From 4a8f0d608a3ace4a1d54852a40c532919969812f Mon Sep 17 00:00:00 2001
From: Starbeamrainbowlabs <sbrl@starbeamrainbowlabs.com>
Date: Sun, 4 Oct 2015 13:08:59 +0100
Subject: [PATCH] Add option to clean raw html and fixed new parser system

---
 build/index.php       | 38 +++++++++++++++++++++++++++-----------
 core.php              | 20 ++++++++++----------
 module_index.json     |  2 +-
 modules/page-edit.php |  2 +-
 4 files changed, 39 insertions(+), 23 deletions(-)

diff --git a/build/index.php b/build/index.php
index 9944685..8053384 100644
--- a/build/index.php
+++ b/build/index.php
@@ -41,6 +41,13 @@ $settings->editing = true;
 // 135,000 characters, which is about 50 pages.
 $settings->maxpagesize = 135000;
 
+// Whether page sources should be cleaned of HTML before rendering. If set to
+// true any raw HTML will be escaped before rendering. Note that this shouldn't
+// affect code blocks - they should alwys be escaped. It is STRONGLY
+// recommended that you keep this option turned on, *ESPECIALLY* if you allow
+// anonymous edits as no sanitizing what so ever is performed on the HTML.
+$settings->clean_raw_html = true;
+
 // Determined whether users who aren't logged in are allowed to edit your wiki.
 // Set to true to allow anonymous users to log in.
 $settings->anonedits = false;
@@ -827,25 +834,30 @@ function add_action($action_name, $func)
 }
 
 // Function to register a new parser.
-$parsers = new stdClass();
-$parsers->none = function() {
-	throw new Exception("No parser registered!");
-};
+$parsers = [
+	"none" => function() {
+		throw new Exception("No parser registered!");
+	}
+];
 function add_parser($name, $parser_code)
 {
 	global $parsers;
-	if(isset($parsers->$name))
+	if(isset($parsers[$name]))
 		throw new Exception("Can't register parser with name '$name' because a parser with that name already exists.");
 	
-	$parsers->$name = $parser_code;
+	$parsers[$name] = $parser_code;
 }
 function parse_page_source($source)
 {
 	global $settings, $parsers;
-	if(!isset($parsers->{$settings->parser}))
-		exit(page_renderer::render_main("Parsing error - $settings->sitename", "<p>Parsing some page source data failed. This is most likely because $settings->sitename has the parser setting set incorrectly. Please contact <a href='mailto:" . hide_email($settings->admindetails["email"]) . "'>" . $settings->admindetails["name"] . "</a>, your Administrator."));
+	if(!isset($parsers[$settings->parser]))
+		exit(page_renderer::render_main("Parsing error - $settings->sitename", "<p>Parsing some page source data failed. This is most likely because $settings->sitename has the parser setting set incorrectly. Please contact <a href='mailto:" . hide_email($settings->admindetails["email"]) . "'>" . $settings->admindetails["name"] . "</a>, your $settings->sitename Administrator."));
 	
-	return $parsers->{$settings->parser}($source);
+/* Not needed atm because escaping happens when saving, not when rendering *
+	if($settings->clean_raw_html)
+		$source = htmlentities($source, ENT_QUOTES | ENT_HTML5);
+*/
+	return $parsers[$settings->parser]($source);
 }
 
 // Function to register a new proprocessor that will be executed just before
@@ -1326,7 +1338,11 @@ register_module([
 				mkdir(dirname("$env->page.md"), null, true);
 			}
 			
-			$pagedata = htmlentities($_POST["content"], ENT_QUOTES);
+			
+			$pagedata = $_POST["content"];
+			
+			if($settings->clean_raw_html)
+				$pagedata = htmlentities($pagedata, ENT_QUOTES);
 			
 			if(file_put_contents("$env->page.md", $pagedata) !== false)
 			{
@@ -1334,7 +1350,7 @@ register_module([
 				// Make sure that this page's parents exist
 				check_subpage_parents($page);
 				
-				//update the page index
+				// Update the page index
 				if(!isset($pageindex->$page))
 				{
 					$pageindex->$page = new stdClass();
diff --git a/core.php b/core.php
index f199ca1..ef61ba3 100644
--- a/core.php
+++ b/core.php
@@ -589,30 +589,30 @@ function add_action($action_name, $func)
 }
 
 // Function to register a new parser.
-$parsers = new stdClass();
-$parsers->none = function() {
-	throw new Exception("No parser registered!");
-};
+$parsers = [
+	"none" => function() {
+		throw new Exception("No parser registered!");
+	}
+];
 function add_parser($name, $parser_code)
 {
 	global $parsers;
-	if(isset($parsers->$name))
+	if(isset($parsers[$name]))
 		throw new Exception("Can't register parser with name '$name' because a parser with that name already exists.");
 	
-	$parsers->$name = $parser_code;
+	$parsers[$name] = $parser_code;
 }
 function parse_page_source($source)
 {
 	global $settings, $parsers;
-	if(!isset($parsers->{$settings->parser}))
-		exit(page_renderer::render_main("Parsing error - $settings->sitename", "<p>Parsing some page source data failed. This is most likely because $settings->sitename has the parser setting set incorrectly. Please contact <a href='mailto:" . hide_email($settings->admindetails["email"]) . "'>" . $settings->admindetails["name"] . "</a>, your Administrator."));
+	if(!isset($parsers[$settings->parser]))
+		exit(page_renderer::render_main("Parsing error - $settings->sitename", "<p>Parsing some page source data failed. This is most likely because $settings->sitename has the parser setting set incorrectly. Please contact <a href='mailto:" . hide_email($settings->admindetails["email"]) . "'>" . $settings->admindetails["name"] . "</a>, your $settings->sitename Administrator."));
 	
 /* Not needed atm because escaping happens when saving, not when rendering *
 	if($settings->clean_raw_html)
 		$source = htmlentities($source, ENT_QUOTES | ENT_HTML5);
 */
-	
-	return $parsers->{$settings->parser}($source);
+	return $parsers[$settings->parser]($source);
 }
 
 // Function to register a new proprocessor that will be executed just before
diff --git a/module_index.json b/module_index.json
index 5f9d6c0..b61b63a 100644
--- a/module_index.json
+++ b/module_index.json
@@ -68,7 +68,7 @@
         "author": "Starbeamrainbowlabs",
         "description": "Allows you to edit pages by adding the edit and save actions. You should probably include this one.",
         "id": "page-edit",
-        "lastupdate": 1443945594,
+        "lastupdate": 1443958991,
         "optional": false
     },
     {
diff --git a/modules/page-edit.php b/modules/page-edit.php
index 2e74ad1..6badf5e 100644
--- a/modules/page-edit.php
+++ b/modules/page-edit.php
@@ -130,7 +130,7 @@ register_module([
 				// Make sure that this page's parents exist
 				check_subpage_parents($page);
 				
-				//update the page index
+				// Update the page index
 				if(!isset($pageindex->$page))
 				{
 					$pageindex->$page = new stdClass();
