowLineNumbers="true" EnableCopyCode="true">

+<?php

+$str = 'one|two|three|four';

+// will output an array

+print_r(explode('|', $str, 2));

+?>

+</com:TTextHighlighter>

+</td></tr>

+

+<tr><td class="samplenote">

+Highlighting control rendering results:

+</td><td class="sampleaction">

+<com:TTextHighlighter EnableCopyCode="false">

+<com:TLabel Text="this is a label" />

+</com:TTextHighlighter>

+</td></tr>

+

+</table>

+

+</com:TContent>
\ No newline at end of file
diff --git a/demos/quickstart/protected/pages/Controls/Standard.page b/demos/quickstart/protected/pages/Controls/Standard.page
index 11c8eaec..d6070986 100644
--- a/demos/quickstart/protected/pages/Controls/Standard.page
+++ b/demos/quickstart/protected/pages/Controls/Standard.page
@@ -91,7 +91,7 @@
   <a href="?page=Controls.RadioButton">TRadioButton</a> represents a radiobutton on a Web page. It is mainly used in a group from which users make a choice.

   </li>

 

-  <li>*

+  <li>

   <a href="?page=Controls.SafeHtml">TSafeHtml</a> displays its body content with assurance that the content contain no harmful code (such as <a href="?page=Security.XSS">XSS</a>).

   </li>

 

diff --git a/demos/quickstart/protected/pages/Controls/Statements.page b/demos/quickstart/protected/pages/Controls/Statements.page
index f37f1dc4..c6807738 100644
--- a/demos/quickstart/protected/pages/Controls/Statements.page
+++ b/demos/quickstart/protected/pages/Controls/Statements.page
@@ -38,4 +38,6 @@ The context of the statements in a <tt>TStatements</tt> control is the control i
 Be aware, since <tt>TStatements</tt> allows execution of arbitrary PHP code, in general you should not use it to evaluate PHP code submitted by your application users.

 </p>

 

+<com:RunBar PagePath="Controls.Samples.TStatements.Home" />

+

 </com:TContent>
\ No newline at end of file
diff --git a/demos/quickstart/protected/pages/Controls/TextHighlighter.page b/demos/quickstart/protected/pages/Controls/TextHighlighter.page
index 23c33b75..40806b02 100644
--- a/demos/quickstart/protected/pages/Controls/TextHighlighter.page
+++ b/demos/quickstart/protected/pages/Controls/TextHighlighter.page
@@ -21,16 +21,6 @@ print_r(explode('|', $str, 2)); // will output an array
 &lt;/com:TTextHighlighter&gt;

 </com:TTextHighlighter>

 

-<p>

-The output will look as follows,

-</p>

-<div style="border:1px solid silver">

-<com:TTextHighlighter ShowLineNumbers="true">

-<?php

-$str = 'one|two|three|four';

-print_r(explode('|', $str, 2)); // will output an array

-?>

-</com:TTextHighlighter>

-</div>

+<com:RunBar PagePath="Controls.Samples.TTextHighlighter.Home" />

 

 </com:TContent>
\ No newline at end of file
diff --git a/framework/Web/UI/WebControls/TSafeHtml.php b/framework/Web/UI/WebControls/TSafeHtml.php
index 432cb104..a625a84d 100644
--- a/framework/Web/UI/WebControls/TSafeHtml.php
+++ b/framework/Web/UI/WebControls/TSafeHtml.php
@@ -13,6 +13,23 @@
 /**

  * TSafeHtml class

  *

+ * TSafeHtml is a control that strips down all potentially dangerous

+ * HTML content. It is mainly a wrapper of {@link http://pixel-apes.com/safehtml/ SafeHTML}

+ * project. According to the SafeHTML project, it tries to safeguard

+ * the following situations when the string is to be displayed to end-users,

+ * - Opening tag without its closing tag

+ * - closing tag without its opening tag

+ * - any of these tags: base, basefont, head, html, body, applet, object,

+ *   iframe, frame, frameset, script, layer, ilayer, embed, bgsound, link,

+ *   meta, style, title, blink, xml, etc.

+ * - any of these attributes: on*, data*, dynsrc

+ * - javascript:/vbscript:/about: etc. protocols

+ * - expression/behavior etc. in styles

+ * - any other active content.

+ *

+ * To use TSafeHtml, simply enclose the content to be secured within

+ * the body of TSafeHtml in a template.

+ *

  * @author Wei Zhuo <weizhuo[at]gmail[dot]com>

  * @version $Revision: $  $Date: $

  * @package System.Web.UI.WebControls

@@ -26,10 +43,10 @@ class TSafeHtml extends TControl
 	 * malicious javascript code from the body content

 	 * @param THtmlWriter writer

 	 */

-	public function renderContents($writer)

+	public function render($writer)

 	{

 		$textWriter=new TTextWriter;

-		parent::renderContents(new THtmlWriter($textWriter));

+		parent::render(new THtmlWriter($textWriter));

 		$writer->write($this->parseSafeHtml($textWriter->flush()));

 	}

 

diff --git a/framework/Web/UI/WebControls/TTextHighlighter.php b/framework/Web/UI/WebControls/TTextHighlighter.php
index 6fb1ddbb..f5c3eca9 100644
--- a/framework/Web/UI/WebControls/TTextHighlighter.php
+++ b/framework/Web/UI/WebControls/TTextHighlighter.php
@@ -131,11 +131,11 @@ class TTextHighlighter extends TWebControl
 	}

 

 	/**

-	 * @return boolean true will show "Copy Code" link

+	 * @return boolean true will show "Copy Code" link. Defaults to false.

 	 */

 	public function getEnableCopyCode()

 	{

-		return $this->getViewState('CopyCode', true);

+		return $this->getViewState('CopyCode', false);

 	}

 

 	/**

@@ -143,7 +143,7 @@ class TTextHighlighter extends TWebControl
 	 */

 	public function setEnableCopyCode($value)

 	{

-		$this->setViewState('CopyCode', TPropertyValue::ensureBoolean($value), true);

+		$this->setViewState('CopyCode', TPropertyValue::ensureBoolean($value), false);

 	}

 

 	/**