<?php

/*

 * Enano - an open-source CMS capable of wiki functions, Drupal-like sidebar blocks, and everything in between

 *

 * This program is Free Software; you can redistribute and/or modify it under the terms of the GNU General Public License

 * as published by the Free Software Foundation; either version 2 of the License, or (at your option) any later version.

 *

 * This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied

 * warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for details.

 *

 * This script contains code originally found in MediaWiki (http://www.mediawiki.org). MediaWiki is also licensed under

 * the GPLv2 or later; see the file GPL included with this package for details.

 */

$attrib = '[a-zA-Z0-9]';

$space = '[\x09\x0a\x0d\x20]';

define( 'MW_CHAR_REFS_REGEX',

'/&([A-Za-z0-9]+);

 |&\#([0-9]+);

 |&\#x([0-9A-Za-z]+);

 |&\#X([0-9A-Za-z]+);

 |(&)/x' );

define( 'MW_ATTRIBS_REGEX',

  "/(?:^|$space)($attrib+)

    ($space*=$space*

    (?:

     # The attribute value: quoted or alone

      ".'"'."([^<".'"'."]*)".'"'."

     | '([^<']*)'

     |  ([a-zA-Z0-9!#$%&()*,\\-.\\/:;<>?@[\\]^_`{|}~]+)

     |  (\#[0-9a-fA-F]+) # Technically wrong, but lots of

               # colors are specified like this.

               # We'll be normalizing it.

    )

     )?(?=$space|\$)/sx" );

/**

 * Take a tag soup fragment listing an HTML element's attributes

 * and normalize it to well-formed XML, discarding unwanted attributes.

 * Output is safe for further wikitext processing, with escaping of

 * values that could trigger problems.

 *

 * - Normalizes attribute names to lowercase

 * - Discards attributes not on a whitelist for the given element

 * - Turns broken or invalid entities into plaintext

 * - Double-quotes all attribute values

 * - Attributes without values are given the name as attribute

 * - Double attributes are discarded

 * - Unsafe style attributes are discarded

 * - Prepends space if there are attributes.

 *

 * @param string $text

 * @param string $element

 * @return string

 */

function fixTagAttributes( $text, $element ) {

  if( trim( $text ) == '' ) {

    return '';

  }

  $stripped = validateTagAttributes(

    decodeTagAttributes( $text ), $element );

  $attribs = array();

  foreach( $stripped as $attribute => $value ) {

    $encAttribute = htmlspecialchars( $attribute );

    $encValue = safeEncodeAttribute( $value );

    $attribs[] = "$encAttribute=".'"'."$encValue".'"'.""; // "

  }

  return count( $attribs ) ? ' ' . implode( ' ', $attribs ) : '';

}

/**

 * Encode an attribute value for HTML tags, with extra armoring

 * against further wiki processing.

 * @param $text

 * @return HTML-encoded text fragment

 */

function safeEncodeAttribute( $text ) {

  $encValue= encodeAttribute( $text );

  # Templates and links may be expanded in later parsing,

  # creating invalid or dangerous output. Suppress this.

  $encValue = strtr( $encValue, array(

    '<'    => '&lt;',   // This should never happen,

    '>'    => '>',   // we've received invalid input

    '"'    => '"', // which should have been escaped.

    '{'    => '{',

    '['    => '[',

    "''"   => '''',

    'ISBN' => 'ISBN',

    'RFC'  => 'RFC',

    'PMID' => 'PMID',

    '|'    => '|',

    '__'   => '__',

  ) );

  return $encValue;

}

/**

 * Encode an attribute value for HTML output.

 * @param $text

 * @return HTML-encoded text fragment

 */

function encodeAttribute( $text ) {

  // In Enano 1.0.3, added this cheapo hack to keep ampersands

  // from being double-sanitized. Thanks to markybob from #deluge.

  // htmlspecialchars() the "manual" way

  $encValue = strtr( $text, array(

    '&'  => '&',

    '"' => '"',

    '&lt;'   => '<',

    '>'   => '>',

    ''' => "'"

  ) );

  $encValue = strtr( $text, array(

    '&' => '&',

    '"' => '"',

    '<' => '&lt;',

    '>' => '>',

    "'" => '''

  ) );

  // Whitespace is normalized during attribute decoding,

  // so if we've been passed non-spaces we must encode them

  // ahead of time or they won't be preserved.

  $encValue = strtr( $encValue, array(

    "\n" => '
',

    "\r" => '
',

    "\t" => '	',

  ) );

  return $encValue;

}

function unstripForHTML( $text ) {

  global $mStripState;

  $text = unstrip( $text, $mStripState );

  $text = unstripNoWiki( $text, $mStripState );

  return $text;

}

/**

 * Always call this after unstrip() to preserve the order

 *

 * @private

 */

function unstripNoWiki( $text, &$state ) {

  if ( !isset( $state['nowiki'] ) ) {

    return $text;

  }

  # TODO: good candidate for FSS

  $text = strtr( $text, $state['nowiki'] );

  return $text;

}

/**

 * Take an array of attribute names and values and normalize or discard

 * illegal values for the given element type.

 *

 * - Discards attributes not on a whitelist for the given element

 * - Unsafe style attributes are discarded

 *

 * @param array $attribs

 * @param string $element

 * @return array

 *

 * @todo Check for legal values where the DTD limits things.

 * @todo Check for unique id attribute :P

 */

function validateTagAttributes( $attribs, $element ) {

  $whitelist = array_flip( attributeWhitelist( $element ) );

  $out = array();

  foreach( $attribs as $attribute => $value ) {

    if( !isset( $whitelist[$attribute] ) ) {

      continue;

    }

    # Strip javascript "expression" from stylesheets.

    # http://msdn.microsoft.com/workshop/author/dhtml/overview/recalc.asp

    if( $attribute == 'style' ) {

      $value = checkCss( $value );

      if( $value === false ) {

        # haxx0r

        continue;

      }

    }

    if ( $attribute === 'id' )

      $value = escapeId( $value );

    // If this attribute was previously set, override it.

    // Output should only have one attribute of each name.

    $out[$attribute] = $value;

  }

  return $out;

}

/**

 * Pick apart some CSS and check it for forbidden or unsafe structures.

 * Returns a sanitized string, or false if it was just too evil.

 *

 * Currently URL references, 'expression', 'tps' are forbidden.

 *

 * @param string $value

 * @return mixed

 */

function checkCss( $value ) {

  $stripped = decodeCharReferences( $value );

  // Remove any comments; IE gets token splitting wrong

  $stripped = preg_replace( '!/\\*.*?\\*/!S', '', $stripped );

  $value = $stripped;

  // ... and continue checks

  $stripped = preg_replace( '!\\\\([0-9A-Fa-f]{1,6})[ \\n\\r\\t\\f]?!e',

    'codepointToUtf8(hexdec("$1"))', $stripped );

  $stripped = str_replace( '\\', '', $stripped );

  if( preg_match( '/(expression|tps*:\/\/|url\\s*\().*/is',

      $stripped ) ) {

    # haxx0r

    return false;

  }

  return $value;

}

/**

 * Decode any character references, numeric or named entities,

 * in the text and return a UTF-8 string.

 *

 * @param string $text

 * @return string

 * @access public

 * @static

 */

function decodeCharReferences( $text ) {

  return preg_replace_callback(

    MW_CHAR_REFS_REGEX,

    'decodeCharReferencesCallback',

    $text );

}

/**

 * Fetch the whitelist of acceptable attributes for a given

 * element name.

 *

 * @param string $element

 * @return array

 */

function attributeWhitelist( $element ) {

  static $list;

  if( !isset( $list ) ) {

    $list = setupAttributeWhitelist();

  }

  return isset( $list[$element] )

    ? $list[$element]

    : array();

}

/**

 * @todo Document it a bit

 * @return array

 */

function setupAttributeWhitelist() {

  global $db, $session, $paths, $template, $plugins;

  $common = array( 'id', 'class', 'lang', 'dir', 'title', 'style' );

  $block = array_merge( $common, array( 'align' ) );

  $tablealign = array( 'align', 'char', 'charoff', 'valign' );

  $tablecell = array( 'abbr',

                      'axis',

                      'headers',

                      'scope',

                      'rowspan',

                      'colspan',

                      'nowrap', # deprecated

                      'width',  # deprecated

                      'height', # deprecated

                      'bgcolor' # deprecated

                      );

  # Numbers refer to sections in HTML 4.01 standard describing the element.

  # See: http://www.w3.org/TR/html4/

  $whitelist = array (

    # 7.5.4

    'div'        => $block,

    'center'     => $common, # deprecated

    'span'       => $block, # ??

    # 7.5.5

    'h1'         => $block,

    'h2'         => $block,

    'h3'         => $block,

    'h4'         => $block,

    'h5'         => $block,

    'h6'         => $block,

    # 7.5.6

    # address

    # 8.2.4

    # bdo

    # 9.2.1

    'em'         => $common,

    'strong'     => $common,

    'cite'       => $common,

    # dfn

    'code'       => $common,

    # samp

    # kbd

    'var'        => $common,

    # abbr

    # acronym

    # 9.2.2

    'blockquote' => array_merge( $common, array( 'cite' ) ),

    # q

    # 9.2.3

    'sub'        => $common,

    'sup'        => $common,

    # 9.3.1

    'p'          => $block,

    # 9.3.2

    'br'         => array( 'id', 'class', 'title', 'style', 'clear' ),

    # 9.3.4

    'pre'        => array_merge( $common, array( 'width' ) ),

    # 9.4

    'ins'        => array_merge( $common, array( 'cite', 'datetime' ) ),

    'del'        => array_merge( $common, array( 'cite', 'datetime' ) ),

    # 10.2

    'ul'         => array_merge( $common, array( 'type' ) ),

    'ol'         => array_merge( $common, array( 'type', 'start' ) ),

    'li'         => array_merge( $common, array( 'type', 'value' ) ),

    # 10.3

    'dl'         => $common,

    'dd'         => $common,

    'dt'         => $common,

    # 11.2.1

    'table'      => array_merge( $common,

              array( 'summary', 'width', 'border', 'frame',

                  'rules', 'cellspacing', 'cellpadding',

                  'align', 'bgcolor',

              ) ),

    # 11.2.2

    'caption'    => array_merge( $common, array( 'align' ) ),

    # 11.2.3

    'thead'      => array_merge( $common, $tablealign ),

    'tfoot'      => array_merge( $common, $tablealign ),

    'tbody'      => array_merge( $common, $tablealign ),

    # 11.2.4

    'colgroup'   => array_merge( $common, array( 'span', 'width' ), $tablealign ),

    'col'        => array_merge( $common, array( 'span', 'width' ), $tablealign ),

    # 11.2.5

    'tr'         => array_merge( $common, array( 'bgcolor' ), $tablealign ),

    # 11.2.6

    'td'         => array_merge( $common, $tablecell, $tablealign ),

    'th'         => array_merge( $common, $tablecell, $tablealign ),

    # 12.2

    # added by dan

    'a'          => array_merge( $common, array( 'href', 'name' ) ),

    # 13.2

    # added by dan

    'img'        => array_merge( $common, array( 'src', 'width', 'height', 'alt' ) ),

    # 15.2.1

    'tt'         => $common,

    'b'          => $common,

    'i'          => $common,

    'big'        => $common,

    'small'      => $common,

    'strike'     => $common,

    's'          => $common,

    'u'          => $common,

    # 15.2.2

    'font'       => array_merge( $common, array( 'size', 'color', 'face' ) ),

    # basefont

    # 15.3

    'hr'         => array_merge( $common, array( 'noshade', 'size', 'width' ) ),

    # XHTML Ruby annotation text module, simple ruby only.

    # http://www.w3c.org/TR/ruby/

    'ruby'       => $common,

    # rbc

    # rtc

    'rb'         => $common,

    'rt'         => $common, #array_merge( $common, array( 'rbspan' ) ),

    'rp'         => $common,

    # For compatibility with the XHTML parser.

    'nowiki'     => array(),

    'noinclude'  => array(),

    'nodisplay'  => array(),

    'lang'       => array('code'),

    # XHTML stuff

    'acronym'    => $common

    );

  // custom tags can be added by plugins

  $code = $plugins->setHook('html_attribute_whitelist');

  foreach ( $code as $cmd )

  {

    eval($cmd);

  }

  return $whitelist;

}

/**

 * Given a value escape it so that it can be used in an id attribute and

 * return it, this does not validate the value however (see first link)

 *

 * @link http://www.w3.org/TR/html401/types.html#type-name Valid characters

 *                                                          in the id and

 *                                                          name attributes

 * @link http://www.w3.org/TR/html401/struct/links.html#h-12.2.3 Anchors with the id attribute

 *

 * @bug 4461

 *

 * @static

 *

 * @param string $id

 * @return string

 */

function escapeId( $id ) {

  static $replace = array(

    '%3A' => ':',

    '%' => '.'

  );

  $id = urlencode( decodeCharReferences( strtr( $id, ' ', '_' ) ) );

  return str_replace( array_keys( $replace ), array_values( $replace ), $id );

}

/**

 * More or less "markup-safe" explode()

 * Ignores any instances of the separator inside <...>

 * @param string $separator

 * @param string $text

 * @return array

 */

function wfExplodeMarkup( $separator, $text ) {

  $placeholder = "\x00";

  // Just in case...

  $text = str_replace( $placeholder, '', $text );

  // Trim stuff

  $replacer = new ReplacerCallback( $separator, $placeholder );

  $cleaned = preg_replace_callback( '/(<.*?>)/', array( $replacer, 'go' ), $text );

  $items = explode( $separator, $cleaned );

  foreach( $items as $i => $str ) {

    $items[$i] = str_replace( $placeholder, $separator, $str );

  }

  return $items;

}

class ReplacerCallback {

  function ReplacerCallback( $from, $to ) {

    $this->from = $from;

    $this->to = $to;

  }

  function go( $matches ) {

    return str_replace( $this->from, $this->to, $matches[1] );

  }

}

/**

 * Return an associative array of attribute names and values from

 * a partial tag string. Attribute names are forces to lowercase,

 * character references are decoded to UTF-8 text.

 *

 * @param string

 * @return array

 */

function decodeTagAttributes( $text ) {

  $attribs = array();

  if( trim( $text ) == '' ) {

    return $attribs;

  }

  $pairs = array();

  if( !preg_match_all(

    MW_ATTRIBS_REGEX,

    $text,

    $pairs,

    PREG_SET_ORDER ) ) {

    return $attribs;

  }

  foreach( $pairs as $set ) {

    $attribute = strtolower( $set[1] );

    $value = getTagAttributeCallback( $set );