915 * Preprocesses an HTML text string prior to being sent to MySQL. |
915 * Preprocesses an HTML text string prior to being sent to MySQL. |
916 * @param string $text |
916 * @param string $text |
917 * @param bool $strip_all_php - if true, strips all PHP regardless of user permissions. Else, strips PHP only if user level < USER_LEVEL_ADMIN. Defaults to true. |
917 * @param bool $strip_all_php - if true, strips all PHP regardless of user permissions. Else, strips PHP only if user level < USER_LEVEL_ADMIN. Defaults to true. |
918 * @param bool $sqlescape - if true, sends text through $db->escape(). Otherwise returns unescaped text. Defaults to true. |
918 * @param bool $sqlescape - if true, sends text through $db->escape(). Otherwise returns unescaped text. Defaults to true. |
919 * @param bool $reduceheadings - if true, finds HTML headings and replaces them with wikitext. Else, does not touch headings. Defaults to true. |
919 * @param bool $reduceheadings - if true, finds HTML headings and replaces them with wikitext. Else, does not touch headings. Defaults to true. |
920 */ |
920 * @param Session_ACLPageInfo Optional permissions instance to check against, $session is used if not provided |
921 public static function preprocess_text($text, $strip_all_php = true, $sqlescape = true, $reduceheadings = true) |
921 */ |
|
922 public static function preprocess_text($text, $strip_all_php = true, $sqlescape = true, $reduceheadings = true, $perms = false) |
922 { |
923 { |
923 global $db, $session, $paths, $template, $plugins; // Common objects |
924 global $db, $session, $paths, $template, $plugins; // Common objects |
924 $random_id = md5( time() . mt_rand() ); |
925 $random_id = md5( time() . mt_rand() ); |
925 |
926 |
926 $code = $plugins->setHook('render_sanitize_pre'); |
927 $code = $plugins->setHook('render_sanitize_pre'); |
927 foreach ( $code as $cmd ) |
928 foreach ( $code as $cmd ) |
928 { |
929 { |
929 eval($cmd); |
930 eval($cmd); |
930 } |
931 } |
931 |
932 |
932 $can_do_php = ( !$strip_all_php && $session->get_permissions('php_in_pages') ); |
933 if ( !is_object($perms) ) |
933 $can_do_html = $session->check_acl_scope('html_in_pages', $paths->namespace) && $session->get_permissions('html_in_pages'); |
934 { |
|
935 $namespace = $paths->namespace; |
|
936 $perms =& $session; |
|
937 } |
|
938 else |
|
939 { |
|
940 $namespace = $perms->namespace; |
|
941 } |
|
942 |
|
943 $can_do_php = ( !$strip_all_php && $perms->get_permissions('php_in_pages') ); |
|
944 $can_do_html = $session->check_acl_scope('html_in_pages', $namespace) && $perms->get_permissions('html_in_pages'); |
934 |
945 |
935 if ( $can_do_html && !$can_do_php ) |
946 if ( $can_do_html && !$can_do_php ) |
936 { |
947 { |
937 $text = preg_replace('#<(\?|\?php|%)(.*?)(\?|%)>#is', '<\\1\\2\\3>', $text); |
948 $text = preg_replace('#<(\?|\?php|%)(.*?)(\?|%)>#is', '<\\1\\2\\3>', $text); |
938 } |
949 } |