Add option to clean raw html and fixed new parser system

build/index.php

@@ -41,6 +41,13 @@ $settings->editing = true;
 // 135,000 characters, which is about 50 pages.
 $settings->maxpagesize = 135000;
 
+// Whether page sources should be cleaned of HTML before rendering. If set to
+// true any raw HTML will be escaped before rendering. Note that this shouldn't
+// affect code blocks - they should alwys be escaped. It is STRONGLY
+// recommended that you keep this option turned on, *ESPECIALLY* if you allow
+// anonymous edits as no sanitizing what so ever is performed on the HTML.
+$settings->clean_raw_html = true;
+
 // Determined whether users who aren't logged in are allowed to edit your wiki.
 // Set to true to allow anonymous users to log in.
 $settings->anonedits = false;
@@ -827,25 +834,30 @@ function add_action($action_name, $func)
 }
 
 // Function to register a new parser.
-$parsers = new stdClass();
-$parsers->none = function() {
-	throw new Exception("No parser registered!");
-};
+$parsers = [
+	"none" => function() {
+		throw new Exception("No parser registered!");
+	}
+];
 function add_parser($name, $parser_code)
 {
 	global $parsers;
-	if(isset($parsers->$name))
+	if(isset($parsers[$name]))
 		throw new Exception("Can't register parser with name '$name' because a parser with that name already exists.");
 	
-	$parsers->$name = $parser_code;
+	$parsers[$name] = $parser_code;
 }
 function parse_page_source($source)
 {
 	global $settings, $parsers;
-	if(!isset($parsers->{$settings->parser}))
-		exit(page_renderer::render_main("Parsing error - $settings->sitename", "<p>Parsing some page source data failed. This is most likely because $settings->sitename has the parser setting set incorrectly. Please contact <a href='mailto:" . hide_email($settings->admindetails["email"]) . "'>" . $settings->admindetails["name"] . "</a>, your Administrator."));
+	if(!isset($parsers[$settings->parser]))
+		exit(page_renderer::render_main("Parsing error - $settings->sitename", "<p>Parsing some page source data failed. This is most likely because $settings->sitename has the parser setting set incorrectly. Please contact <a href='mailto:" . hide_email($settings->admindetails["email"]) . "'>" . $settings->admindetails["name"] . "</a>, your $settings->sitename Administrator."));
 	
-	return $parsers->{$settings->parser}($source);
+/* Not needed atm because escaping happens when saving, not when rendering *
+	if($settings->clean_raw_html)
+		$source = htmlentities($source, ENT_QUOTES | ENT_HTML5);
+*/
+	return $parsers[$settings->parser]($source);
 }
 
 // Function to register a new proprocessor that will be executed just before
@@ -1326,7 +1338,11 @@ register_module([
 				mkdir(dirname("$env->page.md"), null, true);
 			}
 			
-			$pagedata = htmlentities($_POST["content"], ENT_QUOTES);
+			
+			$pagedata = $_POST["content"];
+			
+			if($settings->clean_raw_html)
+				$pagedata = htmlentities($pagedata, ENT_QUOTES);
 			
 			if(file_put_contents("$env->page.md", $pagedata) !== false)
 			{
@@ -1334,7 +1350,7 @@ register_module([
 				// Make sure that this page's parents exist
 				check_subpage_parents($page);
 				
-				//update the page index
+				// Update the page index
 				if(!isset($pageindex->$page))
 				{
 					$pageindex->$page = new stdClass();

core.php

@@ -589,30 +589,30 @@ function add_action($action_name, $func)
 }
 
 // Function to register a new parser.
-$parsers = new stdClass();
-$parsers->none = function() {
-	throw new Exception("No parser registered!");
-};
+$parsers = [
+	"none" => function() {
+		throw new Exception("No parser registered!");
+	}
+];
 function add_parser($name, $parser_code)
 {
 	global $parsers;
-	if(isset($parsers->$name))
+	if(isset($parsers[$name]))
 		throw new Exception("Can't register parser with name '$name' because a parser with that name already exists.");
 	
-	$parsers->$name = $parser_code;
+	$parsers[$name] = $parser_code;
 }
 function parse_page_source($source)
 {
 	global $settings, $parsers;
-	if(!isset($parsers->{$settings->parser}))
-		exit(page_renderer::render_main("Parsing error - $settings->sitename", "<p>Parsing some page source data failed. This is most likely because $settings->sitename has the parser setting set incorrectly. Please contact <a href='mailto:" . hide_email($settings->admindetails["email"]) . "'>" . $settings->admindetails["name"] . "</a>, your Administrator."));
+	if(!isset($parsers[$settings->parser]))
+		exit(page_renderer::render_main("Parsing error - $settings->sitename", "<p>Parsing some page source data failed. This is most likely because $settings->sitename has the parser setting set incorrectly. Please contact <a href='mailto:" . hide_email($settings->admindetails["email"]) . "'>" . $settings->admindetails["name"] . "</a>, your $settings->sitename Administrator."));
 	
 /* Not needed atm because escaping happens when saving, not when rendering *
 	if($settings->clean_raw_html)
 		$source = htmlentities($source, ENT_QUOTES | ENT_HTML5);
 */
-	
-	return $parsers->{$settings->parser}($source);
+	return $parsers[$settings->parser]($source);
 }
 
 // Function to register a new proprocessor that will be executed just before

module_index.json

@@ -68,7 +68,7 @@
         "author": "Starbeamrainbowlabs",
         "description": "Allows you to edit pages by adding the edit and save actions. You should probably include this one.",
         "id": "page-edit",
-        "lastupdate": 1443945594,
+        "lastupdate": 1443958991,
         "optional": false
     },
     {

modules/page-edit.php

@@ -130,7 +130,7 @@ register_module([
 				// Make sure that this page's parents exist
 				check_subpage_parents($page);
 				
-				//update the page index
+				// Update the page index
 				if(!isset($pageindex->$page))
 				{
 					$pageindex->$page = new stdClass();