[Summary view]

   1  <?php
   2  
   3  /**
   4   * Implements safety checks for safe iframes.
   5   *
   6   * @warning This filter is *critical* for ensuring that %HTML.SafeIframe
   7   * works safely.
   8   */
   9  class HTMLPurifier_URIFilter_SafeIframe extends HTMLPurifier_URIFilter
  10  {
  11      /**
  12       * @type string
  13       */
  14      public $name = 'SafeIframe';
  15  
  16      /**
  17       * @type bool
  18       */
  19      public $always_load = true;
  20  
  21      /**
  22       * @type string
  23       */
  24      protected $regexp = null;
  25  
  26      // XXX: The not so good bit about how this is all set up now is we
  27      // can't check HTML.SafeIframe in the 'prepare' step: we have to
  28      // defer till the actual filtering.
  29      /**
  30       * @param HTMLPurifier_Config $config
  31       * @return bool
  32       */
  33      public function prepare($config)
  34      {
  35          $this->regexp = $config->get('URI.SafeIframeRegexp');
  36          return true;
  37      }
  38  
  39      /**
  40       * @param HTMLPurifier_URI $uri
  41       * @param HTMLPurifier_Config $config
  42       * @param HTMLPurifier_Context $context
  43       * @return bool
  44       */
  45      public function filter(&$uri, $config, $context)
  46      {
  47          // check if filter not applicable
  48          if (!$config->get('HTML.SafeIframe')) {
  49              return true;
  50          }
  51          // check if the filter should actually trigger
  52          if (!$context->get('EmbeddedURI', true)) {
  53              return true;
  54          }
  55          $token = $context->get('CurrentToken', true);
  56          if (!($token && $token->name == 'iframe')) {
  57              return true;
  58          }
  59          // check if we actually have some whitelists enabled
  60          if ($this->regexp === null) {
  61              return false;
  62          }
  63          // actually check the whitelists
  64          return preg_match($this->regexp, $uri->toString());
  65      }
  66  }
  67  
  68  // vim: et sw=4 sts=4