<?php

/*
 * Enano - an open-source CMS capable of wiki functions, Drupal-like sidebar blocks, and everything in between
 * Copyright (C) 2006-2009 Dan Fuhry
 *
 * This program is Free Software; you can redistribute and/or modify it under the terms of the GNU General Public License
 * as published by the Free Software Foundation; either version 2 of the License, or (at your option) any later version.
 *
 * This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied
 * warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for details.
 *
 * This script contains code originally found in MediaWiki (http://www.mediawiki.org). MediaWiki is also licensed under
 * the GPLv2 or later; see the file GPL included with this package for details.
 */

$attrib = '[a-zA-Z0-9]';
$space = '[\x09\x0a\x0d\x20]';

define( 'MW_CHAR_REFS_REGEX',
'/&([A-Za-z0-9]+);
 |&\#([0-9]+);
 |&\#x([0-9A-Za-z]+);
 |&\#X([0-9A-Za-z]+);
 |(&)/x' );

define( 'MW_ATTRIBS_REGEX',
	"/(?:^|$space)($attrib+)
		($space*=$space*
		(?:
 		# The attribute value: quoted or alone
			\"([^<\"]*)\"
 		| '([^<']*)'
 		|  ([a-zA-Z0-9!#$%&()*,\\-.\\/:;<>?@[\\]^_`{|}~]+)
 		|  (\#[0-9a-fA-F]+) # Technically wrong, but lots of
 							# colors are specified like this.
 							# We'll be normalizing it.
		)
 		)?(?=$space|\$)/sx" );

/**
 * Take a tag soup fragment listing an HTML element's attributes
 * and normalize it to well-formed XML, discarding unwanted attributes.
 * Output is safe for further wikitext processing, with escaping of
 * values that could trigger problems.
 *
 * - Normalizes attribute names to lowercase
 * - Discards attributes not on a whitelist for the given element
 * - Turns broken or invalid entities into plaintext
 * - Double-quotes all attribute values
 * - Attributes without values are given the name as attribute
 * - Double attributes are discarded
 * - Unsafe style attributes are discarded
 * - Prepends space if there are attributes.
 *
 * @param string $text
 * @param string $element
 * @return string
 */
function fixTagAttributes( $text, $element ) {
	if( trim( $text ) == '' ) {
		return '';
	}
	
	$stripped = validateTagAttributes(
		decodeTagAttributes( $text ), $element );
	
	$attribs = array();
	foreach( $stripped as $attribute => $value ) {
		$encAttribute = htmlspecialchars( $attribute );
		$encValue = safeEncodeAttribute( $value );
		
		$attribs[] = "$encAttribute=".'"'."$encValue".'"'.""; // "
	}
	return count( $attribs ) ? ' ' . implode( ' ', $attribs ) : '';
}

/**
 * Encode an attribute value for HTML tags, with extra armoring
 * against further wiki processing.
 * @param $text
 * @return HTML-encoded text fragment
 */
function safeEncodeAttribute( $text ) {
	$encValue= encodeAttribute( $text );
	
	# Templates and links may be expanded in later parsing,
	# creating invalid or dangerous output. Suppress this.
	$encValue = strtr( $encValue, array(
		'<'    => '&lt;',   // This should never happen,
		'>'    => '&gt;',   // we've received invalid input
		'"'    => '&quot;', // which should have been escaped.
		'{'    => '&#123;',
		'['    => '&#91;',
		"''"   => '&#39;&#39;',
		'ISBN' => '&#73;SBN',
		'RFC'  => '&#82;FC',
		'PMID' => '&#80;MID',
		'|'    => '&#124;',
		'__'   => '&#95;_',
	) );

	return $encValue;
}

/**
 * Encode an attribute value for HTML output.
 * @param $text
 * @return HTML-encoded text fragment
 */
function encodeAttribute( $text ) {
	
	// In Enano 1.0.3, added this cheapo hack to keep ampersands
	// from being double-sanitized. Thanks to markybob from #deluge.
	
	// htmlspecialchars() the "manual" way
	$encValue = strtr( $text, array(
		'&amp;'  => '&',
		'&quot;' => '"',
		'&lt;'   => '<',
		'&gt;'   => '>',
		'&#039;' => "'"
	) );
	
	$encValue = strtr( $text, array(
		'&' => '&amp;',
		'"' => '&quot;',
		'<' => '&lt;',
		'>' => '&gt;',
		"'" => '&#039;'
	) );
	
	
	// Whitespace is normalized during attribute decoding,
	// so if we've been passed non-spaces we must encode them
	// ahead of time or they won't be preserved.
	$encValue = strtr( $encValue, array(
		"\n" => '&#10;',
		"\r" => '&#13;',
		"\t" => '&#9;',
	) );
	
	return $encValue;
}

function unstripForHTML( $text ) {
	global $mStripState;
	$text = unstrip( $text, $mStripState );
	$text = unstripNoWiki( $text, $mStripState );
	return $text;
}

/**
 * Always call this after unstrip() to preserve the order
 *
 * @private
 */
function unstripNoWiki( $text, &$state ) {
	if ( !isset( $state['nowiki'] ) ) {
		return $text;
	}

	# TODO: good candidate for FSS
	$text = strtr( $text, $state['nowiki'] );
	
	return $text;
}

/**
 * Take an array of attribute names and values and normalize or discard
 * illegal values for the given element type.
 *
 * - Discards attributes not on a whitelist for the given element
 * - Unsafe style attributes are discarded
 *
 * @param array $attribs
 * @param string $element
 * @return array
 *
 * @todo Check for legal values where the DTD limits things.
 * @todo Check for unique id attribute :P
 */
function validateTagAttributes( $attribs, $element ) {
	$whitelist = array_flip( attributeWhitelist( $element ) );
	$out = array();
	foreach( $attribs as $attribute => $value ) {
		if( !isset( $whitelist[$attribute] ) ) {
			continue;
		}
		# Strip javascript "expression" from stylesheets.
		# http://msdn.microsoft.com/workshop/author/dhtml/overview/recalc.asp
		if( $attribute == 'style' ) {
			$value = checkCss( $value );
			if( $value === false ) {
				# haxx0r
				continue;
			}
		}

		if ( $attribute === 'id' )
			$value = escapeId( $value );

		// If this attribute was previously set, override it.
		// Output should only have one attribute of each name.
		$out[$attribute] = $value;
	}
	return $out;
}

/**
 * Pick apart some CSS and check it for forbidden or unsafe structures.
 * Returns a sanitized string, or false if it was just too evil.
 *
 * Currently URL references, 'expression', 'tps' are forbidden.
 *
 * @param string $value
 * @return mixed
 */
function checkCss( $value ) {
	$stripped = decodeCharReferences( $value );

	// Remove any comments; IE gets token splitting wrong
	$stripped = preg_replace( '!/\\*.*?\\*/!S', '', $stripped );
	$value = $stripped;

	// ... and continue checks
	$stripped = preg_replace( '!\\\\([0-9A-Fa-f]{1,6})[ \\n\\r\\t\\f]?!e',
		'codepointToUtf8(hexdec("$1"))', $stripped );
	$stripped = str_replace( '\\', '', $stripped );
	if( preg_match( '/(expression|tps*:\/\/|url\\s*\().*/is',
			$stripped ) ) {
		# haxx0r
		return false;
	}
	
	return $value;
}

/**
 * Decode any character references, numeric or named entities,
 * in the text and return a UTF-8 string.
 *
 * @param string $text
 * @return string
 * @access public
 * @static
 */
function decodeCharReferences( $text ) {
	return preg_replace_callback(
		MW_CHAR_REFS_REGEX,
		'decodeCharReferencesCallback',
		$text );
}

/**
 * Fetch the whitelist of acceptable attributes for a given
 * element name.
 *
 * @param string $element
 * @return array
 */
function attributeWhitelist( $element ) {
	static $list;
	if( !isset( $list ) ) {
		$list = setupAttributeWhitelist();
	}
	return isset( $list[$element] )
		? $list[$element]
		: array();
}

/**
 * @todo Document it a bit
 * @return array
 */
function setupAttributeWhitelist() {
	global $db, $session, $paths, $template, $plugins;
	$common = array( 'id', 'class', 'lang', 'dir', 'title', 'style' );
	$block = array_merge( $common, array( 'align' ) );
	$tablealign = array( 'align', 'char', 'charoff', 'valign' );
	$tablecell = array( 'abbr',
											'axis',
											'headers',
											'scope',
											'rowspan',
											'colspan',
											'nowrap', # deprecated
											'width',  # deprecated
											'height', # deprecated
											'bgcolor' # deprecated
											);

	# Numbers refer to sections in HTML 4.01 standard describing the element.
	# See: http://www.w3.org/TR/html4/
	$whitelist = array (
		# 7.5.4
		'div'        => $block,
		'center'     => $common, # deprecated
		'span'       => $block, # ??

		# 7.5.5
		'h1'         => $block,
		'h2'         => $block,
		'h3'         => $block,
		'h4'         => $block,
		'h5'         => $block,
		'h6'         => $block,

		# 7.5.6
		# address

		# 8.2.4
		# bdo

		# 9.2.1
		'em'         => $common,
		'strong'     => $common,
		'cite'       => $common,
		# dfn
		'code'       => $common,
		# samp
		# kbd
		'var'        => $common,
		# abbr
		# acronym

		# 9.2.2
		'blockquote' => array_merge( $common, array( 'cite' ) ),
		# q

		# 9.2.3
		'sub'        => $common,
		'sup'        => $common,

		# 9.3.1
		'p'          => $block,

		# 9.3.2
		'br'         => array( 'id', 'class', 'title', 'style', 'clear' ),

		# 9.3.4
		'pre'        => array_merge( $common, array( 'width' ) ),

		# 9.4
		'ins'        => array_merge( $common, array( 'cite', 'datetime' ) ),
		'del'        => array_merge( $common, array( 'cite', 'datetime' ) ),

		# 10.2
		'ul'         => array_merge( $common, array( 'type' ) ),
		'ol'         => array_merge( $common, array( 'type', 'start' ) ),
		'li'         => array_merge( $common, array( 'type', 'value' ) ),

		# 10.3
		'dl'         => $common,
		'dd'         => $common,
		'dt'         => $common,

		# 11.2.1
		'table'      => array_merge( $common,
							array( 'summary', 'width', 'border', 'frame',
									'rules', 'cellspacing', 'cellpadding',
									'align', 'bgcolor',
							) ),

		# 11.2.2
		'caption'    => array_merge( $common, array( 'align' ) ),

		# 11.2.3
		'thead'      => array_merge( $common, $tablealign ),
		'tfoot'      => array_merge( $common, $tablealign ),
		'tbody'      => array_merge( $common, $tablealign ),

		# 11.2.4
		'colgroup'   => array_merge( $common, array( 'span', 'width' ), $tablealign ),
		'col'        => array_merge( $common, array( 'span', 'width' ), $tablealign ),

		# 11.2.5
		'tr'         => array_merge( $common, array( 'bgcolor' ), $tablealign ),

		# 11.2.6
		'td'         => array_merge( $common, $tablecell, $tablealign ),
		'th'         => array_merge( $common, $tablecell, $tablealign ),
		
		# 12.2
		# added by dan
		'a'          => array_merge( $common, array( 'href', 'name' ) ),
		
		# 13.2
		# added by dan
		'img'        => array_merge( $common, array( 'src', 'width', 'height', 'alt' ) ),

		# 15.2.1
		'tt'         => $common,
		'b'          => $common,
		'i'          => $common,
		'big'        => $common,
		'small'      => $common,
		'strike'     => $common,
		's'          => $common,
		'u'          => $common,

		# 15.2.2
		'font'       => array_merge( $common, array( 'size', 'color', 'face' ) ),
		# basefont

		# 15.3
		'hr'         => array_merge( $common, array( 'noshade', 'size', 'width' ) ),

		# XHTML Ruby annotation text module, simple ruby only.
		# http://www.w3c.org/TR/ruby/
		'ruby'       => $common,
		# rbc
		# rtc
		'rb'         => $common,
		'rt'         => $common, #array_merge( $common, array( 'rbspan' ) ),
		'rp'         => $common,
		
		# For compatibility with the XHTML parser.
		'nowiki'     => array(),
		'noinclude'  => array(),
		'nodisplay'  => array(),
		'lang'       => array('code'),
		
		# XHTML stuff
		'acronym'    => $common
		);
	
	// custom tags can be added by plugins
	$code = $plugins->setHook('html_attribute_whitelist');
	foreach ( $code as $cmd )
	{
		eval($cmd);
	}
	
	return $whitelist;
}

/**
 * Given a value escape it so that it can be used in an id attribute and
 * return it, this does not validate the value however (see first link)
 *
 * @link http://www.w3.org/TR/html401/types.html#type-name Valid characters
 *                                                          in the id and
 *                                                          name attributes
 * @link http://www.w3.org/TR/html401/struct/links.html#h-12.2.3 Anchors with the id attribute
 *
 * @bug 4461
 *
 * @static
 *
 * @param string $id
 * @return string
 */
function escapeId( $id ) {
	static $replace = array(
		'%3A' => ':',
		'%' => '.'
	);

	$id = urlencode( decodeCharReferences( strtr( $id, ' ', '_' ) ) );

	return str_replace( array_keys( $replace ), array_values( $replace ), $id );
}

/**
 * More or less "markup-safe" explode()
 * Ignores any instances of the separator inside <...>
 * @param string $separator
 * @param string $text
 * @return array
 */
function wfExplodeMarkup( $separator, $text ) {
	$placeholder = "\x00";
	
	// Just in case...
	$text = str_replace( $placeholder, '', $text );
	
	// Trim stuff
	$replacer = new ReplacerCallback( $separator, $placeholder );
	$cleaned = preg_replace_callback( '/(<.*?>)/', array( $replacer, 'go' ), $text );
	
	$items = explode( $separator, $cleaned );
	foreach( $items as $i => $str ) {
		$items[$i] = str_replace( $placeholder, $separator, $str );
	}
	
	return $items;
}

class ReplacerCallback {
	function ReplacerCallback( $from, $to ) {
		$this->from = $from;
		$this->to = $to;
	}
	
	function go( $matches ) {
		return str_replace( $this->from, $this->to, $matches[1] );
	}
}

/**
 * Return an associative array of attribute names and values from
 * a partial tag string. Attribute names are forces to lowercase,
 * character references are decoded to UTF-8 text.
 *
 * @param string
 * @return array
 */
function decodeTagAttributes( $text ) {
	$attribs = array();

	if( trim( $text ) == '' ) {
		return $attribs;
	}

	$pairs = array();
	if( !preg_match_all(
		MW_ATTRIBS_REGEX,
		$text,
		$pairs,
		PREG_SET_ORDER ) ) {
		return $attribs;
	}

	foreach( $pairs as $set ) {
		$attribute = strtolower( $set[1] );
		$value = getTagAttributeCallback( $set );
		
		// Normalize whitespace
		$value = preg_replace( '/[\t\r\n ]+/', ' ', $value );
		$value = trim( $value );
		
		// Decode character references
		$attribs[$attribute] = decodeCharReferences( $value );
	}
	return $attribs;
}

/**
 * Pick the appropriate attribute value from a match set from the
 * MW_ATTRIBS_REGEX matches.
 *
 * @param array $set
 * @return string
 * @access private
 */
function getTagAttributeCallback( $set ) {
	if( isset( $set[6] ) ) {
		# Illegal #XXXXXX color with no quotes.
		return $set[6];
	} elseif( isset( $set[5] ) ) {
		# No quotes.
		return $set[5];
	} elseif( isset( $set[4] ) ) {
		# Single-quoted
		return $set[4];
	} elseif( isset( $set[3] ) ) {
		# Double-quoted
		return $set[3];
	} elseif( !isset( $set[2] ) ) {
		# In XHTML, attributes must have a value.
		# For 'reduced' form, return explicitly the attribute name here.
		return $set[1];
	} else {
		die_friendly('Parser error', "<p>Tag conditions not met. This should never happen and is a bug.</p>" );
	}
}

/**
 * Strips and renders nowiki, pre, math, hiero
 * If $render is set, performs necessary rendering operations on plugins
 * Returns the text, and fills an array with data needed in unstrip()
 * If the $state is already a valid strip state, it adds to the state
 *
 * @param bool $stripcomments when set, HTML comments <!-- like this -->
 *  will be stripped in addition to other tags. This is important
 *  for section editing, where these comments cause confusion when
 *  counting the sections in the wikisource
 * 
 * @param array dontstrip contains tags which should not be stripped;
 *  used to prevent stipping of <gallery> when saving (fixes bug 2700)
 *
 * @access private
 */
function mwStrip( $text, &$state, $stripcomments = false , $dontstrip = array () ) {
	global $wgRandomKey;
	$render = true;

	$wgRandomKey = "\x07UNIQ" . dechex(mt_rand(0, 0x7fffffff)) . dechex(mt_rand(0, 0x7fffffff));
	$uniq_prefix =& $wgRandomKey;
	$commentState = array();
	
	$elements = array( 'nowiki', 'gallery' );
	
	# Removing $dontstrip tags from $elements list (currently only 'gallery', fixing bug 2700)
	foreach ( $elements AS $k => $v ) {
		if ( !in_array ( $v , $dontstrip ) ) continue;
		unset ( $elements[$k] );
	}
	
	$matches = array();
	$text = extractTagsAndParams( $elements, $text, $matches, $uniq_prefix );

	foreach( $matches as $marker => $data ) {
		list( $element, $content, $params, $tag ) = $data;
		if( $render ) {
			$tagName = strtolower( $element );
			switch( $tagName ) {
			case '!--':
				// Comment
				if( substr( $tag, -3 ) == '-->' ) {
					$output = $tag;
				} else {
					// Unclosed comment in input.
					// Close it so later stripping can remove it
					$output = "$tag-->";
				}
				break;
			case 'html':
				if( $wgRawHtml ) {
					$output = $content;
					break;
				}
				// Shouldn't happen otherwise. :)
			case 'nowiki':
				$output = wfEscapeHTMLTagsOnly( $content );
				break;
			default:
			}
		} else {
			// Just stripping tags; keep the source
			$output = $tag;
		}

		// Unstrip the output, because unstrip() is no longer recursive so 
		// it won't do it itself
		$output = unstrip( $output, $state );

		if( !$stripcomments && $element == '!--' ) {
			$commentState[$marker] = $output;
		} elseif ( $element == 'html' || $element == 'nowiki' ) {
			$state['nowiki'][$marker] = $output;
		} else {
			$state['general'][$marker] = $output;
		}
	}

	# Unstrip comments unless explicitly told otherwise.
	# (The comments are always stripped prior to this point, so as to
	# not invoke any extension tags / parser hooks contained within
	# a comment.)
	if ( !$stripcomments ) {
		// Put them all back and forget them
		$text = strtr( $text, $commentState );
	}

	return $text;
}

/**
 * Replaces all occurrences of HTML-style comments and the given tags
 * in the text with a random marker and returns teh next text. The output
 * parameter $matches will be an associative array filled with data in
 * the form:
 *   'UNIQ-xxxxx' => array(
 *     'element',
 *     'tag content',
 *     array( 'param' => 'x' ),
 *     '<element param="x">tag content</element>' ) )
 *
 * @param $elements list of element names. Comments are always extracted.
 * @param $text Source text string.
 * @param $uniq_prefix
 *
 * @access private
 * @static
 */
function extractTagsAndParams($elements, $text, &$matches, $uniq_prefix = ''){
	static $n = 1;
	$stripped = '';
	$matches = array();

	$taglist = implode( '|', $elements );
	$start = "/<($taglist)(\\s+[^>]*?|\\s*?)(\/?>)|<(!--)/i";

	while ( '' != $text ) {
		$p = preg_split( $start, $text, 2, PREG_SPLIT_DELIM_CAPTURE );
		$stripped .= $p[0];
		if( count( $p ) < 5 ) {
			break;
		}
		if( count( $p ) > 5 ) {
			// comment
			$element    = $p[4];
			$attributes = '';
			$close      = '';
			$inside     = $p[5];
		} else {
			// tag
			$element    = $p[1];
			$attributes = $p[2];
			$close      = $p[3];
			$inside     = $p[4];
		}

		$marker = "$uniq_prefix-$element-" . sprintf('%08X', $n++) . '-QINU';
		$stripped .= $marker;

		if ( $close === '/>' ) {
			// Empty element tag, <tag />
			$content = null;
			$text = $inside;
			$tail = null;
		} else {
			if( $element == '!--' ) {
				$end = '/(-->)/';
			} else {
				$end = "/(<\\/$element\\s*>)/i";
			}
			$q = preg_split( $end, $inside, 2, PREG_SPLIT_DELIM_CAPTURE );
			$content = $q[0];
			if( count( $q ) < 3 ) {
				# No end tag -- let it run out to the end of the text.
				$tail = '';
				$text = '';
			} else {
				$tail = $q[1];
				$text = $q[2];
			}
		}
		
		$matches[$marker] = array( $element,
			$content,
			decodeTagAttributes( $attributes ),
			"<$element$attributes$close$content$tail" );
	}
	return $stripped;
}

/**
 * Escape html tags
 * Basically replacing " > and < with HTML entities ( &quot;, &gt;, &lt;)
 *
 * @param $in String: text that might contain HTML tags.
 * @return string Escaped string
 */
function wfEscapeHTMLTagsOnly( $in ) {
	return str_replace(
		array( '"', '>', '<' ),
		array( '&quot;', '&gt;', '&lt;' ),
		$in );
}

/**
 * Restores pre, math, and other extensions removed by strip()
 *
 * always call unstripNoWiki() after this one
 * @private
 */
function unstrip( $text, &$state ) {
	if ( !isset( $state['general'] ) ) {
		return $text;
	}

	# TODO: good candidate for FSS
	$text = strtr( $text, $state['general'] );
	
	return $text;
}

/**
 * Return UTF-8 string for a codepoint if that is a valid
 * character reference, otherwise U+FFFD REPLACEMENT CHARACTER.
 * @param int $codepoint
 * @return string
 * @private
 */
function decodeChar( $codepoint ) {
	if( validateCodepoint( $codepoint ) ) {
		return codepointToUtf8( $codepoint );
	} else {
		return UTF8_REPLACEMENT;
	}
}

/**
 * If the named entity is defined in the HTML 4.0/XHTML 1.0 DTD,
 * return the UTF-8 encoding of that character. Otherwise, returns
 * pseudo-entity source (eg &foo;)
 *
 * @param string $name
 * @return string
 */
function decodeEntity( $name ) {
	global $wgHtmlEntities;
	if( isset( $wgHtmlEntities[$name] ) ) {
		return codepointToUtf8( $wgHtmlEntities[$name] );
	} else {
		return "&$name;";
	}
}

/**
 * Returns true if a given Unicode codepoint is a valid character in XML.
 * @param int $codepoint
 * @return bool
 */
function validateCodepoint( $codepoint ) {
	return ($codepoint ==    0x09)
		|| ($codepoint ==    0x0a)
		|| ($codepoint ==    0x0d)
		|| ($codepoint >=    0x20 && $codepoint <=   0xd7ff)
		|| ($codepoint >=  0xe000 && $codepoint <=   0xfffd)
		|| ($codepoint >= 0x10000 && $codepoint <= 0x10ffff);
}
	
/**
 * Return UTF-8 sequence for a given Unicode code point.
 * May die if fed out of range data.
 *
 * @param $codepoint Integer:
 * @return String
 * @public
 */
function codepointToUtf8( $codepoint ) {
	if($codepoint <		0x80) return chr($codepoint);
	if($codepoint <    0x800) return chr($codepoint >>	6 & 0x3f | 0xc0) .
									 chr($codepoint		  & 0x3f | 0x80);
	if($codepoint <  0x10000) return chr($codepoint >> 12 & 0x0f | 0xe0) .
									 chr($codepoint >>	6 & 0x3f | 0x80) .
									 chr($codepoint		  & 0x3f | 0x80);
	if($codepoint < 0x110000) return chr($codepoint >> 18 & 0x07 | 0xf0) .
									 chr($codepoint >> 12 & 0x3f | 0x80) .
									 chr($codepoint >>	6 & 0x3f | 0x80) .
									 chr($codepoint		  & 0x3f | 0x80);

	echo "Asked for code outside of range ($codepoint)\n";
	die( -1 );
}

/**
 * @param string $matches
 * @return string
 */
function decodeCharReferencesCallback( $matches ) {
	if( $matches[1] != '' ) {
		return decodeEntity( $matches[1] );
	} elseif( $matches[2] != '' ) {
		return  decodeChar( intval( $matches[2] ) );
	} elseif( $matches[3] != ''  ) {
		return  decodeChar( hexdec( $matches[3] ) );
	} elseif( $matches[4] != '' ) {
		return  decodeChar( hexdec( $matches[4] ) );
	}
	# Last case should be an ampersand by itself
	return $matches[0];
}