[Summary view] [Print] [Text view]

   1  <?php
   2  /**
   3   * Part of the Joomla Framework Filter Package
   4   *
   5   * @copyright  Copyright (C) 2005 - 2021 Open Source Matters, Inc. All rights reserved.
   6   * @license    GNU General Public License version 2 or later; see LICENSE
   7   */
   8  
   9  namespace Joomla\Filter;
  10  
  11  use Joomla\Language\Language;
  12  use Joomla\Language\Transliterate;
  13  use Joomla\String\StringHelper;
  14  
  15  /**
  16   * OutputFilter is a class for processing an output string for "safe" display
  17   *
  18   * @since  1.0
  19   */
  20  class OutputFilter
  21  {
  22      /**
  23       * Language instance for making a string URL safe
  24       *
  25       * @var    Language|null
  26       * @since  2.0.0
  27       */
  28      private static $language;
  29  
  30      /**
  31       * Makes an object safe to display in forms.
  32       *
  33       * Object parameters that are non-string, array, object or start with underscore will be converted
  34       *
  35       * @param   object   $mixed        An object to be parsed
  36       * @param   integer  $quoteStyle   The optional quote style for the htmlspecialchars function
  37       * @param   mixed    $excludeKeys  An optional string single field name or array of field names not to be parsed (eg, for a textarea)
  38       *
  39       * @return  void
  40       *
  41       * @since   1.0
  42       */
  43  	public static function objectHtmlSafe(&$mixed, $quoteStyle = \ENT_QUOTES, $excludeKeys = '')
  44      {
  45          if (\is_object($mixed))
  46          {
  47              foreach (get_object_vars($mixed) as $k => $v)
  48              {
  49                  if (\is_array($v) || \is_object($v) || $v == null || substr($k, 1, 1) == '_')
  50                  {
  51                      continue;
  52                  }
  53  
  54                  if (\is_string($excludeKeys) && $k == $excludeKeys)
  55                  {
  56                      continue;
  57                  }
  58  
  59                  if (\is_array($excludeKeys) && \in_array($k, $excludeKeys))
  60                  {
  61                      continue;
  62                  }
  63  
  64                  $mixed->$k = htmlspecialchars($v, $quoteStyle, 'UTF-8');
  65              }
  66          }
  67      }
  68  
  69      /**
  70       * Makes a string safe for XHTML output by escaping ampersands in links.
  71       *
  72       * @param   string  $input  String to process
  73       *
  74       * @return  string  Processed string
  75       *
  76       * @since   1.0
  77       */
  78  	public static function linkXhtmlSafe($input)
  79      {
  80          $regex = 'href="([^"]*(&(amp;){0})[^"]*)*?"';
  81  
  82          return preg_replace_callback(
  83              "#$regex#i",
  84              function ($m)
  85              {
  86                  return preg_replace('#&(?!amp;)#', '&amp;', $m[0]);
  87              },
  88              $input
  89          );
  90      }
  91  
  92      /**
  93       * Generates a URL safe version of the specified string with language transliteration.
  94       *
  95       * This method processes a string and replaces all accented UTF-8 characters by unaccented
  96       * ASCII-7 "equivalents"; whitespaces are replaced by hyphens and the string is lowercased.
  97       *
  98       * @param   string  $string    String to process
  99       * @param   string  $language  Language to transliterate to
 100       *
 101       * @return  string  Processed string
 102       *
 103       * @since   1.0
 104       */
 105  	public static function stringUrlSafe($string, $language = '')
 106      {
 107          // Remove any '-' from the string since they will be used as concatenaters
 108          $str = str_replace('-', ' ', $string);
 109  
 110          if (self::$language)
 111          {
 112              /*
 113               * Transliterate on the language requested (fallback to current language if not specified)
 114               *
 115               * 1) If the language is empty, is an asterisk (used in the CMS for "All"), or the language matches, use the active Language instance
 116               * 2) If the language does not match the active Language instance, build a new one to get the right transliterator
 117               */
 118              if (empty($language) || $language === '*' || self::$language->getLanguage() === $language)
 119              {
 120                  $str = self::$language->transliterate($str);
 121              }
 122              else
 123              {
 124                  $str = (new Language(self::$language->getBasePath(), $language, self::$language->getDebug()))->transliterate($str);
 125              }
 126          }
 127          else
 128          {
 129              // Fallback behavior based on the Language package's en-GB LocaliseInterface implementation
 130              $str = StringHelper::strtolower((new Transliterate)->utf8_latin_to_ascii($string));
 131          }
 132  
 133          // Trim white spaces at beginning and end of alias and make lowercase
 134          $str = trim(StringHelper::strtolower($str));
 135  
 136          // Remove any duplicate whitespace, and ensure all characters are alphanumeric
 137          $str = preg_replace('/(\s|[^A-Za-z0-9\-])+/', '-', $str);
 138  
 139          // Trim dashes at beginning and end of alias
 140          $str = trim($str, '-');
 141  
 142          return $str;
 143      }
 144  
 145      /**
 146       * Generates a URL safe version of the specified string with unicode character replacement.
 147       *
 148       * @param   string  $string  String to process
 149       *
 150       * @return  string  Processed string
 151       *
 152       * @since   1.0
 153       */
 154  	public static function stringUrlUnicodeSlug($string)
 155      {
 156          // Replace double byte whitespaces by single byte (East Asian languages)
 157          $str = preg_replace('/\xE3\x80\x80/', ' ', $string);
 158  
 159          // Remove any '-' from the string as they will be used as concatenator.
 160          // Would be great to let the spaces in but only Firefox is friendly with this
 161  
 162          $str = str_replace('-', ' ', $str);
 163  
 164          // Replace forbidden characters by whitespaces
 165          $str = preg_replace('#[:\#\*"@+=;!><&\.%()\]\/\'\\\\|\[]#', "\x20", $str);
 166  
 167          // Delete all '?'
 168          $str = str_replace('?', '', $str);
 169  
 170          // Trim white spaces at beginning and end of alias and make lowercase
 171          $str = trim(StringHelper::strtolower($str));
 172  
 173          // Remove any duplicate whitespace and replace whitespaces by hyphens
 174          $str = preg_replace('#\x20+#', '-', $str);
 175  
 176          return $str;
 177      }
 178  
 179      /**
 180       * Makes a string safe for XHTML output by escaping ampersands.
 181       *
 182       * @param   string  $text  Text to process
 183       *
 184       * @return  string  Processed string.
 185       *
 186       * @since   1.0
 187       */
 188  	public static function ampReplace($text)
 189      {
 190          return preg_replace('/(?<!&)&(?!&|#|[\w]+;)/', '&amp;', $text);
 191      }
 192  
 193      /**
 194       * Cleans text of all formatting and scripting code.
 195       *
 196       * @param   string  $text  Text to clean
 197       *
 198       * @return  string  Cleaned text.
 199       *
 200       * @since   1.0
 201       */
 202  	public static function cleanText(&$text)
 203      {
 204          $text = preg_replace("'<script[^>]*>.*?</script>'si", '', $text);
 205          $text = preg_replace('/<a\s+.*?href="([^"]+)"[^>]*>([^<]+)<\/a>/is', '\2 (\1)', $text);
 206          $text = preg_replace('/<!--.+?-->/', '', $text);
 207          $text = preg_replace('/{.+?}/', '', $text);
 208          $text = preg_replace('/&nbsp;/', ' ', $text);
 209          $text = preg_replace('/&amp;/', ' ', $text);
 210          $text = preg_replace('/&quot;/', ' ', $text);
 211          $text = strip_tags($text);
 212          $text = htmlspecialchars($text, \ENT_COMPAT, 'UTF-8');
 213  
 214          return $text;
 215      }
 216  
 217      /**
 218       * Set a Language instance for use
 219       *
 220       * @param   Language  $language  The Language instance to use.
 221       *
 222       * @return  void
 223       *
 224       * @since   2.0.0
 225       */
 226  	public static function setLanguage(Language $language): void
 227      {
 228          self::$language = $language;
 229      }
 230  
 231      /**
 232       * Strips `<img>` tags from a string.
 233       *
 234       * @param   string  $string  Sting to be cleaned.
 235       *
 236       * @return  string  Cleaned string
 237       *
 238       * @since   1.0
 239       */
 240  	public static function stripImages($string)
 241      {
 242          return preg_replace('#(<[/]?img.*>)#U', '', $string);
 243      }
 244  
 245      /**
 246       * Strips `<iframe>` tags from a string.
 247       *
 248       * @param   string  $string  Sting to be cleaned.
 249       *
 250       * @return  string  Cleaned string
 251       *
 252       * @since   1.0
 253       */
 254  	public static function stripIframes($string)
 255      {
 256          return preg_replace('#(<[/]?iframe.*>)#U', '', $string);
 257      }
 258  }