Wavyzz/dolibarr-fork
2
0
Fork 0
forked from Wavyzz/dolibarr
Code Pull Requests Activity

Merge branch '18.0' of git@github.com:Dolibarr/dolibarr.git into develop

Browse Source
This commit is contained in:
Laurent Destailleur
2023-08-13 16:35:08 +02:00
parent bfde27ea36 ad0b2358ba
commit e1dbeb58ea
7 changed files with 60 additions and 53 deletions
Download Patch File Download Diff File Expand all files Collapse all files

23
htdocs/core/lib/functions.lib.php
View File

@@ -7117,7 +7117,7 @@ function dol_string_nohtmltag($stringtoclean, $removelinefeed = 1, $pagecodeto =
* @param int $allowlink Allow link tags.
* @return string String cleaned
*
* @see dol_escape_htmltag() strip_tags() dol_string_nohtmltag() dol_string_neverthesehtmltags()
* @see dol_htmlwithnojs() dol_escape_htmltag() strip_tags() dol_string_nohtmltag() dol_string_neverthesehtmltags()
*/
function dol_string_onlythesehtmltags($stringtoclean, $cleanalsosomestyles = 1, $removeclassattribute = 1, $cleanalsojavascript = 0, $allowiframe = 0, $allowed_tags = array(), $allowlink = 0)
{
@@ -7179,7 +7179,7 @@ function dol_string_onlythesehtmltags($stringtoclean, $cleanalsosomestyles = 1,
/**
* Clean a string from some undesirable HTML tags.
* Note: Complementary to dol_string_onlythesehtmltags().
* This method is used for example when option MAIN_RESTRICTHTML_REMOVE_ALSO_BAD_ATTRIBUTES is set to 1.
* This method is used for example by dol_htmlwithnojs() when option MAIN_RESTRICTHTML_REMOVE_ALSO_BAD_ATTRIBUTES is set to 1.
*
* @param string $stringtoclean String to clean
* @param array $allowed_attributes Array of tags not allowed
@@ -7231,7 +7231,7 @@ function dol_string_onlythesehtmlattributes($stringtoclean, $allowed_attributes
}
}
$return = $dom->saveHTML();
$return = $dom->saveHTML(); // This may add a LF at end of lines, so we will trim later
//$return = '<html><body>aaaa</p>bb<p>ssdd</p>'."\n<p>aaa</p>aa<p>bb</p>";
$return = preg_replace('/^'.preg_quote('<?xml encoding="UTF-8">', '/').'/', '', $return);
@@ -7245,7 +7245,7 @@ function dol_string_onlythesehtmlattributes($stringtoclean, $allowed_attributes
/**
* Clean a string from some undesirable HTML tags.
* Note. Not as secured as dol_string_onlythesehtmltags().
* Note: You should use instead dol_string_onlythesehtmltags() that is more secured if you can.
*
* @param string $stringtoclean String to clean
* @param array $disallowed_tags Array of tags not allowed
@@ -7358,7 +7358,7 @@ function dol_nl2br($stringtoencode, $nl2brmode = 0, $forxml = false)
* Sanitize a HTML to remove js and dangerous content
*
* @param string $stringtoencode String to encode
* @param int $nouseofiframesandbox Allow use of option MAIN_SECURITY_USE_SANDBOX_FOR_HTMLWITHNOJS for html sanitizing
* @param int $nouseofiframesandbox 0=Default, 1=Allow use of option MAIN_SECURITY_USE_SANDBOX_FOR_HTMLWITHNOJS for html sanitizing (not yet working)
* @param string $check 'restricthtmlnolink' or 'restricthtml' or 'restricthtmlallowclass' or 'restricthtmlallowunvalid'
* @return string HTML sanitized
*/
@@ -7378,10 +7378,10 @@ function dol_htmlwithnojs($stringtoencode, $nouseofiframesandbox = 0, $check = '
do {
$oldstringtoclean = $out;
libxml_use_internal_errors(false); // Avoid to fill memory with xml errors
if (!empty($out) && !empty($conf->global->MAIN_RESTRICTHTML_ONLY_VALID_HTML) && $check != 'restricthtmlallowunvalid') {
try {
libxml_use_internal_errors(false); // Avoid to fill memory with xml errors
$dom = new DOMDocument;
// Add a trick to solve pb with text without parent tag
// like '<h1>Foo</h1><p>bar</p>' that wrongly ends up, without the trick, with '<h1>Foo<p>bar</p></h1>'
@@ -7396,7 +7396,7 @@ function dol_htmlwithnojs($stringtoencode, $nouseofiframesandbox = 0, $check = '
} catch (Exception $e) {
// If error, invalid HTML string with no way to clean it
//print $e->getMessage();
$out = 'InvalidHTMLString';
$out = 'InvalidHTMLStringCantBeCleaned';
}
}
@@ -7420,9 +7420,8 @@ function dol_htmlwithnojs($stringtoencode, $nouseofiframesandbox = 0, $check = '
// Keep only some html tags and remove also some 'javascript:' strings
$out = dol_string_onlythesehtmltags($out, 0, ($check == 'restricthtmlallowclass' ? 0 : 1), 1);
// We should also exclude non expected HTML attributes and clean content of some attributes (keep only alt=, title=...).
// Keep only some html attributes and exclude non expected HTML attributes and clean content of some attributes (keep only alt=, title=...).
if (!empty($conf->global->MAIN_RESTRICTHTML_REMOVE_ALSO_BAD_ATTRIBUTES)) {
// Warning, the function may add a LF so we are forced to trim to compare with old $out without having always a difference and an infinit loop.
$out = dol_string_onlythesehtmlattributes($out);
}
@@ -7461,7 +7460,9 @@ function dol_htmlwithnojs($stringtoencode, $nouseofiframesandbox = 0, $check = '
* - MultiCell -> param must not be encoded into HTML.
* Because writeHTMLCell convert also \n into <br>, if function
* is used to build PDF, nl2brmode must be 1.
* When we output string on pages, we use dol_string_onlythesehtmltags(dol_htmlentitiesbr()) for notes, and use dol_escape_htmltag() for simple labels.
* Note: When we output string on pages, we should use
* - dol_htmlwithnojs(dol_string_onlythesehtmltags(dol_htmlentitiesbr(), 1, 1, 1)) for notes,
* - dol_escape_htmltag() for simple labels.
*
* @param string $stringtoencode String to encode
* @param int $nl2brmode 0=Adding br before \n, 1=Replacing \n by br (for use with FPDF writeHTMLCell function for example)