From 9f437f9588b814208db6b2fbaaa88d5180a95112 Mon Sep 17 00:00:00 2001 From: Nathanwoodburn Date: Mon, 30 Aug 2021 15:06:36 +1000 Subject: [PATCH] Astra Security --- .gitignore | 49 + .gitlab/issue_templates/Bug.md | 26 + .gitlab/issue_templates/Feature.md | 13 + .gitlab/merge_request_templates/Bugfix.md | 32 + .../DevelopToMaster.md | 35 + .gitlab/merge_request_templates/Feature.md | 32 + .gitlab/merge_request_templates/Hotfix.md | 32 + Astra.php | 419 ++ ak.php | 74 + api.php | 417 ++ astra-inc.php | 16 + blackhole.php | 12 + block-page.php | 459 ++ czar-89FC3CFA43E356C42382A941A99E4386.html | 1 + gk.php | 13 + install-astra.php | 735 +++ libraries/API_connect.php | 292 + libraries/Astra_country.php | 45 + libraries/Astra_ip.php | 61 + libraries/Astra_setup.php | 150 + libraries/Bad_bots.php | 108 + libraries/Config_file.php | 18 + libraries/Config_options.php | 84 + libraries/Crypto.php | 71 + libraries/PHPIDS.php | 276 + libraries/SQLite_db.php | 1289 ++++ libraries/Token_bucket.php | 76 + libraries/Update_DB.php | 111 + libraries/Update_config.php | 91 + libraries/Updater.php | 235 + libraries/Virtual_patches.php | 67 + libraries/browser.php | 1730 ++++++ libraries/index.html | 10 + libraries/plugins/IDS/.htaccess | 5 + libraries/plugins/IDS/Caching/Apc.php | 151 + libraries/plugins/IDS/Caching/Database.php | 291 + libraries/plugins/IDS/Caching/Factory.php | 94 + libraries/plugins/IDS/Caching/File.php | 187 + libraries/plugins/IDS/Caching/Interface.php | 73 + libraries/plugins/IDS/Caching/Memcached.php | 195 + libraries/plugins/IDS/Caching/Session.php | 146 + libraries/plugins/IDS/Config/Config.ini.php | 89 + libraries/plugins/IDS/Converter.php | 750 +++ libraries/plugins/IDS/Event.php | 235 + libraries/plugins/IDS/Filter.php | 179 + libraries/plugins/IDS/Filter/Storage.php | 381 ++ libraries/plugins/IDS/Init.php | 240 + libraries/plugins/IDS/Ips.php | 224 + libraries/plugins/IDS/LICENSE.txt | 165 + libraries/plugins/IDS/Log/Api.php | 229 + libraries/plugins/IDS/Log/Composite.php | 136 + libraries/plugins/IDS/Log/Database.php | 300 + libraries/plugins/IDS/Log/Email.php | 400 ++ libraries/plugins/IDS/Log/File.php | 229 + libraries/plugins/IDS/Log/Interface.php | 65 + libraries/plugins/IDS/Monitor.php | 778 +++ libraries/plugins/IDS/Report.php | 341 + libraries/plugins/IDS/Version.php | 49 + libraries/plugins/IDS/default_filter.json | 1 + libraries/plugins/IDS/default_filter.xml | 930 +++ libraries/plugins/IDS/default_filter_orig.xml | 798 +++ libraries/plugins/IDS/tmp/bad_bots.txt | 1 + libraries/plugins/IDS/tmp/cookie_ips.txt | 2 + libraries/plugins/IDS/tmp/custom_rules.txt | 1 + libraries/plugins/IDS/tmp/ips.txt | 2 + libraries/plugins/IDS/tmp/phpids_log.txt | 804 +++ .../htmlpurifier/HTMLPurifier.auto.php | 11 + .../htmlpurifier/HTMLPurifier.autoload.php | 26 + .../htmlpurifier/HTMLPurifier.func.php | 23 + .../htmlpurifier/HTMLPurifier.includes.php | 214 + .../htmlpurifier/HTMLPurifier.kses.php | 30 + .../htmlpurifier/HTMLPurifier.path.php | 11 + .../IDS/vendors/htmlpurifier/HTMLPurifier.php | 237 + .../HTMLPurifier.safe-includes.php | 208 + .../HTMLPurifier/AttrCollections.php | 128 + .../htmlpurifier/HTMLPurifier/AttrDef.php | 123 + .../htmlpurifier/HTMLPurifier/AttrDef/CSS.php | 87 + .../HTMLPurifier/AttrDef/CSS/AlphaValue.php | 21 + .../HTMLPurifier/AttrDef/CSS/Background.php | 87 + .../AttrDef/CSS/BackgroundPosition.php | 133 + .../HTMLPurifier/AttrDef/CSS/Border.php | 43 + .../HTMLPurifier/AttrDef/CSS/Color.php | 78 + .../HTMLPurifier/AttrDef/CSS/Composite.php | 38 + .../AttrDef/CSS/DenyElementDecorator.php | 28 + .../HTMLPurifier/AttrDef/CSS/Filter.php | 54 + .../HTMLPurifier/AttrDef/CSS/Font.php | 149 + .../HTMLPurifier/AttrDef/CSS/FontFamily.php | 197 + .../AttrDef/CSS/ImportantDecorator.php | 40 + .../HTMLPurifier/AttrDef/CSS/Length.php | 47 + .../HTMLPurifier/AttrDef/CSS/ListStyle.php | 78 + .../HTMLPurifier/AttrDef/CSS/Multiple.php | 58 + .../HTMLPurifier/AttrDef/CSS/Number.php | 69 + .../HTMLPurifier/AttrDef/CSS/Percentage.php | 40 + .../AttrDef/CSS/TextDecoration.php | 38 + .../HTMLPurifier/AttrDef/CSS/URI.php | 61 + .../HTMLPurifier/AttrDef/Enum.php | 65 + .../HTMLPurifier/AttrDef/HTML/Bool.php | 28 + .../HTMLPurifier/AttrDef/HTML/Class.php | 34 + .../HTMLPurifier/AttrDef/HTML/Color.php | 32 + .../HTMLPurifier/AttrDef/HTML/FrameTarget.php | 21 + .../HTMLPurifier/AttrDef/HTML/ID.php | 70 + .../HTMLPurifier/AttrDef/HTML/Length.php | 41 + .../HTMLPurifier/AttrDef/HTML/LinkTypes.php | 53 + .../HTMLPurifier/AttrDef/HTML/MultiLength.php | 41 + .../HTMLPurifier/AttrDef/HTML/Nmtokens.php | 52 + .../HTMLPurifier/AttrDef/HTML/Pixels.php | 48 + .../HTMLPurifier/AttrDef/Integer.php | 73 + .../HTMLPurifier/AttrDef/Lang.php | 73 + .../HTMLPurifier/AttrDef/Switch.php | 34 + .../HTMLPurifier/AttrDef/Text.php | 15 + .../htmlpurifier/HTMLPurifier/AttrDef/URI.php | 77 + .../HTMLPurifier/AttrDef/URI/Email.php | 17 + .../AttrDef/URI/Email/SimpleCheck.php | 21 + .../HTMLPurifier/AttrDef/URI/Host.php | 68 + .../HTMLPurifier/AttrDef/URI/IPv4.php | 39 + .../HTMLPurifier/AttrDef/URI/IPv6.php | 99 + .../HTMLPurifier/AttrTransform.php | 56 + .../HTMLPurifier/AttrTransform/Background.php | 23 + .../HTMLPurifier/AttrTransform/BdoDir.php | 19 + .../HTMLPurifier/AttrTransform/BgColor.php | 23 + .../HTMLPurifier/AttrTransform/BoolToCSS.php | 36 + .../HTMLPurifier/AttrTransform/Border.php | 18 + .../HTMLPurifier/AttrTransform/EnumToCSS.php | 58 + .../AttrTransform/ImgRequired.php | 43 + .../HTMLPurifier/AttrTransform/ImgSpace.php | 44 + .../HTMLPurifier/AttrTransform/Input.php | 40 + .../HTMLPurifier/AttrTransform/Lang.php | 28 + .../HTMLPurifier/AttrTransform/Length.php | 27 + .../HTMLPurifier/AttrTransform/Name.php | 21 + .../HTMLPurifier/AttrTransform/NameSync.php | 27 + .../HTMLPurifier/AttrTransform/Nofollow.php | 41 + .../HTMLPurifier/AttrTransform/SafeEmbed.php | 15 + .../HTMLPurifier/AttrTransform/SafeObject.php | 16 + .../HTMLPurifier/AttrTransform/SafeParam.php | 64 + .../AttrTransform/ScriptRequired.php | 16 + .../HTMLPurifier/AttrTransform/Textarea.php | 18 + .../htmlpurifier/HTMLPurifier/AttrTypes.php | 77 + .../HTMLPurifier/AttrValidator.php | 162 + .../htmlpurifier/HTMLPurifier/Bootstrap.php | 104 + .../HTMLPurifier/CSSDefinition.php | 322 + .../htmlpurifier/HTMLPurifier/ChildDef.php | 48 + .../HTMLPurifier/ChildDef/Chameleon.php | 48 + .../HTMLPurifier/ChildDef/Custom.php | 90 + .../HTMLPurifier/ChildDef/Empty.php | 20 + .../HTMLPurifier/ChildDef/Optional.php | 26 + .../HTMLPurifier/ChildDef/Required.php | 117 + .../ChildDef/StrictBlockquote.php | 88 + .../HTMLPurifier/ChildDef/Table.php | 142 + .../htmlpurifier/HTMLPurifier/Config.php | 746 +++ .../htmlpurifier/HTMLPurifier/ConfigDef.php | 9 + .../HTMLPurifier/ConfigDef/Directive.php | 55 + .../HTMLPurifier/ConfigDef/DirectiveAlias.php | 24 + .../HTMLPurifier/ConfigDef/Namespace.php | 10 + .../HTMLPurifier/ConfigSchema.php | 164 + .../ConfigSchema/Builder/ConfigSchema.php | 44 + .../HTMLPurifier/ConfigSchema/Builder/Xml.php | 106 + .../HTMLPurifier/ConfigSchema/Exception.php | 11 + .../HTMLPurifier/ConfigSchema/Interchange.php | 42 + .../ConfigSchema/Interchange/Directive.php | 77 + .../ConfigSchema/Interchange/Id.php | 37 + .../ConfigSchema/Interchange/Namespace.php | 21 + .../ConfigSchema/InterchangeBuilder.php | 180 + .../HTMLPurifier/ConfigSchema/Validator.php | 206 + .../ConfigSchema/ValidatorAtom.php | 66 + .../HTMLPurifier/ConfigSchema/schema.ser | Bin 0 -> 14140 bytes .../schema/Attr.AllowedClasses.txt | 8 + .../schema/Attr.AllowedFrameTargets.txt | 12 + .../ConfigSchema/schema/Attr.AllowedRel.txt | 9 + .../ConfigSchema/schema/Attr.AllowedRev.txt | 9 + .../schema/Attr.ClassUseCDATA.txt | 19 + .../schema/Attr.DefaultImageAlt.txt | 11 + .../schema/Attr.DefaultInvalidImage.txt | 9 + .../schema/Attr.DefaultInvalidImageAlt.txt | 8 + .../schema/Attr.DefaultTextDir.txt | 10 + .../ConfigSchema/schema/Attr.EnableID.txt | 16 + .../schema/Attr.ForbiddenClasses.txt | 8 + .../ConfigSchema/schema/Attr.IDBlacklist.txt | 5 + .../schema/Attr.IDBlacklistRegexp.txt | 9 + .../ConfigSchema/schema/Attr.IDPrefix.txt | 12 + .../schema/Attr.IDPrefixLocal.txt | 14 + .../HTMLPurifier/ConfigSchema/schema/Attr.txt | 3 + .../schema/AutoFormat.AutoParagraph.txt | 31 + .../ConfigSchema/schema/AutoFormat.Custom.txt | 12 + .../schema/AutoFormat.DisplayLinkURI.txt | 11 + .../schema/AutoFormat.Linkify.txt | 12 + .../AutoFormat.PurifierLinkify.DocURL.txt | 12 + .../schema/AutoFormat.PurifierLinkify.txt | 12 + ...rmat.RemoveEmpty.RemoveNbsp.Exceptions.txt | 11 + .../AutoFormat.RemoveEmpty.RemoveNbsp.txt | 15 + .../schema/AutoFormat.RemoveEmpty.txt | 46 + ...utoFormat.RemoveSpansWithoutAttributes.txt | 11 + .../ConfigSchema/schema/AutoFormat.txt | 3 + .../AutoFormatParam.PurifierLinkifyDocURL.txt | 12 + .../ConfigSchema/schema/AutoFormatParam.txt | 3 + .../schema/CSS.AllowImportant.txt | 8 + .../ConfigSchema/schema/CSS.AllowTricky.txt | 11 + .../ConfigSchema/schema/CSS.AllowedFonts.txt | 12 + .../schema/CSS.AllowedProperties.txt | 18 + .../ConfigSchema/schema/CSS.DefinitionRev.txt | 11 + .../schema/CSS.ForbiddenProperties.txt | 13 + .../ConfigSchema/schema/CSS.MaxImgLength.txt | 16 + .../ConfigSchema/schema/CSS.Proprietary.txt | 10 + .../ConfigSchema/schema/CSS.Trusted.txt | 9 + .../HTMLPurifier/ConfigSchema/schema/CSS.txt | 3 + .../schema/Cache.DefinitionImpl.txt | 14 + .../schema/Cache.SerializerPath.txt | 13 + .../schema/Cache.SerializerPermissions.txt | 11 + .../ConfigSchema/schema/Cache.txt | 3 + .../schema/Core.AggressivelyFixLt.txt | 18 + .../schema/Core.CollectErrors.txt | 12 + .../schema/Core.ColorKeywords.txt | 28 + .../schema/Core.ConvertDocumentToFragment.txt | 14 + .../Core.DirectLexLineNumberSyncInterval.txt | 17 + .../ConfigSchema/schema/Core.Encoding.txt | 15 + .../schema/Core.EscapeInvalidChildren.txt | 10 + .../schema/Core.EscapeInvalidTags.txt | 7 + .../schema/Core.EscapeNonASCIICharacters.txt | 13 + .../schema/Core.HiddenElements.txt | 19 + .../ConfigSchema/schema/Core.Language.txt | 10 + .../ConfigSchema/schema/Core.LexerImpl.txt | 34 + .../schema/Core.MaintainLineNumbers.txt | 16 + .../schema/Core.NormalizeNewlines.txt | 11 + .../schema/Core.RemoveInvalidImg.txt | 12 + .../Core.RemoveProcessingInstructions.txt | 11 + .../schema/Core.RemoveScriptContents.txt | 12 + .../HTMLPurifier/ConfigSchema/schema/Core.txt | 3 + .../ConfigSchema/schema/Filter.Custom.txt | 11 + .../Filter.ExtractStyleBlocks.Escaping.txt | 14 + .../Filter.ExtractStyleBlocks.Scope.txt | 29 + .../Filter.ExtractStyleBlocks.TidyImpl.txt | 16 + .../schema/Filter.ExtractStyleBlocks.txt | 74 + .../ConfigSchema/schema/Filter.YouTube.txt | 16 + .../ConfigSchema/schema/Filter.txt | 3 + ...FilterParam.ExtractStyleBlocksEscaping.txt | 14 + .../FilterParam.ExtractStyleBlocksScope.txt | 29 + ...FilterParam.ExtractStyleBlocksTidyImpl.txt | 15 + .../ConfigSchema/schema/FilterParam.txt | 3 + .../ConfigSchema/schema/HTML.Allowed.txt | 25 + .../schema/HTML.AllowedAttributes.txt | 19 + .../schema/HTML.AllowedElements.txt | 23 + .../schema/HTML.AllowedModules.txt | 20 + .../schema/HTML.Attr.Name.UseCDATA.txt | 11 + .../ConfigSchema/schema/HTML.BlockWrapper.txt | 18 + .../ConfigSchema/schema/HTML.CoreModules.txt | 23 + .../schema/HTML.CustomDoctype.txt | 9 + .../ConfigSchema/schema/HTML.DefinitionID.txt | 33 + .../schema/HTML.DefinitionRev.txt | 16 + .../ConfigSchema/schema/HTML.Doctype.txt | 11 + .../schema/HTML.FlashAllowFullScreen.txt | 11 + .../schema/HTML.ForbiddenAttributes.txt | 21 + .../schema/HTML.ForbiddenElements.txt | 20 + .../ConfigSchema/schema/HTML.MaxImgLength.txt | 14 + .../ConfigSchema/schema/HTML.Nofollow.txt | 7 + .../ConfigSchema/schema/HTML.Parent.txt | 12 + .../ConfigSchema/schema/HTML.Proprietary.txt | 12 + .../ConfigSchema/schema/HTML.SafeEmbed.txt | 13 + .../ConfigSchema/schema/HTML.SafeObject.txt | 13 + .../ConfigSchema/schema/HTML.Strict.txt | 9 + .../ConfigSchema/schema/HTML.TidyAdd.txt | 8 + .../ConfigSchema/schema/HTML.TidyLevel.txt | 24 + .../ConfigSchema/schema/HTML.TidyRemove.txt | 8 + .../ConfigSchema/schema/HTML.Trusted.txt | 9 + .../ConfigSchema/schema/HTML.XHTML.txt | 11 + .../HTMLPurifier/ConfigSchema/schema/HTML.txt | 3 + .../schema/Output.CommentScriptContents.txt | 10 + .../schema/Output.FixInnerHTML.txt | 15 + .../schema/Output.FlashCompat.txt | 11 + .../ConfigSchema/schema/Output.Newline.txt | 13 + .../ConfigSchema/schema/Output.SortAttr.txt | 14 + .../ConfigSchema/schema/Output.TidyFormat.txt | 25 + .../ConfigSchema/schema/Output.txt | 3 + .../ConfigSchema/schema/Test.ForceNoIconv.txt | 7 + .../HTMLPurifier/ConfigSchema/schema/Test.txt | 3 + .../schema/URI.AllowedSchemes.txt | 17 + .../ConfigSchema/schema/URI.Base.txt | 17 + .../ConfigSchema/schema/URI.DefaultScheme.txt | 10 + .../ConfigSchema/schema/URI.DefinitionID.txt | 11 + .../ConfigSchema/schema/URI.DefinitionRev.txt | 11 + .../ConfigSchema/schema/URI.Disable.txt | 14 + .../schema/URI.DisableExternal.txt | 11 + .../schema/URI.DisableExternalResources.txt | 13 + .../schema/URI.DisableResources.txt | 15 + .../ConfigSchema/schema/URI.Host.txt | 19 + .../ConfigSchema/schema/URI.HostBlacklist.txt | 9 + .../ConfigSchema/schema/URI.MakeAbsolute.txt | 13 + .../ConfigSchema/schema/URI.Munge.txt | 83 + .../schema/URI.MungeResources.txt | 17 + .../schema/URI.MungeSecretKey.txt | 30 + .../schema/URI.OverrideAllowedSchemes.txt | 9 + .../HTMLPurifier/ConfigSchema/schema/URI.txt | 3 + .../HTMLPurifier/ConfigSchema/schema/info.ini | 3 + .../htmlpurifier/HTMLPurifier/ContentSets.php | 155 + .../htmlpurifier/HTMLPurifier/Context.php | 82 + .../htmlpurifier/HTMLPurifier/Definition.php | 50 + .../HTMLPurifier/DefinitionCache.php | 108 + .../DefinitionCache/Decorator.php | 62 + .../DefinitionCache/Decorator/Cleanup.php | 43 + .../DefinitionCache/Decorator/Memory.php | 46 + .../DefinitionCache/Decorator/Template.php.in | 47 + .../HTMLPurifier/DefinitionCache/Null.php | 39 + .../DefinitionCache/Serializer.php | 191 + ...1.0,801ad73acbcf9d3127e1d01768d26453,1.ser | Bin 0 -> 22628 bytes ...1.0,ddc9b993d7fc8d4a185e8dbf5b9a0996,1.ser | Bin 0 -> 92209 bytes .../DefinitionCache/Serializer/README | 3 + ...0.0,05c766101e813c246917b022f97b5e6e,1.ser | Bin 0 -> 327 bytes .../HTMLPurifier/DefinitionCacheFactory.php | 91 + .../htmlpurifier/HTMLPurifier/Doctype.php | 60 + .../HTMLPurifier/DoctypeRegistry.php | 103 + .../htmlpurifier/HTMLPurifier/ElementDef.php | 183 + .../htmlpurifier/HTMLPurifier/Encoder.php | 426 ++ .../HTMLPurifier/EntityLookup.php | 44 + .../HTMLPurifier/EntityLookup/entities.ser | 1 + .../HTMLPurifier/EntityParser.php | 144 + .../HTMLPurifier/ErrorCollector.php | 209 + .../htmlpurifier/HTMLPurifier/ErrorStruct.php | 60 + .../htmlpurifier/HTMLPurifier/Exception.php | 12 + .../htmlpurifier/HTMLPurifier/Filter.php | 46 + .../Filter/ExtractStyleBlocks.php | 135 + .../HTMLPurifier/Filter/YouTube.php | 39 + .../htmlpurifier/HTMLPurifier/Generator.php | 254 + .../HTMLPurifier/HTMLDefinition.php | 425 ++ .../htmlpurifier/HTMLPurifier/HTMLModule.php | 244 + .../HTMLPurifier/HTMLModule/Bdo.php | 31 + .../HTMLModule/CommonAttributes.php | 26 + .../HTMLPurifier/HTMLModule/Edit.php | 38 + .../HTMLPurifier/HTMLModule/Forms.php | 118 + .../HTMLPurifier/HTMLModule/Hypertext.php | 31 + .../HTMLPurifier/HTMLModule/Image.php | 40 + .../HTMLPurifier/HTMLModule/Legacy.php | 143 + .../HTMLPurifier/HTMLModule/List.php | 37 + .../HTMLPurifier/HTMLModule/Name.php | 21 + .../HTMLPurifier/HTMLModule/Nofollow.php | 19 + .../HTMLModule/NonXMLCommonAttributes.php | 14 + .../HTMLPurifier/HTMLModule/Object.php | 47 + .../HTMLPurifier/HTMLModule/Presentation.php | 36 + .../HTMLPurifier/HTMLModule/Proprietary.php | 33 + .../HTMLPurifier/HTMLModule/Ruby.php | 27 + .../HTMLPurifier/HTMLModule/SafeEmbed.php | 34 + .../HTMLPurifier/HTMLModule/SafeObject.php | 52 + .../HTMLPurifier/HTMLModule/Scripting.php | 54 + .../HTMLModule/StyleAttribute.php | 24 + .../HTMLPurifier/HTMLModule/Tables.php | 66 + .../HTMLPurifier/HTMLModule/Target.php | 23 + .../HTMLPurifier/HTMLModule/Text.php | 71 + .../HTMLPurifier/HTMLModule/Tidy.php | 207 + .../HTMLPurifier/HTMLModule/Tidy/Name.php | 24 + .../HTMLModule/Tidy/Proprietary.php | 24 + .../HTMLPurifier/HTMLModule/Tidy/Strict.php | 21 + .../HTMLModule/Tidy/Transitional.php | 9 + .../HTMLPurifier/HTMLModule/Tidy/XHTML.php | 17 + .../HTMLModule/Tidy/XHTMLAndHTML4.php | 161 + .../HTMLModule/XMLCommonAttributes.php | 14 + .../HTMLPurifier/HTMLModuleManager.php | 403 ++ .../HTMLPurifier/IDAccumulator.php | 53 + .../htmlpurifier/HTMLPurifier/Injector.php | 239 + .../HTMLPurifier/Injector/AutoParagraph.php | 345 ++ .../HTMLPurifier/Injector/DisplayLinkURI.php | 26 + .../HTMLPurifier/Injector/Linkify.php | 46 + .../HTMLPurifier/Injector/PurifierLinkify.php | 45 + .../HTMLPurifier/Injector/RemoveEmpty.php | 51 + .../Injector/RemoveSpansWithoutAttributes.php | 60 + .../HTMLPurifier/Injector/SafeObject.php | 91 + .../htmlpurifier/HTMLPurifier/Language.php | 163 + .../Language/classes/en-x-test.php | 12 + .../Language/messages/en-x-test.php | 11 + .../Language/messages/en-x-testmini.php | 12 + .../HTMLPurifier/Language/messages/en.php | 63 + .../HTMLPurifier/LanguageFactory.php | 198 + .../htmlpurifier/HTMLPurifier/Length.php | 115 + .../htmlpurifier/HTMLPurifier/Lexer.php | 326 + .../HTMLPurifier/Lexer/DOMLex.php | 243 + .../HTMLPurifier/Lexer/DirectLex.php | 490 ++ .../HTMLPurifier/Lexer/PEARSax3.php | 139 + .../htmlpurifier/HTMLPurifier/Lexer/PH5P.php | 3904 ++++++++++++ .../HTMLPurifier/PercentEncoder.php | 98 + .../htmlpurifier/HTMLPurifier/Printer.php | 176 + .../HTMLPurifier/Printer/CSSDefinition.php | 38 + .../HTMLPurifier/Printer/ConfigForm.css | 10 + .../HTMLPurifier/Printer/ConfigForm.js | 5 + .../HTMLPurifier/Printer/ConfigForm.php | 368 ++ .../HTMLPurifier/Printer/HTMLDefinition.php | 272 + .../HTMLPurifier/PropertyList.php | 86 + .../HTMLPurifier/PropertyListIterator.php | 32 + .../htmlpurifier/HTMLPurifier/Strategy.php | 26 + .../HTMLPurifier/Strategy/Composite.php | 25 + .../HTMLPurifier/Strategy/Core.php | 18 + .../HTMLPurifier/Strategy/FixNesting.php | 328 + .../HTMLPurifier/Strategy/MakeWellFormed.php | 532 ++ .../Strategy/RemoveForeignElements.php | 171 + .../Strategy/ValidateAttributes.php | 39 + .../htmlpurifier/HTMLPurifier/StringHash.php | 39 + .../HTMLPurifier/StringHashParser.php | 110 + .../HTMLPurifier/TagTransform.php | 36 + .../HTMLPurifier/TagTransform/Font.php | 98 + .../HTMLPurifier/TagTransform/Simple.php | 35 + .../htmlpurifier/HTMLPurifier/Token.php | 57 + .../HTMLPurifier/Token/Comment.php | 22 + .../htmlpurifier/HTMLPurifier/Token/Empty.php | 11 + .../htmlpurifier/HTMLPurifier/Token/End.php | 19 + .../htmlpurifier/HTMLPurifier/Token/Start.php | 11 + .../htmlpurifier/HTMLPurifier/Token/Tag.php | 57 + .../htmlpurifier/HTMLPurifier/Token/Text.php | 33 + .../HTMLPurifier/TokenFactory.php | 94 + .../vendors/htmlpurifier/HTMLPurifier/URI.php | 204 + .../HTMLPurifier/URIDefinition.php | 93 + .../htmlpurifier/HTMLPurifier/URIFilter.php | 45 + .../URIFilter/DisableExternal.php | 23 + .../URIFilter/DisableExternalResources.php | 12 + .../URIFilter/DisableResources.php | 11 + .../HTMLPurifier/URIFilter/HostBlacklist.php | 21 + .../HTMLPurifier/URIFilter/MakeAbsolute.php | 114 + .../HTMLPurifier/URIFilter/Munge.php | 58 + .../htmlpurifier/HTMLPurifier/URIParser.php | 70 + .../htmlpurifier/HTMLPurifier/URIScheme.php | 89 + .../HTMLPurifier/URIScheme/data.php | 96 + .../HTMLPurifier/URIScheme/file.php | 32 + .../HTMLPurifier/URIScheme/ftp.php | 42 + .../HTMLPurifier/URIScheme/http.php | 19 + .../HTMLPurifier/URIScheme/https.php | 12 + .../HTMLPurifier/URIScheme/mailto.php | 27 + .../HTMLPurifier/URIScheme/news.php | 22 + .../HTMLPurifier/URIScheme/nntp.php | 19 + .../HTMLPurifier/URISchemeRegistry.php | 68 + .../HTMLPurifier/UnitConverter.php | 254 + .../htmlpurifier/HTMLPurifier/VarParser.php | 154 + .../HTMLPurifier/VarParser/Flexible.php | 103 + .../HTMLPurifier/VarParser/Native.php | 26 + .../HTMLPurifier/VarParserException.php | 11 + .../MaxMind-DB-Reader/GeoLite2-Country.mmdb | Bin 0 -> 3656998 bytes .../plugins/MaxMind-DB-Reader/autoload.php | 45 + .../plugins/MaxMind-DB-Reader/composer.json | 34 + .../plugins/MaxMind-DB-Reader/ext/config.m4 | 40 + .../plugins/MaxMind-DB-Reader/ext/maxminddb.c | 623 ++ .../MaxMind-DB-Reader/ext/php_maxminddb.h | 24 + .../src/MaxMind/Db/Reader.php | 309 + .../src/MaxMind/Db/Reader/Decoder.php | 341 + .../Db/Reader/InvalidDatabaseException.php | 10 + .../src/MaxMind/Db/Reader/Metadata.php | 69 + .../src/MaxMind/Db/Reader/Util.php | 26 + libraries/plugins/index.html | 10 + libraries/plugins/ip_address/ip-lib.php | 13 + .../src/Address/AddressInterface.php | 96 + .../ip_address/src/Address/AssignedRange.php | 138 + .../plugins/ip_address/src/Address/IPv4.php | 351 ++ .../plugins/ip_address/src/Address/IPv6.php | 499 ++ .../plugins/ip_address/src/Address/Type.php | 42 + libraries/plugins/ip_address/src/Factory.php | 156 + .../plugins/ip_address/src/Range/Pattern.php | 284 + .../ip_address/src/Range/RangeInterface.php | 89 + .../plugins/ip_address/src/Range/Single.php | 174 + .../plugins/ip_address/src/Range/Subnet.php | 281 + .../plugins/ip_address/src/Range/Type.php | 141 + libraries/plugins/phpMussel/loader.php | 215 + libraries/plugins/phpMussel/vault/.htaccess | 6 + .../plugins/phpMussel/vault/cache/.htaccess | 6 + .../plugins/phpMussel/vault/cache/75.tmp | 1 + .../plugins/phpMussel/vault/cache/index.dat | 1 + libraries/plugins/phpMussel/vault/cli.php | 438 ++ .../plugins/phpMussel/vault/components.dat | 505 ++ libraries/plugins/phpMussel/vault/config.ini | 516 ++ libraries/plugins/phpMussel/vault/config.php | 202 + libraries/plugins/phpMussel/vault/config.yaml | 378 ++ .../phpMussel/vault/fe_assets/.htaccess | 6 + .../phpMussel/vault/fe_assets/_accounts.html | 34 + .../vault/fe_assets/_accounts_row.html | 16 + .../phpMussel/vault/fe_assets/_config.html | 24 + .../vault/fe_assets/_config_row.html | 6 + .../phpMussel/vault/fe_assets/_files.html | 32 + .../vault/fe_assets/_files_edit.html | 21 + .../vault/fe_assets/_files_rename.html | 19 + .../phpMussel/vault/fe_assets/_files_row.html | 6 + .../phpMussel/vault/fe_assets/_home.html | 21 + .../phpMussel/vault/fe_assets/_login.html | 13 + .../phpMussel/vault/fe_assets/_logs.html | 15 + .../vault/fe_assets/_nav_complete_access.html | 19 + .../fe_assets/_nav_logs_access_only.html | 12 + .../vault/fe_assets/_quarantine.html | 27 + .../vault/fe_assets/_quarantine_row.html | 21 + .../vault/fe_assets/_statistics.html | 69 + .../phpMussel/vault/fe_assets/_updates.html | 29 + .../vault/fe_assets/_updates_row.html | 8 + .../vault/fe_assets/_upload_test.html | 16 + .../phpMussel/vault/fe_assets/frontend.css | 62 + .../phpMussel/vault/fe_assets/frontend.html | 24 + .../phpMussel/vault/fe_assets/icons.php | 218 + .../phpMussel/vault/fe_assets/pips.php | 25 + .../plugins/phpMussel/vault/frontend.php | 2725 ++++++++ .../phpMussel/vault/frontend_functions.php | 1007 +++ .../plugins/phpMussel/vault/functions.php | 5509 +++++++++++++++++ .../plugins/phpMussel/vault/greylist.csv | 1 + .../plugins/phpMussel/vault/hotfixes.php | 83 + libraries/plugins/phpMussel/vault/lang.php | 128 + .../plugins/phpMussel/vault/lang/.htaccess | 6 + .../phpMussel/vault/lang/lang.ar.fe.php | 301 + .../plugins/phpMussel/vault/lang/lang.ar.php | 130 + .../phpMussel/vault/lang/lang.de.fe.php | 301 + .../plugins/phpMussel/vault/lang/lang.de.php | 131 + .../phpMussel/vault/lang/lang.en.fe.php | 301 + .../plugins/phpMussel/vault/lang/lang.en.php | 127 + .../phpMussel/vault/lang/lang.es.fe.php | 301 + .../plugins/phpMussel/vault/lang/lang.es.php | 127 + .../phpMussel/vault/lang/lang.fr.fe.php | 301 + .../plugins/phpMussel/vault/lang/lang.fr.php | 132 + .../phpMussel/vault/lang/lang.hi.fe.php | 301 + .../plugins/phpMussel/vault/lang/lang.hi.php | 127 + .../phpMussel/vault/lang/lang.id.fe.php | 301 + .../plugins/phpMussel/vault/lang/lang.id.php | 129 + .../phpMussel/vault/lang/lang.it.fe.php | 301 + .../plugins/phpMussel/vault/lang/lang.it.php | 127 + .../phpMussel/vault/lang/lang.ja.fe.php | 301 + .../plugins/phpMussel/vault/lang/lang.ja.php | 127 + .../phpMussel/vault/lang/lang.ko.fe.php | 301 + .../plugins/phpMussel/vault/lang/lang.ko.php | 127 + .../phpMussel/vault/lang/lang.nl.fe.php | 301 + .../plugins/phpMussel/vault/lang/lang.nl.php | 131 + .../phpMussel/vault/lang/lang.pt.fe.php | 301 + .../plugins/phpMussel/vault/lang/lang.pt.php | 132 + .../phpMussel/vault/lang/lang.ru.fe.php | 301 + .../plugins/phpMussel/vault/lang/lang.ru.php | 139 + .../phpMussel/vault/lang/lang.th.fe.php | 301 + .../plugins/phpMussel/vault/lang/lang.th.php | 127 + .../phpMussel/vault/lang/lang.tr.fe.php | 301 + .../plugins/phpMussel/vault/lang/lang.tr.php | 132 + .../phpMussel/vault/lang/lang.ur.fe.php | 301 + .../plugins/phpMussel/vault/lang/lang.ur.php | 130 + .../phpMussel/vault/lang/lang.vi.fe.php | 301 + .../plugins/phpMussel/vault/lang/lang.vi.php | 127 + .../phpMussel/vault/lang/lang.zh-TW.php | 127 + .../phpMussel/vault/lang/lang.zh-tw.fe.php | 302 + .../phpMussel/vault/lang/lang.zh.fe.php | 302 + .../plugins/phpMussel/vault/lang/lang.zh.php | 127 + .../plugins/phpMussel/vault/php5.4.x.php | 67 + libraries/plugins/phpMussel/vault/plugins.dat | 11 + .../plugins/phpMussel/vault/plugins/.htaccess | 6 + .../vault/plugins/logtoastra/plugin.php | 75 + .../phpMussel/vault/quarantine/.htaccess | 6 + .../plugins/phpMussel/vault/scan_kills.txt | 37 + .../plugins/phpMussel/vault/scan_log.txt | 25 + .../phpMussel/vault/scan_log_serialized.txt | 6 + .../plugins/phpMussel/vault/signatures.dat | 9 + .../phpMussel/vault/signatures/.htaccess | 6 + .../phpMussel/vault/signatures/switch.dat | 47 + .../phpMussel/vault/template_custom.html | 33 + .../phpMussel/vault/template_default.html | 93 + libraries/plugins/phpMussel/vault/themes.dat | 30 + libraries/plugins/phpMussel/vault/upload.php | 401 ++ upgrade.php | 21 + 547 files changed, 65968 insertions(+) create mode 100644 .gitignore create mode 100644 .gitlab/issue_templates/Bug.md create mode 100644 .gitlab/issue_templates/Feature.md create mode 100644 .gitlab/merge_request_templates/Bugfix.md create mode 100644 .gitlab/merge_request_templates/DevelopToMaster.md create mode 100644 .gitlab/merge_request_templates/Feature.md create mode 100644 .gitlab/merge_request_templates/Hotfix.md create mode 100644 Astra.php create mode 100644 ak.php create mode 100644 api.php create mode 100644 astra-inc.php create mode 100644 blackhole.php create mode 100644 block-page.php create mode 100644 czar-89FC3CFA43E356C42382A941A99E4386.html create mode 100644 gk.php create mode 100644 install-astra.php create mode 100644 libraries/API_connect.php create mode 100644 libraries/Astra_country.php create mode 100644 libraries/Astra_ip.php create mode 100644 libraries/Astra_setup.php create mode 100644 libraries/Bad_bots.php create mode 100644 libraries/Config_file.php create mode 100644 libraries/Config_options.php create mode 100644 libraries/Crypto.php create mode 100644 libraries/PHPIDS.php create mode 100644 libraries/SQLite_db.php create mode 100644 libraries/Token_bucket.php create mode 100644 libraries/Update_DB.php create mode 100644 libraries/Update_config.php create mode 100644 libraries/Updater.php create mode 100644 libraries/Virtual_patches.php create mode 100644 libraries/browser.php create mode 100644 libraries/index.html create mode 100644 libraries/plugins/IDS/.htaccess create mode 100644 libraries/plugins/IDS/Caching/Apc.php create mode 100644 libraries/plugins/IDS/Caching/Database.php create mode 100644 libraries/plugins/IDS/Caching/Factory.php create mode 100644 libraries/plugins/IDS/Caching/File.php create mode 100644 libraries/plugins/IDS/Caching/Interface.php create mode 100644 libraries/plugins/IDS/Caching/Memcached.php create mode 100644 libraries/plugins/IDS/Caching/Session.php create mode 100644 libraries/plugins/IDS/Config/Config.ini.php create mode 100644 libraries/plugins/IDS/Converter.php create mode 100644 libraries/plugins/IDS/Event.php create mode 100644 libraries/plugins/IDS/Filter.php create mode 100644 libraries/plugins/IDS/Filter/Storage.php create mode 100644 libraries/plugins/IDS/Init.php create mode 100644 libraries/plugins/IDS/Ips.php create mode 100644 libraries/plugins/IDS/LICENSE.txt create mode 100644 libraries/plugins/IDS/Log/Api.php create mode 100644 libraries/plugins/IDS/Log/Composite.php create mode 100644 libraries/plugins/IDS/Log/Database.php create mode 100644 libraries/plugins/IDS/Log/Email.php create mode 100644 libraries/plugins/IDS/Log/File.php create mode 100644 libraries/plugins/IDS/Log/Interface.php create mode 100644 libraries/plugins/IDS/Monitor.php create mode 100644 libraries/plugins/IDS/Report.php create mode 100644 libraries/plugins/IDS/Version.php create mode 100644 libraries/plugins/IDS/default_filter.json create mode 100644 libraries/plugins/IDS/default_filter.xml create mode 100644 libraries/plugins/IDS/default_filter_orig.xml create mode 100644 libraries/plugins/IDS/tmp/bad_bots.txt create mode 100644 libraries/plugins/IDS/tmp/cookie_ips.txt create mode 100644 libraries/plugins/IDS/tmp/custom_rules.txt create mode 100644 libraries/plugins/IDS/tmp/ips.txt create mode 100644 libraries/plugins/IDS/tmp/phpids_log.txt create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier.auto.php create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier.autoload.php create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier.func.php create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier.includes.php create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier.kses.php create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier.path.php create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier.php create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier.safe-includes.php create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/AttrCollections.php create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/AttrDef.php create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/AttrDef/CSS.php create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/AttrDef/CSS/AlphaValue.php create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/AttrDef/CSS/Background.php create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/AttrDef/CSS/BackgroundPosition.php create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/AttrDef/CSS/Border.php create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/AttrDef/CSS/Color.php create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/AttrDef/CSS/Composite.php create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/AttrDef/CSS/DenyElementDecorator.php create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/AttrDef/CSS/Filter.php create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/AttrDef/CSS/Font.php create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/AttrDef/CSS/FontFamily.php create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/AttrDef/CSS/ImportantDecorator.php create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/AttrDef/CSS/Length.php create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/AttrDef/CSS/ListStyle.php create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/AttrDef/CSS/Multiple.php create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/AttrDef/CSS/Number.php create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/AttrDef/CSS/Percentage.php create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/AttrDef/CSS/TextDecoration.php create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/AttrDef/CSS/URI.php create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/AttrDef/Enum.php create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/AttrDef/HTML/Bool.php create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/AttrDef/HTML/Class.php create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/AttrDef/HTML/Color.php create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/AttrDef/HTML/FrameTarget.php create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/AttrDef/HTML/ID.php create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/AttrDef/HTML/Length.php create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/AttrDef/HTML/LinkTypes.php create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/AttrDef/HTML/MultiLength.php create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/AttrDef/HTML/Nmtokens.php create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/AttrDef/HTML/Pixels.php create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/AttrDef/Integer.php create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/AttrDef/Lang.php create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/AttrDef/Switch.php create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/AttrDef/Text.php create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/AttrDef/URI.php create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/AttrDef/URI/Email.php create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/AttrDef/URI/Email/SimpleCheck.php create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/AttrDef/URI/Host.php create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/AttrDef/URI/IPv4.php create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/AttrDef/URI/IPv6.php create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/AttrTransform.php create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/AttrTransform/Background.php create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/AttrTransform/BdoDir.php create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/AttrTransform/BgColor.php create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/AttrTransform/BoolToCSS.php create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/AttrTransform/Border.php create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/AttrTransform/EnumToCSS.php create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/AttrTransform/ImgRequired.php create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/AttrTransform/ImgSpace.php create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/AttrTransform/Input.php create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/AttrTransform/Lang.php create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/AttrTransform/Length.php create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/AttrTransform/Name.php create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/AttrTransform/NameSync.php create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/AttrTransform/Nofollow.php create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/AttrTransform/SafeEmbed.php create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/AttrTransform/SafeObject.php create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/AttrTransform/SafeParam.php create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/AttrTransform/ScriptRequired.php create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/AttrTransform/Textarea.php create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/AttrTypes.php create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/AttrValidator.php create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/Bootstrap.php create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/CSSDefinition.php create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ChildDef.php create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ChildDef/Chameleon.php create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ChildDef/Custom.php create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ChildDef/Empty.php create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ChildDef/Optional.php create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ChildDef/Required.php create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ChildDef/StrictBlockquote.php create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ChildDef/Table.php create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/Config.php create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigDef.php create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigDef/Directive.php create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigDef/DirectiveAlias.php create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigDef/Namespace.php create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema.php create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/Builder/ConfigSchema.php create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/Builder/Xml.php create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/Exception.php create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/Interchange.php create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/Interchange/Directive.php create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/Interchange/Id.php create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/Interchange/Namespace.php create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/InterchangeBuilder.php create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/Validator.php create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/ValidatorAtom.php create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema.ser create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Attr.AllowedClasses.txt create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Attr.AllowedFrameTargets.txt create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Attr.AllowedRel.txt create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Attr.AllowedRev.txt create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Attr.ClassUseCDATA.txt create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Attr.DefaultImageAlt.txt create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Attr.DefaultInvalidImage.txt create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Attr.DefaultInvalidImageAlt.txt create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Attr.DefaultTextDir.txt create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Attr.EnableID.txt create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Attr.ForbiddenClasses.txt create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Attr.IDBlacklist.txt create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Attr.IDBlacklistRegexp.txt create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Attr.IDPrefix.txt create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Attr.IDPrefixLocal.txt create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Attr.txt create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/AutoFormat.AutoParagraph.txt create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/AutoFormat.Custom.txt create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/AutoFormat.DisplayLinkURI.txt create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/AutoFormat.Linkify.txt create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/AutoFormat.PurifierLinkify.DocURL.txt create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/AutoFormat.PurifierLinkify.txt create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/AutoFormat.RemoveEmpty.RemoveNbsp.Exceptions.txt create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/AutoFormat.RemoveEmpty.RemoveNbsp.txt create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/AutoFormat.RemoveEmpty.txt create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/AutoFormat.RemoveSpansWithoutAttributes.txt create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/AutoFormat.txt create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/AutoFormatParam.PurifierLinkifyDocURL.txt create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/AutoFormatParam.txt create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/CSS.AllowImportant.txt create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/CSS.AllowTricky.txt create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/CSS.AllowedFonts.txt create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/CSS.AllowedProperties.txt create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/CSS.DefinitionRev.txt create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/CSS.ForbiddenProperties.txt create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/CSS.MaxImgLength.txt create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/CSS.Proprietary.txt create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/CSS.Trusted.txt create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/CSS.txt create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Cache.DefinitionImpl.txt create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Cache.SerializerPath.txt create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Cache.SerializerPermissions.txt create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Cache.txt create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Core.AggressivelyFixLt.txt create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Core.CollectErrors.txt create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Core.ColorKeywords.txt create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Core.ConvertDocumentToFragment.txt create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Core.DirectLexLineNumberSyncInterval.txt create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Core.Encoding.txt create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Core.EscapeInvalidChildren.txt create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Core.EscapeInvalidTags.txt create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Core.EscapeNonASCIICharacters.txt create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Core.HiddenElements.txt create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Core.Language.txt create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Core.LexerImpl.txt create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Core.MaintainLineNumbers.txt create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Core.NormalizeNewlines.txt create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Core.RemoveInvalidImg.txt create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Core.RemoveProcessingInstructions.txt create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Core.RemoveScriptContents.txt create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Core.txt create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Filter.Custom.txt create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Filter.ExtractStyleBlocks.Escaping.txt create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Filter.ExtractStyleBlocks.Scope.txt create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Filter.ExtractStyleBlocks.TidyImpl.txt create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Filter.ExtractStyleBlocks.txt create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Filter.YouTube.txt create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Filter.txt create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/FilterParam.ExtractStyleBlocksEscaping.txt create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/FilterParam.ExtractStyleBlocksScope.txt create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/FilterParam.ExtractStyleBlocksTidyImpl.txt create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/FilterParam.txt create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/HTML.Allowed.txt create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/HTML.AllowedAttributes.txt create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/HTML.AllowedElements.txt create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/HTML.AllowedModules.txt create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/HTML.Attr.Name.UseCDATA.txt create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/HTML.BlockWrapper.txt create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/HTML.CoreModules.txt create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/HTML.CustomDoctype.txt create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/HTML.DefinitionID.txt create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/HTML.DefinitionRev.txt create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/HTML.Doctype.txt create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/HTML.FlashAllowFullScreen.txt create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/HTML.ForbiddenAttributes.txt create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/HTML.ForbiddenElements.txt create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/HTML.MaxImgLength.txt create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/HTML.Nofollow.txt create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/HTML.Parent.txt create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/HTML.Proprietary.txt create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/HTML.SafeEmbed.txt create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/HTML.SafeObject.txt create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/HTML.Strict.txt create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/HTML.TidyAdd.txt create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/HTML.TidyLevel.txt create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/HTML.TidyRemove.txt create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/HTML.Trusted.txt create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/HTML.XHTML.txt create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/HTML.txt create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Output.CommentScriptContents.txt create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Output.FixInnerHTML.txt create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Output.FlashCompat.txt create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Output.Newline.txt create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Output.SortAttr.txt create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Output.TidyFormat.txt create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Output.txt create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Test.ForceNoIconv.txt create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Test.txt create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/URI.AllowedSchemes.txt create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/URI.Base.txt create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/URI.DefaultScheme.txt create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/URI.DefinitionID.txt create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/URI.DefinitionRev.txt create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/URI.Disable.txt create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/URI.DisableExternal.txt create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/URI.DisableExternalResources.txt create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/URI.DisableResources.txt create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/URI.Host.txt create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/URI.HostBlacklist.txt create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/URI.MakeAbsolute.txt create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/URI.Munge.txt create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/URI.MungeResources.txt create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/URI.MungeSecretKey.txt create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/URI.OverrideAllowedSchemes.txt create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/URI.txt create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/info.ini create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ContentSets.php create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/Context.php create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/Definition.php create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/DefinitionCache.php create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/DefinitionCache/Decorator.php create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/DefinitionCache/Decorator/Cleanup.php create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/DefinitionCache/Decorator/Memory.php create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/DefinitionCache/Decorator/Template.php.in create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/DefinitionCache/Null.php create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/DefinitionCache/Serializer.php create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/DefinitionCache/Serializer/CSS/4.1.0,801ad73acbcf9d3127e1d01768d26453,1.ser create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/DefinitionCache/Serializer/HTML/4.1.0,ddc9b993d7fc8d4a185e8dbf5b9a0996,1.ser create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/DefinitionCache/Serializer/README create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/DefinitionCache/Serializer/URI/4.0.0,05c766101e813c246917b022f97b5e6e,1.ser create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/DefinitionCacheFactory.php create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/Doctype.php create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/DoctypeRegistry.php create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ElementDef.php create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/Encoder.php create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/EntityLookup.php create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/EntityLookup/entities.ser create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/EntityParser.php create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ErrorCollector.php create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ErrorStruct.php create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/Exception.php create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/Filter.php create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/Filter/ExtractStyleBlocks.php create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/Filter/YouTube.php create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/Generator.php create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/HTMLDefinition.php create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/HTMLModule.php create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/HTMLModule/Bdo.php create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/HTMLModule/CommonAttributes.php create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/HTMLModule/Edit.php create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/HTMLModule/Forms.php create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/HTMLModule/Hypertext.php create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/HTMLModule/Image.php create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/HTMLModule/Legacy.php create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/HTMLModule/List.php create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/HTMLModule/Name.php create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/HTMLModule/Nofollow.php create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/HTMLModule/NonXMLCommonAttributes.php create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/HTMLModule/Object.php create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/HTMLModule/Presentation.php create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/HTMLModule/Proprietary.php create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/HTMLModule/Ruby.php create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/HTMLModule/SafeEmbed.php create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/HTMLModule/SafeObject.php create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/HTMLModule/Scripting.php create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/HTMLModule/StyleAttribute.php create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/HTMLModule/Tables.php create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/HTMLModule/Target.php create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/HTMLModule/Text.php create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/HTMLModule/Tidy.php create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/HTMLModule/Tidy/Name.php create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/HTMLModule/Tidy/Proprietary.php create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/HTMLModule/Tidy/Strict.php create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/HTMLModule/Tidy/Transitional.php create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/HTMLModule/Tidy/XHTML.php create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/HTMLModule/Tidy/XHTMLAndHTML4.php create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/HTMLModule/XMLCommonAttributes.php create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/HTMLModuleManager.php create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/IDAccumulator.php create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/Injector.php create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/Injector/AutoParagraph.php create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/Injector/DisplayLinkURI.php create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/Injector/Linkify.php create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/Injector/PurifierLinkify.php create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/Injector/RemoveEmpty.php create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/Injector/RemoveSpansWithoutAttributes.php create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/Injector/SafeObject.php create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/Language.php create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/Language/classes/en-x-test.php create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/Language/messages/en-x-test.php create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/Language/messages/en-x-testmini.php create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/Language/messages/en.php create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/LanguageFactory.php create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/Length.php create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/Lexer.php create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/Lexer/DOMLex.php create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/Lexer/DirectLex.php create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/Lexer/PEARSax3.php create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/Lexer/PH5P.php create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/PercentEncoder.php create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/Printer.php create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/Printer/CSSDefinition.php create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/Printer/ConfigForm.css create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/Printer/ConfigForm.js create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/Printer/ConfigForm.php create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/Printer/HTMLDefinition.php create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/PropertyList.php create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/PropertyListIterator.php create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/Strategy.php create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/Strategy/Composite.php create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/Strategy/Core.php create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/Strategy/FixNesting.php create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/Strategy/MakeWellFormed.php create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/Strategy/RemoveForeignElements.php create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/Strategy/ValidateAttributes.php create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/StringHash.php create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/StringHashParser.php create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/TagTransform.php create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/TagTransform/Font.php create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/TagTransform/Simple.php create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/Token.php create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/Token/Comment.php create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/Token/Empty.php create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/Token/End.php create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/Token/Start.php create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/Token/Tag.php create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/Token/Text.php create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/TokenFactory.php create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/URI.php create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/URIDefinition.php create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/URIFilter.php create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/URIFilter/DisableExternal.php create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/URIFilter/DisableExternalResources.php create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/URIFilter/DisableResources.php create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/URIFilter/HostBlacklist.php create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/URIFilter/MakeAbsolute.php create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/URIFilter/Munge.php create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/URIParser.php create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/URIScheme.php create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/URIScheme/data.php create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/URIScheme/file.php create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/URIScheme/ftp.php create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/URIScheme/http.php create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/URIScheme/https.php create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/URIScheme/mailto.php create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/URIScheme/news.php create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/URIScheme/nntp.php create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/URISchemeRegistry.php create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/UnitConverter.php create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/VarParser.php create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/VarParser/Flexible.php create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/VarParser/Native.php create mode 100644 libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/VarParserException.php create mode 100644 libraries/plugins/MaxMind-DB-Reader/GeoLite2-Country.mmdb create mode 100644 libraries/plugins/MaxMind-DB-Reader/autoload.php create mode 100644 libraries/plugins/MaxMind-DB-Reader/composer.json create mode 100644 libraries/plugins/MaxMind-DB-Reader/ext/config.m4 create mode 100644 libraries/plugins/MaxMind-DB-Reader/ext/maxminddb.c create mode 100644 libraries/plugins/MaxMind-DB-Reader/ext/php_maxminddb.h create mode 100644 libraries/plugins/MaxMind-DB-Reader/src/MaxMind/Db/Reader.php create mode 100644 libraries/plugins/MaxMind-DB-Reader/src/MaxMind/Db/Reader/Decoder.php create mode 100644 libraries/plugins/MaxMind-DB-Reader/src/MaxMind/Db/Reader/InvalidDatabaseException.php create mode 100644 libraries/plugins/MaxMind-DB-Reader/src/MaxMind/Db/Reader/Metadata.php create mode 100644 libraries/plugins/MaxMind-DB-Reader/src/MaxMind/Db/Reader/Util.php create mode 100644 libraries/plugins/index.html create mode 100644 libraries/plugins/ip_address/ip-lib.php create mode 100644 libraries/plugins/ip_address/src/Address/AddressInterface.php create mode 100644 libraries/plugins/ip_address/src/Address/AssignedRange.php create mode 100644 libraries/plugins/ip_address/src/Address/IPv4.php create mode 100644 libraries/plugins/ip_address/src/Address/IPv6.php create mode 100644 libraries/plugins/ip_address/src/Address/Type.php create mode 100644 libraries/plugins/ip_address/src/Factory.php create mode 100644 libraries/plugins/ip_address/src/Range/Pattern.php create mode 100644 libraries/plugins/ip_address/src/Range/RangeInterface.php create mode 100644 libraries/plugins/ip_address/src/Range/Single.php create mode 100644 libraries/plugins/ip_address/src/Range/Subnet.php create mode 100644 libraries/plugins/ip_address/src/Range/Type.php create mode 100644 libraries/plugins/phpMussel/loader.php create mode 100644 libraries/plugins/phpMussel/vault/.htaccess create mode 100644 libraries/plugins/phpMussel/vault/cache/.htaccess create mode 100644 libraries/plugins/phpMussel/vault/cache/75.tmp create mode 100644 libraries/plugins/phpMussel/vault/cache/index.dat create mode 100644 libraries/plugins/phpMussel/vault/cli.php create mode 100644 libraries/plugins/phpMussel/vault/components.dat create mode 100644 libraries/plugins/phpMussel/vault/config.ini create mode 100644 libraries/plugins/phpMussel/vault/config.php create mode 100644 libraries/plugins/phpMussel/vault/config.yaml create mode 100644 libraries/plugins/phpMussel/vault/fe_assets/.htaccess create mode 100644 libraries/plugins/phpMussel/vault/fe_assets/_accounts.html create mode 100644 libraries/plugins/phpMussel/vault/fe_assets/_accounts_row.html create mode 100644 libraries/plugins/phpMussel/vault/fe_assets/_config.html create mode 100644 libraries/plugins/phpMussel/vault/fe_assets/_config_row.html create mode 100644 libraries/plugins/phpMussel/vault/fe_assets/_files.html create mode 100644 libraries/plugins/phpMussel/vault/fe_assets/_files_edit.html create mode 100644 libraries/plugins/phpMussel/vault/fe_assets/_files_rename.html create mode 100644 libraries/plugins/phpMussel/vault/fe_assets/_files_row.html create mode 100644 libraries/plugins/phpMussel/vault/fe_assets/_home.html create mode 100644 libraries/plugins/phpMussel/vault/fe_assets/_login.html create mode 100644 libraries/plugins/phpMussel/vault/fe_assets/_logs.html create mode 100644 libraries/plugins/phpMussel/vault/fe_assets/_nav_complete_access.html create mode 100644 libraries/plugins/phpMussel/vault/fe_assets/_nav_logs_access_only.html create mode 100644 libraries/plugins/phpMussel/vault/fe_assets/_quarantine.html create mode 100644 libraries/plugins/phpMussel/vault/fe_assets/_quarantine_row.html create mode 100644 libraries/plugins/phpMussel/vault/fe_assets/_statistics.html create mode 100644 libraries/plugins/phpMussel/vault/fe_assets/_updates.html create mode 100644 libraries/plugins/phpMussel/vault/fe_assets/_updates_row.html create mode 100644 libraries/plugins/phpMussel/vault/fe_assets/_upload_test.html create mode 100644 libraries/plugins/phpMussel/vault/fe_assets/frontend.css create mode 100644 libraries/plugins/phpMussel/vault/fe_assets/frontend.html create mode 100644 libraries/plugins/phpMussel/vault/fe_assets/icons.php create mode 100644 libraries/plugins/phpMussel/vault/fe_assets/pips.php create mode 100644 libraries/plugins/phpMussel/vault/frontend.php create mode 100644 libraries/plugins/phpMussel/vault/frontend_functions.php create mode 100644 libraries/plugins/phpMussel/vault/functions.php create mode 100644 libraries/plugins/phpMussel/vault/greylist.csv create mode 100644 libraries/plugins/phpMussel/vault/hotfixes.php create mode 100644 libraries/plugins/phpMussel/vault/lang.php create mode 100644 libraries/plugins/phpMussel/vault/lang/.htaccess create mode 100644 libraries/plugins/phpMussel/vault/lang/lang.ar.fe.php create mode 100644 libraries/plugins/phpMussel/vault/lang/lang.ar.php create mode 100644 libraries/plugins/phpMussel/vault/lang/lang.de.fe.php create mode 100644 libraries/plugins/phpMussel/vault/lang/lang.de.php create mode 100644 libraries/plugins/phpMussel/vault/lang/lang.en.fe.php create mode 100644 libraries/plugins/phpMussel/vault/lang/lang.en.php create mode 100644 libraries/plugins/phpMussel/vault/lang/lang.es.fe.php create mode 100644 libraries/plugins/phpMussel/vault/lang/lang.es.php create mode 100644 libraries/plugins/phpMussel/vault/lang/lang.fr.fe.php create mode 100644 libraries/plugins/phpMussel/vault/lang/lang.fr.php create mode 100644 libraries/plugins/phpMussel/vault/lang/lang.hi.fe.php create mode 100644 libraries/plugins/phpMussel/vault/lang/lang.hi.php create mode 100644 libraries/plugins/phpMussel/vault/lang/lang.id.fe.php create mode 100644 libraries/plugins/phpMussel/vault/lang/lang.id.php create mode 100644 libraries/plugins/phpMussel/vault/lang/lang.it.fe.php create mode 100644 libraries/plugins/phpMussel/vault/lang/lang.it.php create mode 100644 libraries/plugins/phpMussel/vault/lang/lang.ja.fe.php create mode 100644 libraries/plugins/phpMussel/vault/lang/lang.ja.php create mode 100644 libraries/plugins/phpMussel/vault/lang/lang.ko.fe.php create mode 100644 libraries/plugins/phpMussel/vault/lang/lang.ko.php create mode 100644 libraries/plugins/phpMussel/vault/lang/lang.nl.fe.php create mode 100644 libraries/plugins/phpMussel/vault/lang/lang.nl.php create mode 100644 libraries/plugins/phpMussel/vault/lang/lang.pt.fe.php create mode 100644 libraries/plugins/phpMussel/vault/lang/lang.pt.php create mode 100644 libraries/plugins/phpMussel/vault/lang/lang.ru.fe.php create mode 100644 libraries/plugins/phpMussel/vault/lang/lang.ru.php create mode 100644 libraries/plugins/phpMussel/vault/lang/lang.th.fe.php create mode 100644 libraries/plugins/phpMussel/vault/lang/lang.th.php create mode 100644 libraries/plugins/phpMussel/vault/lang/lang.tr.fe.php create mode 100644 libraries/plugins/phpMussel/vault/lang/lang.tr.php create mode 100644 libraries/plugins/phpMussel/vault/lang/lang.ur.fe.php create mode 100644 libraries/plugins/phpMussel/vault/lang/lang.ur.php create mode 100644 libraries/plugins/phpMussel/vault/lang/lang.vi.fe.php create mode 100644 libraries/plugins/phpMussel/vault/lang/lang.vi.php create mode 100644 libraries/plugins/phpMussel/vault/lang/lang.zh-TW.php create mode 100644 libraries/plugins/phpMussel/vault/lang/lang.zh-tw.fe.php create mode 100644 libraries/plugins/phpMussel/vault/lang/lang.zh.fe.php create mode 100644 libraries/plugins/phpMussel/vault/lang/lang.zh.php create mode 100644 libraries/plugins/phpMussel/vault/php5.4.x.php create mode 100644 libraries/plugins/phpMussel/vault/plugins.dat create mode 100644 libraries/plugins/phpMussel/vault/plugins/.htaccess create mode 100644 libraries/plugins/phpMussel/vault/plugins/logtoastra/plugin.php create mode 100644 libraries/plugins/phpMussel/vault/quarantine/.htaccess create mode 100644 libraries/plugins/phpMussel/vault/scan_kills.txt create mode 100644 libraries/plugins/phpMussel/vault/scan_log.txt create mode 100644 libraries/plugins/phpMussel/vault/scan_log_serialized.txt create mode 100644 libraries/plugins/phpMussel/vault/signatures.dat create mode 100644 libraries/plugins/phpMussel/vault/signatures/.htaccess create mode 100644 libraries/plugins/phpMussel/vault/signatures/switch.dat create mode 100644 libraries/plugins/phpMussel/vault/template_custom.html create mode 100644 libraries/plugins/phpMussel/vault/template_default.html create mode 100644 libraries/plugins/phpMussel/vault/themes.dat create mode 100644 libraries/plugins/phpMussel/vault/upload.php create mode 100644 upgrade.php diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..a61be9f --- /dev/null +++ b/.gitignore @@ -0,0 +1,49 @@ +/db +hack.php +post.html +astra-config.php +workspace.xml +/.idea +czar-A9EC79EC9B9113CAF4A4EBD5E04AFBC9.html +/.vscode +libraries/plugins/astra-gk +tests + +# Compiled source # +################### +*.com +*.class +*.dll +*.exe +*.o +*.so + +# Packages # +############ +# it's better to unpack these files and commit the raw source +# git has its own built in compression methods +*.7z +*.dmg +*.gz +*.iso +*.jar +*.rar +*.tar +*.zip +*.db + +# Logs and databases # +###################### +*.log +*.sql +*.sqlite + +# OS generated files # +###################### +.DS_Store +.DS_Store? +._* +.Spotlight-V100 +.Trashes +ehthumbs.db +Thumbs.db \ No newline at end of file diff --git a/.gitlab/issue_templates/Bug.md b/.gitlab/issue_templates/Bug.md new file mode 100644 index 0000000..c7dd307 --- /dev/null +++ b/.gitlab/issue_templates/Bug.md @@ -0,0 +1,26 @@ + + +## Description + + +## Expected Behavior + + +## Actual Behavior + + +## Possible Fix + + +## Steps to Reproduce + + +1. +2. +3. +4. + +## Context + + +/label ~Bug \ No newline at end of file diff --git a/.gitlab/issue_templates/Feature.md b/.gitlab/issue_templates/Feature.md new file mode 100644 index 0000000..42cffb1 --- /dev/null +++ b/.gitlab/issue_templates/Feature.md @@ -0,0 +1,13 @@ + + +## Detailed Description + + +## Context + + + +## Possible Implementation + + +/label ~Feature \ No newline at end of file diff --git a/.gitlab/merge_request_templates/Bugfix.md b/.gitlab/merge_request_templates/Bugfix.md new file mode 100644 index 0000000..79bdb05 --- /dev/null +++ b/.gitlab/merge_request_templates/Bugfix.md @@ -0,0 +1,32 @@ + +# Bugfix + + +## Description + + +## Motivation and Context + + + +## How Has This Been Tested? + + + + +## Screenshots (if appropriate): + +## Types of changes + +- [ ] Bug fix (non-breaking change which fixes an issue) +- [ ] New feature (non-breaking change which adds functionality) +- [ ] Breaking change (fix or feature that would cause existing functionality to not work as expected) + +## Checklist: + + +- [ ] My code follows the code style of this project. +- [ ] My change requires a change to the documentation. +- [ ] I have updated the documentation accordingly. + +/label ~Bugfix \ No newline at end of file diff --git a/.gitlab/merge_request_templates/DevelopToMaster.md b/.gitlab/merge_request_templates/DevelopToMaster.md new file mode 100644 index 0000000..7d888b3 --- /dev/null +++ b/.gitlab/merge_request_templates/DevelopToMaster.md @@ -0,0 +1,35 @@ + +# Develop -> Master + + +## Issue(s) + + +## Description + + +## Motivation and Context + + + +## How Has This Been Tested? + + + + +## Screenshots (if appropriate): + +## Types of changes + +- [ ] Bug fix (non-breaking change which fixes an issue) +- [ ] New feature (non-breaking change which adds functionality) +- [ ] Breaking change (fix or feature that would cause existing functionality to not work as expected) + +## Checklist: + + +- [ ] My code follows the code style of this project. +- [ ] My change requires a change to the documentation. +- [ ] I have updated the documentation accordingly. + +/label ~Feature \ No newline at end of file diff --git a/.gitlab/merge_request_templates/Feature.md b/.gitlab/merge_request_templates/Feature.md new file mode 100644 index 0000000..90cc578 --- /dev/null +++ b/.gitlab/merge_request_templates/Feature.md @@ -0,0 +1,32 @@ + +# Feature + + +## Description + + +## Motivation and Context + + + +## How Has This Been Tested? + + + + +## Screenshots (if appropriate): + +## Types of changes + +- [ ] Bug fix (non-breaking change which fixes an issue) +- [ ] New feature (non-breaking change which adds functionality) +- [ ] Breaking change (fix or feature that would cause existing functionality to not work as expected) + +## Checklist: + + +- [ ] My code follows the code style of this project. +- [ ] My change requires a change to the documentation. +- [ ] I have updated the documentation accordingly. + +/label ~Feature \ No newline at end of file diff --git a/.gitlab/merge_request_templates/Hotfix.md b/.gitlab/merge_request_templates/Hotfix.md new file mode 100644 index 0000000..a1c587d --- /dev/null +++ b/.gitlab/merge_request_templates/Hotfix.md @@ -0,0 +1,32 @@ + +# Hotfix + + +## Description + + +## Motivation and Context + + + +## How Has This Been Tested? + + + + +## Screenshots (if appropriate): + +## Types of changes + +- [ ] Bug fix (non-breaking change which fixes an issue) +- [ ] New feature (non-breaking change which adds functionality) +- [ ] Breaking change (fix or feature that would cause existing functionality to not work as expected) + +## Checklist: + + +- [ ] My code follows the code style of this project. +- [ ] My change requires a change to the documentation. +- [ ] I have updated the documentation accordingly. + +/label ~Hotfix \ No newline at end of file diff --git a/Astra.php b/Astra.php new file mode 100644 index 0000000..022c338 --- /dev/null +++ b/Astra.php @@ -0,0 +1,419 @@ +' . $str . "

\r\n"; + } + } + + public function __construct() + { + + require_once(ASTRAPATH . 'astra-config.php'); + require_once(ASTRAPATH . 'libraries/Config_options.php'); + + if (!defined('CZ_DB_PATH')) { + define('CZ_DB_PATH', dirname(__FILE__) . '/'); + } + + echo_debug('Astra Constuctor Loaded'); + echo_debug('Astra version - v' . CZ_ASTRA_CLIENT_VERSION . ' and PHP version - ' . PHP_VERSION); + if (!$this->meets_requirements()) { + echo_debug('Requirements not met'); + return FALSE; + } else { + echo_debug('Meets all Requirements'); + } + + self::$_config = new AstraConfig(); + + if (CZ_ASTRA_ACTIVE) { + + echo_debug('Astra Active'); + require_once(ASTRAPATH . 'libraries/Astra_ip.php'); + + $client_ip = new Astra_ip(); + + self::$_ip = $client_ip->get_ip_address(); + if (trim(self::$_ip) == "") { + self::$_ip = '103.16.70.12'; + } + + self::$_user_agent = !empty($_SERVER['HTTP_USER_AGENT']) ? $_SERVER['HTTP_USER_AGENT'] : ''; + + if (!empty($cz_lvl)) { + self::$cz_lvl = $cz_lvl; + } else { + self::$cz_lvl = get_cz_lvl(); + $cz_lvl = self::$cz_lvl; + } + + echo_debug('Current IP: ' . self::$_ip); + echo_debug('Current UA: ' . self::$_user_agent); + echo_debug(self::$cz_lvl); + echo_debug($cz_lvl); + + $this->check_search_engine(); + + if (CZ_SETUP) { + echo_debug('Has been Setup'); + $this->init(); + } else { + echo_debug('NOT been Setup'); + if (isset($_SERVER['HTTP_HOST']) && $this->setup()) { + echo_debug('Setup Complete'); + $this->init(); + } + } + } else { + echo_debug('Astra not active'); + show_astra_debug_log(); + return; + } + + show_astra_debug_log(); + } + + protected function meets_requirements() + { + if (!defined('PDO::ATTR_DRIVER_NAME')) { + echo_debug('PDO Driver Missing'); + return FALSE; + } else { + echo_debug('PDO Loaded'); + } + + if (!in_array('sqlite', PDO::getAvailableDrivers(), TRUE)) { + echo_debug('sqlite3 extension not loaded'); + return false; + } else { + echo_debug('SQLite loaded'); + } + + if (!file_exists(CZ_DB_PATH . 'db/' . CZ_DATABASE_NAME . '.db')) { + echo_debug('Updating DB'); + $this->update_db(); + } else { + /* + unlink(ASTRAPATH . 'db/' . CZ_DATABASE_NAME . '.db'); + echo_debug('Updating DB'); + $this->update_db(); + * + */ + } + return TRUE; + } + + public function init() + { + echo_debug('Initializing'); + self::connect_db(); + $this->run(); + } + + public static function connect_db() + { + require_once(ASTRAPATH . 'libraries/SQLite_db.php'); + self::$_db = new SQLiteWrapper(self::$cz_lvl); + } + + private function update_db() + { + require_once(ASTRAPATH . 'libraries/Update_DB.php'); + $update_db = new Update_DB(); + } + + public function setup() + { + + if (empty($_SERVER)) { + return false; + } + + // Added for TC + if (!defined("CZ_SECRET_KEY") || (defined("CZ_SECRET_KEY") && strlen(CZ_SECRET_KEY) < 2)) { + echo_debug('Enc keys not set'); + return false; + } + + /* + if (file_exists(CZ_DB_PATH . 'db/' . CZ_DATABASE_NAME . 'db')) { + if (unlink(CZ_DB_PATH . 'db/' . CZ_DATABASE_NAME . 'db')) { + echo_debug('Deletd Already Set Database'); + } else { + echo_debug('Unable to Delete Database'); + return FALSE; + } + } + */ + + require_once(ASTRAPATH . 'libraries/Astra_setup.php'); + $astraSetup = new Astra_setup(); + $astraSetup->createAstraFiles(); + $rootApiUri = $astraSetup->getRootApiFileUri(); + + require_once(ASTRAPATH . 'libraries/API_connect.php'); + $connect = new API_connect(); + + $connect->setRootApiUri($rootApiUri); + + if (!$connect->setup()) { + return FALSE; + } + + require_once(ASTRAPATH . 'libraries/Update_DB.php'); + $update_db = new Update_DB(); + + if (!$update_db) { + return FALSE; + } + + require_once(ASTRAPATH . 'libraries/Update_config.php'); + $update_config_file = Update_config('CZ_SETUP', base64_encode('TRUE'), FALSE); + + return $update_config_file; + + } + + public function run() + { + echo_debug('About to run'); + + $blocked_or_trusted = self::$_db->is_blocked_or_trusted(self::$_ip, false, self::$_config); + + if ($blocked_or_trusted == "blocked" && !self::$_is_search_engine) { + self::show_block_page(); + } + + if ($blocked_or_trusted == "trusted" || self::is_whitelisted_url() || self::$_is_search_engine) { + echo_debug("Is trusted or whitelisted or a search engine"); + if (self::$_is_search_engine) { + $is_trusted = self::$_db->edit_ip_exception('add', 'trusted', self::$_ip); + } + return TRUE; + } + + $is_bad_bot = $this->is_bad_bot(); + + if ($blocked_or_trusted == "blocked" || $is_bad_bot || self::$_is_fake_search_engine_bot) { + echo_debug('You have been blocked'); + require_once(ASTRAPATH . 'libraries/API_connect.php'); + $connect = new API_connect(); + if ($is_bad_bot || self::$_is_fake_search_engine_bot) { + // self::$_db->log_hit(self::$_ip); + self::$_db->edit_ip_exception('add', 'blocked', self::$_ip); + + echo_debug('You are a badbot'); + $connect->send_request("badbot", array()); + echo_debug('Reported Blackbot status'); + } + self::show_block_page(); + } + + $this->run_upload_scan(); + $this->run_IDS(); + $this->run_patches(); + + if (!self::$_is_search_engine) { + $this->run_token_bucket(); + } + + } + + protected function is_whitelisted_url() + { + if (!empty($_SERVER['REQUEST_URI'])) { + $url = $_SERVER['REQUEST_URI']; + + + $db_params = self::$_db->get_custom_params(); + + $db_allowed_urls = $db_params['url']; + + $allowed_urls = array('/admin/', '/wp-admin', 'checkout', 'paypal', '/ipn.php', '/transaction', 'callback', 'contact-form-7', 'wc-ajax=', '/wc-api', '/wp-json', 'api/soap', 'api/v2_soap'); + + $merge = array_merge($allowed_urls, $db_allowed_urls); + + //print_r($merge); + + foreach ($merge as $allowed_url) { + if (strpos($url, $allowed_url) !== false) { + return TRUE; + } + } + } + + return FALSE; + } + + public static function show_block_page($attack_param = null) + { + if (defined('CZ_ASTRA_MODE') && CZ_ASTRA_MODE == 'monitor') { + return TRUE; + } + + if (!headers_sent()) { + header('HTTP/1.0 403 Forbidden'); + } + echo_debug('About to show block page'); + + if (file_exists(ASTRAPATH . 'block-page-custom.php')) { + $block_page_path = ASTRAPATH . 'block-page-custom.php'; + } else { + $block_page_path = ASTRAPATH . 'block-page.php'; + } + + if (!headers_sent()) { + header('X-XSS-Protection: 1; mode=block'); + header('X-Frame-Options: deny'); + header('X-Content-Type-Options: nosniff'); + + /* No cache headers */ + header('X-LiteSpeed-Cache-Control: no-cache'); + header("Expires: Tue, 03 Jul 2001 06:00:00 GMT"); + header("Last-Modified: " . gmdate("D, d M Y H:i:s") . " GMT"); + header("Cache-Control: no-store, no-cache, must-revalidate, max-age=0"); + header("Cache-Control: post-check=0, pre-check=0", false); + header("Pragma: no-cache"); + header("Connection: close"); + } + + if (file_exists($block_page_path)) { + include($block_page_path); + exit; + die(); + } + + if (!headers_sent()) { + header("Location: " . CZ_BLOCK_PAGE_URL); /* Redirect browser */ + } else { + echo ''; + } + die("You are blocked"); + exit(); + } + + protected function run_upload_scan() + { + + if (empty($_FILES)) { + return true; + } + + if (version_compare(PHP_VERSION, '5.4.0') >= 0) { + echo_debug('Including mussel'); + $config = new AstraConfig(); + $data['key'] = 'file_uploads'; + $musselResult = $config->get_config($data); + if ($musselResult) { + $phpMusselConfig = json_decode($musselResult, true); + if ($phpMusselConfig['status'] == 'TRUE') { + require_once(ASTRAPATH . 'libraries/plugins/phpMussel/loader.php'); + } else { + return false; + } + } else { // Run upload scan by default + require_once(ASTRAPATH . 'libraries/plugins/phpMussel/loader.php'); + } + + } else { + echo_debug('PHP version (' . PHP_VERSION . ') < 5.4.0 so not including Mussel'); + } + + } + + protected function run_ids() + { + require_once(ASTRAPATH . 'libraries/PHPIDS.php'); + echo_debug('Including IDS'); + $phpids = new PHPIDS(self::$_db, self::$_ip); + } + + protected function run_patches() + { + require_once(ASTRAPATH . 'libraries/Virtual_patches.php'); + $patches = new Astra_virtual_patches(); + $patches->apply(); + + $applied_patches = $patches->get_applied_patches(); + + if (count($applied_patches) > 0) { + self::$_db->log_hit(self::$_ip); + self::show_block_page(); + } + } + + protected function is_bad_bot() + { + $db = self::$_db->is_bad_bot(self::$_user_agent); + + if ($db && !self::$_is_search_engine) { + return TRUE; + } + + return FALSE; + } + + protected function check_search_engine() + { + require_once(ASTRAPATH . 'libraries/Bad_bots.php'); + $bot = new Bad_bots(self::$_user_agent, self::$_ip); + + self::$_is_search_engine = $bot->is_search_engine(); + self::$_is_fake_search_engine_bot = $bot->is_fake_bot(); + + return true; + } + + function get_sso_token() + { + $time = strtolower(gmdate("FYhiA")); + $str = CZ_CLIENT_KEY . '|' . CZ_ACCESS_KEY . '|' . $time; + $token = hash_hmac('sha256', $str, CZ_SECRET_KEY, false); + return $token; + } + + protected function run_token_bucket() + { + return TRUE; + require_once(ASTRAPATH . 'libraries/Token_bucket.php'); + Token_bucket::run(); + } + + } + +} \ No newline at end of file diff --git a/ak.php b/ak.php new file mode 100644 index 0000000..7082cfa --- /dev/null +++ b/ak.php @@ -0,0 +1,74 @@ +get_sso_key(); + + $stored = $this->get_session_key(); + + if ($stored === $expected || $rcvd === $expected) { + $this->store_key($expected); + unset($_GET['key']); + return true; + } + header("HTTP/1.0 404 Not Found"); + exit; + } + + protected function get_session_key() + { + + if (function_exists('session_status')) { + if (session_status() === PHP_SESSION_NONE) { + session_start(); + } + } else { + if (session_id() == '') { + session_start(); + } + } + + $key = !empty($_SESSION['astra_ak_key']) ? $_SESSION['astra_ak_key'] : ""; + + return $key; + } + + protected function store_key($key) + { + $_SESSION['astra_ak_key'] = $key; + } + + protected function get_sso_key() + { + define("CZ_DEBUG", TRUE); + require_once __DIR__ . '/astra-config.php'; + $time = strtolower(gmdate("FYhiA")); + $str = CZ_CLIENT_KEY . '|' . CZ_ACCESS_KEY . '|' . $time; + $token = hash_hmac('sha256', $str, CZ_SECRET_KEY, false); + return $token; + } + + public function __construct() + { + if ($this->auth()) { + $this->load(); + } + } + + function load() + { + require __DIR__ . '/Astra.php'; + $astra = new Astra(); + } + } + + new Astra_ak; +} \ No newline at end of file diff --git a/api.php b/api.php new file mode 100644 index 0000000..9de9d55 --- /dev/null +++ b/api.php @@ -0,0 +1,417 @@ +run(); + } + + protected function respond($code, $msg = "", $slug = "") + { + $this->response['origin'] = 'client'; + $this->response['code'] = $code; + $this->response['slug'] = $slug; + if ($msg == "") { + switch ($code) { + case 0: + $msg = "failed"; + break; + case 1: + $msg = "success"; + break; + default: + $msg = "error"; + break; + } + } + + $this->response['msg'] = $msg; + + if (empty($this->response['errors'])) { + $this->response['errors'] = array(); + } + + header('Content-Type: application/json'); + echo json_encode($this->response); + + die(); + } + + protected function addError($slug, $msg) + { + $this->response['errors'][$slug] = $msg; + } + + protected function authenticate() + { + $accessResponse = !empty($_POST['access_code']) ? $_POST['access_code'] : ''; + + if ($accessResponse != CZ_ACCESS_KEY) + $this->respond(-1, "Access Code doesn't match", 'access_code_missing'); + + $encResponse = $_POST['encRequest']; + + $crypto = new Astra_crypto(); + $this->receivedResponse = @unserialize($crypto->decrypt($encResponse, CZ_SECRET_KEY)); + + //echo $this->receivedResponse['client_key'] . "-" . CZ_CLIENT_KEY; + if (($this->receivedResponse == false) || ($this->receivedResponse['client_key'] != CZ_CLIENT_KEY)) + $this->respond(-1, "Secret/Client Key Mismatch"); + + return TRUE; + } + + public function bad_bots_update() + { + require_once(ASTRAPATH . 'libraries\Update_bad_bots.php'); + if (update_bad_bots()) + $this->respond(1); + else + $this->respond(0, "Unable to respond"); + } + + protected function filters_update() + { + require_once(ASTRAPATH . 'libraries\Crypto.php'); + + $dataArray['client_key'] = CZ_CLIENT_KEY; + $dataArray['api'] = "get_filters"; + $str = serialize($dataArray); + + $crypto = new Astra_crypto(); + $encrypted_data = $crypto->encrypt($str, CZ_SECRET_KEY); + + $postdata = http_build_query( + array( + 'encRequest' => $encrypted_data, + 'access_code' => CZ_ACCESS_KEY, + ) + ); + + $opts = array('http' => + array( + 'method' => 'POST', + 'header' => 'Content-type: application/x-www-form-urlencoded', + 'content' => $postdata + ) + ); + $context = stream_context_create($opts); + + $server_reply = file_get_contents(CZ_API_URL, FALSE, $context); + + $filter_file_path = 'libraries/plugins/IDS/default_filter.xml'; + + if (!empty($server_reply)) { + if (is_writeable(dirname(ASTRAPATH . $filter_file_path))) { + $dlHandler = fopen(ASTRAPATH . $filter_file_path, 'w'); + if (!fwrite($dlHandler, $server_reply)) { + $this->respond(0, "Unable to write"); + exit(); + } + fclose($dlHandler); + $this->respond(1); + } else { + $this->respond(0, "Directory not writable"); + } + } else { + $this->respond(0, "Empty Response"); + } + + $this->respond(0); + } + + protected function astra_update() + { + require_once(ASTRAPATH . 'libraries/Updater.php'); + + echo_debug("API Call received"); + echo_debug($this->receivedResponse); + + $server_version = $this->receivedResponse['version']; + + $platform = isset($this->receivedResponse['platform']) ? $this->receivedResponse['platform'] : 'php'; + + echo_debug("Loading updater"); + + $updater = new Astra_updater($server_version); + + if ($updater->is_update()) { + if ($updater->download_file()) { + sleep(1); + if ($updater->update($platform)) { + sleep(1); + $updater->delete(); + + ## Initialize the Setup Process + require_once('libraries/API_connect.php'); + $connect = new API_connect(); + if (!$connect->report_update()) { + $this->respond(-1, "Unable to report update"); + } + } + + $this->response['errors'] = $updater->get_errors(); + $this->respond(1); + } + } + + $this->response['errors'] = $updater->get_errors(); + $this->respond(-1, "Noting to update"); + } + + protected function update_config() + { + require_once(ASTRAPATH . 'libraries/Update_config.php'); + + if (isset($this->receivedResponse['constant_check_for_quotes'])) { + $quotes = $this->receivedResponse['constant_check_for_quotes']; + } else + $quotes = FALSE; + + if (update_config($this->receivedResponse['constant_name'], $this->receivedResponse['constant_value'], $quotes)) { + $this->respond(1); + } else { + $this->respond(0); + } + } + + protected function get_version() + { + $ret = explode(".", CZ_ASTRA_CLIENT_VERSION); + $this->response['version'] = array('major' => $ret[0], 'minor' => $ret[1], 'patch' => $ret[2]); + $this->respond(1); + } + + protected function valid_param($val) + { + if ($this->receivedResponse['rule_type'] === "url") { + return true; + } + + $val = strtolower($val); + $allowed = array('get.', 'post.', 'request.', 'cookie.', 'session.'); + + foreach ($allowed as $a) { + if (substr($val, 0, strlen($a)) == $a) + return TRUE; + } + return FALSE; + } + + protected function whitelist_url() + { + ASTRA::connect_db(); + + $action = $this->receivedResponse['rule_action']; + $val = $this->receivedResponse['rule_val']; + + $allowed_rule_action = array('add', 'delete'); + + if (in_array($action, $allowed_rule_action)) { + switch ($action) { + case 'add': + $result = ASTRA::$_db->add_whitelist_url($val); + break; + case 'delete': + $result = ASTRA::$_db->delete_whitelist_url($val); + break; + } + + if ($result == TRUE) { + $this->respond(1); + } else { + $this->respond(0, "Unable to update db"); + } + + } else { + $this->respond('0', 'Not a valid action'); + } + + } + + protected function custom_rule() + { + //rule_action = add, delete + //rule_type = "trusted", "blocked", "exception", "html" ,"json" + + ASTRA::connect_db(); + + $action = $this->receivedResponse['rule_action']; + $type = $this->receivedResponse['rule_type']; + $val = $this->receivedResponse['rule_val']; + + $allowed_rule_action = array('add', 'delete', 'update'); + + $ip_check = array('trusted', 'blocked'); + $param_check = array('exception', 'html', 'json', 'url',); + $allowed_rule_type = array_merge($ip_check, $param_check); + + if (in_array($action, $allowed_rule_action) && in_array($type, $allowed_rule_type)) { + if (in_array($type, $ip_check) && is_string($val) && strlen($val) == 2) { + if ($type == "blocked") { + $config_data = array( + "key" => "country_blocked", + "value" => $val, + "autoload" => 1, + ); + } elseif ($type == "trusted") { + $config_data = array( + "key" => "country_trusted", + "value" => $val, + "autoload" => 1, + ); + } + switch ($action) { + case 'add': + $this->config_actions("add_config", $config_data); + break; + case 'delete': + $this->config_actions("delete_config", $config_data); + break; + case 'update': + $this->config_actions("update_country", $config_data); + break; + } + } elseif (in_array($type, $ip_check) && filter_var($val, FILTER_VALIDATE_IP) !== TRUE) { + if (ASTRA::$_db->edit_ip_exception($action, $type, $val)) { + $this->respond(1); + } else { + $this->respond('0', 'Unable to set custom IP rule'); + } + } elseif (in_array($type, $param_check) && $this->valid_param($val)) { + if (ASTRA::$_db->edit_param_exception($action, $type, $val)) { + $this->respond(1); + } else { + $this->respond(0, "Couldn't edit exception"); + } + } else { + $this->respond('0', 'Could not validate'); + } + } else { + $this->respond('0', 'Not Allowed'); + } + } + + protected function is_value_exist($_config_option, $config_data) + { + $blocked_countries = json_decode($_config_option->get_config(array("key" => "country_blocked"))); + $trusted_countries = json_decode($_config_option->get_config(array("key" => "country_trusted"))); + + if (!empty($trusted_countries) && !empty($blocked_countries)) { + if (is_array($blocked_countries)) { + return in_array($config_data['value'], $blocked_countries); + } else { + return ($config_data['value'] == $blocked_countries) ? true : false; + } + + if (is_array($trusted_countries)) { + return in_array($config_data['value'], $trusted_countries); + } else { + return ($config_data['value'] == $trusted_countries) ? true : false; + } + } else + return false; + } + + protected function config_actions($func_name, $data) + { + $config = new AstraConfig(); + $result = null; + switch ($func_name) { + case "get_config": + $result = $config->get_config($data); + break; + case "add_config": + $_is_exist = $this->is_value_exist($config, $data); + $result = (!$_is_exist) ? $config->add_config($data) : true; + break; + case "delete_config": + $result = $config->delete_config($data); + break; + case "update_config": + $result = $config->update_config($data); + break; + case "update_country": + $result = $config->update_country($data); + break; + } + if ($result) + $this->respond(1); + else + $this->respond(0, 'Unable to update configuration'); + } + + public function run() + { + + if (!$this->authenticate()) { + $this->respond(-1, "Invalid API Call"); + } + + echo_debug($this->receivedResponse); + + $api = $this->receivedResponse['api']; + + switch ($api) { + case "ping": + $this->respond(1); + break; + case "version": + $this->get_version(); + break; + case "update": + $this->astra_update(); + break; + case "update_bad_bots": + $this->bad_bots_update(); + break; + case "update_filters": + $this->filters_update(); + break; + case "custom_rule": + $this->custom_rule(); + break; + case "update_config": + $this->update_config(); + break; + default: + echo "ping"; + } + } + + } + +} + +if (class_exists('Api')) { + $astra_api = new Api(); +} \ No newline at end of file diff --git a/astra-inc.php b/astra-inc.php new file mode 100644 index 0000000..f8f2d10 --- /dev/null +++ b/astra-inc.php @@ -0,0 +1,16 @@ + \ No newline at end of file diff --git a/blackhole.php b/blackhole.php new file mode 100644 index 0000000..b0c6af7 --- /dev/null +++ b/blackhole.php @@ -0,0 +1,12 @@ +get_ip_address(); + +ASTRA::$_db->block_bot($ip_address); +ASTRA::show_block_page(); +die(); \ No newline at end of file diff --git a/block-page.php b/block-page.php new file mode 100644 index 0000000..5e91767 --- /dev/null +++ b/block-page.php @@ -0,0 +1,459 @@ +get_ip_address(); +$formCheck = false; +if($_POST){ + $formCheck = true; +} +?> + + + + + Attention! + + + + "+d+""'; + $script = "eval(\"" . str_replace(array("\\", '"'), array("\\\\", '\"'), $script) . "\")"; + $script = ''; + return '[javascript protected email address]' . $script; + } + + $support_email = hide_email('help@getastra.com'); + ?> + + + +
+ What ASTRA Means +
+

Sorry, this is not allowed.

+

Thank you for visiting our website, unfortunately our website protection system has detected an issue with your IP + address and wont let you proceed any further.

+

If you feel this is an error, please submit a support request. Thank you for your patience.

+

+ https://www.getastra.com/ +

+ +
+

Go to Homepage

+
+ + + + + + + \ No newline at end of file diff --git a/czar-89FC3CFA43E356C42382A941A99E4386.html b/czar-89FC3CFA43E356C42382A941A99E4386.html new file mode 100644 index 0000000..397e989 --- /dev/null +++ b/czar-89FC3CFA43E356C42382A941A99E4386.html @@ -0,0 +1 @@ +89FC3CFA43E356C42382A941A99E4386 \ No newline at end of file diff --git a/gk.php b/gk.php new file mode 100644 index 0000000..b471548 --- /dev/null +++ b/gk.php @@ -0,0 +1,13 @@ + + * @date 2019-04-07 + */ + +$path_to_ms = __DIR__ . "/libraries/plugins/astra-gk/index.php"; + +if(file_exists($path_to_ms)){ + include_once $path_to_ms; +} \ No newline at end of file diff --git a/install-astra.php b/install-astra.php new file mode 100644 index 0000000..10e9cfa --- /dev/null +++ b/install-astra.php @@ -0,0 +1,735 @@ +data_path = "astra-install.json"; + + $this->response = array( + 'success' => false, + 'msg' => "", + ); + + $this->log = ""; + + $this->run(); + } + + function __destruct() + { + //$this->print_log(); + } + + protected function log($msg) + { + + $this->log .= "

" . $msg . "

\r\n"; + $this->log_count++; + } + + public function getLogs() + { + return $this->log; + } + + public function getInstalled(){ + return file_exists('astra/astra-inc.php') || $this->installed; + } + + protected function print_log() + { + echo $this->log; + } + + protected function respond($success, $msg = '') + { + $this->response['success'] = $success; + if (!empty($msg)) { + $this->response['msg'] = $msg; + } + + header('Content-Type: application/json'); + echo json_encode($this->response, JSON_PRETTY_PRINT); + exit; + } + + protected function load_json() + { + if (file_exists($this->data_path)) { + $string = file_get_contents($this->data_path); + $json_data = json_decode($string, true); + } + + if (!empty($json_data) && is_array($json_data)) { + return $json_data; + } + + return array(); + } + + protected function save_json() + { + return true; + $saved = file_put_contents($this->data_path, json_encode($this->websites)); + return is_int($saved); + } + + public function is_astra_installed($path) + { + return file_exists($path . 'astra'); + } + + protected function clean_install($path) + { + $zip_path = $this->get_astra_zip_path($path); + unlink($zip_path); + + $this->log('Deleting the ZIP file.'); + + return !file_exists($zip_path); + } + + protected function do_install($path = '') + { + + $key = 0; + $this->websites[$key]['installed_astra'] = FALSE; + + if ($this->is_astra_installed($path)) { + $this->log("Astra already installed. Nothing to do! :)"); + return $this->websites[$key]; + } + + + $this->log("-----------"); + $this->log("Installing for " . $_SERVER['HTTP_HOST']); + + + $function_name = "install_default"; + if (method_exists($this, $function_name)) { + $installed = $this->$function_name($path); + if ($installed == true) { + $this->websites[$key]['installed_astra'] = TRUE; + + $this->log("Installed for $path"); + + //$this->respond(true, 'Installed for ' . $website['user']); + } else { + $this->websites[$key]['installed_astra'] = FALSE; + $this->websites[$key]['reason_for_failure'] = $installed; + $this->log("Unable to install. Please email help@getastra.com if you need help"); + //$this->respond(false, 'Unable to install for ' . $website['user']); + } + + + } + + return $this->websites[$key]; + } + + + protected function meets_requirements() { + if (!defined('PDO::ATTR_DRIVER_NAME')) { + $this->log('PDO Driver Missing. Please install or enable in cPanel.'); + return FALSE; + } + + if(!class_exists('ZipArchive')){ + $this->log('ZipArchive Default Class is missing. Please install or enable in cPanel.'); + return FALSE; + } + + if (!extension_loaded('sqlite3')) { + $this->log('sqlite3 extension not loaded. Please install or enable in cPanel. Find installation guides here.'); + return FALSE; + } + + $pdo_drivers = PDO::getAvailableDrivers(); + + if(!is_array($pdo_drivers) || !in_array('sqlite', $pdo_drivers)){ + $this->log('pdo_sqlite extension not loaded. Please install or enable in cPanel. Find installation guides here.'); + } + + return TRUE; + } + + protected function is_astra_included_in_user_ini($file_path) + { + if (!file_exists($file_path)) { + return false; + } + + $contents = file_get_contents($file_path); + + if (strpos($contents, 'astra-inc') !== false) { + return true; + } + + return false; + } + + protected function update_user_ini($path, $astra_inc_path) + { + $path_user_ini = $path . '.user.ini'; + + if ($this->is_astra_included_in_user_ini($path_user_ini)) { + return true; + } + + $file_content = "auto_prepend_file=$astra_inc_path\n\r"; + + $write = false; + + + if (!file_exists($path_user_ini)) { + $write = file_put_contents($path_user_ini, $file_content); + } else { + $old_contents = file_get_contents($path_user_ini); + $file_content .= "\r\n" . $old_contents; + $write = file_put_contents($path_user_ini, $file_content); + $this->log("Updated existing .user.ini"); + } + + return $write; + } + + protected function install_default($path, $plugin_folder_path = '') + { + if (empty($plugin_folder_path)) { + $plugin_folder_path = $path; + } + + $plugin_zip_path = $this->get_astra_zip_path($path); + $username = ""; + + if (file_exists($plugin_zip_path . 'astra')) { + $this->log("Astra is already installed"); + return false; + } + + if (file_exists($plugin_folder_path) && is_writable($plugin_folder_path)) { + + if (!empty($plugin_zip_path) && file_exists($plugin_zip_path)) { + if ($this->is_valid_zip($plugin_zip_path)) { + $extracted = $this->extract_zip($plugin_zip_path, $plugin_folder_path); + + if ($extracted) { + if ($this->update_user_ini($path, $plugin_folder_path . 'astra/astra-inc.php')) { + return true; + } else { + $this->log("Unable to update the .user.ini file for $path"); + return false; + } + } else { + $this->log( "Unable to extract the ZIP."); + return false; + } + } else { + $this->log($this->response['msg']); + return false; + } + } else { + $this->log("Astra ZIP does (secure-*.zip) not exist.
Can you please check?"); + return false; + } + } else { + $this->log( "Folder does not exist or isn't writable ($plugin_folder_path)"); + return false; + } + } + + protected function get_astra_zip_path($path) + { + $matches = glob($path . 'secure-*.zip'); + + $file_name = ""; + if (!empty($matches[0])) { + $file_name = str_replace("./", "/", $matches[0]); + } + + //$this->log("ZIP file path: " . $file_name); + + return $file_name; + } + + protected function extract_zip($zip_path, $extract_to) + { + $zip = new ZipArchive; + if ($zip->open($zip_path) === TRUE) { + $extracted = $zip->extractTo($extract_to); + $zip->close(); + + return $extracted; + } + return FALSE; + } + + protected function is_valid_zip($filename) + { + + $zip = new ZipArchive; + + $res = $zip->open($filename, ZipArchive::CHECKCONS); + + if ($res !== TRUE) { + switch ($res) { + case ZipArchive::ER_NOZIP : + $ret = FALSE; + $this->response['msg'] = "Invalid ZIP - Not a zip archive"; + case ZipArchive::ER_INCONS : + $ret = FALSE; + $this->response['msg'] = "Invalid ZIP - Consistency check failed"; + case ZipArchive::ER_CRC : + $this->response['msg'] = "Invalid ZIP - Error with CRC"; + $ret = FALSE; + default : + $this->response['msg'] = "Invalid ZIP - Checksum failed"; + $ret = FALSE; + } + + if ($ret) { + $zip->close(); + } + return $ret; + } else { + return TRUE; + } + } + + function run() + { + $path = getcwd() . "/"; + $this->log("Path to be secured: " . $path); + + $should_install = isset($_GET['complete']); + + if ($should_install && $this->meets_requirements()) { + $website = $this->do_install($path); + + if ($website['installed_astra'] === true) { + $this->clean_install($path); + $this->log('Deleting Installer'); + $this->installed = true; + unlink(__FILE__); + } + } + + } +} + +$deploy = new Deploy(); +$installed = $deploy->getInstalled(); +$logs = $deploy->getLogs(); +?> + + + + + Astra Installer + + + + +
+
+
+ + +
+
+
+
+
+
+ +

>_

+
+ +

+ +
+ + " + class="btn btn-lg btn-submit btn-success"/> + PHP Version: +
+ +

Installation complete!

+ +
+
+
+ + \ No newline at end of file diff --git a/libraries/API_connect.php b/libraries/API_connect.php new file mode 100644 index 0000000..4e63924 --- /dev/null +++ b/libraries/API_connect.php @@ -0,0 +1,292 @@ +api_url = CZ_API_URL; + } else { + $this->api_url = $url; + } + } + + public function ping() + { + $dataArray = array(); + return $this->send_request("ping", $dataArray); + } + + public function report_update() + { + return true; + $ak = $this->get_end_point_url(FALSE); + + $ch = curl_init(); + curl_setopt($ch, CURLOPT_URL, $ak . 'ak.php'); + curl_setopt($ch, CURLOPT_POST, FALSE); + curl_setopt($ch, CURLOPT_HTTPHEADER, array('Cz-Setup: true')); + curl_setopt($ch, CURLOPT_RETURNTRANSFER, true); + + $output = curl_exec($ch); + echo_debug('cURL Executed'); + + echo_debug('cURL Error >> ' . curl_error($ch)); + echo_debug("
$output
"); + + curl_close($ch); + echo_debug('cURLd'); + + $resp = $output; + $resp = json_decode($resp); + + if (isset($resp->code) && $resp->code == 1) { + return TRUE; + } else { + return FALSE; + } + } + + protected function get_end_point_url($api = TRUE) + { + + $current_url = $this->getHttpsPrefix(); + + $current_url .= str_replace(realpath($_SERVER["DOCUMENT_ROOT"]), $_SERVER['HTTP_HOST'], realpath(dirname(dirname(__FILE__)))); + + if ($api) { + $current_url .= '/api.php'; + } else { + $current_url .= '/'; + } + + $current_url = rtrim($current_url, '/'); + + return $current_url; + + } + + public function setRootApiUri($rootApiUri) + { + if ($rootApiUri == false) { + return false; + } + + $subFolderIfAny = str_replace($_SERVER['DOCUMENT_ROOT'], '', $rootApiUri); + + + $current_url = $this->getHttpsPrefix(); + + $current_url .= rtrim($_SERVER['HTTP_HOST'], '/') . '/' . ltrim($subFolderIfAny, '/'); + $this->rootApiUri = $current_url; + + return; + + } + + protected function getHttpsPrefix(){ + if (@$_SERVER['HTTPS'] == 'on' || @$_SERVER['SERVER_PORT'] == '443' || (isset($_SERVER['HTTP_X_FORWARDED_PROTO']) && $_SERVER['HTTP_X_FORWARDED_PROTO'] == 'https')) { + return "https://"; + } else { + return "http://"; + } + } + + protected function is_request_from_astra() + { + $user_agent = isset($_SERVER['HTTP_USER_AGENT']) ? strtolower($_SERVER['HTTP_USER_AGENT']) : "empty"; + + if (strpos($user_agent, "astra") !== false) { + return true; + } + + return false; + } + + public function setup() + { + + $res = explode(".", CZ_ASTRA_CLIENT_VERSION); + + $version['major'] = $res[0]; + $version['minor'] = $res[1]; + $version['patch'] = $res[2]; + + $client_api_url = !empty($this->rootApiUri) ? $this->rootApiUri : $this->get_end_point_url(); + + $dataArray = array( + "version" => $version, + "client_api_url" => $client_api_url, + "platform" => CZ_PLATFORM, + ); + + /* print_r($dataArray); */ + echo_debug('SETUP API Send Request'); + echo_debug(serialize($dataArray)); + + return $this->send_request("setup", $dataArray); + } + + public function custom_rule($action, $type, $ip_address = "") + { + $dataArray['rule_action'] = $action; + $dataArray['rule_type'] = $type; + $dataArray['ip_address'] = $ip_address; + return $this->send_request("custom_rule", $dataArray); + } + + /* + public function custom_rule($action, $type, $ip_address = "") { + + } + * + */ + + public function hook_has_loggedin($dataArray = array()) + { + + if ($dataArray[0]['success'] === 1) { + return false; + } + + require_once(__DIR__ . '/../Astra.php'); + $astra = new Astra(); + ASTRA::$_db->log_hit(ASTRA::$_ip); + + $dataArray[0]['blocking'] = (ASTRA::$_db->is_blocked_or_trusted(ASTRA::$_ip, false, ASTRA::$_config) == "blocked") ? 1 : 0; + + return true; + } + + public function send_request($api = "", $dataArray = array(), $platform = "php") + { + + if ($this->is_request_from_astra()) { + return false; + } + + $callback = array($this, 'hook_' . $api); + + if (is_callable($callback)) { + $hookResponse = call_user_func($callback, array($dataArray)); + if (is_array($hookResponse)) { + $dataArray = $hookResponse; + } + } + + + $dataArray['client_key'] = CZ_CLIENT_KEY; + $dataArray['api'] = $api; + + //$dataArray['site'] = $_SERVER['SERVER_NAME']; + $dataArray['site'] = $_SERVER['SERVER_NAME']; + if (!isset($dataArray['version'])) { + $dataArray['version'] = CZ_ASTRA_CLIENT_VERSION; + } + + $browser = new Browser_Astra(); + $browser_info['useragent'] = $browser->getUserAgent(); + $browser_info['browser_name'] = $browser->getBrowser(); + $browser_info['version'] = $browser->getVersion(); + $browser_info['platform'] = $browser->getPlatform(); + $browser_info['isMobile'] = $browser->isMobile(); + $browser_info['isTablet'] = $browser->isTablet(); + + $dataArray['ip'] = ASTRA::$_ip; + + if ($dataArray['ip'] == "") { + $dataArray['ip'] = "::1"; + return false; + } + + $dataArray['browser'] = $browser_info; + $dataArray['attack_url'] = htmlspecialchars($_SERVER['REQUEST_URI'], ENT_QUOTES, 'UTF-8'); + + echo_debug($this->api_url); + echo_debug($dataArray); + + $str = serialize($dataArray); + + $crypto = new Astra_crypto(); + $encrypted_data = $crypto->encrypt($str, CZ_SECRET_KEY); + + if ($platform == "wordpress") { + $post_param = array( + "encRequest" => $encrypted_data, + "access_code" => CZ_ACCESS_KEY, + ); + $response = wp_remote_post($this->api_url, array( + 'method' => 'POST', + 'timeout' => 5, + 'redirection' => 5, + 'httpversion' => '1.0', + 'blocking' => true, + 'headers' => array(), + 'body' => $post_param, + 'cookies' => array() + ) + ); + + if (is_wp_error($response) || (isset($response['body']) && is_wp_error($response['body']))) { + return true; + } + + $resp = $response['body']; + } else { + echo_debug('cURLing'); + $ch = curl_init(); + curl_setopt($ch, CURLOPT_URL, $this->api_url); + curl_setopt($ch, CURLOPT_POST, true); + curl_setopt($ch, CURLOPT_POSTFIELDS, "encRequest=" . $encrypted_data . "&access_code=" . CZ_ACCESS_KEY); + curl_setopt($ch, CURLOPT_RETURNTRANSFER, true); + curl_setopt($ch, CURLOPT_CONNECTTIMEOUT, 5); + curl_setopt($ch, CURLOPT_TIMEOUT, 5); //timeout in seconds + curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, false); + curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false); + + $output = curl_exec($ch); + echo_debug('cURL Executed'); + + echo_debug('cURL Error >> ' . curl_error($ch)); + echo_debug("
$output
"); + + if (curl_error($ch)) { + $error_msg = curl_error($ch); + } + + curl_close($ch); + echo_debug('cURLd'); + $resp = $output; + + } + + + $resp = json_decode($resp); + + if (isset($error_msg)) { + //echo $error_msg; + } + + //var_dump($output); + + + if (isset($resp->code) && $resp->code == 1) { + return TRUE; + } else { + return FALSE; + } + } + +} + +/* End of file api_connect.php */ +?> \ No newline at end of file diff --git a/libraries/Astra_country.php b/libraries/Astra_country.php new file mode 100644 index 0000000..b678e2d --- /dev/null +++ b/libraries/Astra_country.php @@ -0,0 +1,45 @@ +get_country_cf($ip_address); + + if($country_cf !== false){ + return $country_cf; + } + + + $ignore_ips = array("0.0.0.0", "0.255.255.255"); + if(!in_array($ip_address, $ignore_ips) ){ + require_once(ASTRAPATH . 'libraries/plugins/MaxMind-DB-Reader/autoload.php'); + $reader = new Reader(ASTRAPATH . 'libraries/plugins/MaxMind-DB-Reader/GeoLite2-Country.mmdb'); + + if(isset($reader->get($ip_address)['country']['iso_code'])){ + return strtoupper($reader->get($ip_address)['country']['iso_code']); + } + } + return 'US'; + } + + + protected function get_country_cf($ip_address){ + if(isset($_SERVER["HTTP_CF_IPCOUNTRY"]) && strlen($_SERVER["HTTP_CF_IPCOUNTRY"]) == 2 && is_string($_SERVER["HTTP_CF_IPCOUNTRY"])){ + return strtoupper($_SERVER["HTTP_CF_IPCOUNTRY"]); + } + + return false; + } + + } +} \ No newline at end of file diff --git a/libraries/Astra_ip.php b/libraries/Astra_ip.php new file mode 100644 index 0000000..f047424 --- /dev/null +++ b/libraries/Astra_ip.php @@ -0,0 +1,61 @@ +validate_ip($ip) || $this->validate_ipv6($ip)) && $ip !== $serverIp) { + return $ip; + } + } + } + } + return isset($_SERVER['REMOTE_ADDR']) ? $_SERVER['REMOTE_ADDR'] : false; + } + + /** + * Ensures an ip address is both a valid IP and does not fall within + * a private network range. + */ + + function validate_ipv6($ip) + { + if (filter_var($ip, FILTER_VALIDATE_IP, FILTER_FLAG_IPV6)) { + return true; + } + + return false; + } + + function validate_ip($ip) + { + if (filter_var($ip, FILTER_VALIDATE_IP, FILTER_FLAG_IPV4 | FILTER_FLAG_NO_PRIV_RANGE | FILTER_FLAG_NO_RES_RANGE) === false) { + return false; + } + return true; + } + + + } +} \ No newline at end of file diff --git a/libraries/Astra_setup.php b/libraries/Astra_setup.php new file mode 100644 index 0000000..c3c125c --- /dev/null +++ b/libraries/Astra_setup.php @@ -0,0 +1,150 @@ + + * @date 2019-04-15 + */ + +class Astra_setup +{ + + private $basePath; + private $filesCreated = false; + + public function getFilesCreated() + { + return $this->filesCreated; + } + + public function createAstraFiles() + { + $folderPath = $this->getBasePath(); + + if ($folderPath == false || !file_exists($folderPath)) { + return false; + } + + $astraPath = rtrim($folderPath, DIRECTORY_SEPARATOR) . DIRECTORY_SEPARATOR . 'astra' . DIRECTORY_SEPARATOR; + + if (!file_exists($astraPath) && !is_dir($astraPath) && is_writable($folderPath)) { + mkdir($astraPath, 0755); + } + + if (file_exists($astraPath)) { + $this->createFiles($folderPath, $astraPath); + } + + + } + + public function getRootApiFilePath() + { + $folderPath = $this->getBasePath(); + + if ($folderPath == false || !file_exists($folderPath)) { + return false; + } + + $astraPath = rtrim($folderPath, DIRECTORY_SEPARATOR) . DIRECTORY_SEPARATOR . 'astra' . DIRECTORY_SEPARATOR; + return $astraPath . 'api.php'; + } + + public function getRootApiFileUri() + { + $folderPath = $this->getBasePath(); + + if ($folderPath == false || !file_exists($folderPath)) { + return false; + } + + $astraPath = rtrim($folderPath, DIRECTORY_SEPARATOR) . DIRECTORY_SEPARATOR . 'astra' . DIRECTORY_SEPARATOR; + $astraPath = str_replace('\\', '/', $astraPath); + + return $astraPath . 'api.php'; + } + + public function getRealApiFileUri(){ + + } + + public function createFiles($folderPath, $astraPath) + { + + $dir = $this->processPath(dirname(__DIR__)); + + $files = array('api.php', 'ak.php', 'gk.php'); + $relPath = $this->getRelativePluginFolderPath(); + + foreach ($files as $file) { + $content = ""; + $content = <<filesCreated = true; + } + + } + } + + public function getRelativePluginFolderPath() + { + $base = $this->getBasePath(); + $dir = $this->processPath(__DIR__); + $rel = dirname(str_replace($base, "", $dir)); + + return $rel; + } + + protected function processPath($path) + { + $isBitnami = strpos($path, "bitnami") !== false; + $isOpt = strpos($path, "/opt/") !== false; + + if ($isBitnami && !$isOpt) { + return DIRECTORY_SEPARATOR . 'opt' . DIRECTORY_SEPARATOR . ltrim($path, DIRECTORY_SEPARATOR); + } + + return $path; + } + + public function getBasePath() + { + + if (!empty($basePath)) { + return $basePath; + } + + $path = $this->processPath(__FILE__); + + $basePath = ""; + $possibleBreakWords = array('/wp-content/', '/catalog/controller/extension/', '/sites/all/modules/', '/modules/', '/app/code/', '/astra/'); + + foreach ($possibleBreakWords as $word) { + if (strpos($path, $word) !== false) { + $basePath = strstr($path, $word, true) . DIRECTORY_SEPARATOR; + break; + } + } + + if (empty($basePath)) { + $basePath = false; + } + + $this->basePath = $basePath; + + return $basePath; + } + +} \ No newline at end of file diff --git a/libraries/Bad_bots.php b/libraries/Bad_bots.php new file mode 100644 index 0000000..333513f --- /dev/null +++ b/libraries/Bad_bots.php @@ -0,0 +1,108 @@ +user_agent = $ua; + $this->ip_address = $ip; + $this->search_engine = array( + 'google' => false, + 'bing' => false, + ); + } + + public function is_search_engine(){ + + return $this->is_google_bot() || $this->is_bing_bot(); + } + + public function is_bing_bot(){ + if(!strstr(strtolower($this->user_agent), "bingbot")){ + return FALSE; + } + + if(filter_var($this->ip_address, FILTER_VALIDATE_IP) === false){ + return FALSE; + } + + + $host = gethostbyaddr($this->ip_address); + + $allowed_domains = array("msn.com"); + $domain = $this->get_host($host); + + if(!in_array($domain, $allowed_domains)){ + $this->is_fake_bot = TRUE; + return FALSE; + } + + $forward_ip = gethostbyname($host); + + if($forward_ip === $this->ip_address){ + return TRUE; + } + + return FALSE; + + } + + public function is_google_bot(){ + //Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html) + if(!strstr(strtolower($this->user_agent), "googlebot")){ + return FALSE; + } + + return $this->verify_google_bot(); + } + + public function is_fake_bot(){ + return $this->is_fake_bot; + } + + protected function verify_google_bot(){ + + if(filter_var($this->ip_address, FILTER_VALIDATE_IP) === false){ + return FALSE; + } + + $host = gethostbyaddr($this->ip_address); + + $allowed_domains = array("google.com", "googlebot.com", "googleusercontent.com"); + $domain = $this->get_host($host); + + if(!in_array($domain, $allowed_domains)){ + //ip-returns-other-domain + $this->is_fake_bot = TRUE; + return FALSE; + } + + $forward_ip = gethostbyname($host); + + if($forward_ip === $this->ip_address){ + return TRUE; + } + + return FALSE; + } + + protected function get_host($host_with_subdomain) { + $array = explode(".", $host_with_subdomain); + return (array_key_exists(count($array) - 2, $array) ? $array[count($array) - 2] : "").".".$array[count($array) - 1]; + } + + public function run() { + + } + } +} +?> \ No newline at end of file diff --git a/libraries/Config_file.php b/libraries/Config_file.php new file mode 100644 index 0000000..d9c7755 --- /dev/null +++ b/libraries/Config_file.php @@ -0,0 +1,18 @@ +_autoload_config(); + } + + protected function _autoload_config() + { + $rows = ASTRA::$_db->get_config_autoload(); + foreach($rows as $row){ + $this->_config[$row['config_key']] = $row['config_value']; + } + } + + function get_config($data) + { + if(isset($this->_config[$data['key']])){ + return $this->_config[$data['key']]; + } + + $key_value = ASTRA::$_db->get_config($data['key']); + + $this->_config[$data['key']] = $key_value; + return $key_value; + } + + function add_config($data) + { + $key_value = ASTRA::$_db->add_config($data['key'],$data['value'],$data['autoload']); + + return $key_value; + } + + function add_config_value($data) + { + $key_value = ASTRA::$_db->add_config_value($data['key'],$data['value']); + + return $key_value; + } + + function delete_config($data) + { + + $key_value = ASTRA::$_db->delete_config($data['key'],$data['value']); + + return $key_value; + } + + function delete_config_value($data) + { + + $key_value = ASTRA::$_db->delete_config_value($data['key'],$data['value']); + + return $key_value; + } + + function update_config($data) + { + $key_value = ASTRA::$_db->update_config($data['key'],$data['value'],$data['autoload']); + + return $key_value; + } + + function update_country($data) + { + $key_value = ASTRA::$_db->update_country($data['key'],$data['value']); + + return $key_value; + } + } +} \ No newline at end of file diff --git a/libraries/Crypto.php b/libraries/Crypto.php new file mode 100644 index 0000000..c56e1a5 --- /dev/null +++ b/libraries/Crypto.php @@ -0,0 +1,71 @@ +pkcs5_pad($plainText, $ivsize); + $secretKey = $this->hextobin(md5($key)); + $initVector = pack("C*", 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f); + + $ciphertext = openssl_encrypt( + $plainPad, + 'AES-128-CBC', + $secretKey, + OPENSSL_RAW_DATA | OPENSSL_ZERO_PADDING, + $initVector + ); + + return bin2hex($ciphertext); + + } + + function decrypt($encryptedText, $key) + { + $secretKey = $this->hextobin(md5($key)); + $initVector = pack("C*", 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f); + $encryptedText = $this->hextobin($encryptedText); + + $decryptedText = openssl_decrypt( + $encryptedText, + 'AES-128-CBC', + $secretKey, + OPENSSL_RAW_DATA | OPENSSL_ZERO_PADDING, + $initVector + ); + + + $decryptedText = rtrim($decryptedText, "\0"); + return $decryptedText; + } + + //*********** Padding Function ********************* + + protected function pkcs5_pad($plainText, $blockSize) + { + $pad = $blockSize - (strlen($plainText) % $blockSize); + return $plainText . str_repeat(chr($pad), $pad); + } + +//********** Hexadecimal to Binary function for php 4.0 version ******** + + protected function hextobin($hexString) + { + $length = strlen($hexString); + $binString = ""; + $count = 0; + while ($count < $length) { + $subString = substr($hexString, $count, 2); + $packedString = pack("H*", $subString); + if ($count == 0) { + $binString = $packedString; + } else { + $binString .= $packedString; + } + + $count += 2; + } + return $binString; + } +} \ No newline at end of file diff --git a/libraries/PHPIDS.php b/libraries/PHPIDS.php new file mode 100644 index 0000000..a7f05fd --- /dev/null +++ b/libraries/PHPIDS.php @@ -0,0 +1,276 @@ +run(); + } + + + protected function encode_items(&$item, $key) + { + $orig = $item; + + //$item = iconv("UTF-8", "ASCII//IGNORE", $item); + $item = iconv("UTF-8", "ISO-8859-1//IGNORE", $item); + + + if ($orig !== $item) { + $item = preg_replace('/[^a-zA-Z0-9]/', '', $item); + $item = str_replace("--", "", $item); + } + } + + protected function get_scan_array() + { + $keys_to_scan = defined('CZ_SCAN_ARRAYS') ? explode(',', CZ_SCAN_ARRAYS) : array('GET', 'POST'); + + $request = array(); + + if (in_array('GET', $keys_to_scan)) { + $request['GET'] = $_GET; + } + + if (in_array('POST', $keys_to_scan)) { + $request['POST'] = $_POST; + } + + if (in_array('REQUEST', $keys_to_scan)) { + $request['REQUEST'] = $_REQUEST; + } + + if (in_array('COOKIE', $keys_to_scan)) { + $request['COOKIE'] = $_COOKIE; + } + + return $request; + } + + protected function is_monitoring_mode($keys_to_scan, $param) + { + $which_key = strtok($param, '.'); + return !in_array($which_key, $keys_to_scan); + } + + public function run() + { + if (file_exists(dirname(__FILE__) . '/plugins/IDS/Init.php')) { + require_once(dirname(__FILE__) . '/plugins/IDS/Init.php'); + require_once(dirname(__FILE__) . '/plugins/IDS/Monitor.php'); + } else { + return FALSE; + } + + try { + + $request = $this->get_scan_array(); + +// $request = array( +// 'GET' => $_GET, +// 'POST' => $_POST, +// ); + + if (defined('CZ_ALLOW_FOREIGN_CHARS') && CZ_ALLOW_FOREIGN_CHARS == TRUE) { + array_walk_recursive($request, array($this, 'encode_items')); + } + + $tmpFolderPath = ASTRAPATH . 'libraries/plugins/IDS/Config/Config.ini.php'; + + if (!is_writable($tmpFolderPath)) { + //chmod($tmpFolderPath, 0775); + } + + $init = IDS_Init::init(ASTRAPATH . 'libraries/plugins/IDS/Config/Config.ini.php'); + $init->config['General']['base_path'] = ASTRAPATH . 'libraries/plugins/IDS/'; + $init->config['General']['use_base_path'] = true; + $init->config['Caching']['caching'] = 'none'; + + $exceptions = $this->get_exceptions($request); + + $ids = new IDS_Monitor($request, $init); + $ids->setExceptions($exceptions['exceptions']); + $ids->setHtml($exceptions['html']); + $ids->setJson($exceptions['json']); + echo_debug('IDS Initialized'); + $result = $ids->run(); + echo_debug('IDS has run'); + + if (!$result->isEmpty()) { + + if ($result->getImpact() < 10) { + return true; + } + + echo_debug('IDS found issues. Will do +1 now.'); + //Increment Hack Attempt Count + + $str_tags = ""; + $dataArray = array(); + + foreach ($result->getTags() as $tag) + $str_tags .= '|' . $tag; + + $iterator = $result->getIterator(); + + $param = ""; + $attack_param = null; + + $is_monitoring = true; + +// $keys_to_scan = defined('CZ_SCAN_ARRAYS') ? explode(',', CZ_SCAN_ARRAYS) : array('GET', 'POST'); + + foreach ($iterator as $threat) { + + $param = urlencode($threat->getName()); + + /*if (!$this->is_monitoring_mode($keys_to_scan, $param)) { + $is_monitoring = false; + }*/ + + if (CZ_ASTRA_MODE == 'monitor') { + $is_monitoring = TRUE; + } else { + $is_monitoring = FALSE; + } + + $attack_param[] = urlencode($threat->getName()); + $param .= "p=" . urlencode($threat->getName()) . "|v=" . urlencode($threat->getValue()); + $param .= "|id="; + + foreach ($threat->getFilters() as $filter) { + $param .= $filter->getId() . ","; + } + $param = rtrim($param, ',') . "#"; + } + + if ($is_monitoring) { + $dataArray['blocking'] = 3; + } else { + ASTRA::$_db->log_hit(ASTRA::$_ip); + $dataArray['blocking'] = (ASTRA::$_db->is_blocked_or_trusted(ASTRA::$_ip, false, ASTRA::$_config) == "blocked") ? 2 : 1; + } + + $param = rtrim($param, '#'); + $dataArray['i'] = $result->getImpact(); + $dataArray["tags"] = $str_tags; + $dataArray['param'] = $param; + + require_once(ASTRAPATH . 'libraries/API_connect.php'); + $connect = new API_connect(); + $connect->send_request("ids", $dataArray); + + if (!$is_monitoring) { + ASTRA::show_block_page($attack_param); + } + + } else { + echo_debug('IDS says all is okay'); + } + } catch (Exception $e) { + printf('An error occured: %s', $e->getMessage()); + } + } + + protected function get_exceptions($request = array()) + { + + $data = array('exceptions' => array(), 'json' => array(), 'html' => array()); + $db_params = ASTRA::$_db->get_custom_params(); + + $default_exceptions = array( + 'REQUEST._pk_ref_3_913b', + 'COOKIE._pk_ref_3_913b', + 'REQUEST._lf', + 'REQUEST.comment', + 'POST.comment', + 'REQUEST.permalink_structure', + 'POST.permalink_structure', + 'REQUEST.selection', + 'POST.selection', + 'REQUEST.content', + 'POST.content', + 'REQUEST.__utmz', + 'COOKIE.__utmz', + 'REQUEST.s_pers', + 'COOKIE.s_pers', + 'REQUEST.user_pass', + 'POST.user_pass', + 'REQUEST.pass1', + 'POST.pass1', + 'REQUEST.pass2', + 'POST.pass2', + 'REQUEST.password', + 'POST.password', + 'GET.gclid', + 'GET.access_token', + 'POST.customize', + 'POST.post_data', + 'POST.mail.body', + 'POST.mail.subject', + 'POST.mail.sender', + 'POST.form', + 'POST.customized', + 'POST.partials', + 'GET.mc_id', + 'POST.shortcode', + 'POST.mail_2.body', + 'POST.mail_2.subject', + 'POST.enquiry', + 'POST.pwd', + 'POST.g-recaptcha-response', + 'POST.g-recaptcha-res', + '/POST.state_([0-999]*)$/', + '/POST.input_([0-999]*)$/', + 'POST.form_token', + 'GET.fbclid', + 'POST.itsec_two_factor_on_board_data', + 'GET.mainwpsignature', + 'POST.wp_statistics_hit', + 'POST.customize_messenger_channel', + 'POST.product.media_gallery.values', + 'GET.utm_source', + 'GET.utm_medium', + 'GET.utm_campaign', + 'POST.fl_builder_data.data.settings.content', + '/POST.fl_builder_data.node_preview.items.([0-999]*)$/', + 'POST.fl_builder_data.settings.text', + '/POST.fl_builder_data.*/', + + ); + + + $data['exceptions'] = array_merge($default_exceptions, $db_params['exception']); + $data['html'] = $db_params['html']; + + //if (!defined('CZ_JSON_EXCLUDE_ALL') || CZ_JSON_EXCLUDE_ALL === FALSE) { + // $data['json'] = $db_params['json']; + //} else { + $data['json'] = array(); + + foreach ($request as $array => $keys) { + foreach ($keys as $k => $par) { + $data['json'][] = "$array.$k"; + } + } + + //} + + return $data; + } + +} diff --git a/libraries/SQLite_db.php b/libraries/SQLite_db.php new file mode 100644 index 0000000..eba806a --- /dev/null +++ b/libraries/SQLite_db.php @@ -0,0 +1,1289 @@ +_blocking_threshold = $cz_lvl[CZ_CONFIG_LVL]['ip_blocking']['count']; + $this->_blocking_duration = $cz_lvl[CZ_CONFIG_LVL]['ip_blocking']['duration']; + }else{ + $this->_blocking_threshold = 5; + $this->_blocking_duration = 200; + } + + $this->error_logging = CZ_DB_PATH . 'db/logging.err'; + $this->_open_connection(); + } + + private function _open_connection() + { + if ($this->_is_open) { + return; + } + + $this->_db_name = CZ_DB_PATH . 'db/' . CZ_DATABASE_NAME . '.db'; + + echo_debug($this->_db_name); + if (!file_exists($this->_db_name)) { + $create_tables = TRUE; + echo_debug('Creating SQL Tables'); + } else { + $create_tables = FALSE; + echo_debug('Tables have to be created'); + } + + try { + $this->_db = new PDO('sqlite:' . $this->_db_name); + echo_debug('PDO Init'); + if ($create_tables) { + $this->_create_tables(); + } + $this->_is_open = true; + return; + } catch (PDOException $e) { + echo_debug('Unable to init DB'); + file_put_contents($this->error_logging, "cannot initialize database\n", LOCK_EX | FILE_APPEND); + $this->_is_open = false; + $this->_db = null; + return; + } + } + + /** + * + * @return bool + */ + private function _create_tables() + { + try { + $query = array(); + + $query[] = "CREATE TABLE IF NOT EXISTS ip_logs ( + id INTEGER PRIMARY KEY, + ip_address TEXT UNIQUE, + request_count INTEGER DEFAULT 0, + request_count_since_blocking INTEGER DEFAULT 0, + blocked_by_ids INTEGER DEFAULT 0, + blocked_by_user INTEGER DEFAULT 0, + trusted_by_user INTEGER DEFAULT 0, + is_range INTEGER DEFAULT 0, + timestamp INTEGER + );"; + + $query[] = "CREATE TABLE IF NOT EXISTS exception_params ( + id INTEGER PRIMARY KEY, + param TEXT UNIQUE, + type TEXT, + timestamp INTEGER + );"; + + $query[] = "CREATE TABLE IF NOT EXISTS exception_url ( + id INTEGER PRIMARY KEY, + url TEXT UNIQUE, + timestamp INTEGER + );"; + + $query[] = "CREATE TABLE IF NOT EXISTS exception_ip_ranges ( + id INTEGER PRIMARY KEY, + ip_range TEXT UNIQUE, + trusted_by_user INTEGER DEFAULT 0, + timestamp INTEGER + );"; + + $query[] = "CREATE TABLE IF NOT EXISTS bad_bots ( + id INTEGER PRIMARY KEY, + bot TEXT UNIQUE, + from_honeypot INTEGER DEFAULT 0, + timestamp INTEGER + );"; + + $query[] = "CREATE TABLE IF NOT EXISTS token_bucket ( + id INTEGER PRIMARY KEY, + ip_address TEXT UNIQUE, + last_api_request TEXT, + throttle_minute TEXT, + reported INTEGER DEFAULT 0 + );"; + + $query[] = "CREATE TABLE config_options ( + id INTEGER PRIMARY KEY, + config_key TEXT UNIQUE NOT NULL, + config_value TEXT NOT NULL, + autoload INTEGER DEFAULT 0 + );"; + + foreach ($query as $q) + $this->_db->exec($q); + + echo_debug('.htaccess file created'); + return true; + } catch (PDOException $e) { + file_put_contents($this->error_logging, "cannot create tables in db", LOCK_EX | FILE_APPEND); + return false; + } + } + + private function _close_connection() + { + $this->_db = null; + $this->_is_open = false; + echo_debug('Closing connection'); + } + + /** + * @return null + */ + function insert_into_ip_logs($data) + { + if (isset($data)) { + if (!$this->_is_open) { + $this->_open_connection(); + } + + if (isset($data['trusted_by_user'])) { + $query = "INSERT INTO ip_logs (ip_address, request_count, request_count_since_blocking, blocked_by_ids, + blocked_by_user, trusted_by_user, timestamp,is_range) VALUES (:ip_address, :request_count, :request_count_since_blocking, + :blocked_by_ids, :blocked_by_user, :trusted_by_user, strftime('%s', 'now'), :is_range);"; + } else { + $query = "INSERT INTO ip_logs (ip_address, request_count, request_count_since_blocking, blocked_by_ids, + blocked_by_user, timestamp,is_range) VALUES (:ip_address, :request_count, :request_count_since_blocking, + :blocked_by_ids, :blocked_by_user, strftime('%s', 'now'), :is_range);"; + } + //$this->_db->setAttribute( PDO::ATTR_ERRMODE, PDO::ERRMODE_WARNING ); + + $statement = $this->_db->prepare($query); + if (!$statement->execute($data)) { + //var_dump($this->_db->errorInfo()); + file_put_contents($this->error_logging, "\n\ncannot execute query: {$query} {$this->_db->errorInfo()}", LOCK_EX | FILE_APPEND); + return false; + } + + $this->_close_connection(); + return true; + } + } + + function get_ip_log($ip_address) + { + if (isset($ip_address)) { + if (!$this->_is_open) { + $this->_open_connection(); + } + $query = "SELECT * FROM ip_logs WHERE ip_address = :ip_address LIMIT 1;"; + $statement = $this->_db->prepare($query); + $statement->execute(array('ip_address' => $ip_address)); + $statement->setFetchMode(PDO::FETCH_ASSOC); + $result_row = $statement->fetch(); + return $result_row; + } + } + + function unblock_ip($ip_address, $by_user = false, $by_ids = false, $trusted = false) + { + if (isset($ip_address)) { + if (!$this->_is_open) { + $this->_open_connection(); + } + + if ($by_user) { + + if ($trusted) { + $update = ',trusted_by_user = 0'; + } else { + $update = ",blocked_by_user = 0"; + } + } + if ($by_ids) { + $update = ",blocked_by_ids = 0"; + } + + $query = "UPDATE ip_logs SET timestamp = 0 {$update}, request_count = 0 WHERE ip_address = '{$ip_address}';"; + + if (!$this->_db->exec($query)) { + $row = $this->get_ip_log($ip_address); + if (empty($row)) { + return true; + } + + file_put_contents($this->error_logging, "unblock_ip - cannot execute query: {$query}", LOCK_EX | FILE_APPEND); + return false; + } + + $this->_close_connection(); + return TRUE; + } + + return TRUE; + } + + + function is_blocked_or_trusted($ip_address, $is_bot = FALSE, $_config) + { + $this->_config = $_config; + + require_once(ASTRAPATH . 'libraries/plugins/ip_address/ip-lib.php'); + if (isset($ip_address)) { + if (!$this->_is_open) { + $this->_open_connection(); + } + + $query = "SELECT * FROM ip_logs WHERE ip_address = :ip_address;"; + $statement = $this->_db->prepare($query); + + if(!is_object($statement)){ + return ""; + } + + $statement->execute(array('ip_address' => $ip_address)); + $statement->setFetchMode(PDO::FETCH_ASSOC); + $result = $statement->fetch(); // this returns false in case of no rows matched. + + if(empty($result) || ($result['blocked_by_ids'] == '0' && $result['blocked_by_user'] == '0' && $result['trusted_by_user'] == '0')) + { + $rangeQuery = "select * from ip_logs where is_range = 1"; + $rangeStatement = $this->_db->prepare($rangeQuery); + $rangeStatement->execute(); + $rangeStatement->setFetchMode(PDO::FETCH_ASSOC); + $rangeResult = $rangeStatement->fetchAll(); + + if(!empty($rangeResult)) + { + return $this->range_blocking($ip_address, $is_bot,$rangeResult); + } + + return $this->country_blocking($ip_address); + } + else + { + return $this->ip_blocking($ip_address, $is_bot,$result); + } + } + } + + function ip_blocking($ip_address, $is_bot,$result) + { + if ($result['trusted_by_user'] == 1) + return "trusted"; + + if ($result['blocked_by_user'] == 1) { + return "blocked"; + } + + //$this->_blocking_duration = 0.1; + + if ($is_bot) { + $duration = 200; + } else { + $duration = $this->_blocking_duration; + } + + if ($result['blocked_by_ids'] == 1) { + if (time() - $result['timestamp'] >= $duration * 60) { + $this->unblock_ip($ip_address, false, true); + return "unblocked"; + } + return "blocked"; + } + + // Country blocking checks + $this->country_blocking($ip_address); + } + + protected function country_blocking($ip_address) + { + $blocked_countries = json_decode($this->_config->get_config(array('key' => 'country_blocked'))); + $trusted_countries = json_decode($this->_config->get_config(array('key' => 'country_trusted'))); + + if(!empty($blocked_countries) || !empty($trusted_countries)) + { + require_once(ASTRAPATH . 'libraries/Astra_country.php'); + $country_library = new Astra_country(); + + $visitor_country = $country_library->get_country($ip_address); + + if(is_array($blocked_countries)) + { + if(in_array($visitor_country,$blocked_countries)) + return "blocked"; + } + else + { + if($visitor_country == $blocked_countries) + return "blocked"; + } + + if(is_array($trusted_countries)) + { + if(in_array($visitor_country,$trusted_countries)) + return "trusted"; + } + else + { + if($visitor_country == $trusted_countries) + return "trusted"; + } + } + } + + function range_blocking($ip_address, $is_bot, $result) + { + $_ip = \IPLib\Factory::addressFromString($ip_address); + $contained = null; + foreach($result as $data) + { + $_range = \IPLib\Factory::rangeFromString($data['ip_address']); + $contained = $_ip->matches($_range); // returns false if the range is ipv6 and ip is of ipv4 and vice-versa + if($contained) + { + return $this->ip_blocking($ip_address, $is_bot,$data); + } + } + } + + function is_bad_bot($user_agent) + { + if (isset($user_agent)) { + if (!$this->_is_open) { + $this->_open_connection(); + } + + try { + $query = "SELECT * FROM bad_bots WHERE '{$user_agent}' LIKE '%' || bot || '%';"; + + $statement = $this->_db->prepare($query); + + if(!is_object($statement)){ + return false; + } + + if ($statement->execute()) { + $statement->setFetchMode(PDO::FETCH_ASSOC); + $result = $statement->fetch(); + //print_r($result); + + if (!empty($result)) { + return TRUE; + } + } + return FALSE; + } catch (PDOException $e) { + return FALSE; + } + } + } + + protected function truncate_table($table_name) + { + try { + + $this->_db->beginTransaction(); + + $query = array(); + $query[] = "DELETE from {$table_name};"; + $query[] = "VACUUM;"; + + foreach ($query as $q) { + $stmt = $this->_db->prepare($q); + $stmt->execute(); + } + + $this->_db->commit(); + + return TRUE; + } catch (PDOException $e) { + return FALSE; + } + } + + function update_bad_bots($bots) + { + if (isset($bots)) { + echo_debug('Bots are set'); + if (!$this->_is_open) { + $this->_open_connection(); + } + + try { + + if ($this->truncate_table('bad_bots')) { + + $this->_db->beginTransaction(); + $query = $this->_db->prepare("INSERT INTO bad_bots (bot, timestamp) VALUES (?, strftime('%s', 'now'))"); + foreach ($bots as $bot) { + $query->bindParam(1, $bot); + $query->execute(); + } + $this->_db->commit(); + echo_debug('BOTS Updated'); + return TRUE; + } else { + echo_debug('Unable to truncate BOTS Table'); + return FALSE; + } + } catch (PDOException $e) { + echo_debug('PDO Error while updating BOTS'); + return FALSE; + } + } else { + echo_debug('Bots not set'); + } + } + + function update_custom_params($params) + { + if (isset($params)) { + if (!$this->_is_open) { + $this->_open_connection(); + } + + if (empty($params)) { + return TRUE; + } + try { + + if ($this->truncate_table('exception_params')) { + + $this->_db->beginTransaction(); + $query = $this->_db->prepare("INSERT INTO exception_params (param, type, timestamp) VALUES (?, ?, strftime('%s', 'now'))"); + foreach ($params as $p) { + $query->bindParam(1, $p[1]); + $query->bindParam(2, $p[0]); + $query->execute(); + } + $this->_db->commit(); + + return TRUE; + } else { + return FALSE; + } + } catch (PDOException $e) { + return FALSE; + } + } else { + return FALSE; + } + } + + function update_custom_ip($ips) + { + if (isset($ips)) { + if (!$this->_is_open) { + $this->_open_connection(); + } + try { + + if (!empty($ips)) { + //$this->_db->beginTransaction(); + foreach ($ips as $ip) { + $type_bool = ($ip[0] == "trusted") ? TRUE : FALSE; + $this->update_ip_logs($ip[1], TRUE, $type_bool); + } + //$this->_db->commit(); + return TRUE; + } else { + return TRUE; + } + } catch (PDOException $e) { + return FALSE; + } + } + } + + function update_ip_logs($ip_address, $user = false, $trusted = FALSE, $is_bot = FALSE) + { + require_once(ASTRAPATH . 'libraries/plugins/ip_address/ip-lib.php'); + if (isset($ip_address)) { + if (!$this->_is_open) { + $this->_open_connection(); + } + + $data = array('ip_address' => $ip_address); + + if ($is_bot) { + $threshold = $cz_lvl[CZ_CONFIG_LVL]['bot_blocking']['count']; + } else { + $threshold = $this->_blocking_threshold; + } + + $field = "blocked_by_ids"; + $conditions = "AND request_count >={$threshold}"; + $_range = $this->is_valid_range($ip_address); + + if ($user) { + $row = $this->get_ip_log($ip_address); + if (empty($row)) { + $data = array( + 'ip_address' => $ip_address, + 'request_count' => 0, + 'request_count_since_blocking' => 0, + 'blocked_by_ids' => 0, + 'blocked_by_user' => ($trusted) ? 0 : 1, + 'trusted_by_user' => (int)$trusted, + 'is_range' => ($_range == false)? 0:1 + ); + return $this->insert_into_ip_logs($data); + } + + if (!$trusted) { + $field = "trusted_by_user=0, blocked_by_user"; + $conditions = ""; + } else { + $field = "blocked_by_user=0, trusted_by_user"; + $conditions = ""; + } + } + + $query = "UPDATE ip_logs SET {$field} = 1, timestamp = strftime('%s', 'now'), request_count_since_blocking=request_count_since_blocking+1 WHERE ip_address = :ip_address {$conditions};"; + + + $statement = $this->_db->prepare($query); + + if ($statement->execute($data)) { + $this->_close_connection(); + return TRUE; + } else { + file_put_contents($this->error_logging, "cannot execute query: {$query}", LOCK_EX | FILE_APPEND); + return FALSE; + } + } + } + + function is_valid_range($ip_address) + { + require_once(ASTRAPATH . 'libraries/plugins/ip_address/ip-lib.php'); + + $_range = \IPLib\Factory::rangeFromString($ip_address); + + if(!is_object($_range)){ + return false; + } + + if((string)$_range->getStartAddress() === (string)$_range->getEndAddress()) + $_range = false; + else + $_range = true; + + return $_range; + } + + function log_hit($ip_address, $blocked = false) + { + if (isset($ip_address)) { + $_range = $this->is_valid_range($ip_address); + $row = $this->get_ip_log($ip_address); + if (empty($row)) { + $data = array( + 'ip_address' => $ip_address, + 'request_count' => 0, + 'request_count_since_blocking' => 0, + 'blocked_by_ids' => 0, + 'blocked_by_user' => 0, + 'is_range' => ($_range == false)? 0:1 + ); + $this->insert_into_ip_logs($data); + } + + if (!$this->_is_open) { + $this->_open_connection(); + } + + if ($blocked) { + $field = "request_count_since_blocking"; + } else { + $field = "request_count"; + } + + $query = "UPDATE ip_logs SET {$field} = {$field} + 1 WHERE ip_address = '{$ip_address}'"; + $statement = $this->_db->prepare($query); + + if ($statement->execute()) { + $this->update_ip_logs($ip_address); + $this->_close_connection(); + return true; + } else { + file_put_contents($this->error_logging, "cannot execute update query: {$query}", LOCK_EX | FILE_APPEND); + return false; + } + } + } + + function insert_into_table($table_name, $data, $timestamp = TRUE) + { + if (isset($data)) { + if (!$this->_is_open) { + $this->_open_connection(); + } + + + try { + $columns = ""; + $values = ""; + foreach ($data as $key => $val) { + $columns .= $key . ', '; + $values .= ':' . $key . ', '; + } + + if ($timestamp) { + $query = "INSERT INTO {$table_name} ({$columns}timestamp) VALUES ({$values}strftime('%s', 'now'));"; + } else { + $columns = rtrim($columns, ', '); + $values = rtrim($values, ', '); + $query = "INSERT INTO {$table_name} ({$columns}) VALUES ({$values});"; + } + + echo_debug($query); + + //echo $query; + + $statement = $this->_db->prepare($query); + + $statement->execute($data); + } catch (PDOException $e) { + if ($e->errorInfo[1] == 1062) { + return TRUE; + } + + file_put_contents($this->error_logging, "cannot execute query: {$query}", LOCK_EX | FILE_APPEND); + return false; + } + $this->_close_connection(); + return true; + } + } + + function delete_from_table($table_name, $data) + { + if (!empty($data)) { + if (!$this->_is_open) { + $this->_open_connection(); + } + + + try { + $where = ""; + foreach ($data as $key => $val) { + $where .= "$key='$val' AND "; + } + + $where = rtrim($where, ' AND '); + echo_debug($where); + + $query = "DELETE FROM {$table_name} WHERE {$where};"; + + echo_debug($query); + + $statement = $this->_db->prepare($query); + $res = $statement->execute(array()); + echo_debug('RES=' . $res . ';'); + if ($res) { + return true; + } else { + return false; + } + } catch (PDOException $e) { + if ($e->errorInfo[1] == 1062) { + return TRUE; + } + + file_put_contents($this->error_logging, "cannot execute query: {$query}", LOCK_EX | FILE_APPEND); + return false; + } + $this->_close_connection(); + return true; + } + } + + function edit_ip_exception($action, $type, $ip) + { +//update_ip_logs($ip_address, $user = false, $trusted = FALSE) { + + $type_bool = ($type == "trusted") ? TRUE : FALSE; + + if ($action == "add") { + return $this->update_ip_logs($ip, TRUE, $type_bool); +//function update_ip_logs($ip_address, $user = false, $trusted = FALSE) { + } elseif ($action == "delete") { + return $this->unblock_ip($ip, TRUE, FALSE, $type_bool); + } else { + return FALSE; + } + } + + function edit_param_exception($action, $type, $val) + { + //$type_bool = ($type == "trusted") ? TRUE : FALSE; + + if ($action == "add") { + $data = array( + 'type' => $type, + 'param' => $val, + ); + + return $this->insert_into_table('exception_params', $data); + } elseif ($action == "delete") { + echo_debug(json_encode($this->get_custom_params())); + $data = array( + 'type' => $type, + 'param' => $val, + ); + return $this->delete_from_table('exception_params', $data); + } else { + return FALSE; + } + } + + function get_api_request($ip_address) + { + if (isset($ip_address)) { + if (!$this->_is_open) { + $this->_open_connection(); + } + + $query = "SELECT * FROM token_bucket WHERE ip_address = :ip_address LIMIT 1;"; + $statement = $this->_db->prepare($query); + $statement->execute(array('ip_address' => $ip_address)); + $statement->setFetchMode(PDO::FETCH_ASSOC); + $result_row = $statement->fetch(); + + if (empty($result_row)) { + $ret = array( + 'last_api_request' => time(), + 'throttle_minute' => 0, + 'ip_address' => $ip_address, + 'reported' => 0 + ); + + $this->insert_into_table('token_bucket', $ret, FALSE); + + return $ret; + } else { + return $result_row; + } + } + return FALSE; + } + + function save_api_request($ip_address, $last_api_request, $throttle_minute, $reported) + { + if (isset($ip_address) && isset($last_api_request) && isset($throttle_minute) && isset($reported)) { + if (!$this->_is_open) { + $this->_open_connection(); + } + + $query = "UPDATE token_bucket SET last_api_request = :last_api_request, throttle_minute=:throttle_minute, reported=:reported WHERE ip_address = :ip_address;"; + + $data = array( + 'ip_address' => $ip_address, + 'last_api_request' => $last_api_request, + 'throttle_minute' => $throttle_minute, + 'reported' => $reported, + ); + + $statement = $this->_db->prepare($query); + + if (!$statement->execute($data)) { + file_put_contents($this->error_logging, "Save_api_request - cannot execute query: {$query}", LOCK_EX | FILE_APPEND); + return false; + } + $this->_close_connection(); + return TRUE; + } + } + + function block_bot($ip_address) + { + if (isset($ip_address)) { + return $this->update_ip_logs($ip_address, FALSE, FALSE, TRUE); + } + return FALSE; + } + + function get_exception_urls() + { + if (!$this->_is_open) { + $this->_open_connection(); + } + + $query = "SELECT * FROM exception_url;"; + + $statement = $this->_db->prepare($query); + $statement->execute(); + $statement->setFetchMode(PDO::FETCH_ASSOC); + + $result_rows = $statement->fetchAll(); + + $ret = array(); + + foreach ($result_rows as $row) { + $ret[] = $row['url']; + } + + return $ret; + } + + function get_custom_params() + { + if (!$this->_is_open) { + $this->_open_connection(); + } + + $query = "SELECT type, param FROM exception_params;"; + + $statement = $this->_db->prepare($query); + $statement->execute(); + $statement->setFetchMode(PDO::FETCH_ASSOC); + + $result_rows = $statement->fetchAll(); + + $ret = array( + 'html' => array(), + 'json' => array(), + 'exception' => array(), + 'url' => array(), + ); + + foreach ($result_rows as $row) { + $ret[$row['type']][] = $row['param']; + } + + return $ret; + } + + function get_config($key = '') + { + if (!$this->_is_open) { + $this->_open_connection(); + } + + if(empty($key)) + { + $query = "SELECT * FROM config_options"; + } + else + { + $query = "SELECT config_value FROM config_options where config_key = :config_key"; + $data = array('config_key' => $key); + } + + $statement = $this->_db->prepare($query); + $statement->setFetchMode(PDO::FETCH_ASSOC); + + if(empty($key)) + { + $statement->execute(); + $result_rows = $statement->fetchAll(); + } + else + { + $statement->execute($data); + $result_rows = $statement->fetch(); + } + + if($result_rows == false) + return false; + + return $result_rows['config_value']; + } + + function get_config_autoload() + { + if (!$this->_is_open) { + $this->_open_connection(); + } + + $query = "SELECT * FROM config_options WHERE autoload = 1"; + + $statement = $this->_db->prepare($query); + + if(!is_object($statement)){ + return array(); + } + + $statement->setFetchMode(PDO::FETCH_ASSOC); + + $statement->execute(); + $result_rows = $statement->fetchAll(); + + if($result_rows == false) + return array(); + + return $result_rows; + } + + function add_config($key,$value,$autoload) + { + if (!$this->_is_open) { + $this->_open_connection(); + } + $key_data = null; + $temp_data = null; + + $_is_key_exist = $this->get_config($key); + + if($_is_key_exist !== false) + { + return $this->add_config_value($key,$value); + } + elseif($_is_key_exist == false) + { + $query = "INSERT INTO config_options (config_key, config_value, autoload) VALUES (:config_key, :config_value, :autoload);"; + $data = array( + "config_key" => $key, + "config_value" => json_encode($value), + "autoload" => $autoload + ); + $statement = $this->_db->prepare($query); + $exe_query = $statement->execute($data); + if (!$exe_query) { + file_put_contents($this->error_logging, "\n\ncannot execute query: {$query} {$this->_db->errorInfo()}", LOCK_EX | FILE_APPEND); + return false; + } + $this->_close_connection(); + return true; + } + } + + function is_value_exist($key,$value) + { + if (!$this->_is_open) { + $this->_open_connection(); + } + + $query = "SELECT config_value FROM config_options where config_key = :config_key"; + $data = array( + 'config_key' => $key + ); + $statement = $this->_db->prepare($query); + $statement->setFetchMode(PDO::FETCH_ASSOC); + $statement->execute($data); + $result_rows = $statement->fetch(); + + // $this->_db->setAttribute( PDO::ATTR_ERRMODE, PDO::ERRMODE_WARNING ); + // var_dump($this->_db->errorInfo()); + + if($result_rows == false) + return false; + else + { + $config_value = json_decode($result_rows['config_value']); + if(is_array($config_value)) + { + foreach($config_value as $item) + { + if($value == $item) + { + return true; + } + } + return false; + } + else + { + if($value == $config_value) + return true; + else + return false; + } + } + } + + function add_config_value($key,$value) + { + $key_value_array = null; + $temp_data = null; + $update_data = null; + + if($this->is_value_exist($key,$value)) + return true; + else + $key_data = $this->get_config($key); + + $decode_data = json_decode($key_data); + + if(empty($decode_data)) + { + $query = "Update config_options set config_value = :config_value where config_key = :config_key"; + $update_data = array( + "config_key" => $key, + "config_value" => json_encode($value) + ); + } + else + { + $key_value_array = json_decode($key_data); + + if(is_array($value)) + { + if(is_array($key_value_array)) + { + foreach($value as $item) + { + if(!in_array($item,$key_value_array)) + $key_value_array[] = $item; + } + } + else + { + $temp_data[] = $key_value_array; + foreach($value as $item) + { + $temp_data[] = $item; + } + } + unset($key_value_array); + $key_value_array = $temp_data; + } + else + { + if(is_array($key_value_array)) + { + $key_value_array[] = $value; + } + else + { + $temp_data[] = $key_value_array; + $temp_data[] = $value; + unset($key_value_array); + $key_value_array = $temp_data; + } + } + + $query = "Update config_options set config_value = :config_value where config_key = :config_key"; + $update_data = array( + "config_key" => $key, + "config_value" => json_encode($key_value_array) + ); + } + + $statement = $this->_db->prepare($query); + $exe_query = $statement->execute($update_data); + if (!$exe_query) { + file_put_contents($this->error_logging, "\n\ncannot execute query: {$query} {$this->_db->errorInfo()}", LOCK_EX | FILE_APPEND); + return false; + } + $this->_close_connection(); + return true; + + } + + function delete_config($key,$value) + { + if (!$this->_is_open) { + $this->_open_connection(); + } + + $key_data = $this->get_config($key); + if($key_data == false) + { + return false; + } + elseif(empty($value)) + { + $query = "DELETE from config_options where config_key = :config_key"; + $data = array( + "config_key" => $key + ); + + $statement = $this->_db->prepare($query); + $exe_query = $statement->execute($data); + if (!$exe_query) { + file_put_contents($this->error_logging, "\n\ncannot execute query: {$query} {$this->_db->errorInfo()}", LOCK_EX | FILE_APPEND); + return false; + } + } + else + { + $this->delete_config_value($key,$value); + } + $this->_close_connection(); + return true; + } + + function delete_config_value($key,$value) + { + $query = "SELECT config_value FROM config_options where config_key = :config_key"; + $data = array('config_key' => $key); + + $statement = $this->_db->prepare($query); + $exe_query_select = $statement->execute($data); + $result_rows = $statement->fetch(); + + $config_value = json_decode($result_rows['config_value'],true); + if(is_array($config_value)) + { + $delete_key = array_search($value,$config_value); + unset($config_value[$delete_key]); + $data = array( + "config_key" => $key, + "config_value" => json_encode(array_values($config_value)) + ); + } + else + { + $config_value = ""; + $data = array( + "config_key" => $key, + "config_value" => json_encode($config_value) + ); + } + + if(!$exe_query_select) + { + file_put_contents($this->error_logging, "\n\ncannot execute query: {$query} {$this->_db->errorInfo()}", LOCK_EX | FILE_APPEND); + return false; + } + else + { + $query = "Update config_options set config_value = :config_value where config_key = :config_key"; + $statement = $this->_db->prepare($query); + $exe_query_update = $statement->execute($data); + + if (!$exe_query_update) { + file_put_contents($this->error_logging, "\n\ncannot execute query: {$query} {$this->_db->errorInfo()}", LOCK_EX | FILE_APPEND); + return false; + } + } + $this->_close_connection(); + return true; + + } + + function update_config($key,$newkey,$autoload) + { + if (!$this->_is_open) { + $this->_open_connection(); + } + + $key_data = $this->get_config($key); + if($key_data == false) + { + return false; + } + else + { + if(empty($newkey)) + { + $query = "update config_options set autoload = :autoload where config_key = :config_key"; + $data = array( + 'autoload' => $autoload, + 'config_key' => $key + ); + } + else + { + $query = "update config_options set config_key = :config_new_key,autoload = :autoload where config_key = :config_key"; + $data = array( + 'config_new_key' => $newkey, + 'config_key' => $key, + 'autoload' => $autoload + ); + } + + // $this->_db->setAttribute( PDO::ATTR_ERRMODE, PDO::ERRMODE_WARNING ); + + $statement = $this->_db->prepare($query); + $exe_query = $statement->execute($data); + if (!$exe_query) { + file_put_contents($this->error_logging, "\n\ncannot execute query: {$query} {$this->_db->errorInfo()}", LOCK_EX | FILE_APPEND); + return false; + } + $this->_close_connection(); + return true; + } + } + + function update_country($key,$value) + { + if (!$this->_is_open) { + $this->_open_connection(); + } + + if($key == "country_trusted") + { + $delete_key = $this->delete_config_value("country_blocked",$value); + + if($delete_key) + { + return $this->add_config_value("country_trusted",$value); + } + else + return $delete_key; + } + elseif($key == "country_blocked") + { + $delete_key = $this->delete_config_value("country_trusted",$value); + + if($delete_key) + { + return $this->add_config_value("country_blocked",$value); + } + else + return $delete_key; + } + } + } + +} \ No newline at end of file diff --git a/libraries/Token_bucket.php b/libraries/Token_bucket.php new file mode 100644 index 0000000..fc9ac93 --- /dev/null +++ b/libraries/Token_bucket.php @@ -0,0 +1,76 @@ +get_api_request(ASTRA::$_ip); + + //print_r($get_api_request); + + $last_api_request = $get_api_request['last_api_request']; # get from the DB; in epoch seconds + $last_api_diff = time() - $last_api_request; # in seconds + $minute_throttle = $get_api_request['throttle_minute']; # get from the DB + $reported = isset($get_api_request['reported']) ? $get_api_request['reported'] : 0; + + if (is_null(self::$_minute_limit)) { + $new_minute_throttle = 0; + } else { + $new_minute_throttle = $minute_throttle - $last_api_diff; + $new_minute_throttle = $new_minute_throttle < 0 ? 0 : $new_minute_throttle; + $new_minute_throttle += self::$_minute / self::$_minute_limit; + $minute_hits_remaining = floor(( self::$_minute - $new_minute_throttle ) * self::$_minute_limit / self::$_minute); + # can output this value with the request if desired: + $minute_hits_remaining = $minute_hits_remaining >= 0 ? $minute_hits_remaining : 0; + $reported = 0; + } + + if ($new_minute_throttle > self::$_minute) { + $wait = ceil($new_minute_throttle - self::$_minute); + if (!$reported) { + /* Send API hit */ + require_once(ASTRAPATH . 'libraries/API_connect.php'); + $connect = new API_connect(); + $reported = (int) $connect->send_request("token_bucket", array('blocking' => 2)); + } + usleep(250000); + /**/ + + die('The one-minute Request limit of ' . self::$_minute_limit . ' requests has been exceeded. Please wait ' . $wait . ' seconds before attempting again.'); + } + + # Save the values back to the database. + $data = array( + 'last_api_request' => time(), + ); + + ASTRA::$_db->save_api_request(ASTRA::$_ip, time(), $new_minute_throttle, $reported); + } + + } + +} \ No newline at end of file diff --git a/libraries/Update_DB.php b/libraries/Update_DB.php new file mode 100644 index 0000000..15ee810 --- /dev/null +++ b/libraries/Update_DB.php @@ -0,0 +1,111 @@ +run(); + echo_debug('Constructor DB'); + } + + protected function is_request_from_astra(){ + $user_agent = isset($_SERVER['HTTP_USER_AGENT']) ? strtolower($_SERVER['HTTP_USER_AGENT']) : "empty"; + + if(strpos($user_agent, "astra") !== false){ + return true; + } + + if(file_exists(ASTRAPATH . 'db/astra-setup.flag')){ + return true; + } + + return false; + } + + protected function make_request() { + + + if($this->is_request_from_astra()){ + return false; + } + + require_once(ASTRAPATH . 'libraries/Crypto.php'); + + echo_debug('cURLing to ' . CZ_API_URL); + + $dataArray['client_key'] = CZ_CLIENT_KEY; + $dataArray['api'] = "get_db"; + + $str = serialize($dataArray); + $crypto = new Astra_crypto(); + $encrypted_data = $crypto->encrypt($str, CZ_SECRET_KEY); + + $ch = curl_init(); + curl_setopt($ch, CURLOPT_URL, CZ_API_URL); + curl_setopt($ch, CURLOPT_POST, true); + curl_setopt($ch, CURLOPT_POSTFIELDS, "encRequest=" . $encrypted_data . "&access_code=" . CZ_ACCESS_KEY); + curl_setopt($ch, CURLOPT_RETURNTRANSFER, true); + curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, false); + curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false); + + $output = curl_exec($ch); + echo_debug('cURL Executed'); + + echo_debug('cURL Error >> ' . curl_error($ch)); + echo_debug("
$output
"); + + $errors = curl_error($ch); + curl_close($ch); + + if ($errors) { + return FALSE; + } else { + return $output; + } + } + + function run() { + + $server_reply = $this->make_request(); + + if ($server_reply === FALSE) { + echo_debug('Update False'); + return FALSE; + } else { + $server_reply = json_decode($server_reply); + echo_debug('JSON Decoded'); + } + + if ($server_reply->code == 1) { + echo_debug('Valid Response'); + $bots = json_decode($server_reply->bots); + $custom_rules = json_decode($server_reply->custom_rules); + } + else{ + echo_debug('Not a valid Response'); + echo_debug(json_encode($server_reply)); + } + + //print_r($bots); + //print_r($custom_rules); + + echo_debug('Connecting DB'); + ASTRA::connect_db(); + echo_debug('DB Connected'); + + $update_bad_bots = ASTRA::$_db->update_bad_bots($bots); + + $update_custom_params = ASTRA::$_db->update_custom_params($custom_rules->params); + $update_custom_ip = ASTRA::$_db->update_custom_ip($custom_rules->ip); + + if ($update_bad_bots && $update_custom_params && $update_custom_ip) { + return TRUE; + } else { + return FALSE; + } + } + + } + +} \ No newline at end of file diff --git a/libraries/Update_config.php b/libraries/Update_config.php new file mode 100644 index 0000000..d9a7707 --- /dev/null +++ b/libraries/Update_config.php @@ -0,0 +1,91 @@ + $line) { + $line_trim = trim($line); + $str_define = strpos($line_trim, 'define("'); + + if ($str_define === false || $str_define != 0) + continue; + + $line_temp = str_replace('define(', '', $line_trim); + $line_temp = str_replace(');', '', $line_temp); + + $matches = explode(",", $line_temp); + $constant = $matches[0]; + $padding = $matches[1]; + + $constant = str_replace('"', "", $constant); + + json_decode(substr($str_replace, 1, -1)); + if (json_last_error() == 0) { + $data['key'] = 'file_uploads'; + $config = new AstraConfig(); + if($config->get_config($data)){ + $data['value'] = ""; + $config->delete_config($data); + $data['value'] = json_decode(substr($str_replace, 1, -1)); + $data['autoload'] = 1; + $config->add_config($data); + }else{ + $data['value'] = json_decode(substr($str_replace, 1, -1)); + $data['autoload'] = 1; + $config->add_config($data); + } + + + }else{ + + if ($constant == $str_constant) { + $config_file[$line_num] = 'define("' . $constant . '", ' . $str_replace . ');' . "\r\n"; + break; + } else { + + } + + } + } + + $handle = fopen($path_to_astra_config, 'w'); + foreach ($config_file as $line) { + fwrite($handle, rtrim($line) . "\r\n"); + } + fclose($handle); + chmod($path_to_astra_config, 0666); + + return TRUE; + } + +} \ No newline at end of file diff --git a/libraries/Updater.php b/libraries/Updater.php new file mode 100644 index 0000000..c2ff668 --- /dev/null +++ b/libraries/Updater.php @@ -0,0 +1,235 @@ +server_version = $server_version; + $this->paths['local_path'] = dirname(dirname(__FILE__)) . '/updates/'; + echo_debug("Local path: " . $this->paths['local_path']); + } + + public function is_update() + { + if (1 == 1 || version_compare($this->server_version, CZ_ASTRA_CLIENT_VERSION) > 0) { + $this->update_file_name = 'astra-' . trim($this->server_version) . '.zip'; + echo_debug("Needs to be updated: " . $this->update_file_name); + return TRUE; + } else { + echo_debug("Update not required as:"); + echo_debug(array("Server Version" => $this->server_version, "Client Version" => CZ_ASTRA_CLIENT_VERSION)); + $this->add_error('update_not_required', 'Update not required. Latest version as per server is ' . $this->server_version . ' and client version is ' . CZ_ASTRA_CLIENT_VERSION); + return FALSE; + } + } + + public function get_errors() + { + return $this->errors; + } + + public function add_error($error_code, $error_message) + { + $this->errors[$error_code] = $error_message; + return true; + } + + protected function is_valid_zip() + { + + $zip = new ZipArchive; + + $res = $zip->open($this->paths['local_path'] . $this->update_file_name, ZipArchive::CHECKCONS); + + if ($res !== TRUE) { + switch ($res) { + case ZipArchive::ER_NOZIP : + echo_debug("Not a ZIP"); + $this->add_error('zip_nozip', "The update zip is invalid"); + $ret = FALSE; + /* Not a zip archive */ + case ZipArchive::ER_INCONS : + echo_debug("Consistency check failed"); + $this->add_error('zip_incons', "Failed to download update zip"); + $ret = FALSE; + /* die('consistency check failed'); */ + case ZipArchive::ER_CRC : + echo_debug("Error with CRC"); + $this->add_error('zip_crc', "Update zip CRC failed"); + $ret = FALSE; + default : + echo_debug("Checksum Failed"); + $this->add_error('zip_checksum', "Update zip checksum failed"); + $ret = FALSE; + } + + if ($ret) { + $zip->close(); + } + return $ret; + } else { + echo_debug("Update file is a valid ZIP"); + return TRUE; + } + } + + public function download_file() + { + + $download_filename = $this->paths['local_path'] . $this->update_file_name; + if (file_exists($download_filename) && filesize($download_filename) < 5) { + unlink($download_filename); + } + + if (!is_file($download_filename)) { + + /* Download the File */ + require_once(ASTRAPATH . 'libraries/Crypto.php'); + + $dataArray['client_key'] = CZ_CLIENT_KEY; + $dataArray['api'] = "download_package"; + + $str = serialize($dataArray); + $crypto = new Astra_crypto(); + $encrypted_data = $crypto->encrypt($str, CZ_SECRET_KEY); + + if (!is_dir($this->paths['local_path'])) { + echo_debug("Making updates directory"); + mkdir($this->paths['local_path']); + } + + if (is_writable(dirname($this->paths['local_path'] . $this->update_file_name))) { + $dlHandler = fopen($this->paths['local_path'] . $this->update_file_name, 'w'); + + $ch = curl_init(); + curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, 0); + curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, 0); + curl_setopt($ch, CURLOPT_POSTFIELDS, "encRequest=" . $encrypted_data . "&access_code=" . CZ_ACCESS_KEY); + curl_setopt($ch, CURLOPT_URL, CZ_API_URL); + curl_setopt($ch, CURLOPT_FILE, $dlHandler); + curl_setopt($ch, CURLOPT_HEADER, false); + curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true); + + curl_setopt($ch, CURLOPT_HTTPHEADER, array( + 'Content-type: application/x-www-form-urlencoded', + )); + + + $result = curl_exec($ch); + curl_close($ch); + + fclose($dlHandler); + + if ($this->is_valid_zip()) { + return TRUE; + } else { + /* + unlink($this->paths['local_path'] . $this->update_file_name); + echo_debug("Deleted ZIP file since it was not a valid."); + * + */ + return FALSE; + } + } else { + $this->add_error('update_folder_not_writable', 'Please ensure the following path is writable: ' . dirname($this->paths['local_path'] . $this->update_file_name)); + return false; + } + } else { + echo_debug("Unable to write the file since the file probably exists"); + return TRUE; + } + } + + protected function migration() + { + if (file_exists(ASTRAPATH . 'upgrade.php')) { + echo_debug("Upgrade file exists and will be executed"); + $output = shell_exec('php ' . ASTRAPATH . 'upgrade.php'); + echo_debug($output); + unlink(ASTRAPATH . 'upgrade.php'); + echo_debug("Upgrade file deleted"); + return TRUE; + } + + if (!strpos(__FILE__, 'xampp')) { + + } else { + echo_debug("We are in local"); + $fp = dirname(dirname(dirname(__FILE__))) . '/astra/' . 'upgrade.php'; + echo_debug($fp); + if (file_exists($fp)) { + echo_debug("Upgrade file exists and will be executed"); + $output = shell_exec('php ' . $fp); + echo_debug($output); + unlink($fp); + echo_debug("Upgrade file deleted"); + return TRUE; + } + } + + echo_debug('Upgrade file does not exist'); + return TRUE; + } + + public function update($platform = 'php') + { + $zip = new ZipArchive; + if ($zip->open($this->paths['local_path'] . $this->update_file_name) === TRUE) { + if ($platform == 'php') { + $extract_to = dirname(ASTRAPATH); + } else { + $extract_to = dirname(dirname(ASTRAPATH)); + } + echo_debug("Will extract Update to: " . $extract_to); + $extracted = $zip->extractTo($extract_to); + $zip->close(); + $this->migration(); + + if ($extracted) { + echo_debug("ZIP successfully extracted"); + return TRUE; + } else { + $this->add_error('zip_extract_error', 'Failed to extract the update file'); + echo_debug("ZIP extraction not successful"); + return FALSE; + } + } + + $this->add_error('zip_open_error', 'Failed to open the update file'); + echo_debug("Unable to open Update ZIP File"); + return FALSE; + } + + public function delete() + { + if (file_exists($this->paths['local_path'] . $this->update_file_name)) { + if (unlink($this->paths['local_path'] . $this->update_file_name)) { + echo_debug("Just deleted: " . $this->paths['local_path'] . $this->update_file_name); + return TRUE; + } else { + echo_debug("File Exists but unable to delete: " . $this->paths['local_path'] . $this->update_file_name); + return FALSE; + } + } else { + $this->add_error('zip_delete_error', 'Failed to delete update file: ' . $this->paths['local_path'] . $this->update_file_name); + echo_debug("Unable to delete: " . $this->paths['local_path'] . $this->update_file_name); + } + } + + } + +} \ No newline at end of file diff --git a/libraries/Virtual_patches.php b/libraries/Virtual_patches.php new file mode 100644 index 0000000..e31dd3e --- /dev/null +++ b/libraries/Virtual_patches.php @@ -0,0 +1,67 @@ + + * @date 12/5/19 + */ + +if (!class_exists('Astra_virtual_patches')) { + + class Astra_virtual_patches + { + + protected $url; + protected $applied_patches = array(); + + function __construct() + { + if (!empty($_SERVER['REQUEST_URI'])) { + $this->url = $_SERVER['REQUEST_URI']; + } + } + + function apply() + { + + $methods = preg_grep('/^patch_/', get_class_methods($this)); + foreach ($methods as $method) { + $is_applied = $this->{$method}(); + if ($is_applied === TRUE) { + $this->applied_patches[] = $method; + } + } + + //print_r($this->applied_patches); + } + + function get_applied_patches() + { + return $this->applied_patches; + } + + function url_contains($slug = '') + { + return (false !== strpos($this->url, $slug)) ? TRUE : FALSE; + } + + function string_after($haystack, $needle) + { + return substr($haystack, strpos($haystack, $needle) + strlen($needle)); + } + + function patch_magento_smartwave_quickview() + { + + if (!$this->url_contains('quickview/index/view/path')) { + return false; + } + + $string_after = $this->string_after($this->url, 'quickview/index/view/path'); + if ($this->url_contains(';') || strlen($string_after) > 3) { + return true; + } + + } + } +} \ No newline at end of file diff --git a/libraries/browser.php b/libraries/browser.php new file mode 100644 index 0000000..eb99c78 --- /dev/null +++ b/libraries/browser.php @@ -0,0 +1,1730 @@ +getBrowser() == Browser::BROWSER_FIREFOX && $browser->getVersion() >= 2 ) { + * echo 'You have FireFox version 2 or greater'; + * } + * + * User Agents Sampled from: http://www.useragentstring.com/ + * + * This implementation is based on the original work from Gary White + * http://apptools.com/phptools/browser/ + * + */ + +if (!class_exists('Browser_Astra')) { + class Browser_Astra + { + private $_agent = ''; + private $_browser_name = ''; + private $_version = ''; + private $_platform = ''; + private $_os = ''; + private $_is_aol = false; + private $_is_mobile = false; + private $_is_tablet = false; + private $_is_robot = false; + private $_is_facebook = false; + private $_aol_version = ''; + + const BROWSER_UNKNOWN = 'unknown'; + const VERSION_UNKNOWN = 'unknown'; + + const BROWSER_OPERA = 'Opera'; // http://www.opera.com/ + const BROWSER_OPERA_MINI = 'Opera Mini'; // http://www.opera.com/mini/ + const BROWSER_WEBTV = 'WebTV'; // http://www.webtv.net/pc/ + const BROWSER_EDGE = 'Edge'; // https://www.microsoft.com/edge + const BROWSER_IE = 'Internet Explorer'; // http://www.microsoft.com/ie/ + const BROWSER_POCKET_IE = 'Pocket Internet Explorer'; // http://en.wikipedia.org/wiki/Internet_Explorer_Mobile + const BROWSER_KONQUEROR = 'Konqueror'; // http://www.konqueror.org/ + const BROWSER_ICAB = 'iCab'; // http://www.icab.de/ + const BROWSER_OMNIWEB = 'OmniWeb'; // http://www.omnigroup.com/applications/omniweb/ + const BROWSER_FIREBIRD = 'Firebird'; // http://www.ibphoenix.com/ + const BROWSER_FIREFOX = 'Firefox'; // http://www.mozilla.com/en-US/firefox/firefox.html + const BROWSER_ICEWEASEL = 'Iceweasel'; // http://www.geticeweasel.org/ + const BROWSER_SHIRETOKO = 'Shiretoko'; // http://wiki.mozilla.org/Projects/shiretoko + const BROWSER_MOZILLA = 'Mozilla'; // http://www.mozilla.com/en-US/ + const BROWSER_AMAYA = 'Amaya'; // http://www.w3.org/Amaya/ + const BROWSER_LYNX = 'Lynx'; // http://en.wikipedia.org/wiki/Lynx + const BROWSER_SAFARI = 'Safari'; // http://apple.com + const BROWSER_IPHONE = 'iPhone'; // http://apple.com + const BROWSER_IPOD = 'iPod'; // http://apple.com + const BROWSER_IPAD = 'iPad'; // http://apple.com + const BROWSER_CHROME = 'Chrome'; // http://www.google.com/chrome + const BROWSER_ANDROID = 'Android'; // http://www.android.com/ + const BROWSER_GOOGLEBOT = 'GoogleBot'; // http://en.wikipedia.org/wiki/Googlebot + + const BROWSER_YANDEXBOT = 'YandexBot'; // http://yandex.com/bots + const BROWSER_YANDEXIMAGERESIZER_BOT = 'YandexImageResizer'; // http://yandex.com/bots + const BROWSER_YANDEXIMAGES_BOT = 'YandexImages'; // http://yandex.com/bots + const BROWSER_YANDEXVIDEO_BOT = 'YandexVideo'; // http://yandex.com/bots + const BROWSER_YANDEXMEDIA_BOT = 'YandexMedia'; // http://yandex.com/bots + const BROWSER_YANDEXBLOGS_BOT = 'YandexBlogs'; // http://yandex.com/bots + const BROWSER_YANDEXFAVICONS_BOT = 'YandexFavicons'; // http://yandex.com/bots + const BROWSER_YANDEXWEBMASTER_BOT = 'YandexWebmaster'; // http://yandex.com/bots + const BROWSER_YANDEXDIRECT_BOT = 'YandexDirect'; // http://yandex.com/bots + const BROWSER_YANDEXMETRIKA_BOT = 'YandexMetrika'; // http://yandex.com/bots + const BROWSER_YANDEXNEWS_BOT = 'YandexNews'; // http://yandex.com/bots + const BROWSER_YANDEXCATALOG_BOT = 'YandexCatalog'; // http://yandex.com/bots + + const BROWSER_SLURP = 'Yahoo! Slurp'; // http://en.wikipedia.org/wiki/Yahoo!_Slurp + const BROWSER_W3CVALIDATOR = 'W3C Validator'; // http://validator.w3.org/ + const BROWSER_BLACKBERRY = 'BlackBerry'; // http://www.blackberry.com/ + const BROWSER_ICECAT = 'IceCat'; // http://en.wikipedia.org/wiki/GNU_IceCat + const BROWSER_NOKIA_S60 = 'Nokia S60 OSS Browser'; // http://en.wikipedia.org/wiki/Web_Browser_for_S60 + const BROWSER_NOKIA = 'Nokia Browser'; // * all other WAP-based browsers on the Nokia Platform + const BROWSER_MSN = 'MSN Browser'; // http://explorer.msn.com/ + const BROWSER_MSNBOT = 'MSN Bot'; // http://search.msn.com/msnbot.htm + const BROWSER_BINGBOT = 'Bing Bot'; // http://en.wikipedia.org/wiki/Bingbot + const BROWSER_VIVALDI = 'Vivalidi'; // https://vivaldi.com/ + const BROWSER_YANDEX = 'Yandex'; // https://browser.yandex.ua/ + + const BROWSER_NETSCAPE_NAVIGATOR = 'Netscape Navigator'; // http://browser.netscape.com/ (DEPRECATED) + const BROWSER_GALEON = 'Galeon'; // http://galeon.sourceforge.net/ (DEPRECATED) + const BROWSER_NETPOSITIVE = 'NetPositive'; // http://en.wikipedia.org/wiki/NetPositive (DEPRECATED) + const BROWSER_PHOENIX = 'Phoenix'; // http://en.wikipedia.org/wiki/History_of_Mozilla_Firefox (DEPRECATED) + const BROWSER_PLAYSTATION = "PlayStation"; + const BROWSER_SAMSUNG = "SamsungBrowser"; + const BROWSER_SILK = "Silk"; + const BROWSER_I_FRAME = "Iframely"; + const BROWSER_COCOA = "CocoaRestClient"; + + const PLATFORM_UNKNOWN = 'unknown'; + const PLATFORM_WINDOWS = 'Windows'; + const PLATFORM_WINDOWS_CE = 'Windows CE'; + const PLATFORM_APPLE = 'Apple'; + const PLATFORM_LINUX = 'Linux'; + const PLATFORM_OS2 = 'OS/2'; + const PLATFORM_BEOS = 'BeOS'; + const PLATFORM_IPHONE = 'iPhone'; + const PLATFORM_IPOD = 'iPod'; + const PLATFORM_IPAD = 'iPad'; + const PLATFORM_BLACKBERRY = 'BlackBerry'; + const PLATFORM_NOKIA = 'Nokia'; + const PLATFORM_FREEBSD = 'FreeBSD'; + const PLATFORM_OPENBSD = 'OpenBSD'; + const PLATFORM_NETBSD = 'NetBSD'; + const PLATFORM_SUNOS = 'SunOS'; + const PLATFORM_OPENSOLARIS = 'OpenSolaris'; + const PLATFORM_ANDROID = 'Android'; + const PLATFORM_PLAYSTATION = "Sony PlayStation"; + const PLATFORM_ROKU = "Roku"; + const PLATFORM_APPLE_TV = "Apple TV"; + const PLATFORM_TERMINAL = "Terminal"; + const PLATFORM_FIRE_OS = "Fire OS"; + const PLATFORM_SMART_TV = "SMART-TV"; + const PLATFORM_CHROME_OS = "Chrome OS"; + const PLATFORM_JAVA_ANDROID = "Java/Android"; + const PLATFORM_POSTMAN = "Postman"; + const PLATFORM_I_FRAME = "Iframely"; + + const OPERATING_SYSTEM_UNKNOWN = 'unknown'; + + /** + * Class constructor + */ + public function __construct($userAgent = "") + { + $this->reset(); + if ($userAgent != "") { + $this->setUserAgent($userAgent); + } else { + $this->determine(); + } + } + + /** + * Reset all properties + */ + public function reset() + { + $this->_agent = isset($_SERVER['HTTP_USER_AGENT']) ? $_SERVER['HTTP_USER_AGENT'] : ""; + $this->_browser_name = self::BROWSER_UNKNOWN; + $this->_version = self::VERSION_UNKNOWN; + $this->_platform = self::PLATFORM_UNKNOWN; + $this->_os = self::OPERATING_SYSTEM_UNKNOWN; + $this->_is_aol = false; + $this->_is_mobile = false; + $this->_is_tablet = false; + $this->_is_robot = false; + $this->_is_facebook = false; + $this->_aol_version = self::VERSION_UNKNOWN; + } + + /** + * Check to see if the specific browser is valid + * @param string $browserName + * @return bool True if the browser is the specified browser + */ + function isBrowser($browserName) + { + return (0 == strcasecmp($this->_browser_name, trim($browserName))); + } + + /** + * The name of the browser. All return types are from the class contants + * @return string Name of the browser + */ + public function getBrowser() + { + return $this->_browser_name; + } + + /** + * Set the name of the browser + * @param $browser string The name of the Browser + */ + public function setBrowser($browser) + { + $this->_browser_name = $browser; + } + + /** + * The name of the platform. All return types are from the class contants + * @return string Name of the browser + */ + public function getPlatform() + { + return $this->_platform; + } + + /** + * Set the name of the platform + * @param string $platform The name of the Platform + */ + public function setPlatform($platform) + { + $this->_platform = $platform; + } + + /** + * The version of the browser. + * @return string Version of the browser (will only contain alpha-numeric characters and a period) + */ + public function getVersion() + { + return $this->_version; + } + + /** + * Set the version of the browser + * @param string $version The version of the Browser + */ + public function setVersion($version) + { + $this->_version = preg_replace('/[^0-9,.,a-z,A-Z-]/', '', $version); + } + + /** + * The version of AOL. + * @return string Version of AOL (will only contain alpha-numeric characters and a period) + */ + public function getAolVersion() + { + return $this->_aol_version; + } + + /** + * Set the version of AOL + * @param string $version The version of AOL + */ + public function setAolVersion($version) + { + $this->_aol_version = preg_replace('/[^0-9,.,a-z,A-Z]/', '', $version); + } + + /** + * Is the browser from AOL? + * @return boolean True if the browser is from AOL otherwise false + */ + public function isAol() + { + return $this->_is_aol; + } + + /** + * Is the browser from a mobile device? + * @return boolean True if the browser is from a mobile device otherwise false + */ + public function isMobile() + { + return $this->_is_mobile; + } + + /** + * Is the browser from a tablet device? + * @return boolean True if the browser is from a tablet device otherwise false + */ + public function isTablet() + { + return $this->_is_tablet; + } + + /** + * Is the browser from a robot (ex Slurp,GoogleBot)? + * @return boolean True if the browser is from a robot otherwise false + */ + public function isRobot() + { + return $this->_is_robot; + } + + /** + * Is the browser from facebook? + * @return boolean True if the browser is from facebook otherwise false + */ + public function isFacebook() + { + return $this->_is_facebook; + } + + /** + * Set the browser to be from AOL + * @param $isAol + */ + public function setAol($isAol) + { + $this->_is_aol = $isAol; + } + + /** + * Set the Browser to be mobile + * @param boolean $value is the browser a mobile browser or not + */ + protected function setMobile($value = true) + { + $this->_is_mobile = $value; + } + + /** + * Set the Browser to be tablet + * @param boolean $value is the browser a tablet browser or not + */ + protected function setTablet($value = true) + { + $this->_is_tablet = $value; + } + + /** + * Set the Browser to be a robot + * @param boolean $value is the browser a robot or not + */ + protected function setRobot($value = true) + { + $this->_is_robot = $value; + } + + /** + * Set the Browser to be a Facebook request + * @param boolean $value is the browser a robot or not + */ + protected function setFacebook($value = true) + { + $this->_is_facebook = $value; + } + + /** + * Get the user agent value in use to determine the browser + * @return string The user agent from the HTTP header + */ + public function getUserAgent() + { + return $this->_agent; + } + + /** + * Set the user agent value (the construction will use the HTTP header value - this will overwrite it) + * @param string $agent_string The value for the User Agent + */ + public function setUserAgent($agent_string) + { + $this->reset(); + $this->_agent = $agent_string; + $this->determine(); + } + + /** + * Used to determine if the browser is actually "chromeframe" + * @since 1.7 + * @return boolean True if the browser is using chromeframe + */ + public function isChromeFrame() + { + return (strpos($this->_agent, "chromeframe") !== false); + } + + /** + * Returns a formatted string with a summary of the details of the browser. + * @return string formatted string with a summary of the browser + */ + public function __toString() + { + return "Browser Name: {$this->getBrowser()}
\n" . + "Browser Version: {$this->getVersion()}
\n" . + "Browser User Agent String: {$this->getUserAgent()}
\n" . + "Platform: {$this->getPlatform()}
"; + } + + /** + * Protected routine to calculate and determine what the browser is in use (including platform) + */ + protected function determine() + { + $this->checkPlatform(); + $this->checkBrowsers(); + $this->checkForAol(); + } + + /** + * Protected routine to determine the browser type + * @return boolean True if the browser was detected otherwise false + */ + protected function checkBrowsers() + { + return ( + // well-known, well-used + // Special Notes: + // (1) Opera must be checked before FireFox due to the odd + // user agents used in some older versions of Opera + // (2) WebTV is strapped onto Internet Explorer so we must + // check for WebTV before IE + // (3) (deprecated) Galeon is based on Firefox and needs to be + // tested before Firefox is tested + // (4) OmniWeb is based on Safari so OmniWeb check must occur + // before Safari + // (5) Netscape 9+ is based on Firefox so Netscape checks + // before FireFox are necessary + // (6) Vivalid is UA contains both Firefox and Chrome so Vivalid checks + // before Firefox and Chrome + $this->checkBrowserWebTv() || + $this->checkBrowserEdge() || + $this->checkBrowserInternetExplorer() || + $this->checkBrowserOpera() || + $this->checkBrowserGaleon() || + $this->checkBrowserNetscapeNavigator9Plus() || + $this->checkBrowserVivaldi() || + $this->checkBrowserYandex() || + $this->checkBrowserFirefox() || + $this->checkBrowserChrome() || + $this->checkBrowserOmniWeb() || + + // common mobile + $this->checkBrowserAndroid() || + $this->checkBrowseriPad() || + $this->checkBrowseriPod() || + $this->checkBrowseriPhone() || + $this->checkBrowserBlackBerry() || + $this->checkBrowserNokia() || + + // common bots + $this->checkBrowserGoogleBot() || + $this->checkBrowserMSNBot() || + $this->checkBrowserBingBot() || + $this->checkBrowserSlurp() || + + // Yandex bots + $this->checkBrowserYandexBot() || + $this->checkBrowserYandexImageResizerBot() || + $this->checkBrowserYandexBlogsBot() || + $this->checkBrowserYandexCatalogBot() || + $this->checkBrowserYandexDirectBot() || + $this->checkBrowserYandexFaviconsBot() || + $this->checkBrowserYandexImagesBot() || + $this->checkBrowserYandexMediaBot() || + $this->checkBrowserYandexMetrikaBot() || + $this->checkBrowserYandexNewsBot() || + $this->checkBrowserYandexVideoBot() || + $this->checkBrowserYandexWebmasterBot() || + + // check for facebook external hit when loading URL + $this->checkFacebookExternalHit() || + + // WebKit base check (post mobile and others) + $this->checkBrowserSamsung() || + $this->checkBrowserSilk() || + $this->checkBrowserSafari() || + + // everyone else + $this->checkBrowserNetPositive() || + $this->checkBrowserFirebird() || + $this->checkBrowserKonqueror() || + $this->checkBrowserIcab() || + $this->checkBrowserPhoenix() || + $this->checkBrowserAmaya() || + $this->checkBrowserLynx() || + $this->checkBrowserShiretoko() || + $this->checkBrowserIceCat() || + $this->checkBrowserIceweasel() || + $this->checkBrowserW3CValidator() || + $this->checkBrowserPlayStation() || + $this->checkBrowserIframely() || + $this->checkBrowserCocoa() || + $this->checkBrowserMozilla() /* Mozilla is such an open standard that you must check it last */ + + + ); + } + + /** + * Determine if the user is using a BlackBerry (last updated 1.7) + * @return boolean True if the browser is the BlackBerry browser otherwise false + */ + protected function checkBrowserBlackBerry() + { + if (stripos($this->_agent, 'blackberry') !== false) { + $aresult = explode("/", stristr($this->_agent, "BlackBerry")); + if (isset($aresult[1])) { + $aversion = explode(' ', $aresult[1]); + $this->setVersion($aversion[0]); + $this->_browser_name = self::BROWSER_BLACKBERRY; + $this->setMobile(true); + return true; + } + } + return false; + } + + /** + * Determine if the user is using an AOL User Agent (last updated 1.7) + * @return boolean True if the browser is from AOL otherwise false + */ + protected function checkForAol() + { + $this->setAol(false); + $this->setAolVersion(self::VERSION_UNKNOWN); + + if (stripos($this->_agent, 'aol') !== false) { + $aversion = explode(' ', stristr($this->_agent, 'AOL')); + if (isset($aversion[1])) { + $this->setAol(true); + $this->setAolVersion(preg_replace('/[^0-9\.a-z]/i', '', $aversion[1])); + return true; + } + } + return false; + } + + /** + * Determine if the browser is the GoogleBot or not (last updated 1.7) + * @return boolean True if the browser is the GoogletBot otherwise false + */ + protected function checkBrowserGoogleBot() + { + if (stripos($this->_agent, 'googlebot') !== false) { + $aresult = explode('/', stristr($this->_agent, 'googlebot')); + if (isset($aresult[1])) { + $aversion = explode(' ', $aresult[1]); + $this->setVersion(str_replace(';', '', $aversion[0])); + $this->_browser_name = self::BROWSER_GOOGLEBOT; + $this->setRobot(true); + return true; + } + } + return false; + } + + /** + * Determine if the browser is the YandexBot or not + * @return boolean True if the browser is the YandexBot otherwise false + */ + protected function checkBrowserYandexBot() + { + if (stripos($this->_agent, 'YandexBot') !== false) { + $aresult = explode('/', stristr($this->_agent, 'YandexBot')); + if (isset($aresult[1])) { + $aversion = explode(' ', $aresult[1]); + $this->setVersion(str_replace(';', '', $aversion[0])); + $this->_browser_name = self::BROWSER_YANDEXBOT; + $this->setRobot(true); + return true; + } + } + return false; + } + + /** + * Determine if the browser is the YandexImageResizer or not + * @return boolean True if the browser is the YandexImageResizer otherwise false + */ + protected function checkBrowserYandexImageResizerBot() + { + if (stripos($this->_agent, 'YandexImageResizer') !== false) { + $aresult = explode('/', stristr($this->_agent, 'YandexImageResizer')); + if (isset($aresult[1])) { + $aversion = explode(' ', $aresult[1]); + $this->setVersion(str_replace(';', '', $aversion[0])); + $this->_browser_name = self::BROWSER_YANDEXIMAGERESIZER_BOT; + $this->setRobot(true); + return true; + } + } + return false; + } + + /** + * Determine if the browser is the YandexCatalog or not + * @return boolean True if the browser is the YandexCatalog otherwise false + */ + protected function checkBrowserYandexCatalogBot() + { + if (stripos($this->_agent, 'YandexCatalog') !== false) { + $aresult = explode('/', stristr($this->_agent, 'YandexCatalog')); + if (isset($aresult[1])) { + $aversion = explode(' ', $aresult[1]); + $this->setVersion(str_replace(';', '', $aversion[0])); + $this->_browser_name = self::BROWSER_YANDEXCATALOG_BOT; + $this->setRobot(true); + return true; + } + } + return false; + } + + /** + * Determine if the browser is the YandexNews or not + * @return boolean True if the browser is the YandexNews otherwise false + */ + protected function checkBrowserYandexNewsBot() + { + if (stripos($this->_agent, 'YandexNews') !== false) { + $aresult = explode('/', stristr($this->_agent, 'YandexNews')); + if (isset($aresult[1])) { + $aversion = explode(' ', $aresult[1]); + $this->setVersion(str_replace(';', '', $aversion[0])); + $this->_browser_name = self::BROWSER_YANDEXNEWS_BOT; + $this->setRobot(true); + return true; + } + } + return false; + } + + /** + * Determine if the browser is the YandexMetrika or not + * @return boolean True if the browser is the YandexMetrika otherwise false + */ + protected function checkBrowserYandexMetrikaBot() + { + if (stripos($this->_agent, 'YandexMetrika') !== false) { + $aresult = explode('/', stristr($this->_agent, 'YandexMetrika')); + if (isset($aresult[1])) { + $aversion = explode(' ', $aresult[1]); + $this->setVersion(str_replace(';', '', $aversion[0])); + $this->_browser_name = self::BROWSER_YANDEXMETRIKA_BOT; + $this->setRobot(true); + return true; + } + } + return false; + } + + /** + * Determine if the browser is the YandexDirect or not + * @return boolean True if the browser is the YandexDirect otherwise false + */ + protected function checkBrowserYandexDirectBot() + { + if (stripos($this->_agent, 'YandexDirect') !== false) { + $aresult = explode('/', stristr($this->_agent, 'YandexDirect')); + if (isset($aresult[1])) { + $aversion = explode(' ', $aresult[1]); + $this->setVersion(str_replace(';', '', $aversion[0])); + $this->_browser_name = self::BROWSER_YANDEXDIRECT_BOT; + $this->setRobot(true); + return true; + } + } + return false; + } + + /** + * Determine if the browser is the YandexWebmaster or not + * @return boolean True if the browser is the YandexWebmaster otherwise false + */ + protected function checkBrowserYandexWebmasterBot() + { + if (stripos($this->_agent, 'YandexWebmaster') !== false) { + $aresult = explode('/', stristr($this->_agent, 'YandexWebmaster')); + if (isset($aresult[1])) { + $aversion = explode(' ', $aresult[1]); + $this->setVersion(str_replace(';', '', $aversion[0])); + $this->_browser_name = self::BROWSER_YANDEXWEBMASTER_BOT; + $this->setRobot(true); + return true; + } + } + return false; + } + + /** + * Determine if the browser is the YandexFavicons or not + * @return boolean True if the browser is the YandexFavicons otherwise false + */ + protected function checkBrowserYandexFaviconsBot() + { + if (stripos($this->_agent, 'YandexFavicons') !== false) { + $aresult = explode('/', stristr($this->_agent, 'YandexFavicons')); + if (isset($aresult[1])) { + $aversion = explode(' ', $aresult[1]); + $this->setVersion(str_replace(';', '', $aversion[0])); + $this->_browser_name = self::BROWSER_YANDEXFAVICONS_BOT; + $this->setRobot(true); + return true; + } + } + return false; + } + + /** + * Determine if the browser is the YandexBlogs or not + * @return boolean True if the browser is the YandexBlogs otherwise false + */ + protected function checkBrowserYandexBlogsBot() + { + if (stripos($this->_agent, 'YandexBlogs') !== false) { + $aresult = explode('/', stristr($this->_agent, 'YandexBlogs')); + if (isset($aresult[1])) { + $aversion = explode(' ', $aresult[1]); + $this->setVersion(str_replace(';', '', $aversion[0])); + $this->_browser_name = self::BROWSER_YANDEXBLOGS_BOT; + $this->setRobot(true); + return true; + } + } + return false; + } + + /** + * Determine if the browser is the YandexMedia or not + * @return boolean True if the browser is the YandexMedia otherwise false + */ + protected function checkBrowserYandexMediaBot() + { + if (stripos($this->_agent, 'YandexMedia') !== false) { + $aresult = explode('/', stristr($this->_agent, 'YandexMedia')); + if (isset($aresult[1])) { + $aversion = explode(' ', $aresult[1]); + $this->setVersion(str_replace(';', '', $aversion[0])); + $this->_browser_name = self::BROWSER_YANDEXMEDIA_BOT; + $this->setRobot(true); + return true; + } + } + return false; + } + + /** + * Determine if the browser is the YandexVideo or not + * @return boolean True if the browser is the YandexVideo otherwise false + */ + protected function checkBrowserYandexVideoBot() + { + if (stripos($this->_agent, 'YandexVideo') !== false) { + $aresult = explode('/', stristr($this->_agent, 'YandexVideo')); + if (isset($aresult[1])) { + $aversion = explode(' ', $aresult[1]); + $this->setVersion(str_replace(';', '', $aversion[0])); + $this->_browser_name = self::BROWSER_YANDEXVIDEO_BOT; + $this->setRobot(true); + return true; + } + } + return false; + } + + /** + * Determine if the browser is the YandexImages or not + * @return boolean True if the browser is the YandexImages otherwise false + */ + protected function checkBrowserYandexImagesBot() + { + if (stripos($this->_agent, 'YandexImages') !== false) { + $aresult = explode('/', stristr($this->_agent, 'YandexImages')); + if (isset($aresult[1])) { + $aversion = explode(' ', $aresult[1]); + $this->setVersion(str_replace(';', '', $aversion[0])); + $this->_browser_name = self::BROWSER_YANDEXIMAGES_BOT; + $this->setRobot(true); + return true; + } + } + return false; + } + + /** + * Determine if the browser is the MSNBot or not (last updated 1.9) + * @return boolean True if the browser is the MSNBot otherwise false + */ + protected function checkBrowserMSNBot() + { + if (stripos($this->_agent, "msnbot") !== false) { + $aresult = explode("/", stristr($this->_agent, "msnbot")); + if (isset($aresult[1])) { + $aversion = explode(" ", $aresult[1]); + $this->setVersion(str_replace(";", "", $aversion[0])); + $this->_browser_name = self::BROWSER_MSNBOT; + $this->setRobot(true); + return true; + } + } + return false; + } + + /** + * Determine if the browser is the BingBot or not (last updated 1.9) + * @return boolean True if the browser is the BingBot otherwise false + */ + protected function checkBrowserBingBot() + { + if (stripos($this->_agent, "bingbot") !== false) { + $aresult = explode("/", stristr($this->_agent, "bingbot")); + if (isset($aresult[1])) { + $aversion = explode(" ", $aresult[1]); + $this->setVersion(str_replace(";", "", $aversion[0])); + $this->_browser_name = self::BROWSER_BINGBOT; + $this->setRobot(true); + return true; + } + } + return false; + } + + /** + * Determine if the browser is the W3C Validator or not (last updated 1.7) + * @return boolean True if the browser is the W3C Validator otherwise false + */ + protected function checkBrowserW3CValidator() + { + if (stripos($this->_agent, 'W3C-checklink') !== false) { + $aresult = explode('/', stristr($this->_agent, 'W3C-checklink')); + if (isset($aresult[1])) { + $aversion = explode(' ', $aresult[1]); + $this->setVersion($aversion[0]); + $this->_browser_name = self::BROWSER_W3CVALIDATOR; + return true; + } + } else if (stripos($this->_agent, 'W3C_Validator') !== false) { + // Some of the Validator versions do not delineate w/ a slash - add it back in + $ua = str_replace("W3C_Validator ", "W3C_Validator/", $this->_agent); + $aresult = explode('/', stristr($ua, 'W3C_Validator')); + if (isset($aresult[1])) { + $aversion = explode(' ', $aresult[1]); + $this->setVersion($aversion[0]); + $this->_browser_name = self::BROWSER_W3CVALIDATOR; + return true; + } + } else if (stripos($this->_agent, 'W3C-mobileOK') !== false) { + $this->_browser_name = self::BROWSER_W3CVALIDATOR; + $this->setMobile(true); + return true; + } + return false; + } + + /** + * Determine if the browser is the Yahoo! Slurp Robot or not (last updated 1.7) + * @return boolean True if the browser is the Yahoo! Slurp Robot otherwise false + */ + protected function checkBrowserSlurp() + { + if (stripos($this->_agent, 'slurp') !== false) { + $aresult = explode('/', stristr($this->_agent, 'Slurp')); + if (isset($aresult[1])) { + $aversion = explode(' ', $aresult[1]); + $this->setVersion($aversion[0]); + $this->_browser_name = self::BROWSER_SLURP; + $this->setRobot(true); + $this->setMobile(false); + return true; + } + } + return false; + } + + /** + * Determine if the browser is Edge or not + * @return boolean True if the browser is Edge otherwise false + */ + protected function checkBrowserEdge() + { + if (stripos($this->_agent, 'Edge/') !== false) { + $aresult = explode('/', stristr($this->_agent, 'Edge')); + if (isset($aresult[1])) { + $aversion = explode(' ', $aresult[1]); + $this->setVersion($aversion[0]); + $this->setBrowser(self::BROWSER_EDGE); + if (stripos($this->_agent, 'Windows Phone') !== false || stripos($this->_agent, 'Android') !== false) { + $this->setMobile(true); + } + return true; + } + } + return false; + } + + /** + * Determine if the browser is Internet Explorer or not (last updated 1.7) + * @return boolean True if the browser is Internet Explorer otherwise false + */ + protected function checkBrowserInternetExplorer() + { + // Test for IE11 + if (stripos($this->_agent, 'Trident/7.0; rv:11.0') !== false) { + $this->setBrowser(self::BROWSER_IE); + $this->setVersion('11.0'); + return true; + } // Test for v1 - v1.5 IE + else if (stripos($this->_agent, 'microsoft internet explorer') !== false) { + $this->setBrowser(self::BROWSER_IE); + $this->setVersion('1.0'); + $aresult = stristr($this->_agent, '/'); + if (preg_match('/308|425|426|474|0b1/i', $aresult)) { + $this->setVersion('1.5'); + } + return true; + } // Test for versions > 1.5 + else if (stripos($this->_agent, 'msie') !== false && stripos($this->_agent, 'opera') === false) { + // See if the browser is the odd MSN Explorer + if (stripos($this->_agent, 'msnb') !== false) { + $aresult = explode(' ', stristr(str_replace(';', '; ', $this->_agent), 'MSN')); + if (isset($aresult[1])) { + $this->setBrowser(self::BROWSER_MSN); + $this->setVersion(str_replace(array('(', ')', ';'), '', $aresult[1])); + return true; + } + } + $aresult = explode(' ', stristr(str_replace(';', '; ', $this->_agent), 'msie')); + if (isset($aresult[1])) { + $this->setBrowser(self::BROWSER_IE); + $this->setVersion(str_replace(array('(', ')', ';'), '', $aresult[1])); + if (preg_match('#trident/([0-9\.]+);#i', $this->_agent, $aresult)) { + if ($aresult[1] == '3.1') { + $this->setVersion('7.0'); + } else if ($aresult[1] == '4.0') { + $this->setVersion('8.0'); + } else if ($aresult[1] == '5.0') { + $this->setVersion('9.0'); + } else if ($aresult[1] == '6.0') { + $this->setVersion('10.0'); + } else if ($aresult[1] == '7.0') { + $this->setVersion('11.0'); + } else if ($aresult[1] == '8.0') { + $this->setVersion('11.0'); + } + } + if (stripos($this->_agent, 'IEMobile') !== false) { + $this->setBrowser(self::BROWSER_POCKET_IE); + $this->setMobile(true); + } + return true; + } + } // Test for versions > IE 10 + else if (stripos($this->_agent, 'trident') !== false) { + $this->setBrowser(self::BROWSER_IE); + $result = explode('rv:', $this->_agent); + if (isset($result[1])) { + $this->setVersion(preg_replace('/[^0-9.]+/', '', $result[1])); + $this->_agent = str_replace(array("Mozilla", "Gecko"), "MSIE", $this->_agent); + } + } // Test for Pocket IE + else if (stripos($this->_agent, 'mspie') !== false || stripos($this->_agent, 'pocket') !== false) { + $aresult = explode(' ', stristr($this->_agent, 'mspie')); + if (isset($aresult[1])) { + $this->setPlatform(self::PLATFORM_WINDOWS_CE); + $this->setBrowser(self::BROWSER_POCKET_IE); + $this->setMobile(true); + + if (stripos($this->_agent, 'mspie') !== false) { + $this->setVersion($aresult[1]); + } else { + $aversion = explode('/', $this->_agent); + if (isset($aversion[1])) { + $this->setVersion($aversion[1]); + } + } + return true; + } + } + return false; + } + + /** + * Determine if the browser is Opera or not (last updated 1.7) + * @return boolean True if the browser is Opera otherwise false + */ + protected function checkBrowserOpera() + { + if (stripos($this->_agent, 'opera mini') !== false) { + $resultant = stristr($this->_agent, 'opera mini'); + if (preg_match('/\//', $resultant)) { + $aresult = explode('/', $resultant); + if (isset($aresult[1])) { + $aversion = explode(' ', $aresult[1]); + $this->setVersion($aversion[0]); + } + } else { + $aversion = explode(' ', stristr($resultant, 'opera mini')); + if (isset($aversion[1])) { + $this->setVersion($aversion[1]); + } + } + $this->_browser_name = self::BROWSER_OPERA_MINI; + $this->setMobile(true); + return true; + } else if (stripos($this->_agent, 'opera') !== false) { + $resultant = stristr($this->_agent, 'opera'); + if (preg_match('/Version\/(1*.*)$/', $resultant, $matches)) { + $this->setVersion($matches[1]); + } else if (preg_match('/\//', $resultant)) { + $aresult = explode('/', str_replace("(", " ", $resultant)); + if (isset($aresult[1])) { + $aversion = explode(' ', $aresult[1]); + $this->setVersion($aversion[0]); + } + } else { + $aversion = explode(' ', stristr($resultant, 'opera')); + $this->setVersion(isset($aversion[1]) ? $aversion[1] : ""); + } + if (stripos($this->_agent, 'Opera Mobi') !== false) { + $this->setMobile(true); + } + $this->_browser_name = self::BROWSER_OPERA; + return true; + } else if (stripos($this->_agent, 'OPR') !== false) { + $resultant = stristr($this->_agent, 'OPR'); + if (preg_match('/\//', $resultant)) { + $aresult = explode('/', str_replace("(", " ", $resultant)); + if (isset($aresult[1])) { + $aversion = explode(' ', $aresult[1]); + $this->setVersion($aversion[0]); + } + } + if (stripos($this->_agent, 'Mobile') !== false) { + $this->setMobile(true); + } + $this->_browser_name = self::BROWSER_OPERA; + return true; + } + return false; + } + + /** + * Determine if the browser is Chrome or not (last updated 1.7) + * @return boolean True if the browser is Chrome otherwise false + */ + protected function checkBrowserChrome() + { + if (stripos($this->_agent, 'Chrome') !== false) { + $aresult = explode('/', stristr($this->_agent, 'Chrome')); + if (isset($aresult[1])) { + $aversion = explode(' ', $aresult[1]); + $this->setVersion($aversion[0]); + $this->setBrowser(self::BROWSER_CHROME); + //Chrome on Android + if (stripos($this->_agent, 'Android') !== false) { + if (stripos($this->_agent, 'Mobile') !== false) { + $this->setMobile(true); + } else { + $this->setTablet(true); + } + } + return true; + } + } + return false; + } + + + /** + * Determine if the browser is WebTv or not (last updated 1.7) + * @return boolean True if the browser is WebTv otherwise false + */ + protected function checkBrowserWebTv() + { + if (stripos($this->_agent, 'webtv') !== false) { + $aresult = explode('/', stristr($this->_agent, 'webtv')); + if (isset($aresult[1])) { + $aversion = explode(' ', $aresult[1]); + $this->setVersion($aversion[0]); + $this->setBrowser(self::BROWSER_WEBTV); + return true; + } + } + return false; + } + + /** + * Determine if the browser is NetPositive or not (last updated 1.7) + * @return boolean True if the browser is NetPositive otherwise false + */ + protected function checkBrowserNetPositive() + { + if (stripos($this->_agent, 'NetPositive') !== false) { + $aresult = explode('/', stristr($this->_agent, 'NetPositive')); + if (isset($aresult[1])) { + $aversion = explode(' ', $aresult[1]); + $this->setVersion(str_replace(array('(', ')', ';'), '', $aversion[0])); + $this->setBrowser(self::BROWSER_NETPOSITIVE); + return true; + } + } + return false; + } + + /** + * Determine if the browser is Galeon or not (last updated 1.7) + * @return boolean True if the browser is Galeon otherwise false + */ + protected function checkBrowserGaleon() + { + if (stripos($this->_agent, 'galeon') !== false) { + $aresult = explode(' ', stristr($this->_agent, 'galeon')); + $aversion = explode('/', $aresult[0]); + if (isset($aversion[1])) { + $this->setVersion($aversion[1]); + $this->setBrowser(self::BROWSER_GALEON); + return true; + } + } + return false; + } + + /** + * Determine if the browser is Konqueror or not (last updated 1.7) + * @return boolean True if the browser is Konqueror otherwise false + */ + protected function checkBrowserKonqueror() + { + if (stripos($this->_agent, 'Konqueror') !== false) { + $aresult = explode(' ', stristr($this->_agent, 'Konqueror')); + $aversion = explode('/', $aresult[0]); + if (isset($aversion[1])) { + $this->setVersion($aversion[1]); + $this->setBrowser(self::BROWSER_KONQUEROR); + return true; + } + } + return false; + } + + /** + * Determine if the browser is iCab or not (last updated 1.7) + * @return boolean True if the browser is iCab otherwise false + */ + protected function checkBrowserIcab() + { + if (stripos($this->_agent, 'icab') !== false) { + $aversion = explode(' ', stristr(str_replace('/', ' ', $this->_agent), 'icab')); + if (isset($aversion[1])) { + $this->setVersion($aversion[1]); + $this->setBrowser(self::BROWSER_ICAB); + return true; + } + } + return false; + } + + /** + * Determine if the browser is OmniWeb or not (last updated 1.7) + * @return boolean True if the browser is OmniWeb otherwise false + */ + protected function checkBrowserOmniWeb() + { + if (stripos($this->_agent, 'omniweb') !== false) { + $aresult = explode('/', stristr($this->_agent, 'omniweb')); + $aversion = explode(' ', isset($aresult[1]) ? $aresult[1] : ""); + $this->setVersion($aversion[0]); + $this->setBrowser(self::BROWSER_OMNIWEB); + return true; + } + return false; + } + + /** + * Determine if the browser is Phoenix or not (last updated 1.7) + * @return boolean True if the browser is Phoenix otherwise false + */ + protected function checkBrowserPhoenix() + { + if (stripos($this->_agent, 'Phoenix') !== false) { + $aversion = explode('/', stristr($this->_agent, 'Phoenix')); + if (isset($aversion[1])) { + $this->setVersion($aversion[1]); + $this->setBrowser(self::BROWSER_PHOENIX); + return true; + } + } + return false; + } + + /** + * Determine if the browser is Firebird or not (last updated 1.7) + * @return boolean True if the browser is Firebird otherwise false + */ + protected function checkBrowserFirebird() + { + if (stripos($this->_agent, 'Firebird') !== false) { + $aversion = explode('/', stristr($this->_agent, 'Firebird')); + if (isset($aversion[1])) { + $this->setVersion($aversion[1]); + $this->setBrowser(self::BROWSER_FIREBIRD); + return true; + } + } + return false; + } + + /** + * Determine if the browser is Netscape Navigator 9+ or not (last updated 1.7) + * NOTE: (http://browser.netscape.com/ - Official support ended on March 1st, 2008) + * @return boolean True if the browser is Netscape Navigator 9+ otherwise false + */ + protected function checkBrowserNetscapeNavigator9Plus() + { + if (stripos($this->_agent, 'Firefox') !== false && preg_match('/Navigator\/([^ ]*)/i', $this->_agent, $matches)) { + $this->setVersion($matches[1]); + $this->setBrowser(self::BROWSER_NETSCAPE_NAVIGATOR); + return true; + } else if (stripos($this->_agent, 'Firefox') === false && preg_match('/Netscape6?\/([^ ]*)/i', $this->_agent, $matches)) { + $this->setVersion($matches[1]); + $this->setBrowser(self::BROWSER_NETSCAPE_NAVIGATOR); + return true; + } + return false; + } + + /** + * Determine if the browser is Shiretoko or not (https://wiki.mozilla.org/Projects/shiretoko) (last updated 1.7) + * @return boolean True if the browser is Shiretoko otherwise false + */ + protected function checkBrowserShiretoko() + { + if (stripos($this->_agent, 'Mozilla') !== false && preg_match('/Shiretoko\/([^ ]*)/i', $this->_agent, $matches)) { + $this->setVersion($matches[1]); + $this->setBrowser(self::BROWSER_SHIRETOKO); + return true; + } + return false; + } + + /** + * Determine if the browser is Ice Cat or not (http://en.wikipedia.org/wiki/GNU_IceCat) (last updated 1.7) + * @return boolean True if the browser is Ice Cat otherwise false + */ + protected function checkBrowserIceCat() + { + if (stripos($this->_agent, 'Mozilla') !== false && preg_match('/IceCat\/([^ ]*)/i', $this->_agent, $matches)) { + $this->setVersion($matches[1]); + $this->setBrowser(self::BROWSER_ICECAT); + return true; + } + return false; + } + + /** + * Determine if the browser is Nokia or not (last updated 1.7) + * @return boolean True if the browser is Nokia otherwise false + */ + protected function checkBrowserNokia() + { + if (preg_match("/Nokia([^\/]+)\/([^ SP]+)/i", $this->_agent, $matches)) { + $this->setVersion($matches[2]); + if (stripos($this->_agent, 'Series60') !== false || strpos($this->_agent, 'S60') !== false) { + $this->setBrowser(self::BROWSER_NOKIA_S60); + } else { + $this->setBrowser(self::BROWSER_NOKIA); + } + $this->setMobile(true); + return true; + } + return false; + } + + /** + * Determine if the browser is Firefox or not (last updated 1.7) + * @return boolean True if the browser is Firefox otherwise false + */ + protected function checkBrowserFirefox() + { + if (stripos($this->_agent, 'safari') === false) { + if (preg_match("/Firefox[\/ \(]([^ ;\)]+)/i", $this->_agent, $matches)) { + $this->setVersion($matches[1]); + $this->setBrowser(self::BROWSER_FIREFOX); + //Firefox on Android + if (stripos($this->_agent, 'Android') !== false) { + if (stripos($this->_agent, 'Mobile') !== false) { + $this->setMobile(true); + } else { + $this->setTablet(true); + } + } + return true; + } else if (preg_match("/Firefox$/i", $this->_agent, $matches)) { + $this->setVersion(""); + $this->setBrowser(self::BROWSER_FIREFOX); + return true; + } + } + return false; + } + + /** + * Determine if the browser is Firefox or not (last updated 1.7) + * @return boolean True if the browser is Firefox otherwise false + */ + protected function checkBrowserIceweasel() + { + if (stripos($this->_agent, 'Iceweasel') !== false) { + $aresult = explode('/', stristr($this->_agent, 'Iceweasel')); + if (isset($aresult[1])) { + $aversion = explode(' ', $aresult[1]); + $this->setVersion($aversion[0]); + $this->setBrowser(self::BROWSER_ICEWEASEL); + return true; + } + } + return false; + } + + /** + * Determine if the browser is Mozilla or not (last updated 1.7) + * @return boolean True if the browser is Mozilla otherwise false + */ + protected function checkBrowserMozilla() + { + if (stripos($this->_agent, 'mozilla') !== false && preg_match('/rv:[0-9].[0-9][a-b]?/i', $this->_agent) && stripos($this->_agent, 'netscape') === false) { + $aversion = explode(' ', stristr($this->_agent, 'rv:')); + preg_match('/rv:[0-9].[0-9][a-b]?/i', $this->_agent, $aversion); + $this->setVersion(str_replace('rv:', '', $aversion[0])); + $this->setBrowser(self::BROWSER_MOZILLA); + return true; + } else if (stripos($this->_agent, 'mozilla') !== false && preg_match('/rv:[0-9]\.[0-9]/i', $this->_agent) && stripos($this->_agent, 'netscape') === false) { + $aversion = explode('', stristr($this->_agent, 'rv:')); + $this->setVersion(str_replace('rv:', '', $aversion[0])); + $this->setBrowser(self::BROWSER_MOZILLA); + return true; + } else if (stripos($this->_agent, 'mozilla') !== false && preg_match('/mozilla\/([^ ]*)/i', $this->_agent, $matches) && stripos($this->_agent, 'netscape') === false) { + $this->setVersion($matches[1]); + $this->setBrowser(self::BROWSER_MOZILLA); + return true; + } + return false; + } + + /** + * Determine if the browser is Lynx or not (last updated 1.7) + * @return boolean True if the browser is Lynx otherwise false + */ + protected function checkBrowserLynx() + { + if (stripos($this->_agent, 'lynx') !== false) { + $aresult = explode('/', stristr($this->_agent, 'Lynx')); + $aversion = explode(' ', (isset($aresult[1]) ? $aresult[1] : "")); + $this->setVersion($aversion[0]); + $this->setBrowser(self::BROWSER_LYNX); + return true; + } + return false; + } + + /** + * Determine if the browser is Amaya or not (last updated 1.7) + * @return boolean True if the browser is Amaya otherwise false + */ + protected function checkBrowserAmaya() + { + if (stripos($this->_agent, 'amaya') !== false) { + $aresult = explode('/', stristr($this->_agent, 'Amaya')); + if (isset($aresult[1])) { + $aversion = explode(' ', $aresult[1]); + $this->setVersion($aversion[0]); + $this->setBrowser(self::BROWSER_AMAYA); + return true; + } + } + return false; + } + + /** + * Determine if the browser is Safari or not (last updated 1.7) + * @return boolean True if the browser is Safari otherwise false + */ + protected function checkBrowserSafari() + { + if (stripos($this->_agent, 'Safari') !== false + && stripos($this->_agent, 'iPhone') === false + && stripos($this->_agent, 'iPod') === false + ) { + + $aresult = explode('/', stristr($this->_agent, 'Version')); + if (isset($aresult[1])) { + $aversion = explode(' ', $aresult[1]); + $this->setVersion($aversion[0]); + } else { + $this->setVersion(self::VERSION_UNKNOWN); + } + $this->setBrowser(self::BROWSER_SAFARI); + return true; + } + return false; + } + + protected function checkBrowserSamsung() + { + if (stripos($this->_agent, 'SamsungBrowser') !== false) { + + $aresult = explode('/', stristr($this->_agent, 'SamsungBrowser')); + if (isset($aresult[1])) { + $aversion = explode(' ', $aresult[1]); + $this->setVersion($aversion[0]); + } else { + $this->setVersion(self::VERSION_UNKNOWN); + } + $this->setBrowser(self::BROWSER_SAMSUNG); + return true; + } + return false; + } + + protected function checkBrowserSilk() + { + if (stripos($this->_agent, 'Silk') !== false) { + $aresult = explode('/', stristr($this->_agent, 'Silk')); + if (isset($aresult[1])) { + $aversion = explode(' ', $aresult[1]); + $this->setVersion($aversion[0]); + } else { + $this->setVersion(self::VERSION_UNKNOWN); + } + $this->setBrowser(self::BROWSER_SILK); + return true; + } + return false; + } + + protected function checkBrowserIframely() + { + if (stripos($this->_agent, 'Iframely') !== false) { + $aresult = explode('/', stristr($this->_agent, 'Iframely')); + if (isset($aresult[1])) { + $aversion = explode(' ', $aresult[1]); + $this->setVersion($aversion[0]); + } else { + $this->setVersion(self::VERSION_UNKNOWN); + } + $this->setBrowser(self::BROWSER_I_FRAME); + return true; + } + return false; + } + + protected function checkBrowserCocoa() + { + if (stripos($this->_agent, 'CocoaRestClient') !== false) { + $aresult = explode('/', stristr($this->_agent, 'CocoaRestClient')); + if (isset($aresult[1])) { + $aversion = explode(' ', $aresult[1]); + $this->setVersion($aversion[0]); + } else { + $this->setVersion(self::VERSION_UNKNOWN); + } + $this->setBrowser(self::BROWSER_COCOA); + return true; + } + return false; + } + + /** + * Detect if URL is loaded from FacebookExternalHit + * @return boolean True if it detects FacebookExternalHit otherwise false + */ + protected function checkFacebookExternalHit() + { + if (stristr($this->_agent, 'FacebookExternalHit')) { + $this->setRobot(true); + $this->setFacebook(true); + return true; + } + return false; + } + + /** + * Detect if URL is being loaded from internal Facebook browser + * @return boolean True if it detects internal Facebook browser otherwise false + */ + protected function checkForFacebookIos() + { + if (stristr($this->_agent, 'FBIOS')) { + $this->setFacebook(true); + return true; + } + return false; + } + + /** + * Detect Version for the Safari browser on iOS devices + * @return boolean True if it detects the version correctly otherwise false + */ + protected function getSafariVersionOnIos() + { + $aresult = explode('/', stristr($this->_agent, 'Version')); + if (isset($aresult[1])) { + $aversion = explode(' ', $aresult[1]); + $this->setVersion($aversion[0]); + return true; + } + return false; + } + + /** + * Detect Version for the Chrome browser on iOS devices + * @return boolean True if it detects the version correctly otherwise false + */ + protected function getChromeVersionOnIos() + { + $aresult = explode('/', stristr($this->_agent, 'CriOS')); + if (isset($aresult[1])) { + $aversion = explode(' ', $aresult[1]); + $this->setVersion($aversion[0]); + $this->setBrowser(self::BROWSER_CHROME); + return true; + } + return false; + } + + /** + * Determine if the browser is iPhone or not (last updated 1.7) + * @return boolean True if the browser is iPhone otherwise false + */ + protected function checkBrowseriPhone() + { + if (stripos($this->_agent, 'iPhone') !== false) { + $this->setVersion(self::VERSION_UNKNOWN); + $this->setBrowser(self::BROWSER_IPHONE); + $this->getSafariVersionOnIos(); + $this->getChromeVersionOnIos(); + $this->checkForFacebookIos(); + $this->setMobile(true); + return true; + + } + return false; + } + + /** + * Determine if the browser is iPad or not (last updated 1.7) + * @return boolean True if the browser is iPad otherwise false + */ + protected function checkBrowseriPad() + { + if (stripos($this->_agent, 'iPad') !== false) { + $this->setVersion(self::VERSION_UNKNOWN); + $this->setBrowser(self::BROWSER_IPAD); + $this->getSafariVersionOnIos(); + $this->getChromeVersionOnIos(); + $this->checkForFacebookIos(); + $this->setTablet(true); + return true; + } + return false; + } + + /** + * Determine if the browser is iPod or not (last updated 1.7) + * @return boolean True if the browser is iPod otherwise false + */ + protected function checkBrowseriPod() + { + if (stripos($this->_agent, 'iPod') !== false) { + $this->setVersion(self::VERSION_UNKNOWN); + $this->setBrowser(self::BROWSER_IPOD); + $this->getSafariVersionOnIos(); + $this->getChromeVersionOnIos(); + $this->checkForFacebookIos(); + $this->setMobile(true); + return true; + } + return false; + } + + /** + * Determine if the browser is Android or not (last updated 1.7) + * @return boolean True if the browser is Android otherwise false + */ + protected function checkBrowserAndroid() + { + if (stripos($this->_agent, 'Android') !== false) { + $aresult = explode(' ', stristr($this->_agent, 'Android')); + if (isset($aresult[1])) { + $aversion = explode(' ', $aresult[1]); + $this->setVersion($aversion[0]); + } else { + $this->setVersion(self::VERSION_UNKNOWN); + } + if (stripos($this->_agent, 'Mobile') !== false) { + $this->setMobile(true); + } else { + $this->setTablet(true); + } + $this->setBrowser(self::BROWSER_ANDROID); + return true; + } + return false; + } + + /** + * Determine if the browser is Vivaldi + * @return boolean True if the browser is Vivaldi otherwise false + */ + protected function checkBrowserVivaldi() + { + if (stripos($this->_agent, 'Vivaldi') !== false) { + $aresult = explode('/', stristr($this->_agent, 'Vivaldi')); + if (isset($aresult[1])) { + $aversion = explode(' ', $aresult[1]); + $this->setVersion($aversion[0]); + $this->setBrowser(self::BROWSER_VIVALDI); + return true; + } + } + return false; + } + + /** + * Determine if the browser is Yandex + * @return boolean True if the browser is Yandex otherwise false + */ + protected function checkBrowserYandex() + { + if (stripos($this->_agent, 'YaBrowser') !== false) { + $aresult = explode('/', stristr($this->_agent, 'YaBrowser')); + if (isset($aresult[1])) { + $aversion = explode(' ', $aresult[1]); + $this->setVersion($aversion[0]); + $this->setBrowser(self::BROWSER_YANDEX); + + if (stripos($this->_agent, 'iPad') !== false) { + $this->setTablet(true); + } elseif (stripos($this->_agent, 'Mobile') !== false) { + $this->setMobile(true); + } elseif (stripos($this->_agent, 'Android') !== false) { + $this->setTablet(true); + } + + return true; + } + } + + return false; + } + + /** + * Determine if the browser is a PlayStation + * @return boolean True if the browser is PlayStation otherwise false + */ + protected function checkBrowserPlayStation() + { + if (stripos($this->_agent, 'PlayStation ') !== false) { + $aresult = explode(' ', stristr($this->_agent, 'PlayStation ')); + $this->setBrowser(self::BROWSER_PLAYSTATION); + if (isset($aresult[0])) { + $aversion = explode(')', $aresult[2]); + $this->setVersion($aversion[0]); + if (stripos($this->_agent, 'Portable)') !== false || stripos($this->_agent, 'Vita') !== false) { + $this->setMobile(true); + } + return true; + } + } + return false; + } + + /** + * Determine the user's platform (last updated 2.0) + */ + protected function checkPlatform() + { + if (stripos($this->_agent, 'windows') !== false) { + $this->_platform = self::PLATFORM_WINDOWS; + } else if (stripos($this->_agent, 'iPad') !== false) { + $this->_platform = self::PLATFORM_IPAD; + } else if (stripos($this->_agent, 'iPod') !== false) { + $this->_platform = self::PLATFORM_IPOD; + } else if (stripos($this->_agent, 'iPhone') !== false) { + $this->_platform = self::PLATFORM_IPHONE; + } elseif (stripos($this->_agent, 'mac') !== false) { + $this->_platform = self::PLATFORM_APPLE; + } elseif (stripos($this->_agent, 'android') !== false) { + $this->_platform = self::PLATFORM_ANDROID; + } elseif (stripos($this->_agent, 'Silk') !== false) { + $this->_platform = self::PLATFORM_FIRE_OS; + } elseif (stripos($this->_agent, 'linux') !== false && stripos($this->_agent, 'SMART-TV') !== false) { + $this->_platform = self::PLATFORM_LINUX . '/' . self::PLATFORM_SMART_TV; + } elseif (stripos($this->_agent, 'linux') !== false) { + $this->_platform = self::PLATFORM_LINUX; + } else if (stripos($this->_agent, 'Nokia') !== false) { + $this->_platform = self::PLATFORM_NOKIA; + } else if (stripos($this->_agent, 'BlackBerry') !== false) { + $this->_platform = self::PLATFORM_BLACKBERRY; + } elseif (stripos($this->_agent, 'FreeBSD') !== false) { + $this->_platform = self::PLATFORM_FREEBSD; + } elseif (stripos($this->_agent, 'OpenBSD') !== false) { + $this->_platform = self::PLATFORM_OPENBSD; + } elseif (stripos($this->_agent, 'NetBSD') !== false) { + $this->_platform = self::PLATFORM_NETBSD; + } elseif (stripos($this->_agent, 'OpenSolaris') !== false) { + $this->_platform = self::PLATFORM_OPENSOLARIS; + } elseif (stripos($this->_agent, 'SunOS') !== false) { + $this->_platform = self::PLATFORM_SUNOS; + } elseif (stripos($this->_agent, 'OS\/2') !== false) { + $this->_platform = self::PLATFORM_OS2; + } elseif (stripos($this->_agent, 'BeOS') !== false) { + $this->_platform = self::PLATFORM_BEOS; + } elseif (stripos($this->_agent, 'win') !== false) { + $this->_platform = self::PLATFORM_WINDOWS; + } elseif (stripos($this->_agent, 'Playstation') !== false) { + $this->_platform = self::PLATFORM_PLAYSTATION; + } elseif (stripos($this->_agent, 'Roku') !== false) { + $this->_platform = self::PLATFORM_ROKU; + } elseif (stripos($this->_agent, 'iOS') !== false) { + $this->_platform = self::PLATFORM_IPHONE . '/' . self::PLATFORM_IPAD; + } elseif (stripos($this->_agent, 'tvOS') !== false) { + $this->_platform = self::PLATFORM_APPLE_TV; + } elseif (stripos($this->_agent, 'curl') !== false) { + $this->_platform = self::PLATFORM_TERMINAL; + } elseif (stripos($this->_agent, 'CrOS') !== false) { + $this->_platform = self::PLATFORM_CHROME_OS; + } elseif (stripos($this->_agent, 'okhttp') !== false) { + $this->_platform = self::PLATFORM_JAVA_ANDROID; + } elseif (stripos($this->_agent, 'PostmanRuntime') !== false) { + $this->_platform = self::PLATFORM_POSTMAN; + } elseif (stripos($this->_agent, 'Iframely') !== false) { + $this->_platform = self::PLATFORM_I_FRAME; + } + + } + } +} \ No newline at end of file diff --git a/libraries/index.html b/libraries/index.html new file mode 100644 index 0000000..566549b --- /dev/null +++ b/libraries/index.html @@ -0,0 +1,10 @@ + + + + + Title + + + + + \ No newline at end of file diff --git a/libraries/plugins/IDS/.htaccess b/libraries/plugins/IDS/.htaccess new file mode 100644 index 0000000..878d02a --- /dev/null +++ b/libraries/plugins/IDS/.htaccess @@ -0,0 +1,5 @@ +# in case PHPIDS is placed in the web-root +deny from all + +# silence is golden +php_flag display_errors off \ No newline at end of file diff --git a/libraries/plugins/IDS/Caching/Apc.php b/libraries/plugins/IDS/Caching/Apc.php new file mode 100644 index 0000000..405aca3 --- /dev/null +++ b/libraries/plugins/IDS/Caching/Apc.php @@ -0,0 +1,151 @@ +. + * + * PHP version 5.1.6+ + * + * @category Security + * @package PHPIDS + * @author Mario Heiderich + * @author Christian Matthies + * @author Lars Strojny + * @license http://www.gnu.org/licenses/lgpl.html LGPL + * @link http://php-ids.org/ + */ + +require_once 'IDS/Caching/Interface.php'; + +/** + * APC caching wrapper + * + * This class inhabits functionality to get and set cache via memcached. + * + * @category Security + * @package PHPIDS + * @author Yves Berkholz + * @copyright 2007-2009 The PHPIDS Groupoup + * @license http://www.gnu.org/licenses/lgpl.html LGPL + * @version Release: $Id$ + * @link http://php-ids.org/ + * @since Version 0.6.5 + */ +class IDS_Caching_Apc implements IDS_Caching_Interface +{ + + /** + * Caching type + * + * @var string + */ + private $type = null; + + /** + * Cache configuration + * + * @var array + */ + private $config = null; + + /** + * Flag if the filter storage has been found in memcached + * + * @var boolean + */ + private $isCached = false; + + /** + * Holds an instance of this class + * + * @var object + */ + private static $cachingInstance = null; + + + /** + * Constructor + * + * @param string $type caching type + * @param array $init the IDS_Init object + * + * @return void + */ + public function __construct($type, $init) + { + + $this->type = $type; + $this->config = $init->config['Caching']; + } + + /** + * Returns an instance of this class + * + * @param string $type caching type + * @param object $init the IDS_Init object + * + * @return object $this + */ + public static function getInstance($type, $init) + { + + if (!self::$cachingInstance) { + self::$cachingInstance = new IDS_Caching_Apc($type, $init); + } + + return self::$cachingInstance; + } + + /** + * Writes cache data + * + * @param array $data the caching data + * + * @return object $this + */ + public function setCache(array $data) + { + if(!$this->isCached) + apc_store($this->config['key_prefix'] . '.storage', + $data, $this->config['expiration_time']); + return $this; + } + + /** + * Returns the cached data + * + * Note that this method returns false if either type or file cache is + * not set + * + * @return mixed cache data or false + */ + public function getCache() + { + $data = apc_fetch($this->config['key_prefix'] . '.storage'); + $this->isCached = !empty($data); + return $data; + } +} + +/** + * Local variables: + * tab-width: 4 + * c-basic-offset: 4 + * End: + * vim600: sw=4 ts=4 expandtab + */ diff --git a/libraries/plugins/IDS/Caching/Database.php b/libraries/plugins/IDS/Caching/Database.php new file mode 100644 index 0000000..86b7498 --- /dev/null +++ b/libraries/plugins/IDS/Caching/Database.php @@ -0,0 +1,291 @@ +. + * + * PHP version 5.1.6+ + * + * @category Security + * @package PHPIDS + * @author Mario Heiderich + * @author Christian Matthies + * @author Lars Strojny + * @license http://www.gnu.org/licenses/lgpl.html LGPL + * @link http://php-ids.org/ + */ + +require_once 'IDS/Caching/Interface.php'; + +/** + * Needed SQL: + * + + #create the database + + CREATE DATABASE IF NOT EXISTS `phpids` DEFAULT CHARACTER + SET utf8 COLLATE utf8_general_ci; + DROP TABLE IF EXISTS `cache`; + + #now select the created datbase and create the table + + CREATE TABLE `cache` ( + `type` VARCHAR( 32 ) NOT null , + `data` TEXT NOT null , + `created` DATETIME NOT null , + `modified` DATETIME NOT null + ) ENGINE = MYISAM ; + */ + +/** + * Database caching wrapper + * + * This class inhabits functionality to get and set cache via a database. + * + * @category Security + * @package PHPIDS + * @author Christian Matthies + * @author Mario Heiderich + * @author Lars Strojny + * @copyright 2007-2009 The PHPIDS Groupup + * @license http://www.gnu.org/licenses/lgpl.html LGPL + * @version Release: $Id:Database.php 517 2007-09-15 15:04:13Z mario $ + * @link http://php-ids.org/ + * @since Version 0.4 + */ +class IDS_Caching_Database implements IDS_Caching_Interface +{ + + /** + * Caching type + * + * @var string + */ + private $type = null; + + /** + * Cache configuration + * + * @var array + */ + private $config = null; + + /** + * DBH + * + * @var object + */ + private $handle = null; + + /** + * Holds an instance of this class + * + * @var object + */ + private static $cachingInstance = null; + + /** + * Constructor + * + * Connects to database. + * + * @param string $type caching type + * @param object $init the IDS_Init object + * + * @return void + */ + public function __construct($type, $init) + { + + $this->type = $type; + $this->config = $init->config['Caching']; + $this->handle = $this->_connect(); + } + + /** + * Returns an instance of this class + * + * @static + * @param string $type caching type + * @param object $init the IDS_Init object + * + * @return object $this + */ + public static function getInstance($type, $init) + { + + if (!self::$cachingInstance) { + self::$cachingInstance = new IDS_Caching_Database($type, $init); + } + return self::$cachingInstance; + } + + /** + * Writes cache data into the database + * + * @param array $data the caching data + * + * @throws PDOException if a db error occurred + * @return object $this + */ + public function setCache(array $data) + { + + $handle = $this->handle; + + $rows = $handle->query('SELECT created FROM `' . + $this->config['table'].'`'); + + if (!$rows || $rows->rowCount() === 0) { + + $this->_write($handle, $data); + } else { + + foreach ($rows as $row) { + + if ((time()-strtotime($row['created'])) > + $this->config['expiration_time']) { + + $this->_write($handle, $data); + } + } + } + + return $this; + } + + /** + * Returns the cached data + * + * Note that this method returns false if either type or file cache is + * not set + * + * @throws PDOException if a db error occurred + * @return mixed cache data or false + */ + public function getCache() + { + + try{ + $handle = $this->handle; + $result = $handle->prepare('SELECT * FROM `' . + $this->config['table'] . + '` where type=?'); + $result->execute(array($this->type)); + + foreach ($result as $row) { + return unserialize($row['data']); + } + + } catch (PDOException $e) { + throw new PDOException('PDOException: ' . $e->getMessage()); + } + return false; + } + + /** + * Connect to database and return a handle + * + * @return object PDO + * @throws Exception if connection parameters are faulty + * @throws PDOException if a db error occurred + */ + private function _connect() + { + + // validate connection parameters + if (!$this->config['wrapper'] + || !$this->config['user'] + || !$this->config['password'] + || !$this->config['table']) { + + throw new Exception(' + Insufficient connection parameters' + ); + } + + // try to connect + try { + $handle = new PDO( + $this->config['wrapper'], + $this->config['user'], + $this->config['password'] + ); + $handle->setAttribute( + PDO::MYSQL_ATTR_USE_BUFFERED_QUERY, true + ); + + } catch (PDOException $e) { + throw new PDOException('PDOException: ' . $e->getMessage()); + } + return $handle; + } + + /** + * Write the cache data to the table + * + * @param object $handle the database handle + * @param array $data the caching data + * + * @return object PDO + * @throws PDOException if a db error occurred + */ + private function _write($handle, $data) + { + + try { + $handle->query('TRUNCATE ' . + $this->config['table'].''); + $statement = $handle->prepare(' + INSERT INTO `' . + $this->config['table'].'` ( + type, + data, + created, + modified + ) + VALUES ( + :type, + :data, + now(), + now() + ) + '); + + $statement->bindParam('type', + $handle->quote($this->type)); + $statement->bindParam('data', serialize($data)); + + if (!$statement->execute()) { + throw new PDOException($statement->errorCode()); + } + + } catch (PDOException $e) { + throw new PDOException('PDOException: ' . $e->getMessage()); + } + } +} + +/** + * Local variables: + * tab-width: 4 + * c-basic-offset: 4 + * End: + * vim600: sw=4 ts=4 expandtab + */ diff --git a/libraries/plugins/IDS/Caching/Factory.php b/libraries/plugins/IDS/Caching/Factory.php new file mode 100644 index 0000000..1711acb --- /dev/null +++ b/libraries/plugins/IDS/Caching/Factory.php @@ -0,0 +1,94 @@ +. + * + * PHP version 5.1.6+ + * + * @category Security + * @package PHPIDS + * @author Mario Heiderich + * @author Christian Matthies + * @author Lars Strojny + * @license http://www.gnu.org/licenses/lgpl.html LGPL + * @link http://php-ids.org/ + */ + +/** + * Caching factory + * + * This class is used as a factory to load the correct concrete caching + * implementation. + * + * @category Security + * @package PHPIDS + * @author Christian Matthies + * @author Mario Heiderich + * @author Lars Strojny + * @copyright 2007-2009 The PHPIDS Group + * @license http://www.gnu.org/licenses/lgpl.html LGPL + * @version Release: $Id:Factory.php 517 2007-09-15 15:04:13Z mario $ + * @link http://php-ids.org/ + * @since Version 0.4 + */ +class IDS_Caching +{ + + /** + * Factory method + * + * @param object $init the IDS_Init object + * @param string $type the caching type + * + * @return object the caching facility + */ + public static function factory($init, $type) + { + + $object = false; + $wrapper = preg_replace( + '/\W+/m', + null, + ucfirst($init->config['Caching']['caching']) + ); + $class = 'IDS_Caching_' . $wrapper; + $path = dirname(__FILE__) . DIRECTORY_SEPARATOR . + $wrapper . '.php'; + + if (file_exists($path)) { + include_once $path; + + if (class_exists($class)) { + $object = call_user_func(array($class, 'getInstance'), + $type, $init); + } + } + + return $object; + } +} + +/** + * Local variables: + * tab-width: 4 + * c-basic-offset: 4 + * End: + * vim600: sw=4 ts=4 expandtab + */ diff --git a/libraries/plugins/IDS/Caching/File.php b/libraries/plugins/IDS/Caching/File.php new file mode 100644 index 0000000..5ed3986 --- /dev/null +++ b/libraries/plugins/IDS/Caching/File.php @@ -0,0 +1,187 @@ +. + * + * PHP version 5.1.6+ + * + * @category Security + * @package PHPIDS + * @author Mario Heiderich + * @author Christian Matthies + * @author Lars Strojny + * @license http://www.gnu.org/licenses/lgpl.html LGPL + * @link http://php-ids.org/ + */ + +require_once 'IDS/Caching/Interface.php'; + +/** + * File caching wrapper + * + * This class inhabits functionality to get and set cache via a static flatfile. + * + * @category Security + * @package PHPIDS + * @author Christian Matthies + * @author Mario Heiderich + * @author Lars Strojny + * @copyright 2007-2009 The PHPIDS Group + * @license http://www.gnu.org/licenses/lgpl.html LGPL + * @version Release: $Id:File.php 517 2007-09-15 15:04:13Z mario $ + * @link http://php-ids.org/ + * @since Version 0.4 + */ +class IDS_Caching_File implements IDS_Caching_Interface +{ + + /** + * Caching type + * + * @var string + */ + private $type = null; + + /** + * Cache configuration + * + * @var array + */ + private $config = null; + + /** + * Path to cache file + * + * @var string + */ + private $path = null; + + /** + * Holds an instance of this class + * + * @var object + */ + private static $cachingInstance = null; + + /** + * Constructor + * + * @param string $type caching type + * @param object $init the IDS_Init object + * + * @return void + */ + public function __construct($type, $init) + { + + $this->type = $type; + $this->config = $init->config['Caching']; + $this->path = $init->getBasePath() . $this->config['path']; + + if (file_exists($this->path) && !is_writable($this->path)) { + throw new Exception('Make sure all files in ' . + htmlspecialchars($this->path, ENT_QUOTES, 'UTF-8') . + 'are writeable!'); + } + } + + /** + * Returns an instance of this class + * + * @param string $type caching type + * @param object $init the IDS_Init object + * + * @return object $this + */ + public static function getInstance($type, $init) + { + if (!self::$cachingInstance) { + self::$cachingInstance = new IDS_Caching_File($type, $init); + } + + return self::$cachingInstance; + } + + /** + * Writes cache data into the file + * + * @param array $data the cache data + * + * @throws Exception if cache file couldn't be created + * @return object $this + */ + public function setCache(array $data) + { + + if (!is_writable(preg_replace('/[\/][^\/]+\.[^\/]++$/', null, + $this->path))) { + throw new Exception('Temp directory ' . + htmlspecialchars($this->path, ENT_QUOTES, 'UTF-8') . + ' seems not writable'); + } + + if ((!file_exists($this->path) || (time()-filectime($this->path)) > + $this->config['expiration_time'])) { + $handle = @fopen($this->path, 'w+'); + $serialized = @serialize($data); + + if (!$handle) { + throw new Exception("Cache file couldn't be created"); + } + if (!$serialized) { + throw new Exception("Cache data couldn't be serialized"); + } + + fwrite($handle, $serialized); + fclose($handle); + } + + return $this; + } + + /** + * Returns the cached data + * + * Note that this method returns false if either type or file cache is + * not set + * + * @return mixed cache data or false + */ + public function getCache() + { + + // make sure filters are parsed again if cache expired + if (file_exists($this->path) && (time()-filectime($this->path)) < + $this->config['expiration_time']) { + $data = unserialize(file_get_contents($this->path)); + return $data; + } + + return false; + } +} + +/** + * Local variables: + * tab-width: 4 + * c-basic-offset: 4 + * End: + * vim600: sw=4 ts=4 expandtab + */ diff --git a/libraries/plugins/IDS/Caching/Interface.php b/libraries/plugins/IDS/Caching/Interface.php new file mode 100644 index 0000000..d9558e8 --- /dev/null +++ b/libraries/plugins/IDS/Caching/Interface.php @@ -0,0 +1,73 @@ +. + * + * PHP version 5.1.6+ + * + * @category Security + * @package PHPIDS + * @author Mario Heiderich + * @author Christian Matthies + * @author Lars Strojny + * @license http://www.gnu.org/licenses/lgpl.html LGPL + * @link http://php-ids.org/ + */ + +/** + * Caching wrapper interface + * + * @category Security + * @package PHPIDS + * @author Christian Matthies + * @author Mario Heiderich + * @author Lars Strojny + * @copyright 2007-2009 The PHPIDS Group + * @version SVN: $Id:Interface.php 517 2007-09-15 15:04:13Z mario $ + * @license http://www.gnu.org/licenses/lgpl.html LGPL + * @since Version 0.4 + * @link http://php-ids.org/ + */ +interface IDS_Caching_Interface +{ + /** + * Interface method + * + * @param array $data the cache data + * + * @return void + */ + public function setCache(array $data); + + /** + * Interface method + * + * @return void + */ + public function getCache(); +} + +/** + * Local variables: + * tab-width: 4 + * c-basic-offset: 4 + * End: + * vim600: sw=4 ts=4 expandtab + */ diff --git a/libraries/plugins/IDS/Caching/Memcached.php b/libraries/plugins/IDS/Caching/Memcached.php new file mode 100644 index 0000000..1d09296 --- /dev/null +++ b/libraries/plugins/IDS/Caching/Memcached.php @@ -0,0 +1,195 @@ +. + * + * PHP version 5.1.6+ + * + * @category Security + * @package PHPIDS + * @author Mario Heiderich + * @author Christian Matthies + * @author Lars Strojny + * @license http://www.gnu.org/licenses/lgpl.html LGPL + * @link http://php-ids.org/ + */ + +require_once 'IDS/Caching/Interface.php'; + +/** + * File caching wrapper + * + * This class inhabits functionality to get and set cache via memcached. + * + * @category Security + * @package PHPIDS + * @author Christian Matthies + * @author Mario Heiderich + * @author Lars Strojny + * @copyright 2007-2009 The PHPIDS Groupoup + * @license http://www.gnu.org/licenses/lgpl.html LGPL + * @version Release: $Id:Memcached.php 517 2007-09-15 15:04:13Z mario $ + * @link http://php-ids.org/ + * @since Version 0.4 + */ +class IDS_Caching_Memcached implements IDS_Caching_Interface +{ + + /** + * Caching type + * + * @var string + */ + private $type = null; + + /** + * Cache configuration + * + * @var array + */ + private $config = null; + + /** + * Flag if the filter storage has been found in memcached + * + * @var boolean + */ + private $isCached = false; + + /** + * Memcache object + * + * @var object + */ + private $memcache = null; + + /** + * Holds an instance of this class + * + * @var object + */ + private static $cachingInstance = null; + + + /** + * Constructor + * + * @param string $type caching type + * @param array $init the IDS_Init object + * + * @return void + */ + public function __construct($type, $init) + { + + $this->type = $type; + $this->config = $init->config['Caching']; + + $this->_connect(); + } + + /** + * Returns an instance of this class + * + * @param string $type caching type + * @param object $init the IDS_Init object + * + * @return object $this + */ + public static function getInstance($type, $init) + { + + if (!self::$cachingInstance) { + self::$cachingInstance = new IDS_Caching_Memcached($type, $init); + } + + return self::$cachingInstance; + } + + /** + * Writes cache data + * + * @param array $data the caching data + * + * @return object $this + */ + public function setCache(array $data) + { + + if(!$this->isCached) { + $this->memcache->set( + $this->config['key_prefix'] . '.storage', + $data, false, $this->config['expiration_time'] + ); + } + + return $this; + } + + /** + * Returns the cached data + * + * Note that this method returns false if either type or file cache is + * not set + * + * @return mixed cache data or false + */ + public function getCache() + { + + $data = $this->memcache->get( + $this->config['key_prefix'] . + '.storage' + ); + $this->isCached = !empty($data); + + return $data; + } + + /** + * Connect to the memcached server + * + * @throws Exception if connection parameters are insufficient + * @return void + */ + private function _connect() + { + + if ($this->config['host'] && $this->config['port']) { + // establish the memcache connection + $this->memcache = new Memcache; + $this->memcache->pconnect( + $this->config['host'], + $this->config['port'] + ); + + } else { + throw new Exception('Insufficient connection parameters'); + } + } +} + +/** + * Local variables: + * tab-width: 4 + * c-basic-offset: 4 + * End: + * vim600: sw=4 ts=4 expandtab + */ diff --git a/libraries/plugins/IDS/Caching/Session.php b/libraries/plugins/IDS/Caching/Session.php new file mode 100644 index 0000000..aab81f7 --- /dev/null +++ b/libraries/plugins/IDS/Caching/Session.php @@ -0,0 +1,146 @@ +. + * + * PHP version 5.1.6+ + * + * @category Security + * @package PHPIDS + * @author Mario Heiderich + * @author Christian Matthies + * @author Lars Strojny + * @license http://www.gnu.org/licenses/lgpl.html LGPL + * @link http://php-ids.org/ + */ + +require_once 'IDS/Caching/Interface.php'; + +/** + * File caching wrapper + * + * This class inhabits functionality to get and set cache via session. + * + * @category Security + * @package PHPIDS + * @author Christian Matthies + * @author Mario Heiderich + * @author Lars Strojny + * @copyright 2007-2009 The PHPIDS Group + * @license http://www.gnu.org/licenses/lgpl.html LGPL + * @version Release: $Id:Session.php 517 2007-09-15 15:04:13Z mario $ + * @link http://php-ids.org/ + * @since Version 0.4 + */ +class IDS_Caching_Session implements IDS_Caching_Interface +{ + + /** + * Caching type + * + * @var string + */ + private $type = null; + + /** + * Cache configuration + * + * @var array + */ + private $config = null; + + /** + * Holds an instance of this class + * + * @var object + */ + private static $cachingInstance = null; + + /** + * Constructor + * + * @param string $type caching type + * @param object $init the IDS_Init object + * + * @return void + */ + public function __construct($type, $init) + { + $this->type = $type; + $this->config = $init->config['Caching']; + } + + /** + * Returns an instance of this class + * + * @param string $type caching type + * @param object $init the IDS_Init object + * + * @return object $this + */ + public static function getInstance($type, $init) + { + + if (!self::$cachingInstance) { + self::$cachingInstance = new IDS_Caching_Session($type, $init); + } + + return self::$cachingInstance; + } + + /** + * Writes cache data into the session + * + * @param array $data the caching data + * + * @return object $this + */ + public function setCache(array $data) + { + + $_SESSION['PHPIDS'][$this->type] = $data; + return $this; + } + + /** + * Returns the cached data + * + * Note that this method returns false if either type or file cache is not set + * + * @return mixed cache data or false + */ + public function getCache() + { + + if ($this->type && $_SESSION['PHPIDS'][$this->type]) { + return $_SESSION['PHPIDS'][$this->type]; + } + + return false; + } +} + +/** + * Local variables: + * tab-width: 4 + * c-basic-offset: 4 + * End: + * vim600: sw=4 ts=4 expandtab + */ diff --git a/libraries/plugins/IDS/Config/Config.ini.php b/libraries/plugins/IDS/Config/Config.ini.php new file mode 100644 index 0000000..1480a62 --- /dev/null +++ b/libraries/plugins/IDS/Config/Config.ini.php @@ -0,0 +1,89 @@ +; + +; PHPIDS Config.ini + +; General configuration settings + + +[General] + + ; basic settings - customize to make the PHPIDS work at all + filter_type = xml + + base_path = /full/path/to/IDS/ + use_base_path = false + + filter_path = default_filter.xml + tmp_path = tmp + scan_keys = false + + ; in case you want to use a different HTMLPurifier source, specify it here + ; By default, those files are used that are being shipped with PHPIDS + HTML_Purifier_Path = vendors/htmlpurifier/HTMLPurifier.auto.php + HTML_Purifier_Cache = vendors/htmlpurifier/HTMLPurifier/DefinitionCache/Serializer + + ; define which fields contain html and need preparation before + ; hitting the PHPIDS rules (new in PHPIDS 0.5) + ;html[] = POST.__wysiwyg + + ; define which fields contain JSON data and should be treated as such + ; for fewer false positives (new in PHPIDS 0.5.3) + ;json[] = POST.__jsondata + + ; define which fields shouldn't be monitored (a[b]=c should be referenced via a.b) + exceptions[] = GET.__utmz + exceptions[] = GET.__utmc + + ; you can use regular expressions for wildcard exceptions - example: /.*foo/i + + ; PHPIDS should run with PHP 5.1.2 but this is untested - set + ; this value to force compatibilty with minor versions + min_php_version = 5.1.6 + +; If you use the PHPIDS logger you can define specific configuration here + +[Logging] + + ; file logging + path = tmp/phpids_log.txt + + ; email logging + + ; note that enabling safemode you can prevent spam attempts, + ; see documentation + recipients[] = test@test.com.invalid + subject = "PHPIDS detected an intrusion attempt!" + header = "From: info@phpids.org" + envelope = "" + safemode = true + urlencode = true + allowed_rate = 15 + + ; database logging + + wrapper = "mysql:host=localhost;port=3306;dbname=phpids" + user = phpids_user + password = 123456 + table = intrusions + +; If you would like to use other methods than file caching you can configure them here + +[Caching] + + ; caching: session|file|database|memcached|none + caching = file + expiration_time = 600 + + ; file cache + path = tmp/default_filter.cache + + ; database cache + wrapper = "mysql:host=localhost;port=3306;dbname=phpids" + user = phpids_user + password = 123456 + table = cache + + ; memcached + ;host = localhost + ;port = 11211 + ;key_prefix = PHPIDS diff --git a/libraries/plugins/IDS/Converter.php b/libraries/plugins/IDS/Converter.php new file mode 100644 index 0000000..4f38725 --- /dev/null +++ b/libraries/plugins/IDS/Converter.php @@ -0,0 +1,750 @@ +. + * + * PHP version 5.1.6+ + * + * @category Security + * @package PHPIDS + * @author Mario Heiderich + * @author Christian Matthies + * @author Lars Strojny + * @license http://www.gnu.org/licenses/lgpl.html LGPL + * @link http://php-ids.org/ + */ + +/** + * PHPIDS specific utility class to convert charsets manually + * + * Note that if you make use of IDS_Converter::runAll(), existing class + * methods will be executed in the same order as they are implemented in the + * class tree! + * + * @category Security + * @package PHPIDS + * @author Christian Matthies + * @author Mario Heiderich + * @author Lars Strojny + * @copyright 2007-2009 The PHPIDS Group + * @license http://www.gnu.org/licenses/lgpl.html LGPL + * @version Release: $Id:Converter.php 517 2007-09-15 15:04:13Z mario $ + * @link http://php-ids.org/ + */ +class IDS_Converter +{ + /** + * Runs all converter functions + * + * Note that if you make use of IDS_Converter::runAll(), existing class + * methods will be executed in the same order as they are implemented in the + * class tree! + * + * @param string $value the value to convert + * + * @static + * @return string + */ + public static function runAll($value) + { + foreach (get_class_methods(__CLASS__) as $method) { + + if (strpos($method, 'run') === 0) { + continue; + } + $value = self::$method($value); + } + + return $value; + } + + /** + * Check for comments and erases them if available + * + * @param string $value the value to convert + * + * @static + * @return string + */ + public static function convertFromCommented($value) + { + // check for existing comments + if (preg_match('/(?:\|\/\*|\*\/|\/\/\W*\w+\s*$)|' . + '(?:--[^-]*-)/ms', $value)) { + + $pattern = array( + '/(?:(?:))/ms', + '/(?:(?:\/\*\/*[^\/\*]*)+\*\/)/ms', + '/(?:--[^-]*-)/ms' + ); + + $converted = preg_replace($pattern, ';', $value); + $value .= "\n" . $converted; + } + + //make sure inline comments are detected and converted correctly + $value = preg_replace('/(<\w+)\/+(\w+=?)/m', '$1/$2', $value); + $value = preg_replace('/[^\\\:]\/\/(.*)$/m', '/**/$1', $value); + $value = preg_replace('/([^\-&])#.*[\r\n\v\f]/m', '$1', $value); + $value = preg_replace('/([^&\-])#.*\n/m', '$1 ', $value); + $value = preg_replace('/^#.*\n/m', ' ', $value); + + return $value; + } + + /** + * Strip newlines + * + * @param string $value the value to convert + * + * @static + * @return string + */ + public static function convertFromWhiteSpace($value) + { + //check for inline linebreaks + $search = array('\r', '\n', '\f', '\t', '\v'); + $value = str_replace($search, ';', $value); + + // replace replacement characters regular spaces + $value = str_replace('�', ' ', $value); + + //convert real linebreaks + return preg_replace('/(?:\n|\r|\v)/m', ' ', $value); + } + + /** + * Checks for common charcode pattern and decodes them + * + * @param string $value the value to convert + * + * @static + * @return string + */ + public static function convertFromJSCharcode($value) + { + $matches = array(); + + // check if value matches typical charCode pattern + if (preg_match_all('/(?:[\d+-=\/\* ]+(?:\s?,\s?[\d+-=\/\* ]+)){4,}/ms', + $value, $matches)) { + + $converted = ''; + $string = implode(',', $matches[0]); + $string = preg_replace('/\s/', '', $string); + $string = preg_replace('/\w+=/', '', $string); + $charcode = explode(',', $string); + + foreach ($charcode as $char) { + $char = preg_replace('/\W0/s', '', $char); + + if (preg_match_all('/\d*[+-\/\* ]\d+/', $char, $matches)) { + $match = preg_split('/(\W?\d+)/', + (implode('', $matches[0])), + null, + PREG_SPLIT_DELIM_CAPTURE); + + if (array_sum($match) >= 20 && array_sum($match) <= 127) { + $converted .= chr(array_sum($match)); + } + + } elseif (!empty($char) && $char >= 20 && $char <= 127) { + $converted .= chr($char); + } + } + + $value .= "\n" . $converted; + } + + // check for octal charcode pattern + if (preg_match_all('/(?:(?:[\\\]+\d+[ \t]*){8,})/ims', $value, $matches)) { + + $converted = ''; + $charcode = explode('\\', preg_replace('/\s/', '', implode(',', + $matches[0]))); + + foreach ($charcode as $char) { + if (!empty($char)) { + if (octdec($char) >= 20 && octdec($char) <= 127) { + $converted .= chr(octdec($char)); + } + } + } + $value .= "\n" . $converted; + } + + // check for hexadecimal charcode pattern + if (preg_match_all('/(?:(?:[\\\]+\w+\s*){8,})/ims', $value, $matches)) { + + $converted = ''; + $charcode = explode('\\', preg_replace('/[ux]/', '', implode(',', + $matches[0]))); + + foreach ($charcode as $char) { + if (!empty($char)) { + if (hexdec($char) >= 20 && hexdec($char) <= 127) { + $converted .= chr(hexdec($char)); + } + } + } + $value .= "\n" . $converted; + } + + return $value; + } + + /** + * Eliminate JS regex modifiers + * + * @param string $value the value to convert + * + * @static + * @return string + */ + public static function convertJSRegexModifiers($value) + { + $value = preg_replace('/\/[gim]+/', '/', $value); + + return $value; + } + + /** + * Converts from hex/dec entities + * + * @param string $value the value to convert + * + * @static + * @return string + */ + public static function convertEntities($value) + { + $converted = null; + + //deal with double encoded payload + $value = preg_replace('/&/', '&', $value); + + if (preg_match('/&#x?[\w]+/ms', $value)) { + $converted = preg_replace('/(&#x?[\w]{2}\d?);?/ms', '$1;', $value); + $converted = html_entity_decode($converted, ENT_QUOTES, 'UTF-8'); + $value .= "\n" . str_replace(';;', ';', $converted); + } + // normalize obfuscated protocol handlers + $value = preg_replace( + '/(?:j\s*a\s*v\s*a\s*s\s*c\s*r\s*i\s*p\s*t\s*:)|(d\s*a\s*t\s*a\s*:)/ms', + 'javascript:', $value + ); + + return $value; + } + + /** + * Normalize quotes + * + * @param string $value the value to convert + * + * @static + * @return string + */ + public static function convertQuotes($value) + { + // normalize different quotes to " + $pattern = array('\'', '`', '´', '’', '‘'); + $value = str_replace($pattern, '"', $value); + + //make sure harmless quoted strings don't generate false alerts + $value = preg_replace('/^"([^"=\\!><~]+)"$/', '$1', $value); + + return $value; + } + + /** + * Converts SQLHEX to plain text + * + * @param string $value the value to convert + * + * @static + * @return string + */ + public static function convertFromSQLHex($value) + { + $matches = array(); + if(preg_match_all('/(?:(?:\A|[^\d])0x[a-f\d]{3,}[a-f\d]*)+/im', $value, $matches)) { + foreach($matches[0] as $match) { + $converted = ''; + foreach(str_split($match, 2) as $hex_index) { + if(preg_match('/[a-f\d]{2,3}/i', $hex_index)) { + $converted .= chr(hexdec($hex_index)); + } + } + $value = str_replace($match, $converted, $value); + } + } + // take care of hex encoded ctrl chars + $value = preg_replace('/0x\d+/m', ' 1 ', $value); + + return $value; + } + + /** + * Converts basic SQL keywords and obfuscations + * + * @param string $value the value to convert + * + * @static + * @return string + */ + public static function convertFromSQLKeywords($value) + { + $pattern = array('/(?:is\s+null)|(like\s+null)|' . + '(?:(?:^|\W)in[+\s]*\([\s\d"]+[^()]*\))/ims'); + $value = preg_replace($pattern, '"=0', $value); + + $value = preg_replace('/[^\w\)]+\s*like\s*[^\w\s]+/ims', '1" OR "1"', $value); + $value = preg_replace('/null([,"\s])/ims', '0$1', $value); + $value = preg_replace('/\d+\./ims', ' 1', $value); + $value = preg_replace('/,null/ims', ',0', $value); + $value = preg_replace('/(?:between)/ims', 'or', $value); + $value = preg_replace('/(?:and\s+\d+\.?\d*)/ims', '', $value); + $value = preg_replace('/(?:\s+and\s+)/ims', ' or ', $value); + + $pattern = array('/(?:not\s+between)|(?:is\s+not)|(?:not\s+in)|' . + '(?:xor|<>|rlike(?:\s+binary)?)|' . + '(?:regexp\s+binary)|' . + '(?:sounds\s+like)/ims'); + $value = preg_replace($pattern, '!', $value); + $value = preg_replace('/"\s+\d/', '"', $value); + $value = preg_replace('/(\W)div(\W)/ims', '$1 OR $2', $value); + $value = preg_replace('/\/(?:\d+|null)/', null, $value); + + return $value; + } + + /** + * Detects nullbytes and controls chars via ord() + * + * @param string $value the value to convert + * + * @static + * @return string + */ + public static function convertFromControlChars($value) + { + // critical ctrl values + $search = array( + chr(0), chr(1), chr(2), chr(3), chr(4), chr(5), + chr(6), chr(7), chr(8), chr(11), chr(12), chr(14), + chr(15), chr(16), chr(17), chr(18), chr(19), chr(24), + chr(25), chr(192), chr(193), chr(238), chr(255), '\\0' + ); + + $value = str_replace($search, '%00', $value); + + //take care for malicious unicode characters + $value = urldecode(preg_replace('/(?:%E(?:2|3)%8(?:0|1)%(?:A|8|9)' . + '\w|%EF%BB%BF|%EF%BF%BD)|(?:&#(?:65|8)\d{3};?)/i', null, + urlencode($value))); + $value = urldecode( + preg_replace('/(?:%F0%80%BE)/i', '>', urlencode($value))); + $value = urldecode( + preg_replace('/(?:%F0%80%BC)/i', '<', urlencode($value))); + $value = urldecode( + preg_replace('/(?:%F0%80%A2)/i', '"', urlencode($value))); + $value = urldecode( + preg_replace('/(?:%F0%80%A7)/i', '\'', urlencode($value))); + + $value = preg_replace('/(?:%ff1c)/', '<', $value); + $value = preg_replace( + '/(?:&[#x]*(200|820|200|820|zwn?j|lrm|rlm)\w?;?)/i', null,$value + ); + $value = preg_replace('/(?:&#(?:65|8)\d{3};?)|' . + '(?:&#(?:56|7)3\d{2};?)|' . + '(?:&#x(?:fe|20)\w{2};?)|' . + '(?:&#x(?:d[c-f])\w{2};?)/i', null, + $value); + + $value = str_replace( + array('«', '〈', '＜', '‹', '〈', '⟨'), '<', $value + ); + $value = str_replace( + array('»', '〉', '＞', '›', '〉', '⟩'), '>', $value + ); + + return $value; + } + + /** + * This method matches and translates base64 strings and fragments + * used in data URIs + * + * @param string $value the value to convert + * + * @static + * @return string + */ + public static function convertFromNestedBase64($value) + { + $matches = array(); + preg_match_all('/(?:^|[,&?])\s*([a-z0-9]{30,}=*)(?:\W|$)/im', + $value, + $matches); + + foreach ($matches[1] as $item) { + if (isset($item) && !preg_match('/[a-f0-9]{32}/i', $item)) { + $base64_item = base64_decode($item); + $value = str_replace($item, $base64_item, $value); + } + } + + return $value; + } + + /** + * Detects nullbytes and controls chars via ord() + * + * @param string $value the value to convert + * + * @static + * @return string + */ + public static function convertFromOutOfRangeChars($value) + { + $values = str_split($value); + foreach ($values as $item) { + if (ord($item) >= 127) { + $value = str_replace($item, ' ', $value); + } + } + + return $value; + } + + /** + * Strip XML patterns + * + * @param string $value the value to convert + * + * @static + * @return string + */ + public static function convertFromXML($value) + { + $converted = strip_tags($value); + + if ($converted && ($converted != $value)) { + return $value . "\n" . $converted; + } + return $value; + } + + /** + * This method converts JS unicode code points to + * regular characters + * + * @param string $value the value to convert + * + * @static + * @return string + */ + public static function convertFromJSUnicode($value) + { + $matches = array(); + + preg_match_all('/\\\u[0-9a-f]{4}/ims', $value, $matches); + + if (!empty($matches[0])) { + foreach ($matches[0] as $match) { + $chr = chr(hexdec(substr($match, 2, 4))); + $value = str_replace($match, $chr, $value); + } + $value .= "\n\u0001"; + } + + return $value; + } + + /** + * Converts relevant UTF-7 tags to UTF-8 + * + * @param string $value the value to convert + * + * @static + * @return string + */ + public static function convertFromUTF7($value) + { + if(preg_match('/\+A\w+-?/m', $value)) { + if (function_exists('mb_convert_encoding')) { + if(version_compare(PHP_VERSION, '5.2.8', '<')) { + $tmp_chars = str_split($value); + $value = ''; + foreach($tmp_chars as $char) { + if(ord($char) <= 127) { + $value .= $char; + } + } + } + $value .= "\n" . mb_convert_encoding($value, 'UTF-8', 'UTF-7'); + } else { + //list of all critical UTF7 codepoints + $schemes = array( + '+ACI-' => '"', + '+ADw-' => '<', + '+AD4-' => '>', + '+AFs-' => '[', + '+AF0-' => ']', + '+AHs-' => '{', + '+AH0-' => '}', + '+AFw-' => '\\', + '+ADs-' => ';', + '+ACM-' => '#', + '+ACY-' => '&', + '+ACU-' => '%', + '+ACQ-' => '$', + '+AD0-' => '=', + '+AGA-' => '`', + '+ALQ-' => '"', + '+IBg-' => '"', + '+IBk-' => '"', + '+AHw-' => '|', + '+ACo-' => '*', + '+AF4-' => '^', + '+ACIAPg-' => '">', + '+ACIAPgA8-' => '">' + ); + + $value = str_ireplace(array_keys($schemes), + array_values($schemes), $value); + } + } + return $value; + } + + /** + * Converts basic concatenations + * + * @param string $value the value to convert + * + * @static + * @return string + */ + public static function convertFromConcatenated($value) + { + //normalize remaining backslashes + if ($value != preg_replace('/(\w)\\\/', "$1", $value)) { + $value .= preg_replace('/(\w)\\\/', "$1", $value); + } + + $compare = stripslashes($value); + + $pattern = array('/(?:<\/\w+>\+<\w+>)/s', + '/(?:":\d+[^"[]+")/s', + '/(?:"?"\+\w+\+")/s', + '/(?:"\s*;[^"]+")|(?:";[^"]+:\s*")/s', + '/(?:"\s*(?:;|\+).{8,18}:\s*")/s', + '/(?:";\w+=)|(?:!""&&")|(?:~)/s', + '/(?:"?"\+""?\+?"?)|(?:;\w+=")|(?:"[|&]{2,})/s', + '/(?:"\s*\W+")/s', + '/(?:";\w\s*\+=\s*\w?\s*")/s', + '/(?:"[|&;]+\s*[^|&\n]*[|&]+\s*"?)/s', + '/(?:";\s*\w+\W+\w*\s*[|&]*")/s', + '/(?:"\s*"\s*\.)/s', + '/(?:\s*new\s+\w+\s*[+",])/', + '/(?:(?:^|\s+)(?:do|else)\s+)/', + '/(?:[{(]\s*new\s+\w+\s*[)}])/', + '/(?:(this|self)\.)/', + '/(?:undefined)/', + '/(?:in\s+)/'); + + // strip out concatenations + $converted = preg_replace($pattern, null, $compare); + + //strip object traversal + $converted = preg_replace('/\w(\.\w\()/', "$1", $converted); + + // normalize obfuscated method calls + $converted = preg_replace('/\)\s*\+/', ")", $converted); + + //convert JS special numbers + $converted = preg_replace('/(?:\(*[.\d]e[+-]*[^a-z\W]+\)*)' . + '|(?:NaN|Infinity)\W/ims', 1, $converted); + + if ($converted && ($compare != $converted)) { + $value .= "\n" . $converted; + } + + return $value; + } + + /** + * This method collects and decodes proprietary encoding types + * + * @param string $value the value to convert + * + * @static + * @return string + */ + public static function convertFromProprietaryEncodings($value) { + + //Xajax error reportings + $value = preg_replace('//im', '$1', $value); + + //strip false alert triggering apostrophes + $value = preg_replace('/(\w)\"(s)/m', '$1$2', $value); + + //strip quotes within typical search patterns + $value = preg_replace('/^"([^"=\\!><~]+)"$/', '$1', $value); + + //OpenID login tokens + $value = preg_replace('/{[\w-]{8,9}\}(?:\{[\w=]{8}\}){2}/', null, $value); + + //convert Content and \sdo\s to null + $value = preg_replace('/Content|\Wdo\s/', null, $value); + + //strip emoticons + $value = preg_replace( + '/(?:\s[:;]-[)\/PD]+)|(?:\s;[)PD]+)|(?:\s:[)PD]+)|-\.-|\^\^/m', + null, + $value + ); + + //normalize separation char repetion + $value = preg_replace('/([.+~=*_\-;])\1{2,}/m', '$1', $value); + + //normalize multiple single quotes + $value = preg_replace('/"{2,}/m', '"', $value); + + //normalize quoted numerical values and asterisks + $value = preg_replace('/"(\d+)"/m', '$1', $value); + + //normalize pipe separated request parameters + $value = preg_replace('/\|(\w+=\w+)/m', '&$1', $value); + + //normalize ampersand listings + $value = preg_replace('/(\w\s)&\s(\w)/', '$1$2', $value); + + //normalize escaped RegExp modifiers + $value = preg_replace('/\/\\\(\w)/', '/$1', $value); + + return $value; + } + + /** + * This method is the centrifuge prototype + * + * @param string $value the value to convert + * @param IDS_Monitor $monitor the monitor object + * + * @static + * @return string + */ + public static function runCentrifuge($value, IDS_Monitor $monitor = null) + { + $threshold = 3.49; + if (strlen($value) > 25) { + + //strip padding + $tmp_value = preg_replace('/\s{4}|==$/m', null, $value); + $tmp_value = preg_replace( + '/\s{4}|[\p{L}\d\+\-=,.%()]{8,}/m', + 'aaa', + $tmp_value + ); + + // Check for the attack char ratio + $tmp_value = preg_replace('/([*.!?+-])\1{1,}/m', '$1', $tmp_value); + $tmp_value = preg_replace('/"[\p{L}\d\s]+"/m', null, $tmp_value); + + $stripped_length = strlen(preg_replace('/[\d\s\p{L}\.:,%&\/><\-)!|]+/m', + null, $tmp_value)); + $overall_length = strlen( + preg_replace('/([\d\s\p{L}:,\.]{3,})+/m', 'aaa', + preg_replace('/\s{2,}/m', null, $tmp_value)) + ); + + if ($stripped_length != 0 + && $overall_length/$stripped_length <= $threshold) { + + $monitor->centrifuge['ratio'] = + $overall_length/$stripped_length; + $monitor->centrifuge['threshold'] = + $threshold; + + $value .= "\n$[!!!]"; + } + } + + if (strlen($value) > 40) { + // Replace all non-special chars + $converted = preg_replace('/[\w\s\p{L},.:!]/', null, $value); + + // Split string into an array, unify and sort + $array = str_split($converted); + $array = array_unique($array); + asort($array); + + // Normalize certain tokens + $schemes = array( + '~' => '+', + '^' => '+', + '|' => '+', + '*' => '+', + '%' => '+', + '&' => '+', + '/' => '+' + ); + + $converted = implode($array); + + $_keys = array_keys($schemes); + $_values = array_values($schemes); + + $converted = str_replace($_keys, $_values, $converted); + + $converted = preg_replace('/[+-]\s*\d+/', '+', $converted); + $converted = preg_replace('/[()[\]{}]/', '(', $converted); + $converted = preg_replace('/[!?:=]/', ':', $converted); + $converted = preg_replace('/[^:(+]/', null, stripslashes($converted)); + + // Sort again and implode + $array = str_split($converted); + asort($array); + + $converted = implode($array); + + if (preg_match('/(?:\({2,}\+{2,}:{2,})|(?:\({2,}\+{2,}:+)|' . + '(?:\({3,}\++:{2,})/', $converted)) { + + $monitor->centrifuge['converted'] = $converted; + + return $value . "\n" . $converted; + } + } + + return $value; + } +} + +/** + * Local variables: + * tab-width: 4 + * c-basic-offset: 4 + * End: + * vim600: sw=4 ts=4 expandtab + */ diff --git a/libraries/plugins/IDS/Event.php b/libraries/plugins/IDS/Event.php new file mode 100644 index 0000000..547d69c --- /dev/null +++ b/libraries/plugins/IDS/Event.php @@ -0,0 +1,235 @@ +. + * + * PHP version 5.1.6+ + * + * @category Security + * @package PHPIDS + * @author Mario Heiderich + * @author Christian Matthies + * @author Lars Strojny + * @license http://www.gnu.org/licenses/lgpl.html LGPL + * @link http://php-ids.org/ + */ + +/** + * PHPIDS event object + * + * This class represents a certain event that occured while applying the filters + * to the supplied data. It aggregates a bunch of IDS_Filter implementations and + * is a assembled in IDS_Report. + * + * Note that this class implements both Countable and IteratorAggregate + * + * @category Security + * @package PHPIDS + * @author Christian Matthies + * @author Mario Heiderich + * @author Lars Strojny + * @copyright 2007-2009 The PHPIDS Group + * @license http://www.gnu.org/licenses/lgpl.html LGPL + * @version Release: $Id:Event.php 517 2007-09-15 15:04:13Z mario $ + * @link http://php-ids.org/ + */ +class IDS_Event implements Countable, IteratorAggregate +{ + + /** + * Event name + * + * @var scalar + */ + protected $name = null; + + /** + * Value of the event + * + * @var scalar + */ + protected $value = null; + + /** + * List of filter objects + * + * Filter objects in this array are those that matched the events value + * + * @var array + */ + protected $filters = array(); + + /** + * Calculated impact + * + * Total impact of the event + * + * @var integer + */ + protected $impact = 0; + + /** + * Affecte tags + * + * @var array + */ + protected $tags = array(); + + /** + * Constructor + * + * Fills event properties + * + * @param scalar $name the event name + * @param scalar $value the event value + * @param array $filters the corresponding filters + * + * @return void + */ + public function __construct($name, $value, Array $filters) + { + if (!is_scalar($name)) { + throw new InvalidArgumentException( + 'Expected $name to be a scalar,' . gettype($name) . ' given' + ); + } + + if (!is_scalar($value)) { + throw new InvalidArgumentException(' + Expected $value to be a scalar,' . gettype($value) . ' given' + ); + } + + $this->name = $name; + $this->value = $value; + + foreach ($filters as $filter) { + if (!$filter instanceof IDS_Filter) { + throw new InvalidArgumentException( + 'Filter must be derived from IDS_Filter' + ); + } + + $this->filters[] = $filter; + } + } + + /** + * Returns event name + * + * The name of the event usually is the key of the variable that was + * considered to be malicious + * + * @return scalar + */ + public function getName() + { + return $this->name; + } + + /** + * Returns event value + * + * @return scalar + */ + public function getValue() + { + return $this->value; + } + + /** + * Returns calculated impact + * + * @return integer + */ + public function getImpact() + { + if (!$this->impact) { + $this->impact = 0; + foreach ($this->filters as $filter) { + $this->impact += $filter->getImpact(); + } + } + + return $this->impact; + } + + /** + * Returns affected tags + * + * @return array + */ + public function getTags() + { + $filters = $this->getFilters(); + + foreach ($filters as $filter) { + $this->tags = array_merge($this->tags, + $filter->getTags()); + } + + $this->tags = array_values(array_unique($this->tags)); + + return $this->tags; + } + + /** + * Returns list of filter objects + * + * @return array + */ + public function getFilters() + { + return $this->filters; + } + + /** + * Returns number of filters + * + * To implement interface Countable this returns the number of filters + * appended. + * + * @return integer + */ + public function count() + { + return count($this->getFilters()); + } + + /** + * IteratorAggregate iterator getter + * + * Returns an iterator to iterate over the appended filters. + * + * @return ArrayObject the filter collection + */ + public function getIterator() + { + return new ArrayObject($this->getFilters()); + } +} + +/** + * Local variables: + * tab-width: 4 + * c-basic-offset: 4 + * End: + * vim600: sw=4 ts=4 expandtab + */ diff --git a/libraries/plugins/IDS/Filter.php b/libraries/plugins/IDS/Filter.php new file mode 100644 index 0000000..9c427c0 --- /dev/null +++ b/libraries/plugins/IDS/Filter.php @@ -0,0 +1,179 @@ +. + * + * PHP version 5.1.6+ + * + * @category Security + * @package PHPIDS + * @author Mario Heiderich + * @author Christian Matthies + * @author Lars Strojny + * @license http://www.gnu.org/licenses/lgpl.html LGPL + * @link http://php-ids.org/ + */ + +/** + * PHPIDS Filter object + * + * Each object of this class serves as a container for a specific filter. The + * object provides methods to get information about this particular filter and + * also to match an arbitrary string against it. + * + * @category Security + * @package PHPIDS + * @author Christian Matthies + * @author Mario Heiderich + * @author Lars Strojny + * @copyright 2007-2009 The PHPIDS Group + * @license http://www.gnu.org/licenses/lgpl.html LGPL + * @version Release: $Id:Filter.php 517 2007-09-15 15:04:13Z mario $ + * @link http://php-ids.org/ + * @since Version 0.4 + */ +class IDS_Filter { + + /** + * Filter rule + * + * @var string + */ + protected $rule; + + /** + * List of tags of the filter + * + * @var array + */ + protected $tags = array(); + + /** + * Filter impact level + * + * @var integer + */ + protected $impact = 0; + + /** + * Filter description + * + * @var string + */ + protected $description = null; + + /** + * Constructor + * + * @param integer $id filter id + * @param mixed $rule filter rule + * @param string $description filter description + * @param array $tags list of tags + * @param integer $impact filter impact level + * + * @return void + */ + public function __construct($id, $rule, $description, array $tags, $impact) { + $this->id = $id; + $this->rule = $rule; + $this->tags = $tags; + $this->impact = $impact; + $this->description = $description; + } + + /** + * Matches a string against current filter + * + * Matches given string against the filter rule the specific object of this + * class represents + * + * @param string $string the string to match + * + * @throws InvalidArgumentException if argument is no string + * @return boolean + */ + public function match($string) { + if (!is_string($string)) { + throw new InvalidArgumentException(' + Invalid argument. Expected a string, received ' . gettype($string) + ); + } + return (bool) preg_match( + '/' . $this->getRule() . '/ms', strtolower($string) + ); + } + + /** + * Returns filter description + * + * @return string + */ + public function getDescription() { + return $this->description; + } + + /** + * Return list of affected tags + * + * Each filter rule is concerned with a certain kind of attack vectors. + * This method returns those affected kinds. + * + * @return array + */ + public function getTags() { + return $this->tags; + } + + /** + * Returns filter rule + * + * @return string + */ + public function getRule() { + return $this->rule; + } + + /** + * Get filter impact level + * + * @return integer + */ + public function getImpact() { + return $this->impact; + } + + /** + * Get filter ID + * + * @return integer + */ + public function getId() { + return $this->id; + } + +} + +/** + * Local variables: + * tab-width: 4 + * c-basic-offset: 4 + * End: + * vim600: sw=4 ts=4 expandtab + */ diff --git a/libraries/plugins/IDS/Filter/Storage.php b/libraries/plugins/IDS/Filter/Storage.php new file mode 100644 index 0000000..f1a6406 --- /dev/null +++ b/libraries/plugins/IDS/Filter/Storage.php @@ -0,0 +1,381 @@ +. + * + * PHP version 5.1.6+ + * + * @category Security + * @package PHPIDS + * @author Mario Heiderich + * @author Christian Matthies + * @author Lars Strojny + * @license http://www.gnu.org/licenses/lgpl.html LGPL + * @link http://php-ids.org/ + */ + +/** + * Filter Storage + * + * This class provides various default functions for gathering filter patterns + * to be used later on by the detection mechanism. You might extend this class + * to your requirements. + * + * @category Security + * @package PHPIDS + * @author Christian Matthies + * @author Mario Heiderich + * @author Lars Strojny + * @copyright 2007-2009 The PHPIDS Group + * @license http://www.gnu.org/licenses/lgpl.html LGPL + * @version Release: $Id:Storage.php 517 2007-09-15 15:04:13Z mario $ + * @link http://php-ids.org/ + */ +class IDS_Filter_Storage +{ + + /** + * Filter source file + * + * @var string + */ + protected $source = null; + + /** + * Holds caching settings + * + * @var array + */ + protected $cacheSettings = null; + + /** + * Cache container + * + * @var object IDS_Caching wrapper + */ + protected $cache = null; + + /** + * Filter container + * + * @var array + */ + protected $filterSet = array(); + + /** + * Constructor + * + * Loads filters based on provided IDS_Init settings. + * + * @param object $init IDS_Init instance + * + * @throws Exception if unsupported filter type is given + * @return void + */ + public final function __construct(IDS_Init $init) + { + if ($init->config) { + + $caching = isset($init->config['Caching']['caching']) ? + $init->config['Caching']['caching'] : 'none'; + + $type = $init->config['General']['filter_type']; + $this->source = $init->getBasePath() + . $init->config['General']['filter_path']; + + if ($caching && $caching != 'none') { + $this->cacheSettings = $init->config['Caching']; + include_once 'IDS/Caching/Factory.php'; + $this->cache = IDS_Caching::factory($init, 'storage'); + } + + switch ($type) { + case 'xml' : + $this->getFilterFromXML(); + break; + case 'json' : + $this->getFilterFromJson(); + break; + default : + throw new Exception('Unsupported filter type.'); + } + } + } + + /** + * Sets the filter array + * + * @param array $filterSet array containing multiple IDS_Filter instances + * + * @return object $this + */ + public final function setFilterSet($filterSet) + { + foreach ($filterSet as $filter) { + $this->addFilter($filter); + } + + return $this; + } + + /** + * Returns registered filters + * + * @return array + */ + public final function getFilterSet() + { + return $this->filterSet; + } + + /** + * Adds a filter + * + * @param object $filter IDS_Filter instance + * + * @return object $this + */ + public final function addFilter(IDS_Filter $filter) + { + $this->filterSet[] = $filter; + return $this; + } + + /** + * Checks if any filters are cached + * + * @return mixed $filters cached filters or false + */ + private function _isCached() + { + $filters = false; + + if ($this->cacheSettings) { + + if ($this->cache) { + $filters = $this->cache->getCache(); + } + } + + return $filters; + } + + /** + * Loads filters from XML using SimpleXML + * + * This function parses the provided source file and stores the result. + * If caching mode is enabled the result will be cached to increase + * the performance. + * + * @throws Exception if problems with fetching the XML data occur + * @return object $this + */ + public function getFilterFromXML() + { + + if (extension_loaded('SimpleXML')) { + + /* + * See if filters are already available in the cache + */ + $filters = $this->_isCached(); + + /* + * If they aren't, parse the source file + */ + if (!$filters) { + if (file_exists($this->source)) { + if (LIBXML_VERSION >= 20621) { + $filters = simplexml_load_file($this->source, + null, + LIBXML_COMPACT); + } else { + $filters = simplexml_load_file($this->source); + } + } + } + + /* + * In case we still don't have any filters loaded and exception + * will be thrown + */ + if (empty($filters)) { + throw new Exception( + 'XML data could not be loaded.' . + ' Make sure you specified the correct path.' + ); + } + + /* + * Now the storage will be filled with IDS_Filter objects + */ + $data = array(); + $nocache = $filters instanceof SimpleXMLElement; + $filters = $nocache ? $filters->filter : $filters; + + include_once 'IDS/Filter.php'; + + foreach ($filters as $filter) { + + $id = $nocache ? (string) $filter->id : + $filter['id']; + $rule = $nocache ? (string) $filter->rule : + $filter['rule']; + $impact = $nocache ? (string) $filter->impact : + $filter['impact']; + $tags = $nocache ? array_values((array) $filter->tags) : + $filter['tags']; + $description = $nocache ? (string) $filter->description : + $filter['description']; + + $this->addFilter(new IDS_Filter($id, + $rule, + $description, + (array) $tags[0], + (int) $impact)); + + $data[] = array( + 'id' => $id, + 'rule' => $rule, + 'impact' => $impact, + 'tags' => $tags, + 'description' => $description + ); + } + + /* + * If caching is enabled, the fetched data will be cached + */ + if ($this->cacheSettings) { + + $this->cache->setCache($data); + } + + } else { + throw new Exception( + 'SimpleXML not loaded.' + ); + } + + return $this; + } + + /** + * Loads filters from Json file using ext/Json + * + * This function parses the provided source file and stores the result. + * If caching mode is enabled the result will be cached to increase + * the performance. + * + * @throws Exception if problems with fetching the JSON data occur + * @return object $this + */ + public function getFilterFromJson() + { + + if (extension_loaded('Json')) { + + /* + * See if filters are already available in the cache + */ + $filters = $this->_isCached(); + + /* + * If they aren't, parse the source file + */ + if (!$filters) { + if (file_exists($this->source)) { + $filters = json_decode(file_get_contents($this->source)); + } else { + throw new Exception( + 'JSON data could not be loaded.' . + ' Make sure you specified the correct path.' + ); + } + } + + if (!$filters) { + throw new Exception( + 'JSON data could not be loaded.' . + ' Make sure you specified the correct path.' + ); + } + + /* + * Now the storage will be filled with IDS_Filter objects + */ + $data = array(); + $nocache = !is_array($filters); + $filters = $nocache ? $filters->filters->filter : $filters; + + include_once 'IDS/Filter.php'; + + foreach ($filters as $filter) { + + $id = $nocache ? (string) $filter->id : + $filter['id']; + $rule = $nocache ? (string) $filter->rule : + $filter['rule']; + $impact = $nocache ? (string) $filter->impact : + $filter['impact']; + $tags = $nocache ? array_values((array) $filter->tags) : + $filter['tags']; + $description = $nocache ? (string) $filter->description : + $filter['description']; + + $this->addFilter(new IDS_Filter($id, + $rule, + $description, + (array) $tags[0], + (int) $impact)); + + $data[] = array( + 'id' => $id, + 'rule' => $rule, + 'impact' => $impact, + 'tags' => $tags, + 'description' => $description + ); + } + + /* + * If caching is enabled, the fetched data will be cached + */ + if ($this->cacheSettings) { + $this->cache->setCache($data); + } + + } else { + throw new Exception( + 'ext/json not loaded.' + ); + } + + return $this; + } +} + +/** + * Local variables: + * tab-width: 4 + * c-basic-offset: 4 + * End: + * vim600: sw=4 ts=4 expandtab + */ diff --git a/libraries/plugins/IDS/Init.php b/libraries/plugins/IDS/Init.php new file mode 100644 index 0000000..3a2f099 --- /dev/null +++ b/libraries/plugins/IDS/Init.php @@ -0,0 +1,240 @@ +. + * + * PHP version 5.1.6+ + * + * @category Security + * @package PHPIDS + * @author Mario Heiderich + * @author Christian Matthies + * @author Lars Strojny + * @license http://www.gnu.org/licenses/lgpl.html LGPL + * @link http://php-ids.org/ + */ + +/** + * Framework initiation + * + * This class is used for the purpose to initiate the framework and inhabits + * functionality to parse the needed configuration file. + * + * @category Security + * @package PHPIDS + * @author Christian Matthies + * @author Mario Heiderich + * @author Lars Strojny + * @copyright 2007-2009 The PHPIDS Groupup + * @license http://www.gnu.org/licenses/lgpl.html LGPL + * @version Release: $Id:Init.php 517 2007-09-15 15:04:13Z mario $ + * @link http://php-ids.org/ + * @since Version 0.4 + */ +class IDS_Init +{ + + /** + * Holds config settings + * + * @var array + */ + public $config = array(); + + /** + * Instance of this class depending on the supplied config file + * + * @var array + * @static + */ + private static $instances = array(); + + /** + * Path to the config file + * + * @var string + */ + private $configPath = null; + + /** + * Constructor + * + * Includes needed classes and parses the configuration file + * + * @param string $configPath the path to the config file + * + * @return object $this + */ + private function __construct($configPath = null) + { + include_once 'IDS/Monitor.php'; + include_once 'IDS/Filter/Storage.php'; + + if ($configPath) { + $this->setConfigPath($configPath); + + if (function_exists('parse_ini_file')) { + $this->config = parse_ini_file($this->configPath, true); + } else { + $configContent = file_get_contents($this->configPath); + $this->config = parse_ini_string($configContent, true); + } + + } + } + + /** + * Permitting to clone this object + * + * For the sake of correctness of a singleton pattern, this is necessary + * + * @return void + */ + public final function __clone() + { + } + + /** + * Returns an instance of this class. Also a PHP version check + * is being performed to avoid compatibility problems with PHP < 5.1.6 + * + * @param string $configPath the path to the config file + * + * @return object + */ + public static function init($configPath = null) + { + if (!isset(self::$instances[$configPath])) { + self::$instances[$configPath] = new IDS_Init($configPath); + } + + return self::$instances[$configPath]; + } + + /** + * Sets the path to the configuration file + * + * @param string $path the path to the config + * + * @throws Exception if file not found + * @return void + */ + public function setConfigPath($path) + { + if (file_exists($path)) { + $this->configPath = $path; + } else { + throw new Exception( + 'Configuration file could not be found at ' . + htmlspecialchars($path, ENT_QUOTES, 'UTF-8') + ); + } + } + + /** + * Returns path to configuration file + * + * @return string the config path + */ + public function getConfigPath() + { + return $this->configPath; + } + + /** + * This method checks if a base path is given and usage is set to true. + * If all that tests succeed the base path will be returned as a string - + * else null will be returned. + * + * @return string the base path or null + */ + public function getBasePath() + { + + return ((isset($this->config['General']['base_path']) + && $this->config['General']['base_path'] + && isset($this->config['General']['use_base_path']) + && $this->config['General']['use_base_path']) + ? $this->config['General']['base_path'] : null); + } + + /** + * Merges new settings into the exsiting ones or overwrites them + * + * @param array $config the config array + * @param boolean $overwrite config overwrite flag + * + * @return void + */ + public function setConfig(array $config, $overwrite = false) + { + if ($overwrite) { + $this->config = $this->_mergeConfig($this->config, $config); + } else { + $this->config = $this->_mergeConfig($config, $this->config); + } + } + + /** + * Merge config hashes recursivly + * + * The algorithm merges configuration arrays recursively. If an element is + * an array in both, the values will be appended. If it is a scalar in both, + * the value will be replaced. + * + * @param array $current The legacy hash + * @param array $successor The hash which values count more when in doubt + * @return array Merged hash + */ + protected function _mergeConfig($current, $successor) + { + if (is_array($current) and is_array($successor)) { + foreach ($successor as $key => $value) { + if (isset($current[$key]) + and is_array($value) + and is_array($current[$key])) { + + $current[$key] = $this->_mergeConfig($current[$key], $value); + } else { + $current[$key] = $successor[$key]; + } + } + } + return $current; + } + + /** + * Returns the config array + * + * @return array the config array + */ + public function getConfig() + { + return $this->config; + } +} + +/** + * Local variables: + * tab-width: 4 + * c-basic-offset: 4 + * End: + * vim600: sw=4 ts=4 expandtab + */ diff --git a/libraries/plugins/IDS/Ips.php b/libraries/plugins/IDS/Ips.php new file mode 100644 index 0000000..1a8a864 --- /dev/null +++ b/libraries/plugins/IDS/Ips.php @@ -0,0 +1,224 @@ + + * @license http://www.gnu.org/licenses/lgpl.html LGPL + * @version Release: $Id:Ips.php 517 2011-07-29 15:04:13Z bernieberg $ + */ +class IDS_Ips +{ + /** + * Holds the data from the log file + * + * @var array + */ + private $data = array(); + + /** + * how long an ip will be blocked from their last hit + * + * @var int + */ + private $blocked_duration = 7200; + + /** + * How many negative hits until they are blocked + * + * @var int + */ + private $blocked_count = 5; + + /** + * location of the ip log file + * + * @var string + */ + private $ip_file = null; + + + /** + * Constructor + * + * Sets up the object with the passed arguments + * + * @param string $ip_file location of the ip log file + * @param int $duration how long, in seconds, to keep an ip blocked + * @param int $count how many hits until be block this ip + * + * @return void + */ + public function __construct($ip_file, $duration = 7200, $count = 5) + { + $this->blocked_duration = $duration; + $this->blocked_count = $count; + $this->ip_file = $ip_file; + + if (!file_exists($ip_file)) { + $this->data = array(); + return; + } + + // 0 = ip address + // 1 = count + // 2 = last date + // 3 = ban count + + $handle = fopen($ip_file, "r"); + $good_data = array(); + + while (($data = fgetcsv($handle, 0, ",")) !== FALSE) { + $good_data[$data[0]] = $data; + } + fclose($handle); + + $this->data = $good_data; + } + + public function tempBlock($ip_address) + { + + if (!array_key_exists($ip_address, $this->data)) { + $this->data[$ip_address] = array($ip_address, $this->blocked_count + 1, time(), 0, false); + } else { + $this->data[$ip_address][1] += $this->blocked_count; + $this->data[$ip_address][2] = time(); + } + + $this->writeLog(); + return true; + } + + /** + * isBlocked + * + * Is the passed ip address blocked? + * + * @param string $ip_address ip we are checking + * + * @return boolean + */ + public function isBlocked($ip_address) + { + + if (!array_key_exists($ip_address, $this->data)) { + return array(false, 0); + } + + $blocked_time = time()-$this->blocked_duration; + $ip_data = $this->data[$ip_address]; + + //print_r($ip_data); + + if ($ip_data[1]>=$this->blocked_count && $ip_data[2]>=$blocked_time) { + $this->incCount($ip_address); + $this->writeLog(); + return array(true, $ip_data[3]); + } + elseif($ip_data[2] <= $blocked_time && $ip_data[4] == 1) + { + //$this->unBlock($ip_address); + $this->resetCount($ip_address); + $this->writeLog(); + } + + return array(false, 0); + } + + /** + * blockCount + * + * increase ban count, you should run writeLog after this + * + * @param string $ip_address ip we are checking + * + * @return void + */ + public function resetCount($ip_address) + { + if (array_key_exists($ip_address, $this->data)) { + //unset($this->data[$ip_address]); + $this->data[$ip_address][1] = 0; + $this->data[$ip_address][4] = false; + } + } + + /** + * blockCount + * + * increase ban count, you should run writeLog after this + * + * @param string $ip_address ip we are checking + * + * @return void + */ + public function incCount($ip_address) + { + if (array_key_exists($ip_address, $this->data) && $this->data[$ip_address][4] == false) { + $this->data[$ip_address][3]++; + $this->data[$ip_address][4] = true; + } + } + + /** + * unBlock + * + * remove the passed ip address, you should run writeLog after this + * + * @param string $ip_address ip we are checking + * + * @return void + */ + public function unBlock($ip_address) + { + echo "UNBLOCKED !"; + if (array_key_exists($ip_address, $this->data)) { + unset($this->data[$ip_address]); + } + } + + /** + * logHit + * + * log and increment a negative hit for this ip address + * + * @param string $ip_address ip we are checking + * + * @return void + */ + public function logHit($ip_address) + { + if (!array_key_exists($ip_address, $this->data)) { + $this->data[$ip_address] = array($ip_address, 1, time(), 0, false); + } else { + $this->data[$ip_address][1]++; + $this->data[$ip_address][2] = time(); + } + } + + /** + * writeLog + * + * write the ip log file + * + * @return void + */ + public function writeLog() + { + $fp = fopen($this->ip_file, 'w'); + + foreach ($this->data as $fields) { + fputcsv($fp, $fields); + } + + fclose($fp); + + return true; + } +} + +?> \ No newline at end of file diff --git a/libraries/plugins/IDS/LICENSE.txt b/libraries/plugins/IDS/LICENSE.txt new file mode 100644 index 0000000..3f9959f --- /dev/null +++ b/libraries/plugins/IDS/LICENSE.txt @@ -0,0 +1,165 @@ + GNU LESSER GENERAL PUBLIC LICENSE + Version 3, 29 June 2007 + + Copyright (C) 2007 Free Software Foundation, Inc. + Everyone is permitted to copy and distribute verbatim copies + of this license document, but changing it is not allowed. + + + This version of the GNU Lesser General Public License incorporates +the terms and conditions of version 3 of the GNU General Public +License, supplemented by the additional permissions listed below. + + 0. Additional Definitions. + + As used herein, "this License" refers to version 3 of the GNU Lesser +General Public License, and the "GNU GPL" refers to version 3 of the GNU +General Public License. + + "The Library" refers to a covered work governed by this License, +other than an Application or a Combined Work as defined below. + + An "Application" is any work that makes use of an interface provided +by the Library, but which is not otherwise based on the Library. +Defining a subclass of a class defined by the Library is deemed a mode +of using an interface provided by the Library. + + A "Combined Work" is a work produced by combining or linking an +Application with the Library. The particular version of the Library +with which the Combined Work was made is also called the "Linked +Version". + + The "Minimal Corresponding Source" for a Combined Work means the +Corresponding Source for the Combined Work, excluding any source code +for portions of the Combined Work that, considered in isolation, are +based on the Application, and not on the Linked Version. + + The "Corresponding Application Code" for a Combined Work means the +object code and/or source code for the Application, including any data +and utility programs needed for reproducing the Combined Work from the +Application, but excluding the System Libraries of the Combined Work. + + 1. Exception to Section 3 of the GNU GPL. + + You may convey a covered work under sections 3 and 4 of this License +without being bound by section 3 of the GNU GPL. + + 2. Conveying Modified Versions. + + If you modify a copy of the Library, and, in your modifications, a +facility refers to a function or data to be supplied by an Application +that uses the facility (other than as an argument passed when the +facility is invoked), then you may convey a copy of the modified +version: + + a) under this License, provided that you make a good faith effort to + ensure that, in the event an Application does not supply the + function or data, the facility still operates, and performs + whatever part of its purpose remains meaningful, or + + b) under the GNU GPL, with none of the additional permissions of + this License applicable to that copy. + + 3. Object Code Incorporating Material from Library Header Files. + + The object code form of an Application may incorporate material from +a header file that is part of the Library. You may convey such object +code under terms of your choice, provided that, if the incorporated +material is not limited to numerical parameters, data structure +layouts and accessors, or small macros, inline functions and templates +(ten or fewer lines in length), you do both of the following: + + a) Give prominent notice with each copy of the object code that the + Library is used in it and that the Library and its use are + covered by this License. + + b) Accompany the object code with a copy of the GNU GPL and this license + document. + + 4. Combined Works. + + You may convey a Combined Work under terms of your choice that, +taken together, effectively do not restrict modification of the +portions of the Library contained in the Combined Work and reverse +engineering for debugging such modifications, if you also do each of +the following: + + a) Give prominent notice with each copy of the Combined Work that + the Library is used in it and that the Library and its use are + covered by this License. + + b) Accompany the Combined Work with a copy of the GNU GPL and this license + document. + + c) For a Combined Work that displays copyright notices during + execution, include the copyright notice for the Library among + these notices, as well as a reference directing the user to the + copies of the GNU GPL and this license document. + + d) Do one of the following: + + 0) Convey the Minimal Corresponding Source under the terms of this + License, and the Corresponding Application Code in a form + suitable for, and under terms that permit, the user to + recombine or relink the Application with a modified version of + the Linked Version to produce a modified Combined Work, in the + manner specified by section 6 of the GNU GPL for conveying + Corresponding Source. + + 1) Use a suitable shared library mechanism for linking with the + Library. A suitable mechanism is one that (a) uses at run time + a copy of the Library already present on the user's computer + system, and (b) will operate properly with a modified version + of the Library that is interface-compatible with the Linked + Version. + + e) Provide Installation Information, but only if you would otherwise + be required to provide such information under section 6 of the + GNU GPL, and only to the extent that such information is + necessary to install and execute a modified version of the + Combined Work produced by recombining or relinking the + Application with a modified version of the Linked Version. (If + you use option 4d0, the Installation Information must accompany + the Minimal Corresponding Source and Corresponding Application + Code. If you use option 4d1, you must provide the Installation + Information in the manner specified by section 6 of the GNU GPL + for conveying Corresponding Source.) + + 5. Combined Libraries. + + You may place library facilities that are a work based on the +Library side by side in a single library together with other library +facilities that are not Applications and are not covered by this +License, and convey such a combined library under terms of your +choice, if you do both of the following: + + a) Accompany the combined library with a copy of the same work based + on the Library, uncombined with any other library facilities, + conveyed under the terms of this License. + + b) Give prominent notice with the combined library that part of it + is a work based on the Library, and explaining where to find the + accompanying uncombined form of the same work. + + 6. Revised Versions of the GNU Lesser General Public License. + + The Free Software Foundation may publish revised and/or new versions +of the GNU Lesser General Public License from time to time. Such new +versions will be similar in spirit to the present version, but may +differ in detail to address new problems or concerns. + + Each version is given a distinguishing version number. If the +Library as you received it specifies that a certain numbered version +of the GNU Lesser General Public License "or any later version" +applies to it, you have the option of following the terms and +conditions either of that published version or of any later version +published by the Free Software Foundation. If the Library as you +received it does not specify a version number of the GNU Lesser +General Public License, you may choose any version of the GNU Lesser +General Public License ever published by the Free Software Foundation. + + If the Library as you received it specifies that a proxy can decide +whether future versions of the GNU Lesser General Public License shall +apply, that proxy's public statement of acceptance of any version is +permanent authorization for you to choose that version for the +Library. \ No newline at end of file diff --git a/libraries/plugins/IDS/Log/Api.php b/libraries/plugins/IDS/Log/Api.php new file mode 100644 index 0000000..8f8f2f5 --- /dev/null +++ b/libraries/plugins/IDS/Log/Api.php @@ -0,0 +1,229 @@ +. + * + * PHP version 5.1.6+ + * + * @category Security + * @package PHPIDS + * @author Mario Heiderich + * @author Christian Matthies + * @author Lars Strojny + * @license http://www.gnu.org/licenses/lgpl.html LGPL + * @link http://php-ids.org/ + */ + +require_once 'IDS/Log/Interface.php'; + +/** + * File logging wrapper + * + * The file wrapper is designed to store data into a flatfile. It implements the + * singleton pattern. + * + * @category Security + * @package PHPIDS + * @author Christian Matthies + * @author Mario Heiderich + * @author Lars Strojny + * @copyright 2007-2009 The PHPIDS Group + * @license http://www.gnu.org/licenses/lgpl.html LGPL + * @version Release: $Id:File.php 517 2007-09-15 15:04:13Z mario $ + * @link http://php-ids.org/ + */ +class IDS_Log_Api implements IDS_Log_Interface +{ + + /** + * Path to the log file + * + * @var string + */ + private $logfile = null; + + /** + * Instance container + * + * Due to the singleton pattern this class allows to initiate only one + * instance for each file. + * + * @var array + */ + private static $instances = array(); + + /** + * Holds current remote address + * + * @var string + */ + private $ip = 'local/unknown'; + + /** + * Constructor + * + * @param string $logfile path to the log file + * + * @return void + */ + protected function __construct($logfile) + { + + // determine correct IP address and concat them if necessary + $this->ip = $_SERVER['REMOTE_ADDR'] . + (isset($_SERVER['HTTP_X_FORWARDED_FOR']) ? + ' (' . $_SERVER['HTTP_X_FORWARDED_FOR'] . ')' : ''); + + $this->logfile = $logfile; + } + + /** + * Returns an instance of this class + * + * This method allows the passed argument to be either an instance of + * IDS_Init or a path to a log file. Due to the singleton pattern only one + * instance for each file can be initiated. + * + * @param mixed $config IDS_Init or path to a file + * @param string $classname the class name to use + * + * @return object $this + */ + public static function getInstance($config, $classname = 'IDS_Log_Api') + { + if ($config instanceof IDS_Init) { + $logfile = $config->getBasePath() . $config->config['Logging']['path']; + } elseif (is_string($config)) { + $logfile = $config; + } + + if (!isset(self::$instances[$logfile])) { + self::$instances[$logfile] = new $classname($logfile); + } + + return self::$instances[$logfile]; + } + + /** + * Permitting to clone this object + * + * For the sake of correctness of a singleton pattern, this is necessary + * + * @return void + */ + private function __clone() + { + } + + /** + * Prepares data + * + * Converts given data into a format that can be stored into a file. + * You might edit this method to your requirements. + * + * @param mixed $data incoming report data + * + * @return string + */ + protected function prepareData($data) + { + + $format = '"%s",%s,%d,"%s","%s","%s","%s"'; + + $attackedParameters = ''; + foreach ($data as $event) { + $attackedParameters .= $event->getName() . '=' . + rawurlencode($event->getValue()) . ' '; + } + + $dataString = sprintf($format, + urlencode($this->ip), + date('c'), + $data->getImpact(), + join(' ', $data->getTags()), + urlencode(trim($attackedParameters)), + urlencode($_SERVER['REQUEST_URI']), + $_SERVER['SERVER_ADDR'] + ); + + return $dataString; + } + + /** + * Stores given data into a file + * + * @param object $data IDS_Report + * + * @throws Exception if the logfile isn't writeable + * @return boolean + */ + public function execute(IDS_Report $data) + { + + /* + * In case the data has been modified before it might be necessary + * to convert it to string since we can't store array or object + * into a file + */ + $data = $this->prepareData($data); + + if (is_string($data)) { + + if (file_exists($this->logfile)) { + $data = trim($data); + + if (!empty($data)) { + if (is_writable($this->logfile)) { + + $handle = fopen($this->logfile, 'a'); + fwrite($handle, trim($data) . "\n"); + fclose($handle); + + } else { + throw new Exception( + 'Please make sure that ' . $this->logfile . + ' is writeable.' + ); + } + } + } else { + throw new Exception( + 'Given file does not exist. Please make sure the + logfile is present in the given directory.' + ); + } + } else { + throw new Exception( + 'Please make sure that data returned by + IDS_Log_File::prepareData() is a string.' + ); + } + + return true; + } +} + +/** + * Local variables: + * tab-width: 4 + * c-basic-offset: 4 + * End: + * vim600: sw=4 ts=4 expandtab + */ diff --git a/libraries/plugins/IDS/Log/Composite.php b/libraries/plugins/IDS/Log/Composite.php new file mode 100644 index 0000000..fcd2a7c --- /dev/null +++ b/libraries/plugins/IDS/Log/Composite.php @@ -0,0 +1,136 @@ +. + * + * PHP version 5.1.6+ + * + * @category Security + * @package PHPIDS + * @author Mario Heiderich + * @author Christian Matthies + * @author Lars Strojny + * @license http://www.gnu.org/licenses/lgpl.html LGPL + * @link http://php-ids.org/ + */ + +require_once 'IDS/Log/Interface.php'; + +/** + * Log Composite + * + * This class implements the composite pattern to allow to work with multiple + * logging wrappers at once. + * + * @category Security + * @package PHPIDS + * @author Christian Matthies + * @author Mario Heiderich + * @author Lars Strojny + * @copyright 2007-2009 The PHPIDS Group + * @license http://www.gnu.org/licenses/lgpl.html LGPL + * @version Release: $Id:Composite.php 517 2007-09-15 15:04:13Z mario $ + * @link http://php-ids.org/ + */ +class IDS_Log_Composite +{ + + /** + * Holds registered logging wrapper + * + * @var array + */ + public $loggers = array(); + + /** + * Iterates through registered loggers and executes them + * + * @param object $data IDS_Report object + * + * @return void + */ + public function execute(IDS_Report $data) + { + // make sure request uri is set right on IIS + if (!isset($_SERVER['REQUEST_URI'])) { + $_SERVER['REQUEST_URI'] = substr($_SERVER['PHP_SELF'], 1); + if (isset($_SERVER['QUERY_STRING']) && $_SERVER['QUERY_STRING']) { + $_SERVER['REQUEST_URI'] .= '?' . $_SERVER['QUERY_STRING']; + } + } + + // make sure server address is set right on IIS + if (isset($_SERVER['LOCAL_ADDR'])) { + $_SERVER['SERVER_ADDR'] = $_SERVER['LOCAL_ADDR']; + } + + foreach ($this->loggers as $logger) { + $logger->execute($data); + } + } + + /** + * Registers a new logging wrapper + * + * Only valid IDS_Log_Interface instances passed to this function will be + * registered + * + * @return void + */ + public function addLogger() + { + + $args = func_get_args(); + + foreach ($args as $class) { + if (!in_array($class, $this->loggers) && + ($class instanceof IDS_Log_Interface)) { + $this->loggers[] = $class; + } + } + } + + /** + * Removes a logger + * + * @param object $logger IDS_Log_Interface object + * + * @return boolean + */ + public function removeLogger(IDS_Log_Interface $logger) + { + $key = array_search($logger, $this->loggers); + + if (isset($this->loggers[$key])) { + unset($this->loggers[$key]); + return true; + } + + return false; + } +} + +/** + * Local variables: + * tab-width: 4 + * c-basic-offset: 4 + * End: + * vim600: sw=4 ts=4 expandtab + */ diff --git a/libraries/plugins/IDS/Log/Database.php b/libraries/plugins/IDS/Log/Database.php new file mode 100644 index 0000000..4728379 --- /dev/null +++ b/libraries/plugins/IDS/Log/Database.php @@ -0,0 +1,300 @@ +. + * + * PHP version 5.1.6+ + * + * @category Security + * @package PHPIDS + * @author Mario Heiderich + * @author Christian Matthies + * @author Lars Strojny + * @license http://www.gnu.org/licenses/lgpl.html LGPL + * @link http://php-ids.org/ + */ + +require_once 'IDS/Log/Interface.php'; + +/* + * Needed SQL: + * + CREATE DATABASE IF NOT EXISTS `phpids` DEFAULT CHARACTER + SET utf8 COLLATE utf8_general_ci; + DROP TABLE IF EXISTS `intrusions`; + CREATE TABLE IF NOT EXISTS `intrusions` ( + `id` int(11) unsigned NOT null auto_increment, + `name` varchar(128) NOT null, + `value` text NOT null, + `page` varchar(255) NOT null, + `tags` varchar(128) NOT null, + `ip` varchar(15) NOT null, + `ip2` varchar(15) NOT null, + `impact` int(11) unsigned NOT null, + `origin` varchar(15) NOT null, + `created` datetime NOT null, + PRIMARY KEY (`id`) + ) ENGINE=MyISAM ; + * + * + * + */ + +/** + * Database logging wrapper + * + * The database wrapper is designed to store reports into an sql database. It + * implements the singleton pattern and is based in PDO, supporting + * different database types. + * + * @category Security + * @package PHPIDS + * @author Christian Matthies + * @author Mario Heiderich + * @author Lars Strojny + * @copyright 2007-2009 The PHPIDS Group + * @license http://www.gnu.org/licenses/lgpl.html LGPL + * @version Release: $Id:Database.php 517 2007-09-15 15:04:13Z mario $ + * @link http://php-ids.org/ + */ +class IDS_Log_Database implements IDS_Log_Interface +{ + + /** + * Database wrapper + * + * @var string + */ + private $wrapper = null; + + /** + * Database user + * + * @var string + */ + private $user = null; + + /** + * Database password + * + * @var string + */ + private $password = null; + + /** + * Database table + * + * @var string + */ + private $table = null; + + /** + * Database handle + * + * @var object PDO instance + */ + private $handle = null; + + /** + * Prepared SQL statement + * + * @var string + */ + private $statement = null; + + /** + * Holds current remote address + * + * @var string + */ + private $ip = 'local/unknown'; + + /** + * Instance container + * + * Due to the singleton pattern this class allows to initiate only one instance + * for each database wrapper. + * + * @var array + */ + private static $instances = array(); + + /** + * Constructor + * + * Prepares the SQL statement + * + * @param mixed $config IDS_Init instance | array + * + * @return void + * @throws PDOException if a db error occurred + */ + protected function __construct($config) + { + + if ($config instanceof IDS_Init) { + $this->wrapper = $config->config['Logging']['wrapper']; + $this->user = $config->config['Logging']['user']; + $this->password = $config->config['Logging']['password']; + $this->table = $config->config['Logging']['table']; + + } elseif (is_array($config)) { + $this->wrapper = $config['wrapper']; + $this->user = $config['user']; + $this->password = $config['password']; + $this->table = $config['table']; + } + + // determine correct IP address and concat them if necessary + $this->ip = $_SERVER['REMOTE_ADDR']; + $this->ip2 = isset($_SERVER['HTTP_X_FORWARDED_FOR']) + ? $_SERVER['HTTP_X_FORWARDED_FOR'] + : ''; + + try { + $this->handle = new PDO( + $this->wrapper, + $this->user, + $this->password + ); + + $this->statement = $this->handle->prepare(' + INSERT INTO ' . $this->table . ' ( + name, + value, + page, + tags, + ip, + ip2, + impact, + origin, + created + ) + VALUES ( + :name, + :value, + :page, + :tags, + :ip, + :ip2, + :impact, + :origin, + now() + ) + '); + + } catch (PDOException $e) { + throw new PDOException('PDOException: ' . $e->getMessage()); + } + } + + /** + * Returns an instance of this class + * + * This method allows the passed argument to be either an instance of IDS_Init or + * an array. + * + * @param mixed $config IDS_Init | array + * @param string $classname the class name to use + * + * @return object $this + */ + public static function getInstance($config, $classname = 'IDS_Log_Database') + { + if ($config instanceof IDS_Init) { + $wrapper = $config->config['Logging']['wrapper']; + } elseif (is_array($config)) { + $wrapper = $config['wrapper']; + } + + if (!isset(self::$instances[$wrapper])) { + self::$instances[$wrapper] = new $classname($config); + } + + return self::$instances[$wrapper]; + } + + /** + * Permitting to clone this object + * + * For the sake of correctness of a singleton pattern, this is necessary + * + * @return void + */ + private function __clone() + { + } + + /** + * Stores given data into the database + * + * @param object $data IDS_Report instance + * + * @throws Exception if db error occurred + * @return boolean + */ + public function execute(IDS_Report $data) + { + if (!isset($_SERVER['REQUEST_URI'])) { + $_SERVER['REQUEST_URI'] = substr($_SERVER['PHP_SELF'], 1); + if (isset($_SERVER['QUERY_STRING']) && $_SERVER['QUERY_STRING']) { + $_SERVER['REQUEST_URI'] .= '?' . $_SERVER['QUERY_STRING']; + } + } + + foreach ($data as $event) { + $page = isset($_SERVER['REQUEST_URI']) ? $_SERVER['REQUEST_URI'] : ''; + $ip = $this->ip; + $ip2 = $this->ip2; + + $name = $event->getName(); + $value = $event->getValue(); + $impact = $event->getImpact(); + $tags = implode(', ', $event->getTags()); + + $this->statement->bindParam('name', $name); + $this->statement->bindParam('value', $value); + $this->statement->bindParam('page', $page); + $this->statement->bindParam('tags', $tags); + $this->statement->bindParam('ip', $ip); + $this->statement->bindParam('ip2', $ip2); + $this->statement->bindParam('impact', $impact); + $this->statement->bindParam('origin', $_SERVER['SERVER_ADDR']); + + if (!$this->statement->execute()) { + + $info = $this->statement->errorInfo(); + throw new Exception( + $this->statement->errorCode() . ', ' . $info[1] . ', ' . $info[2] + ); + } + } + + return true; + } +} + +/** + * Local variables: + * tab-width: 4 + * c-basic-offset: 4 + * End: + * vim600: sw=4 ts=4 expandtab + */ diff --git a/libraries/plugins/IDS/Log/Email.php b/libraries/plugins/IDS/Log/Email.php new file mode 100644 index 0000000..ec4c1f0 --- /dev/null +++ b/libraries/plugins/IDS/Log/Email.php @@ -0,0 +1,400 @@ +. + * + * PHP version 5.1.6+ + * + * @category Security + * @package PHPIDS + * @author Mario Heiderich + * @author Christian Matthies + * @author Lars Strojny + * @license http://www.gnu.org/licenses/lgpl.html LGPL + * @link http://php-ids.org/ + */ + +require_once 'IDS/Log/Interface.php'; + +/** + * Email logging wrapper + * + * The Email wrapper is designed to send reports via email. It implements the + * singleton pattern. + * + * @category Security + * @package PHPIDS + * @author Christian Matthies + * @author Mario Heiderich + * @author Lars Strojny + * @copyright 2007-2009 The PHPIDS Group + * @license http://www.gnu.org/licenses/lgpl.html LGPL + * @version Release: $Id:Email.php 517 2007-09-15 15:04:13Z mario $ + * @link http://php-ids.org/ + */ +class IDS_Log_Email implements IDS_Log_Interface +{ + + /** + * Recipient container + * + * @var array + */ + protected $recipients = array(); + + /** + * Mail subject + * + * @var string + */ + protected $subject = null; + + /** + * Additional mail headers + * + * @var string + */ + protected $headers = null; + + /** + * Safemode switch + * + * Using this switch it is possible to enable safemode, which is a spam + * protection based on the alert frequency. + * + * @var boolean + */ + protected $safemode = true; + + /** + * Urlencode for result strings + * + * This switch is true by default. Setting it to false removes + * the 'better safe than sorry' urlencoding for the result string in + * the report mails. Enhances readability but maybe XSSes email clients. + * + * @var boolean + */ + protected $urlencode = true; + + /** + * Send rate + * + * If safemode is enabled, this property defines how often reports will be + * sent out. Default value is 15, which means that a mail will be sent on + * condition that the last email has not been sent earlier than 15 seconds ago. + * + * @var integer + */ + protected $allowed_rate = 15; + + /** + * PHPIDS temp directory + * + * When safemod is enabled, a path to a temp directory is needed to + * store some information. Default is IDS/tmp/ + * + * @var string + */ + protected $tmp_path = 'IDS/tmp/'; + + /** + * File prefix for tmp files + * + * @var string + */ + protected $file_prefix = 'PHPIDS_Log_Email_'; + + /** + * Holds current remote address + * + * @var string + */ + protected $ip = 'local/unknown'; + + /** + * Instance container + * + * @var array + */ + protected static $instance = array(); + + /** + * Constructor + * + * @param mixed $config IDS_Init instance | array + * + * @return void + */ + protected function __construct($config) + { + + if ($config instanceof IDS_Init) { + $this->recipients = $config->config['Logging']['recipients']; + $this->subject = $config->config['Logging']['subject']; + $this->headers = $config->config['Logging']['header']; + $this->envelope = $config->config['Logging']['envelope']; + $this->safemode = $config->config['Logging']['safemode']; + $this->urlencode = $config->config['Logging']['urlencode']; + $this->allowed_rate = $config->config['Logging']['allowed_rate']; + $this->tmp_path = $config->getBasePath() + . $config->config['General']['tmp_path']; + + } elseif (is_array($config)) { + $this->recipients[] = $config['recipients']; + $this->subject = $config['subject']; + $this->additionalHeaders = $config['header']; + } + + // determine correct IP address and concat them if necessary + $this->ip = $_SERVER['REMOTE_ADDR'] . + (isset($_SERVER['HTTP_X_FORWARDED_FOR']) ? + ' (' . $_SERVER['HTTP_X_FORWARDED_FOR'] . ')' : ''); + } + + /** + * Returns an instance of this class + * + * This method allows the passed argument to be either an instance of + * IDS_Init or an array. + * + * @param mixed $config IDS_Init | array + * @param string $classname the class name to use + * + * @return object $this + */ + public static function getInstance($config, $classname = 'IDS_Log_Email') + { + if (!self::$instance) { + self::$instance = new $classname($config); + } + + return self::$instance; + } + + /** + * Permitting to clone this object + * + * For the sake of correctness of a singleton pattern, this is necessary + * + * @return void + */ + private function __clone() + { + } + + /** + * Detects spam attempts + * + * To avoid mail spam through this logging class this function is used + * to detect such attempts based on the alert frequency. + * + * @return boolean + */ + protected function isSpamAttempt() + { + + /* + * loop through all files in the tmp directory and + * delete garbage files + */ + $dir = $this->tmp_path; + $numPrefixChars = strlen($this->file_prefix); + $files = scandir($dir); + foreach ($files as $file) { + if (is_file($dir . DIRECTORY_SEPARATOR . $file)) { + if (substr($file, 0, $numPrefixChars) == $this->file_prefix) { + $lastModified = filemtime($dir . DIRECTORY_SEPARATOR . $file); + if ((time() - $lastModified) > 3600) { + unlink($dir . DIRECTORY_SEPARATOR . $file); + } + } + } + } + + /* + * end deleting garbage files + */ + $remoteAddr = $this->ip; + $userAgent = $_SERVER['HTTP_USER_AGENT']; + $filename = $this->file_prefix . md5($remoteAddr.$userAgent) . '.tmp'; + $file = $dir . DIRECTORY_SEPARATOR . $filename; + + if (!file_exists($file)) { + $handle = fopen($file, 'w'); + fwrite($handle, time()); + fclose($handle); + + return false; + } + + $lastAttack = file_get_contents($file); + $difference = time() - $lastAttack; + if ($difference > $this->allowed_rate) { + unlink($file); + } else { + return true; + } + + return false; + } + + /** + * Prepares data + * + * Converts given data into a format that can be read in an email. + * You might edit this method to your requirements. + * + * @param mixed $data the report data + * + * @return string + */ + protected function prepareData($data) + { + + $format = "The following attack has been detected by PHPIDS\n\n"; + $format .= "IP: %s \n"; + $format .= "Date: %s \n"; + $format .= "Impact: %d \n"; + $format .= "Affected tags: %s \n"; + + $attackedParameters = ''; + foreach ($data as $event) { + $attackedParameters .= $event->getName() . '=' . + ((!isset($this->urlencode) ||$this->urlencode) + ? urlencode($event->getValue()) + : $event->getValue()) . ", "; + } + + $format .= "Affected parameters: %s \n"; + $format .= "Request URI: %s \n"; + $format .= "Origin: %s \n"; + + return sprintf($format, + $this->ip, + date('c'), + $data->getImpact(), + join(' ', $data->getTags()), + trim($attackedParameters), + htmlspecialchars($_SERVER['REQUEST_URI'], ENT_QUOTES, 'UTF-8'), + $_SERVER['SERVER_ADDR']); + } + + /** + * Sends the report to registered recipients + * + * @param object $data IDS_Report instance + * + * @throws Exception if data is no string + * @return boolean + */ + public function execute(IDS_Report $data) + { + + if ($this->safemode) { + if ($this->isSpamAttempt()) { + return false; + } + } + + /* + * In case the data has been modified before it might + * be necessary to convert it to string since it's pretty + * senseless to send array or object via e-mail + */ + $data = $this->prepareData($data); + + if (is_string($data)) { + $data = trim($data); + + // if headers are passed as array, we need to make a string of it + if (is_array($this->headers)) { + $headers = ""; + foreach ($this->headers as $header) { + $headers .= $header . "\r\n"; + } + } else { + $headers = $this->headers; + } + + if (!empty($this->recipients)) { + if (is_array($this->recipients)) { + foreach ($this->recipients as $address) { + $this->send( + $address, + $data, + $headers, + $this->envelope + ); + } + } else { + $this->send( + $this->recipients, + $data, + $headers, + $this->envelope + ); + } + } + + } else { + throw new Exception( + 'Please make sure that data returned by + IDS_Log_Email::prepareData() is a string.' + ); + } + + return true; + } + + /** + * Sends an email + * + * @param string $address email address + * @param string $data the report data + * @param string $headers the mail headers + * @param string $envelope the optional envelope string + * + * @return boolean + */ + protected function send($address, $data, $headers, $envelope = null) + { + if (!$envelope || strpos(ini_get('sendmail_path'),' -f') !== false) { + return mail($address, + $this->subject, + $data, + $headers); + } else { + return mail($address, + $this->subject, + $data, + $headers, + '-f' . $envelope); + } + } +} + +/** + * Local variables: + * tab-width: 4 + * c-basic-offset: 4 + * End: + * vim600: sw=4 ts=4 expandtab + */ diff --git a/libraries/plugins/IDS/Log/File.php b/libraries/plugins/IDS/Log/File.php new file mode 100644 index 0000000..76be418 --- /dev/null +++ b/libraries/plugins/IDS/Log/File.php @@ -0,0 +1,229 @@ +. + * + * PHP version 5.1.6+ + * + * @category Security + * @package PHPIDS + * @author Mario Heiderich + * @author Christian Matthies + * @author Lars Strojny + * @license http://www.gnu.org/licenses/lgpl.html LGPL + * @link http://php-ids.org/ + */ + +require_once 'IDS/Log/Interface.php'; + +/** + * File logging wrapper + * + * The file wrapper is designed to store data into a flatfile. It implements the + * singleton pattern. + * + * @category Security + * @package PHPIDS + * @author Christian Matthies + * @author Mario Heiderich + * @author Lars Strojny + * @copyright 2007-2009 The PHPIDS Group + * @license http://www.gnu.org/licenses/lgpl.html LGPL + * @version Release: $Id:File.php 517 2007-09-15 15:04:13Z mario $ + * @link http://php-ids.org/ + */ +class IDS_Log_File implements IDS_Log_Interface +{ + + /** + * Path to the log file + * + * @var string + */ + private $logfile = null; + + /** + * Instance container + * + * Due to the singleton pattern this class allows to initiate only one + * instance for each file. + * + * @var array + */ + private static $instances = array(); + + /** + * Holds current remote address + * + * @var string + */ + private $ip = 'local/unknown'; + + /** + * Constructor + * + * @param string $logfile path to the log file + * + * @return void + */ + protected function __construct($logfile) + { + + // determine correct IP address and concat them if necessary + $this->ip = $_SERVER['REMOTE_ADDR'] . + (isset($_SERVER['HTTP_X_FORWARDED_FOR']) ? + ' (' . $_SERVER['HTTP_X_FORWARDED_FOR'] . ')' : ''); + + $this->logfile = $logfile; + } + + /** + * Returns an instance of this class + * + * This method allows the passed argument to be either an instance of + * IDS_Init or a path to a log file. Due to the singleton pattern only one + * instance for each file can be initiated. + * + * @param mixed $config IDS_Init or path to a file + * @param string $classname the class name to use + * + * @return object $this + */ + public static function getInstance($config, $classname = 'IDS_Log_File') + { + if ($config instanceof IDS_Init) { + $logfile = $config->getBasePath() . $config->config['Logging']['path']; + } elseif (is_string($config)) { + $logfile = $config; + } + + if (!isset(self::$instances[$logfile])) { + self::$instances[$logfile] = new $classname($logfile); + } + + return self::$instances[$logfile]; + } + + /** + * Permitting to clone this object + * + * For the sake of correctness of a singleton pattern, this is necessary + * + * @return void + */ + private function __clone() + { + } + + /** + * Prepares data + * + * Converts given data into a format that can be stored into a file. + * You might edit this method to your requirements. + * + * @param mixed $data incoming report data + * + * @return string + */ + protected function prepareData($data) + { + + $format = '"%s",%s,%d,"%s","%s","%s","%s"'; + + $attackedParameters = ''; + foreach ($data as $event) { + $attackedParameters .= $event->getName() . '=' . + rawurlencode($event->getValue()) . ' '; + } + + $dataString = sprintf($format, + urlencode($this->ip), + date('c'), + $data->getImpact(), + join(' ', $data->getTags()), + urlencode(trim($attackedParameters)), + urlencode($_SERVER['REQUEST_URI']), + $_SERVER['SERVER_ADDR'] + ); + + return $dataString; + } + + /** + * Stores given data into a file + * + * @param object $data IDS_Report + * + * @throws Exception if the logfile isn't writeable + * @return boolean + */ + public function execute(IDS_Report $data) + { + + /* + * In case the data has been modified before it might be necessary + * to convert it to string since we can't store array or object + * into a file + */ + $data = $this->prepareData($data); + + if (is_string($data)) { + + if (file_exists($this->logfile)) { + $data = trim($data); + + if (!empty($data)) { + if (is_writable($this->logfile)) { + + $handle = fopen($this->logfile, 'a'); + fwrite($handle, trim($data) . "\n"); + fclose($handle); + + } else { + throw new Exception( + 'Please make sure that ' . $this->logfile . + ' is writeable.' + ); + } + } + } else { + throw new Exception( + 'Given file does not exist. Please make sure the + logfile is present in the given directory.' + ); + } + } else { + throw new Exception( + 'Please make sure that data returned by + IDS_Log_File::prepareData() is a string.' + ); + } + + return true; + } +} + +/** + * Local variables: + * tab-width: 4 + * c-basic-offset: 4 + * End: + * vim600: sw=4 ts=4 expandtab + */ diff --git a/libraries/plugins/IDS/Log/Interface.php b/libraries/plugins/IDS/Log/Interface.php new file mode 100644 index 0000000..551532f --- /dev/null +++ b/libraries/plugins/IDS/Log/Interface.php @@ -0,0 +1,65 @@ +. + * + * PHP version 5.1.6+ + * + * @category Security + * @package PHPIDS + * @author Mario Heiderich + * @author Christian Matthies + * @author Lars Strojny + * @license http://www.gnu.org/licenses/lgpl.html LGPL + * @link http://php-ids.org/ + */ + +/** + * Interface for logging wrappers + * + * @category Security + * @package PHPIDS + * @author Christian Matthies + * @author Mario Heiderich + * @author Lars Strojny + * @copyright 2007-2009 The PHPIDS Group + * @version Release: $Id:Interface.php 517 2007-09-15 15:04:13Z mario $ + * @license http://www.gnu.org/licenses/lgpl.html LGPL + * @link http://php-ids.org/ + */ +interface IDS_Log_Interface +{ + /** + * Interface method + * + * @param IDS_Report $data the report data + * + * @return void + */ + public function execute(IDS_Report $data); +} + +/** + * Local variables: + * tab-width: 4 + * c-basic-offset: 4 + * End: + * vim600: sw=4 ts=4 expandtab + */ diff --git a/libraries/plugins/IDS/Monitor.php b/libraries/plugins/IDS/Monitor.php new file mode 100644 index 0000000..ee5cf97 --- /dev/null +++ b/libraries/plugins/IDS/Monitor.php @@ -0,0 +1,778 @@ +. + * + * PHP version 5.1.6+ + * + * @category Security + * @package PHPIDS + * @author Mario Heiderich + * @author Christian Matthies + * @author Lars Strojny + * @license http://www.gnu.org/licenses/lgpl.html LGPL + * @link http://php-ids.org/ + */ + +/** + * Monitoring engine + * + * This class represents the core of the frameworks attack detection mechanism + * and provides functions to scan incoming data for malicious appearing script + * fragments. + * + * @category Security + * @package PHPIDS + * @author Christian Matthies + * @author Mario Heiderich + * @author Lars Strojny + * @copyright 2007-2009 The PHPIDS Group + * @license http://www.gnu.org/licenses/lgpl.html LGPL + * @version Release: $Id:Monitor.php 949 2008-06-28 01:26:03Z christ1an $ + * @link http://php-ids.org/ + */ +class IDS_Monitor +{ + + /** + * Tags to define what to search for + * + * Accepted values are xss, csrf, sqli, dt, id, lfi, rfe, spam, dos + * + * @var array + */ + private $tags = null; + + /** + * Request array + * + * Array containing raw data to search in + * + * @var array + */ + private $request = null; + + /** + * Container for filter rules + * + * Holds an instance of IDS_Filter_Storage + * + * @var object + */ + private $storage = null; + + /** + * Results + * + * Holds an instance of IDS_Report which itself provides an API to + * access the detected results + * + * @var object + */ + private $report = null; + + /** + * Scan keys switch + * + * Enabling this property will cause the monitor to scan both the key and + * the value of variables + * + * @var boolean + */ + public $scanKeys = false; + + /** + * Exception container + * + * Using this array it is possible to define variables that must not be + * scanned. Per default, utmz google analytics parameters are permitted. + * + * @var array + */ + private $exceptions = array(); + + /** + * Html container + * + * Using this array it is possible to define variables that legally + * contain html and have to be prepared before hitting the rules to + * avoid too many false alerts + * + * @var array + */ + private $html = array(); + + /** + * JSON container + * + * Using this array it is possible to define variables that contain + * JSON data - and should be treated as such + * + * @var array + */ + private $json = array(); + + /** + * Holds HTMLPurifier object + * + * @var object + */ + private $htmlpurifier = NULL; + + /** + * Path to HTMLPurifier source + * + * This path might be changed in case one wishes to make use of a + * different HTMLPurifier source file e.g. if already used in the + * application PHPIDS is protecting + * + * @var string + */ + private $pathToHTMLPurifier = ''; + + /** + * HTMLPurifier cache directory + * + * @var string + */ + private $HTMLPurifierCache = ''; + + /** + * This property holds the tmp JSON string from the + * _jsonDecodeValues() callback + * + * @var string + */ + private $tmpJsonString = ''; + + + /** + * Constructor + * + * @param array $request array to scan + * @param object $init instance of IDS_Init + * @param array $tags list of tags to which filters should be applied + * + * @return void + */ + public function __construct(array $request, IDS_Init $init, array $tags = null) + { + $version = isset($init->config['General']['min_php_version']) + ? $init->config['General']['min_php_version'] : '5.1.6'; + + if (version_compare(PHP_VERSION, $version, '<')) { + throw new Exception( + 'PHP version has to be equal or higher than ' . $version . ' or + PHP version couldn\'t be determined' + ); + } + + + if (!empty($request)) { + $this->storage = new IDS_Filter_Storage($init); + $this->request = $request; + $this->tags = $tags; + + $this->scanKeys = $init->config['General']['scan_keys']; + + $this->exceptions = isset($init->config['General']['exceptions']) + ? $init->config['General']['exceptions'] : false; + + $this->html = isset($init->config['General']['html']) + ? $init->config['General']['html'] : false; + + $this->json = isset($init->config['General']['json']) + ? $init->config['General']['json'] : false; + + if(isset($init->config['General']['HTML_Purifier_Path']) + && isset($init->config['General']['HTML_Purifier_Cache'])) { + + $this->pathToHTMLPurifier = + $init->config['General']['HTML_Purifier_Path']; + + $this->HTMLPurifierCache = $init->getBasePath() + . $init->config['General']['HTML_Purifier_Cache']; + } + + } + + if (!is_writeable($init->getBasePath() + . $init->config['General']['tmp_path'])) { + throw new Exception( + 'Please make sure the ' . + htmlspecialchars($init->getBasePath() . + $init->config['General']['tmp_path'], ENT_QUOTES, 'UTF-8') . + ' folder is writable' + ); + } + + include_once 'IDS/Report.php'; + $this->report = new IDS_Report; + } + + /** + * Starts the scan mechanism + * + * @return object IDS_Report + */ + public function run() + { + + if (!empty($this->request)) { + foreach ($this->request as $key => $value) { + $this->_iterate($key, $value); + } + } + + return $this->getReport(); + } + + /** + * Iterates through given data and delegates it to IDS_Monitor::_detect() in + * order to check for malicious appearing fragments + * + * @param mixed $key the former array key + * @param mixed $value the former array value + * + * @return void + */ + private function _iterate($key, $value) + { + + if (!is_array($value)) { + if (is_string($value)) { + + if ($filter = $this->_detect($key, $value)) { + include_once 'IDS/Event.php'; + $this->report->addEvent( + new IDS_Event( + $key, + $value, + $filter + ) + ); + } + } + } else { + foreach ($value as $subKey => $subValue) { + $this->_iterate($key . '.' . $subKey, $subValue); + } + } + } + + /** + * Checks whether given value matches any of the supplied filter patterns + * + * @param mixed $key the key of the value to scan + * @param mixed $value the value to scan + * + * @return bool|array false or array of filter(s) that matched the value + */ + private function _detect($key, $value) + { + + // define the pre-filter + $prefilter = '/[^\w\s\/@!?\.]+|(?:\.\/)|(?:@@\w+)' + . '|(?:\+ADw)|(?:union\s+select)/i'; + + // to increase performance, only start detection if value + // isn't alphanumeric + if (!$this->scanKeys + && (!$value || !preg_match($prefilter, $value))) { + return false; + } elseif($this->scanKeys) { + if((!$key || !preg_match($prefilter, $key)) + && (!$value || !preg_match($prefilter, $value))) { + return false; + } + } + + // check if this field is part of the exceptions + if (is_array($this->exceptions)) { + foreach($this->exceptions as $exception) { + $matches = array(); + if(preg_match('/(\/.*\/[^eE]*)$/', $exception, $matches)) { + if(isset($matches[1]) && preg_match($matches[1], $key)) { + return false; + } + } else { + if($exception === $key) { + return false; + } + } + } + } + + // check for magic quotes and remove them if necessary + if (function_exists('get_magic_quotes_gpc') + && get_magic_quotes_gpc()) { + $value = stripslashes($value); + } + if(function_exists('get_magic_quotes_gpc') + && !get_magic_quotes_gpc() + && version_compare(PHP_VERSION, '5.3.0', '>=')) { + $value = preg_replace('/\\\(["\'\/])/im', '$1', $value); + } + + // if html monitoring is enabled for this field - then do it! + if (is_array($this->html) && in_array($key, $this->html, true)) { + list($key, $value) = $this->_purifyValues($key, $value); + } + + // check if json monitoring is enabled for this field + if (is_array($this->json) && in_array($key, $this->json, true)) { + list($key, $value) = $this->_jsonDecodeValues($key, $value); + } + + // use the converter + include_once 'IDS/Converter.php'; + $value = IDS_Converter::runAll($value); + $value = IDS_Converter::runCentrifuge($value, $this); + + // scan keys if activated via config + $key = $this->scanKeys ? IDS_Converter::runAll($key) + : $key; + $key = $this->scanKeys ? IDS_Converter::runCentrifuge($key, $this) + : $key; + + $filters = array(); + $filterSet = $this->storage->getFilterSet(); + foreach ($filterSet as $filter) { + + /* + * in case we have a tag array specified the IDS will only + * use those filters that are meant to detect any of the + * defined tags + */ + if (is_array($this->tags)) { + if (array_intersect($this->tags, $filter->getTags())) { + if ($this->_match($key, $value, $filter)) { + $filters[] = $filter; + } + } + } else { + if ($this->_match($key, $value, $filter)) { + $filters[] = $filter; + } + } + } + + return empty($filters) ? false : $filters; + } + + + /** + * Purifies given key and value variables using HTMLPurifier + * + * This function is needed whenever there is variables for which HTML + * might be allowed like e.g. WYSIWYG post bodies. It will dectect malicious + * code fragments and leaves harmless parts untouched. + * + * @param mixed $key + * @param mixed $value + * @since 0.5 + * @throws Exception + * + * @return array + */ + private function _purifyValues($key, $value) + { + /* + * Perform a pre-check if string is valid for purification + */ + if(!$this->_purifierPreCheck($key, $value)) { + return array($key, $value); + } + + include_once $this->pathToHTMLPurifier; + + if (!is_writeable($this->HTMLPurifierCache)) { + throw new Exception( + $this->HTMLPurifierCache . ' must be writeable'); + } + + if (class_exists('HTMLPurifier')) { + $config = HTMLPurifier_Config::createDefault(); + $config->set('Attr.EnableID', true); + $config->set('Cache.SerializerPath', $this->HTMLPurifierCache); + $config->set('Output.Newline', "\n"); + $this->htmlpurifier = new HTMLPurifier($config); + } else { + throw new Exception( + 'HTMLPurifier class could not be found - ' . + 'make sure the purifier files are valid and' . + ' the path is correct' + ); + } + + $value = preg_replace('/[\x0b-\x0c]/', ' ', $value); + $key = preg_replace('/[\x0b-\x0c]/', ' ', $key); + + $purified_value = $this->htmlpurifier->purify($value); + $purified_key = $this->htmlpurifier->purify($key); + + $redux_value = strip_tags($value); + $redux_key = strip_tags($key); + + if ($value != $purified_value || $redux_value) { + $value = $this->_diff($value, $purified_value, $redux_value); + } else { + $value = NULL; + } + if ($key != $purified_key) { + $key = $this->_diff($key, $purified_key, $redux_key); + } else { + $key = NULL; + } + + return array($key, $value); + } + + /** + * This method makes sure no dangerous markup can be smuggled in + * attributes when HTML mode is switched on. + * + * If the precheck considers the string too dangerous for + * purification false is being returned. + * + * @param mixed $key + * @param mixed $value + * @since 0.6 + * + * @return boolean + */ + private function _purifierPreCheck($key = '', $value = '') + { + /* + * Remove control chars before pre-check + */ + $tmp_value = preg_replace('/\p{C}/', null, $value); + $tmp_key = preg_replace('/\p{C}/', null, $key); + + $precheck = '/<(script|iframe|applet|object)\W/i'; + if(preg_match($precheck, $tmp_key) + || preg_match($precheck, $tmp_value)) { + + return false; + } + return true; + } + + + /** + * This method calculates the difference between the original + * and the purified markup strings. + * + * @param string $original the original markup + * @param string $purified the purified markup + * @param string $redux the string without html + * @since 0.5 + * + * @return string the difference between the strings + */ + private function _diff($original, $purified, $redux) + { + /* + * deal with over-sensitive alt-attribute addition of the purifier + * and other common html formatting problems + */ + $purified = preg_replace('/\s+alt="[^"]*"/m', null, $purified); + $purified = preg_replace('/=?\s*"\s*"/m', null, $purified); + $original = preg_replace('/\s+alt="[^"]*"/m', null, $original); + $original = preg_replace('/=?\s*"\s*"/m', null, $original); + $original = preg_replace('/style\s*=\s*([^"])/m', 'style = "$1', $original); + + # deal with oversensitive CSS normalization + $original = preg_replace('/(?:([\w\-]+:)+\s*([^;]+;\s*))/m', '$1$2', $original); + + # strip whitespace between tags + $original = trim(preg_replace('/>\s*<', $original)); + $purified = trim(preg_replace('/>\s*<', $purified)); + + $original = preg_replace( + '/(=\s*(["\'`])[^>"\'`]*>[^>"\'`]*["\'`])/m', 'alt$1', $original + ); + + // no purified html is left + if (!$purified) { + return $original; + } + + // calculate the diff length + $length = mb_strlen($original) - mb_strlen($purified); + + /* + * Calculate the difference between the original html input + * and the purified string. + */ + $array_1 = preg_split('/(? $value) { + if (!isset($array_2[$key]) || $value !== $array_2[$key]) { + $differences[] = $value; + } + } + + // return the diff - ready to hit the converter and the rules + if(intval($length) <= 10) { + $diff = trim(join('', $differences)); + } else { + $diff = mb_substr(trim(join('', $differences)), 0, strlen($original)); + } + + // clean up spaces between tag delimiters + $diff = preg_replace('/>\s*<', $diff); + + // correct over-sensitively stripped bad html elements + $diff = preg_replace('/[^<](iframe|script|embed|object' . + '|applet|base|img|style)/m', '<$1', $diff); + + if (mb_strlen($diff) < 4) { + return null; + } + + return $diff . $redux; + } + + /** + * This method prepares incoming JSON data for the PHPIDS detection + * process. It utilizes _jsonConcatContents() as callback and returns a + * string version of the JSON data structures. + * + * @param mixed $key + * @param mixed $value + * @since 0.5.3 + * + * @return array + */ + private function _jsonDecodeValues($key, $value) { + + $tmp_key = json_decode($key); + $tmp_value = json_decode($value); + + if($tmp_value && is_array($tmp_value) || is_object($tmp_value)) { + array_walk_recursive($tmp_value, array($this, '_jsonConcatContents')); + $value = $this->tmpJsonString; + } else { + $this->tmpJsonString .= " " . $tmp_value . "\n"; + } + + if($tmp_key && is_array($tmp_key) || is_object($tmp_key)) { + array_walk_recursive($tmp_key, array($this, '_jsonConcatContents')); + $key = $this->tmpJsonString; + } else { + $this->tmpJsonString .= " " . $tmp_key . "\n"; + } + + return array($key, $value); + } + + /** + * This is the callback used in _jsonDecodeValues(). The method + * concatenates key and value and stores them in $this->tmpJsonString. + * + * @param mixed $key + * @param mixed $value + * @since 0.5.3 + * + * @return void + */ + private function _jsonConcatContents($key, $value) { + + if(is_string($key) && is_string($value)) { + $this->tmpJsonString .= $key . " " . $value . "\n"; + } else { + $this->_jsonDecodeValues( + json_encode($key), json_encode($value) + ); + } + } + + /** + * Matches given value and/or key against given filter + * + * @param mixed $key the key to optionally scan + * @param mixed $value the value to scan + * @param object $filter the filter object + * + * @return boolean + */ + private function _match($key, $value, $filter) + { + if ($this->scanKeys) { + if ($filter->match($key)) { + return true; + } + } + + if ($filter->match($value)) { + return true; + } + + return false; + } + + /** + * Sets exception array + * + * @param mixed $exceptions the thrown exceptions + * + * @return void + */ + public function setExceptions($exceptions) + { + if (!is_array($exceptions)) { + $exceptions = array($exceptions); + } + + $this->exceptions = $exceptions; + } + + /** + * Returns exception array + * + * @return array + */ + public function getExceptions() + { + return $this->exceptions; + } + + /** + * Sets html array + * + * @param mixed $html the fields containing html + * @since 0.5 + * + * @return void + */ + public function setHtml($html) + { + if (!is_array($html)) { + $html = array($html); + } + + $this->html = $html; + } + + /** + * Adds a value to the html array + * + * @since 0.5 + * + * @return void + */ + public function addHtml($value) + { + $this->html[] = $value; + } + + /** + * Returns html array + * + * @since 0.5 + * + * @return array the fields that contain allowed html + */ + public function getHtml() + { + return $this->html; + } + + /** + * Sets json array + * + * @param mixed $json the fields containing json + * @since 0.5.3 + * + * @return void + */ + public function setJson($json) + { + if (!is_array($json)) { + $json = array($json); + } + + $this->json = $json; + } + + /** + * Adds a value to the json array + * + * @param string the value containing JSON data + * @since 0.5.3 + * + * @return void + */ + public function addJson($value) + { + $this->json[] = $value; + } + + /** + * Returns json array + * + * @since 0.5.3 + * + * @return array the fields that contain json + */ + public function getJson() + { + return $this->json; + } + + /** + * Returns storage container + * + * @return array + */ + public function getStorage() + { + return $this->storage; + } + + /** + * Returns report object providing various functions to work with + * detected results. Also the centrifuge data is being set as property + * of the report object. + * + * @return object IDS_Report + */ + public function getReport() + { + if (isset($this->centrifuge) && $this->centrifuge) { + $this->report->setCentrifuge($this->centrifuge); + } + + return $this->report; + } + +} + +/** + * Local variables: + * tab-width: 4 + * c-basic-offset: 4 + * End: + * vim600: sw=4 ts=4 expandtab + */ diff --git a/libraries/plugins/IDS/Report.php b/libraries/plugins/IDS/Report.php new file mode 100644 index 0000000..675b976 --- /dev/null +++ b/libraries/plugins/IDS/Report.php @@ -0,0 +1,341 @@ +. + * + * PHP version 5.1.6+ + * + * @category Security + * @package PHPIDS + * @author Mario Heiderich + * @author Christian Matthies + * @author Lars Strojny + * @license http://www.gnu.org/licenses/lgpl.html LGPL + * @link http://php-ids.org/ + */ + +/** + * PHPIDS report object + * + * The report objects collects a number of events and thereby presents the + * detected results. It provides a convenient API to work with the results. + * + * Note that this class implements Countable, IteratorAggregate and + * a __toString() method + * + * @category Security + * @package PHPIDS + * @author Christian Matthies + * @author Mario Heiderich + * @author Lars Strojny + * @copyright 2007-2009 The PHPIDS Group + * @license http://www.gnu.org/licenses/lgpl.html LGPL + * @version Release: $Id:Report.php 517 2007-09-15 15:04:13Z mario $ + * @link http://php-ids.org/ + */ +class IDS_Report implements Countable, IteratorAggregate +{ + + /** + * Event container + * + * @var array + */ + protected $events = array(); + + /** + * List of affected tags + * + * This list of tags is collected from the collected event objects on + * demand when IDS_Report->getTags() is called + * + * @var array + */ + protected $tags = array(); + + /** + * Impact level + * + * The impact level is calculated on demand by adding the results of the + * event objects on IDS_Report->getImpact() + * + * @var integer + */ + protected $impact = 0; + + /** + * Centrifuge data + * + * This variable - initiated as an empty array - carries all information + * about the centrifuge data if available + * + * @var array + */ + protected $centrifuge = array(); + + /** + * Constructor + * + * @param array $events the events the report should include + * + * @return void + */ + public function __construct(array $events = null) + { + if ($events) { + foreach ($events as $event) { + $this->addEvent($event); + } + } + } + + /** + * Adds an IDS_Event object to the report + * + * @param object $event IDS_Event + * + * @return object $this + */ + public function addEvent(IDS_Event $event) + { + $this->clear(); + $this->events[$event->getName()] = $event; + + return $this; + } + + /** + * Get event by name + * + * In most cases an event is identified by the key of the variable that + * contained maliciously appearing content + * + * @param scalar $name the event name + * + * @throws InvalidArgumentException if argument is invalid + * @return mixed IDS_Event object or false if the event does not exist + */ + public function getEvent($name) + { + if (!is_scalar($name)) { + throw new InvalidArgumentException( + 'Invalid argument type given' + ); + } + + if ($this->hasEvent($name)) { + return $this->events[$name]; + } + + return false; + } + + /** + * Returns list of affected tags + * + * @return array + */ + public function getTags() + { + if (!$this->tags) { + $this->tags = array(); + + foreach ($this->events as $event) { + $this->tags = array_merge($this->tags, + $event->getTags()); + } + + $this->tags = array_values(array_unique($this->tags)); + } + + return $this->tags; + } + + /** + * Returns total impact + * + * Each stored IDS_Event object and its IDS_Filter sub-object are called + * to calculate the overall impact level of this request + * + * @return integer + */ + public function getImpact() + { + if (!$this->impact) { + $this->impact = 0; + foreach ($this->events as $event) { + $this->impact += $event->getImpact(); + } + } + + return $this->impact; + } + + /** + * Checks if a specific event with given name exists + * + * @param scalar $name the event name + * + * @throws InvalidArgumentException if argument is illegal + * + * @return boolean + */ + public function hasEvent($name) + { + if (!is_scalar($name)) { + throw new InvalidArgumentException('Invalid argument given'); + } + + return isset($this->events[$name]); + } + + /** + * Returns total amount of events + * + * @return integer + */ + public function count() + { + return count($this->events); + } + + /** + * Return iterator object + * + * In order to provide the possibility to directly iterate over the + * IDS_Event object the IteratorAggregate is implemented. One can easily + * use foreach() to iterate through all stored IDS_Event objects. + * + * @return ArrayObject the event collection + */ + public function getIterator() + { + return new ArrayObject($this->events); + } + + /** + * Checks if any events are registered + * + * @return boolean + */ + public function isEmpty() + { + return empty($this->events); + } + + /** + * Clears calculated/collected values + * + * @return void + */ + protected function clear() + { + $this->impact = 0; + $this->tags = array(); + } + + /** + * This method returns the centrifuge property or null if not + * filled with data + * + * @return array/null + */ + public function getCentrifuge() + { + return ($this->centrifuge && count($this->centrifuge) > 0) + ? $this->centrifuge : null; + } + + /** + * This method sets the centrifuge property + * + * @param array $centrifuge the centrifuge data + * + * @throws InvalidArgumentException if argument is illegal + * + * @return boolean true is arguments were valid + */ + public function setCentrifuge($centrifuge = array()) + { + if (is_array($centrifuge) && $centrifuge) { + $this->centrifuge = $centrifuge; + return true; + } + throw new InvalidArgumentException('Invalid argument given'); + } + + /** + * Directly outputs all available information + * + * @return string + */ + public function __toString() + { + if (!$this->isEmpty()) { + $output = ''; + $output .= 'Total impact: ' . $this->getImpact() . "
\n"; + $output .= 'Affected tags: ' . join(', ', $this->getTags()) . + "
\n"; + + foreach ($this->events as $event) { + $output .= "
\nVariable: " . + htmlspecialchars($event->getName()) . ' | Value: ' . + htmlspecialchars($event->getValue()) . "
\n"; + $output .= 'Impact: ' . $event->getImpact() . ' | Tags: ' . + join(', ', $event->getTags()) . "
\n"; + + foreach ($event as $filter) { + $output .= 'Description: ' . $filter->getDescription() . + ' | '; + $output .= 'Tags: ' . join(', ', $filter->getTags()) . + ' | '; + $output .= 'ID: ' . $filter->getId() . + "
\n"; + } + } + + $output .= '
'; + + if ($centrifuge = $this->getCentrifuge()) { + $output .= 'Centrifuge detection data'; + $output .= '
Threshold: ' . + ((isset($centrifuge['threshold'])&&$centrifuge['threshold']) ? + $centrifuge['threshold'] : '---'); + $output .= '
Ratio: ' . + ((isset($centrifuge['ratio'])&&$centrifuge['ratio']) ? + $centrifuge['ratio'] : '---'); + if(isset($centrifuge['converted'])) { + $output .= '
Converted: ' . $centrifuge['converted']; + } + $output .= "

\n"; + } + } + + return isset($output) ? $output : ''; + } +} + +/** + * Local variables: + * tab-width: 4 + * c-basic-offset: 4 + * End: + * vim600: sw=4 ts=4 expandtab + */ diff --git a/libraries/plugins/IDS/Version.php b/libraries/plugins/IDS/Version.php new file mode 100644 index 0000000..094551f --- /dev/null +++ b/libraries/plugins/IDS/Version.php @@ -0,0 +1,49 @@ +. + * + * PHP version 5.1.6+ + * + * @category Security + * @package PHPIDS + * @author Mario Heiderich + * @author Christian Matthies + * @author Lars Strojny + * @license http://www.gnu.org/licenses/lgpl.html LGPL + * @link http://php-ids.org/ + */ + +/** + * PHPIDS version class + * + * @category Security + * @package PHPIDS + * @author Christian Matthies + * @author Mario Heiderich + * @author Lars Strojny + * @copyright 2007-2009 The PHPIDS Group + * @license http://www.gnu.org/licenses/lgpl.html LGPL + * @version Release: $Id:Converter.php 517 2007-09-15 15:04:13Z mario $ + * @link http://php-ids.org/ + */ +abstract class IDS_Version +{ + const VERSION = '@@phpIdsVersion@@'; +} diff --git a/libraries/plugins/IDS/default_filter.json b/libraries/plugins/IDS/default_filter.json new file mode 100644 index 0000000..0e68fa0 --- /dev/null +++ b/libraries/plugins/IDS/default_filter.json @@ -0,0 +1 @@ +{"filters":{"filter":[{"id":"1","rule":"(?:\"[^\"]*[^-]?>)|(?:[^\\w\\s]\\s*\\\/>)|(?:>\")","description":"finds html breaking injections including whitespace attacks","tags":{"tag":["xss","csrf"]},"impact":"4"},{"id":"2","rule":"(?:\"+.*[<=]\\s*\"[^\"]+\")|(?:\"\\s*\\w+\\s*=)|(?:>\\w=\\\/)|(?:#.+\\)[\"\\s]*>)|(?:\"\\s*(?:src|style|on\\w+)\\s*=\\s*\")|(?:[^\"]?\"[,;\\s]+\\w*[\\[\\(])","description":"finds attribute breaking injections including whitespace attacks","tags":{"tag":["xss","csrf"]},"impact":"4"},{"id":"3","rule":"(?:^>[\\w\\s]*<\\\/?\\w{2,}>)","description":"finds unquoted attribute breaking injections","tags":{"tag":["xss","csrf"]},"impact":"2"},{"id":"4","rule":"(?:[+\\\/]\\s*name[\\W\\d]*[)+])|(?:;\\W*url\\s*=)|(?:[^\\w\\s\\\/?:>]\\s*(?:location|referrer|name)\\s*[^\\\/\\w\\s-])","description":"Detects url-, name-, JSON, and referrer-contained payload attacks","tags":{"tag":["xss","csrf"]},"impact":"5"},{"id":"5","rule":"(?:\\W\\s*hash\\s*[^\\w\\s-])|(?:\\w+=\\W*[^,]*,[^\\s(]\\s*\\()|(?:\\?\"[^\\s\"]\":)|(?:(?]*)t(?!rong))|(?:\\)|(?:[^*]\\\/\\*|\\*\\\/[^*])|(?:(?:[\\W\\d]#|--|{)$)|(?:\\\/{3,}.*$)|(?:)","description":"Detects common comment types","tags":{"tag":["xss","csrf","id"]},"impact":"3"},{"id":"37","rule":"(?:\\~])","description":"Detects conditional SQL injection attempts","tags":{"tag":["sqli","id","lfi"]},"impact":"6"},{"id":"42","rule":"(?:\"\\s*or\\s*\"?\\d)|(?:\\\\x(?:23|27|3d))|(?:^.?\"$)|(?:(?:^[\"\\\\]*(?:[\\d\"]+|[^\"]+\"))+\\s*(?:n?and|x?or|not|\\|\\||\\&\\&)\\s*[\\w\"[+&!@(),.-])|(?:[^\\w\\s]\\w+\\s*[|-]\\s*\"\\s*\\w)|(?:@\\w+\\s+(and|or)\\s*[\"\\d]+)|(?:@[\\w-]+\\s(and|or)\\s*[^\\w\\s])|(?:[^\\w\\s:]\\s*\\d\\W+[^\\w\\s]\\s*\".)|(?:\\Winformation_schema|table_name\\W)","description":"Detects classic SQL injection probings 1\/2","tags":{"tag":["sqli","id","lfi"]},"impact":"6"},{"id":"43","rule":"(?:\"\\s*\\*.+(?:or|id)\\W*\"\\d)|(?:\\^\")|(?:^[\\w\\s\"-]+(?<=and\\s)(?<=or\\s)(?<=xor\\s)(?<=nand\\s)(?<=not\\s)(?<=\\|\\|)(?<=\\&\\&)\\w+\\()|(?:\"[\\s\\d]*[^\\w\\s]+\\W*\\d\\W*.*[\"\\d])|(?:\"\\s*[^\\w\\s?]+\\s*[^\\w\\s]+\\s*\")|(?:\"\\s*[^\\w\\s]+\\s*[\\W\\d].*(?:#|--))|(?:\".*\\*\\s*\\d)|(?:\"\\s*or\\s[^\\d]+[\\w-]+.*\\d)|(?:[()*<>%+-][\\w-]+[^\\w\\s]+\"[^,])","description":"Detects classic SQL injection probings 2\/2","tags":{"tag":["sqli","id","lfi"]},"impact":"6"},{"id":"44","rule":"(?:\\d\"\\s+\"\\s+\\d)|(?:^admin\\s*\"|(\\\/\\*)+\"+\\s?(?:--|#|\\\/\\*|{)?)|(?:\"\\s*or[\\w\\s-]+\\s*[+<>=(),-]\\s*[\\d\"])|(?:\"\\s*[^\\w\\s]?=\\s*\")|(?:\"\\W*[+=]+\\W*\")|(?:\"\\s*[!=|][\\d\\s!=+-]+.*[\"(].*$)|(?:\"\\s*[!=|][\\d\\s!=]+.*\\d+$)|(?:\"\\s*like\\W+[\\w\"(])|(?:\\sis\\s*0\\W)|(?:where\\s[\\s\\w\\.,-]+\\s=)|(?:\"[<>~]+\")","description":"Detects basic SQL authentication bypass attempts 1\/3","tags":{"tag":["sqli","id","lfi"]},"impact":"7"},{"id":"45","rule":"(?:union\\s*(?:all|distinct|[(!@]*)?\\s*[([]*\\s*select)|(?:\\w+\\s+like\\s+\\\")|(?:like\\s*\"\\%)|(?:\"\\s*like\\W*[\"\\d])|(?:\"\\s*(?:n?and|x?or|not |\\|\\||\\&\\&)\\s+[\\s\\w]+=\\s*\\w+\\s*having)|(?:\"\\s*\\*\\s*\\w+\\W+\")|(?:\"\\s*[^?\\w\\s=.,;)(]+\\s*[(@\"]*\\s*\\w+\\W+\\w)|(?:select\\s*[\\[\\]()\\s\\w\\.,\"-]+from)|(?:find_in_set\\s*\\()","description":"Detects basic SQL authentication bypass attempts 2\/3","tags":{"tag":["sqli","id","lfi"]},"impact":"7"},{"id":"46","rule":"(?:in\\s*\\(+\\s*select)|(?:(?:n?and|x?or|not |\\|\\||\\&\\&)\\s+[\\s\\w+]+(?:regexp\\s*\\(|sounds\\s+like\\s*\"|[=\\d]+x))|(\"\\s*\\d\\s*(?:--|#))|(?:\"[%&<>^=]+\\d\\s*(=|or))|(?:\"\\W+[\\w+-]+\\s*=\\s*\\d\\W+\")|(?:\"\\s*is\\s*\\d.+\"?\\w)|(?:\"\\|?[\\w-]{3,}[^\\w\\s.,]+\")|(?:\"\\s*is\\s*[\\d.]+\\s*\\W.*\")","description":"Detects basic SQL authentication bypass attempts 3\/3","tags":{"tag":["sqli","id","lfi"]},"impact":"7"},{"id":"47","rule":"(?:[\\d\\W]\\s+as\\s*[\"\\w]+\\s*from)|(?:^[\\W\\d]+\\s*(?:union|select|create|rename|truncate|load|alter|delete|update|insert|desc))|(?:(?:select|create|rename|truncate|load|alter|delete|update|insert|desc)\\s+(?:(?:group_)concat|char|load_file)\\s?\\(?)|(?:end\\s*\\);)|(\"\\s+regexp\\W)|(?:[\\s(]load_file\\s*\\()","description":"Detects concatenated basic SQL injection and SQLLFI attempts","tags":{"tag":["sqli","id","lfi"]},"impact":"5"},{"id":"48","rule":"(?:@.+=\\s*\\(\\s*select)|(?:\\d+\\s*or\\s*\\d+\\s*[\\-+])|(?:\\\/\\w+;?\\s+(?:having|and|or|select)\\W)|(?:\\d\\s+group\\s+by.+\\()|(?:(?:;|#|--)\\s*(?:drop|alter))|(?:(?:;|#|--)\\s*(?:update|insert)\\s*\\w{2,})|(?:[^\\w]SET\\s*@\\w+)|(?:(?:n?and|x?or|not |\\|\\||\\&\\&)[\\s(]+\\w+[\\s)]*[!=+]+[\\s\\d]*[\"=()])","description":"Detects chained SQL injection attempts 1\/2","tags":{"tag":["sqli","id"]},"impact":"6"},{"id":"49","rule":"(?:\"\\s+and\\s*=\\W)|(?:\\(\\s*select\\s*\\w+\\s*\\()|(?:\\*\\\/from)|(?:\\+\\s*\\d+\\s*\\+\\s*@)|(?:\\w\"\\s*(?:[-+=|@]+\\s*)+[\\d(])|(?:coalesce\\s*\\(|@@\\w+\\s*[^\\w\\s])|(?:\\W!+\"\\w)|(?:\";\\s*(?:if|while|begin))|(?:\"[\\s\\d]+=\\s*\\d)|(?:order\\s+by\\s+if\\w*\\s*\\()|(?:[\\s(]+case\\d*\\W.+[tw]hen[\\s(])","description":"Detects chained SQL injection attempts 2\/2","tags":{"tag":["sqli","id"]},"impact":"6"},{"id":"50","rule":"(?:(select|;)\\s+(?:benchmark|if|sleep)\\s*?\\(\\s*\\(?\\s*\\w+)","description":"Detects SQL benchmark and sleep injection attempts including conditional queries","tags":{"tag":["sqli","id"]},"impact":"4"},{"id":"51","rule":"(?:create\\s+function\\s+\\w+\\s+returns)|(?:;\\s*(?:select|create|rename|truncate|load|alter|delete|update|insert|desc)\\s*[\\[(]?\\w{2,})","description":"Detects MySQL UDF injection and other data\/structure manipulation attempts","tags":{"tag":["sqli","id"]},"impact":"6"},{"id":"52","rule":"(?:alter\\s*\\w+.*character\\s+set\\s+\\w+)|(\";\\s*waitfor\\s+time\\s+\")|(?:\";.*:\\s*goto)","description":"Detects MySQL charset switch and MSSQL DoS attempts","tags":{"tag":["sqli","id"]},"impact":"6"},{"id":"53","rule":"(?:procedure\\s+analyse\\s*\\()|(?:;\\s*(declare|open)\\s+[\\w-]+)|(?:create\\s+(procedure|function)\\s*\\w+\\s*\\(\\s*\\)\\s*-)|(?:declare[^\\w]+[@#]\\s*\\w+)|(exec\\s*\\(\\s*@)","description":"Detects MySQL and PostgreSQL stored procedure\/function injections","tags":{"tag":["sqli","id"]},"impact":"7"},{"id":"54","rule":"(?:select\\s*pg_sleep)|(?:waitfor\\s*delay\\s?\"+\\s?\\d)|(?:;\\s*shutdown\\s*(?:;|--|#|\\\/\\*|{))","description":"Detects Postgres pg_sleep injection, waitfor delay attacks and database shutdown attempts","tags":{"tag":["sqli","id"]},"impact":"5"},{"id":"55","rule":"(?:\\sexec\\s+xp_cmdshell)|(?:\"\\s*!\\s*[\"\\w])|(?:from\\W+information_schema\\W)|(?:(?:(?:current_)?user|database|schema|connection_id)\\s*\\([^\\)]*)|(?:\";?\\s*(?:select|union|having)\\s*[^\\s])|(?:\\wiif\\s*\\()|(?:exec\\s+master\\.)|(?:union select @)|(?:union[\\w(\\s]*select)|(?:select.*\\w?user\\()|(?:into[\\s+]+(?:dump|out)file\\s*\")","description":"Detects MSSQL code execution and information gathering attempts","tags":{"tag":["sqli","id"]},"impact":"5"},{"id":"56","rule":"(?:merge.*using\\s*\\()|(execute\\s*immediate\\s*\")|(?:\\W+\\d*\\s*having\\s*[^\\s\\-])|(?:match\\s*[\\w(),+-]+\\s*against\\s*\\()","description":"Detects MATCH AGAINST, MERGE, EXECUTE IMMEDIATE and HAVING injections","tags":{"tag":["sqli","id"]},"impact":"5"},{"id":"57","rule":"(?:,.*[)\\da-f\"]\"(?:\".*\"|\\Z|[^\"]+))|(?:\\Wselect.+\\W*from)|((?:select|create|rename|truncate|load|alter|delete|update|insert|desc)\\s*\\(\\s*space\\s*\\()","description":"Detects MySQL comment-\/space-obfuscated injections and backtick termination","tags":{"tag":["sqli","id"]},"impact":"5"},{"id":"58","rule":"(?:@[\\w-]+\\s*\\()|(?:]\\s*\\(\\s*[\"!]\\s*\\w)|(?:<[?%](?:php)?.*(?:[?%]>)?)|(?:;[\\s\\w|]*\\$\\w+\\s*=)|(?:\\$\\w+\\s*=(?:(?:\\s*\\$?\\w+\\s*[(;])|\\s*\".*\"))|(?:;\\s*\\{\\W*\\w+\\s*\\()","description":"Detects code injection attempts 1\/3","tags":{"tag":["id","rfe","lfi"]},"impact":"7"},{"id":"59","rule":"(?:(?:[;]+|(<[?%](?:php)?)).*(?:define|eval|file_get_contents|include|require|require_once|set|shell_exec|phpinfo|system|passthru|preg_\\w+|execute)\\s*[\"(@])","description":"Detects code injection attempts 2\/3","tags":{"tag":["id","rfe","lfi"]},"impact":"7"},{"id":"60","rule":"(?:(?:[;]+|(<[?%](?:php)?)).*[^\\w](?:echo|print|print_r|var_dump|[fp]open))|(?:;\\s*rm\\s+-\\w+\\s+)|(?:;.*{.*\\$\\w+\\s*=)|(?:\\$\\w+\\s*\\[\\]\\s*=\\s*)","description":"Detects code injection attempts 3\/3","tags":{"tag":["id","rfe","lfi"]},"impact":"7"},{"id":"61","rule":"(?:\\w+]?(?))","description":"Finds attribute breaking injections including obfuscated attributes","tags":{"tag":["xss","csrf"]},"impact":"4"},{"id":"69","rule":"(?:(?:msgbox|eval)\\s*\\+|(?:language\\s*=\\*vbscript))","description":"Finds basic VBScript injection attempts","tags":{"tag":["xss","csrf"]},"impact":"4"},{"id":"70","rule":"(?:\\[\\$(?:ne|eq|lte?|gte?|n?in|mod|all|size|exists|type|slice|or)\\])","description":"Finds basic MongoDB SQL injection attempts","tags":{"tag":"sqli"},"impact":"4"},{"id":"71","rule":"(?:[\\s\\d\\\/\"]+(?:on\\w+|style|poster|background)=[$\"\\w])|(?:-type\\s*:\\s*multipart)","description":"finds malicious attribute injection attempts and MHTML attacks","tags":{"tag":["xss","csrf"]},"impact":"6"},{"id":"72","rule":"(?:(sleep\\((\\s*)(\\d*)(\\s*)\\)|benchmark\\((.*)\\,(.*)\\)))","description":"Detects blind sqli tests using sleep() or benchmark().","tags":{"tag":["sqli","id"]},"impact":"4"},{"id":"73","rule":"(?i:(\\%SYSTEMROOT\\%))","description":"An attacker is trying to locate a file to read or write.","tags":{"tag":["files","id"]},"impact":"4"},{"id":"74","rule":"(?i:(ping(.*)[\\-(.*)\\w|\\w(.*)\\-]))","description":"Detects remote code exectuion tests. Will match \"ping -n 3 localhost\" and \"ping localhost -n 3\"","tags":{"tag":["Command Execution","id"]},"impact":"5"},{"id":"75","rule":"(?:(((.*)\\%[c|d|i|e|f|g|o|s|u|x|p|n]){8}))","description":"Looking for a format string attack","tags":{"tag":"format string"},"impact":"4"},{"id":"76","rule":"(?:(union(.*)select(.*)from))","description":"Looking for basic sql injection. Common attack string for mysql, oracle and others.","tags":{"tag":["sqli","id"]},"impact":"3"},{"id":"77","rule":"(?:^(-0000023456|4294967295|4294967296|2147483648|2147483647|0000012345|-2147483648|-2147483649|0000023456|2.2250738585072007e-308|1e309)$)","description":"Looking for intiger overflow attacks, these are taken from skipfish, except 2.2250738585072007e-308 is the \"magic number\" crash","tags":{"tag":["sqli","id"]},"impact":"3"}]}} \ No newline at end of file diff --git a/libraries/plugins/IDS/default_filter.xml b/libraries/plugins/IDS/default_filter.xml new file mode 100644 index 0000000..0a6bc5a --- /dev/null +++ b/libraries/plugins/IDS/default_filter.xml @@ -0,0 +1,930 @@ + + + 1 + )|(?:[^\w\s]\s*\/>)|(?:>")]]> + Finds Html Breaking Injections Including Whitespace Attacks + + xss + csrf + + 4 + + + 2 + \w=\/)|(?:#.+\)["\s]*>)|(?:"\s*(?:src|style|on\w+)\s*=\s*")|(?:[^"]?"[,;\s]+\w*[\[\(])]]> + Finds Attribute Breaking Injections Including Whitespace Attacks + + xss + csrf + + 4 + + + 3 + [\w\s]*<\/?\w{2,}>)]]> + Finds Unquoted Attribute Breaking Injections + + xss + csrf + + 2 + + + 4 + ]\s*(?:location|referrer|name)\s*[^\/\w\s-])]]> + Detects Url-, Name-, JSON, And Referrer-contained Payload Attacks + + xss + csrf + + 5 + + + 5 + + Detects Hash-contained Xss Payload Attacks, Setter Usage And Property Overloading + + xss + csrf + + 5 + + + 6 + + Detects Self Contained Xss Via With(), Common Loops And Regex To String Conversion + + xss + csrf + + 5 + + + 7 + + Detects JavaScript With(), Ternary Operators And XML Predicate Attacks + + xss + csrf + + 5 + + + 8 + + Detects Self-executing JavaScript Functions + + xss + csrf + + 5 + + + 9 + + Detects The IE Octal, Hex And Unicode Entities + + xss + csrf + + 2 + + + 10 + + Detects Basic Directory Traversal + + dt + id + lfi + + 5 + + + 11 + + Detects Specific Directory And Path Traversal + + dt + id + lfi + + 5 + + + 12 + + Detects Etc/passwd Inclusion Attempts + + dt + id + lfi + + 5 + + + 13 + + Detects Halfwidth/fullwidth Encoded Unicode HTML Breaking Attempts + + xss + csrf + + 3 + + + 14 + + Detects Possible Includes, VBSCript/JScript Encodeed And Packed Functions + + xss + csrf + id + rfe + + 5 + + + 15 + + Detects JavaScript DOM/miscellaneous Properties And Methods + + xss + csrf + id + rfe + + 6 + + + 16 + + Detects Possible Includes And Typical Script Methods + + xss + csrf + id + rfe + + 5 + + + 17 + + Detects JavaScript Object Properties And Methods + + xss + csrf + id + rfe + + 4 + + + 18 + + Detects JavaScript Array Properties And Methods + + xss + csrf + id + rfe + + 4 + + + 19 + + Detects JavaScript String Properties And Methods + + xss + csrf + id + rfe + + 4 + + + 20 + + Detects JavaScript Language Constructs + + xss + csrf + id + rfe + + 4 + + + 21 + + Detects Very Basic XSS Probings + + xss + csrf + id + rfe + + 3 + + + 22 + + Detects Advanced XSS Probings Via Script(), RexExp, Constructors And XML Namespaces + + xss + csrf + id + rfe + + 5 + + + 23 + + Detects JavaScript Location/document Property Access And Window Access Obfuscation + + xss + csrf + + 5 + + + 24 + + Detects Basic Obfuscated JavaScript Script Injections + + xss + csrf + + 5 + + + 25 + + Detects Obfuscated JavaScript Script Injections + + xss + csrf + + 5 + + + 26 + + Detects JavaScript Cookie Stealing And Redirection Attempts + + xss + csrf + + 4 + + + 27 + + Detects Data: URL Injections, VBS Injections And Common URI Schemes + + xss + rfe + + 5 + + + 28 + + Detects IE Firefoxurl Injections, Cache Poisoning Attempts And Local File Inclusion/execution + + xss + rfe + lfi + csrf + + 5 + + + 29 + + Detects Bindings And Behavior Injections + + xss + csrf + rfe + + 4 + + + 30 + + Detects Common XSS Concatenation Patterns 1/2 + + xss + csrf + id + rfe + + 4 + + + 31 + + Detects Common XSS Concatenation Patterns 2/2 + + xss + csrf + id + rfe + + 4 + + + 32 + + Detects Possible Event Handlers + + xss + csrf + + 4 + + + 33 + ]*)t(?!rong))|(?:\ + Detects Obfuscated Script Tags And XML Wrapped HTML + + xss + + 4 + + + 34 + + Detects Attributes In Closing Tags And Conditional Compilation Tokens + + xss + csrf + + 4 + + + 35 + )|(?:[^*]\/\*|\*\/[^*])|(?:(?:[\W\d]#|--|{)$)|(?:\/{3,}.*$)|(?:)]]> + Detects Common Comment Types + + xss + csrf + id + + 3 + + + 36 + + Detects Base Href Injections And XML Entity Injections + + xss + csrf + id + + 5 + + + 37 + + Detects Possibly Malicious Html Elements Including Some Attributes + + xss + csrf + id + rfe + lfi + + 4 + + + 39 + + Detects MySQL Comments, Conditions And Ch(a)r Injections + + sqli + id + lfi + + 6 + + + 40 + ~])]]> + Detects Conditional SQL Injection Attempts + + sqli + id + lfi + + 6 + + + 41 + + Detects Conditional SQL Injection Attempts + + sqli + id + lfi + + 0 + + + 42 + %+-][\w-]+[^\w\s]+"[^,])]]> + Detects Classic SQL Injection Probings 2/2 + + sqli + id + lfi + + 6 + + + 43 + =(),-]\s*[\d"])|(?:"\s*[^\w\s]?=\s*")|(?:"\W*[+=]+\W*")|(?:"\s*[!=|][\d\s!=+-]+.*["(].*$)|(?:"\s*[!=|][\d\s!=]+.*\d+$)|(?:"\s*like\W+[\w"(])|(?:\sis\s*0\W)|(?:where\s[\s\w\.,-]+\s=)|(?:"[<>~]+")]]> + Detects Basic SQL Authentication Bypass Attempts 1/3 + + sqli + id + lfi + + 7 + + + 44 + + Detects Basic SQL Authentication Bypass Attempts 2/3 + + sqli + id + lfi + + 7 + + + 45 + ^=]+\d\s*(=|or))|(?:"\W+[\w+-]+\s*=\s*\d\W+")|(?:"\s*is\s*\d.+"?\w)|(?:"\|?[\w-]{3,}[^\w\s.,]+")|(?:"\s*is\s*[\d.]+\s*\W.*")]]> + Detects Basic SQL Authentication Bypass Attempts 3/3 + + sqli + id + lfi + + 7 + + + 46 + + Detects Concatenated Basic SQL Injection And SQLLFI Attempts + + sqli + id + lfi + + 5 + + + 47 + + Detects Chained SQL Injection Attempts 1/2 + + sqli + id + + 6 + + + 48 + + Detects Chained SQL Injection Attempts 2/2 + + sqli + id + + 6 + + + 49 + + Detects SQL Benchmark And Sleep Injection Attempts Including Conditional Queries + + sqli + id + + 4 + + + 50 + + Detects MySQL UDF Injection And Other Data/structure Manipulation Attempts + + sqli + id + + 6 + + + 51 + + Detects MySQL Charset Switch And MSSQL DoS Attempts + + sqli + id + + 6 + + + 52 + + Detects MySQL And PostgreSQL Stored Procedure/function Injections + + sqli + id + + 7 + + + 53 + + Detects Postgres Pg_sleep Injection, Waitfor Delay Attacks And Database Shutdown Attempts + + sqli + id + + 5 + + + 54 + + Detects MSSQL Code Execution And Information Gathering Attempts + + sqli + id + + 5 + + + 55 + + Detects MATCH AGAINST, MERGE, EXECUTE IMMEDIATE And HAVING Injections + + sqli + id + + 5 + + + 56 + + Detects MySQL Comment-/space-obfuscated Injections And Backtick Termination + + sqli + id + + 5 + + + 57 + )?)|(?:;[\s\w|]*\$\w+\s*=)|(?:\$\w+\s*=(?:(?:\s*\$?\w+\s*[(;])|\s*".*"))|(?:;\s*\{\W*\w+\s*\()]]> + Detects Code Injection Attempts 1/3 + + id + rfe + lfi + + 7 + + + 58 + + Detects Code Injection Attempts 2/3 + + id + rfe + lfi + + 7 + + + 59 + + Detects Code Injection Attempts 3/3 + + id + rfe + lfi + + 7 + + + 60 + + Detects Url Injections And RFE Attempts + + id + rfe + lfi + + 5 + + + 61 + + Detects Common Function Declarations And Special JS Operators + + id + rfe + lfi + + 5 + + + 62 + + Detects Common Mail Header Injections + + id + spam + + 5 + + + 63 + + Detects Perl Echo Shellcode Injection And LDAP Vectors + + lfi + rfe + + 5 + + + 64 + + Detects Basic XSS DoS Attempts + + rfe + dos + + 5 + + + 65 + + Detects Unknown Attack Vectors Based On PHPIDS Centrifuge Detection + + xss + csrf + id + rfe + lfi + + 7 + + + 66 + ))]]> + Finds Attribute Breaking Injections Including Obfuscated Attributes + + xss + csrf + + 4 + + + 67 + + Finds Basic VBScript Injection Attempts + + xss + csrf + + 4 + + + 68 + + Finds Basic MongoDB SQL Injection Attempts + + sqli + + 4 + + + 69 + + Finds Malicious Attribute Injection Attempts And MHTML Attacks + + xss + csrf + + 6 + + + 70 + + Detects Blind Sqli Tests Using Sleep() Or Benchmark(). + + sqli + id + + 4 + + + 71 + + An Attacker Is Trying To Locate A File To Read Or Write. + + files + id + + 4 + + + 73 + + Looking For A Format String Attack + + format string + + 4 + + + 74 + + Looking For Basic Sql Injection. Common Attack String For Mysql, Oracle And Others. + + sqli + id + + 3 + + + 75 + + Looking For Integer Overflow Attacks, These Are Taken From Skipfish, Except 2.2250738585072007e-308 Is The "magic Number" Crash + + sqli + id + + 3 + + + 76 + + Rate Limit Of Requests Exceeded + + DoS + + 3 + + + 77 + + Suspicious Bots Scanners + + DoS + + 1 + + + 78 + + Shellshock Vulnerability (CVE-2014-6271) + + none + + 3 + + + 79 + + ]]> + SSI Command Injection + + none + + 2 + + + 80 + + TimThumb WebShot Remote Code Execution (0-day) + + none + + 3 + + + 81 + + Joomla 1.5-3.4.5 Object Injection Remote Command Execution + + none + + 3 + + + 82 + \/\\\\*\\x60] + ]]> + SQL Injection (username) + + none + + 3 + + + 83 + + SQL Injection (time-based) + + none + + 2 + + + 84 + + Malformed Host Header + + none + + 2 + + + 85 + + Attempt To Access Phpinfo.php + + none + + 1 + + + 86 + \\s*\/dev\/(?:tc|ud)p\/[^\/]{5,255}\/\\d{1,5}\\b + ]]> + Dev TCP UDP Device File Access (possible Reverse Shell) + + none + + 3 + + + 87 + + Shell Backdoor + + none + + 3 + + + 88 + + Shell Backdoor (img) + + none + + 3 + + + 89 + + Shell Backdoor (p) + + none + + 3 + + \ No newline at end of file diff --git a/libraries/plugins/IDS/default_filter_orig.xml b/libraries/plugins/IDS/default_filter_orig.xml new file mode 100644 index 0000000..1799e8b --- /dev/null +++ b/libraries/plugins/IDS/default_filter_orig.xml @@ -0,0 +1,798 @@ + + + 1 + )|(?:[^\w\s]\s*\/>)|(?:>")]]> + finds html breaking injections including whitespace attacks + + xss + csrf + + 4 + + + 2 + \w=\/)|(?:#.+\)["\s]*>)|(?:"\s*(?:src|style|on\w+)\s*=\s*")|(?:[^"]?"[,;\s]+\w*[\[\(])]]> + finds attribute breaking injections including whitespace attacks + + xss + csrf + + 4 + + + 3 + [\w\s]*<\/?\w{2,}>)]]> + finds unquoted attribute breaking injections + + xss + csrf + + 2 + + + 4 + ]\s*(?:location|referrer|name)\s*[^\/\w\s-])]]> + Detects url-, name-, JSON, and referrer-contained payload attacks + + xss + csrf + + 5 + + + 5 + + Detects hash-contained xss payload attacks, setter usage and property overloading + + xss + csrf + + 5 + + + 6 + + Detects self contained xss via with(), common loops and regex to string conversion + + xss + csrf + + 5 + + + 7 + + Detects JavaScript with(), ternary operators and XML predicate attacks + + xss + csrf + + 5 + + + 8 + + Detects self-executing JavaScript functions + + xss + csrf + + 5 + + + 9 + + Detects the IE octal, hex and unicode entities + + xss + csrf + + 2 + + + 10 + + Detects basic directory traversal + + dt + id + lfi + + 5 + + + 11 + + Detects specific directory and path traversal + + dt + id + lfi + + 5 + + + 12 + + Detects etc/passwd inclusion attempts + + dt + id + lfi + + 5 + + + 13 + + Detects halfwidth/fullwidth encoded unicode HTML breaking attempts + + xss + csrf + + 3 + + + 14 + + Detects possible includes, VBSCript/JScript encodeed and packed functions + + xss + csrf + id + rfe + + 5 + + + 15 + + Detects JavaScript DOM/miscellaneous properties and methods + + xss + csrf + id + rfe + + 6 + + + 16 + + Detects possible includes and typical script methods + + xss + csrf + id + rfe + + 5 + + + 17 + + Detects JavaScript object properties and methods + + xss + csrf + id + rfe + + 4 + + + 18 + + Detects JavaScript array properties and methods + + xss + csrf + id + rfe + + 4 + + + 19 + + Detects JavaScript string properties and methods + + xss + csrf + id + rfe + + 4 + + + 20 + + Detects JavaScript language constructs + + xss + csrf + id + rfe + + 4 + + + 21 + + Detects very basic XSS probings + + xss + csrf + id + rfe + + 3 + + + 22 + + Detects advanced XSS probings via Script(), RexExp, constructors and XML namespaces + + xss + csrf + id + rfe + + 5 + + + 23 + + Detects JavaScript location/document property access and window access obfuscation + + xss + csrf + + 5 + + + 24 + + Detects basic obfuscated JavaScript script injections + + xss + csrf + + 5 + + + 25 + + Detects obfuscated JavaScript script injections + + xss + csrf + + 5 + + + 26 + + Detects JavaScript cookie stealing and redirection attempts + + xss + csrf + + 4 + + + 27 + + Detects data: URL injections, VBS injections and common URI schemes + + xss + rfe + + 5 + + + 28 + + Detects IE firefoxurl injections, cache poisoning attempts and local file inclusion/execution + + xss + rfe + lfi + csrf + + 5 + + + 29 + + Detects bindings and behavior injections + + xss + csrf + rfe + + 4 + + + 30 + + Detects common XSS concatenation patterns 1/2 + + xss + csrf + id + rfe + + 4 + + + 31 + + Detects common XSS concatenation patterns 2/2 + + xss + csrf + id + rfe + + 4 + + + 32 + + Detects possible event handlers + + xss + csrf + + 4 + + + 33 + ]*)t(?!rong))|(?:\ + Detects obfuscated script tags and XML wrapped HTML + + xss + + 4 + + + 34 + + Detects attributes in closing tags and conditional compilation tokens + + xss + csrf + + 4 + + + 35 + )|(?:[^*]\/\*|\*\/[^*])|(?:(?:[\W\d]#|--|{)$)|(?:\/{3,}.*$)|(?:)]]> + Detects common comment types + + xss + csrf + id + + 3 + + + 37 + + Detects base href injections and XML entity injections + + xss + csrf + id + + 5 + + + 38 + + Detects possibly malicious html elements including some attributes + + xss + csrf + id + rfe + lfi + + 4 + + + 39 + + Detects nullbytes and other dangerous characters + + id + rfe + xss + + 5 + + + 40 + + Detects MySQL comments, conditions and ch(a)r injections + + sqli + id + lfi + + 6 + + + 41 + ~])]]> + Detects conditional SQL injection attempts + + sqli + id + lfi + + 6 + + + 42 + + Detects conditional SQL injection attempts + + sqli + id + lfi + + + + 43 + %+-][\w-]+[^\w\s]+"[^,])]]> + Detects classic SQL injection probings 2/2 + + sqli + id + lfi + + 6 + + + 44 + =(),-]\s*[\d"])|(?:"\s*[^\w\s]?=\s*")|(?:"\W*[+=]+\W*")|(?:"\s*[!=|][\d\s!=+-]+.*["(].*$)|(?:"\s*[!=|][\d\s!=]+.*\d+$)|(?:"\s*like\W+[\w"(])|(?:\sis\s*0\W)|(?:where\s[\s\w\.,-]+\s=)|(?:"[<>~]+")]]> + Detects basic SQL authentication bypass attempts 1/3 + + sqli + id + lfi + + 7 + + + 45 + + Detects basic SQL authentication bypass attempts 2/3 + + sqli + id + lfi + + 7 + + + 46 + ^=]+\d\s*(=|or))|(?:"\W+[\w+-]+\s*=\s*\d\W+")|(?:"\s*is\s*\d.+"?\w)|(?:"\|?[\w-]{3,}[^\w\s.,]+")|(?:"\s*is\s*[\d.]+\s*\W.*")]]> + Detects basic SQL authentication bypass attempts 3/3 + + sqli + id + lfi + + 7 + + + 47 + + Detects concatenated basic SQL injection and SQLLFI attempts + + sqli + id + lfi + + 5 + + + 48 + + Detects chained SQL injection attempts 1/2 + + sqli + id + + 6 + + + 49 + + Detects chained SQL injection attempts 2/2 + + sqli + id + + 6 + + + 50 + + Detects SQL benchmark and sleep injection attempts including conditional queries + + sqli + id + + 4 + + + 51 + + Detects MySQL UDF injection and other data/structure manipulation attempts + + sqli + id + + 6 + + + 52 + + Detects MySQL charset switch and MSSQL DoS attempts + + sqli + id + + 6 + + + 53 + + Detects MySQL and PostgreSQL stored procedure/function injections + + sqli + id + + 7 + + + 54 + + Detects Postgres pg_sleep injection, waitfor delay attacks and database shutdown attempts + + sqli + id + + 5 + + + 55 + + Detects MSSQL code execution and information gathering attempts + + sqli + id + + 5 + + + 56 + + Detects MATCH AGAINST, MERGE, EXECUTE IMMEDIATE and HAVING injections + + sqli + id + + 5 + + + 57 + + Detects MySQL comment-/space-obfuscated injections and backtick termination + + sqli + id + + 5 + + + 58 + )?)|(?:;[\s\w|]*\$\w+\s*=)|(?:\$\w+\s*=(?:(?:\s*\$?\w+\s*[(;])|\s*".*"))|(?:;\s*\{\W*\w+\s*\()]]> + Detects code injection attempts 1/3 + + id + rfe + lfi + + 7 + + + 59 + + Detects code injection attempts 2/3 + + id + rfe + lfi + + 7 + + + 60 + + Detects code injection attempts 3/3 + + id + rfe + lfi + + 7 + + + 61 + + Detects url injections and RFE attempts + + id + rfe + lfi + + 5 + + + 62 + + Detects common function declarations and special JS operators + + id + rfe + lfi + + 5 + + + 63 + + Detects common mail header injections + + id + spam + + 5 + + + 64 + + Detects perl echo shellcode injection and LDAP vectors + + lfi + rfe + + 5 + + + 65 + + Detects basic XSS DoS attempts + + rfe + dos + + 5 + + + 67 + + Detects unknown attack vectors based on PHPIDS Centrifuge detection + + xss + csrf + id + rfe + lfi + + 7 + + + 68 + ))]]> + Finds attribute breaking injections including obfuscated attributes + + xss + csrf + + 4 + + + 69 + + Finds basic VBScript injection attempts + + xss + csrf + + 4 + + + 70 + + Finds basic MongoDB SQL injection attempts + + sqli + + 4 + + + 71 + + finds malicious attribute injection attempts and MHTML attacks + + xss + csrf + + 6 + + + 72 + + Detects blind sqli tests using sleep() or benchmark(). + + sqli + id + + 4 + + + 73 + + An attacker is trying to locate a file to read or write. + + files + id + + 4 + + + 74 + + Detects remote code exectuion tests. Will match "ping -n 3 localhost" and "ping localhost -n 3" + + Command Execution + id + + 5 + + + 75 + + Looking for a format string attack + + format string + + 4 + + + 76 + + Looking for basic sql injection. Common attack string for mysql, oracle and others. + + sqli + id + + 3 + + + 77 + + Looking for integer overflow attacks, these are taken from skipfish, except 2.2250738585072007e-308 is the "magic number" crash + + sqli + id + + 3 + + \ No newline at end of file diff --git a/libraries/plugins/IDS/tmp/bad_bots.txt b/libraries/plugins/IDS/tmp/bad_bots.txt new file mode 100644 index 0000000..aa08a0a --- /dev/null +++ b/libraries/plugins/IDS/tmp/bad_bots.txt @@ -0,0 +1 @@ +@nonymouse|ADSARobot|Advanced\ Email\ Extractor|ah-ha|aktuelles|almaden|amzn_assoc|Anarchie|Art-Online|AspiWeb|ASPSeek|ASSORT|ATHENS|Atomz|attach|attache|autoemailspider|BackWeb|Bandit|BatchFTP|bdfetch|big\.brother|BlackWidow|bmclient|Boston\ Project|Bot\ mailto:craftbot@yahoo\.com|BravoBrian\ SpiderEngine\ MarcoPolo|Buddy|Bullseye|bumblebee|capture|CherryPicker|ChinaClaw|CICC|clipping|Crescent\ Internet\ ToolPack|cURL|Custo|cyberalert|Deweb|diagem|Digger|Digimarc|DIIbot|DirectUpdate|DISCo|Drip|DSurf15a|DTS\.Agent|EasyDL|eCatch|echo\ extense|ecollector|efp@gmx\.net|EirGrabber|Email\ Extractor|EmailCollector|EmailSiphon|EmailWolf|Express\ WebPictures|ExtractorPro|EyeNetIE|fastlwspider|FavOrg|Favorites\ Sweeper|Fetch\ API\ Request|FEZhead|FileHound|FlashGet|FlickBot|fluffy|frontpage|GalaxyBot|Generic|Getleft|GetSmart|GetWeb!|GetWebPage|gigabaz|Girafabot|Go!Zilla|Go-Ahead-Got-It|GornKer|Grabber|GrabNet|Grafula|Green\ Research|Harvest|hhjhj@yahoo|hloader|HMView|HomePageSearch|http\ generic|HTTPConnect|httpdown|HTTrack|IBM_Planetwide|Image\ Stripper|Image\ Sucker|imagefetch|IncyWincy|Indy\ Library|informant|Ingelin|InterGET|Internet\ Ninja|InternetLinkAgent|InternetSeer\.com|iOpus|IPiumBot\ laurion(dot)com|Iria|Irvine|Jakarta|JBH*Agent|JetCar|JustView|Kapere|KWebGet|Lachesis|larbin|LeechFTP|LexiBot|lftp|libwww|likse|Link*Sleuth|LINKS\ ARoMATIZED|LinkWalker|lwp-trivial|Mac\ Finder|Mag-Net|Magnet|Mass\ Downloader|MCspider|MemoWeb|Microsoft\ URL\ Control|MIDown\ tool|minibot\(NaverRobot\)|Missigua\ Locator|Mister\ PiX|MMMtoCrawl\/UrlDispatcherLLL|MSProxy|multithreaddb|nationaldirectory|Navroad|NearSite|Net\ Vampire|NetAnts|NetCarta|netcraft|netfactual|NetMechanic|netprospector|NetResearchServer|NetSpider|NetZIP|NEWT|nicerspro|NPBot|Octopus|Offline\ Explorer|Offline\ Navigator|OpaL|Openfind|OpenTextSiteCrawler|OutWit|PackRat|PageGrabber|Papa\ Foto|pavuk|pcBrowser|PersonaPilot|PingALink|Pockey|Program\ Shareware|psbot|PSurf|puf|Pump|PushSite|QRVA|QuepasaCreep|RealDownload|Reaper|Recorder|ReGet|replacer|RepoMonkey|Robozilla|Rover|RPT-HTTPClient|Rsync|SearchExpress|searchhippo|searchterms\.it|Second\ Street\ Research|Shai|sitecheck|SiteMapper|SiteSnagger|SlySearch|SmartDownload|snagger|SpaceBison|Spegla|SpiderBot|SqWorm|Star\ Downloader|Stripper|Sucker|SuperBot|SuperHTTP|Surfbot|SurfWalker|Szukacz|tAkeOut|tarspider|Teleport\ Pro|Telesoft|Templeton|traffixer|TrueRobot|TuringOS|TurnitinBot|TV33_Mercator|UIowaCrawler|URL_Spider_Pro|UtilMind|Vacuum|vagabondo|vayala|visibilitygap|vobsub|VoidEYE|vspider|w3mir|Web\ Data\ Extractor|Web\ Downloader|Web\ Image\ Collector|Web\ Sucker|web\.by\.mail|WebAuto|webbandit|Webclipping|webcollage|webcollector|WebCopier|webcraft@bea|WebDAV|webdevil|webdownloader|Webdup|WebEmailExtractor|WebFetch|WebGo\ IS|WebHook|Webinator|WebLeacher|WebMiner|WebMirror|webmole|WebReaper|WebSauger|WEBsaver|Website\ eXtractor|Website\ Quester|WebSnake|Webster|WebStripper|websucker|webvac|webwalk|webweasel|WebWhacker|WebZIP|Wget|whizbang|WhosTalking|Widow|WISEbot|WUMPUS|Wweb|WWWOFFLE|Wysigot|x-Tractor|Xaldon\ WebSpider|XGET \ No newline at end of file diff --git a/libraries/plugins/IDS/tmp/cookie_ips.txt b/libraries/plugins/IDS/tmp/cookie_ips.txt new file mode 100644 index 0000000..3fb3cf7 --- /dev/null +++ b/libraries/plugins/IDS/tmp/cookie_ips.txt @@ -0,0 +1,2 @@ +172.19.20.122,2,1429360837,14, +::1,0,1430174122,16, diff --git a/libraries/plugins/IDS/tmp/custom_rules.txt b/libraries/plugins/IDS/tmp/custom_rules.txt new file mode 100644 index 0000000..e6e3202 --- /dev/null +++ b/libraries/plugins/IDS/tmp/custom_rules.txt @@ -0,0 +1 @@ +a:5:{s:7:"trusted";a:0:{}s:7:"blocked";a:0:{}s:9:"exception";a:1:{i:0;s:10:"COOKIE.lol";}s:4:"html";a:0:{}s:4:"json";a:0:{}} \ No newline at end of file diff --git a/libraries/plugins/IDS/tmp/ips.txt b/libraries/plugins/IDS/tmp/ips.txt new file mode 100644 index 0000000..2fcf5f7 --- /dev/null +++ b/libraries/plugins/IDS/tmp/ips.txt @@ -0,0 +1,2 @@ +172.19.13.36,0,1426076415,3, +::1,0,1428069894,5, diff --git a/libraries/plugins/IDS/tmp/phpids_log.txt b/libraries/plugins/IDS/tmp/phpids_log.txt new file mode 100644 index 0000000..3932af9 --- /dev/null +++ b/libraries/plugins/IDS/tmp/phpids_log.txt @@ -0,0 +1,804 @@ +"local/unknown",2008-08-18T18:00:29+02:00,36,"xss csrf id rfe lfi sqli","test=%5C%22%3E%3Cscript%3Eeval%28window.name%29%3C%2Fscript%3E","%2Fphp-ids.org%2Ftrunk%2Fdocs%2Fexamples%2Fexample.php%3Ftest%3D%2522%253E%253Cscript%253Eeval%28window.name%29%253C%2Fscript%253E" +"local/unknown",2008-08-18T18:00:32+02:00,36,"xss csrf id rfe lfi sqli","test=%5C%22%3E%3Cscript%3Eeval%28window.name%29%3C%2Fscript%3E","%2Fphp-ids.org%2Ftrunk%2Fdocs%2Fexamples%2Fexample.php%3Ftest%3D%2522%253E%253Cscript%253Eeval%28window.name%29%253C%2Fscript%253E" +"local/unknown",2008-08-18T18:00:46+02:00,36,"xss csrf id rfe lfi sqli","test=%5C%22%3E%3Cscript%3Eeval%28window.name%29%3C%2Fscript%3E","%2Fphp-ids.org%2Ftrunk%2Fdocs%2Fexamples%2Fexample.php%3Ftest%3D%2522%253E%253Cscript%253Eeval%28window.name%29%253C%2Fscript%253E" +"local/unknown",2008-08-18T18:27:34+02:00,36,"xss csrf id rfe lfi sqli","test=%5C%22%3E%3Cscript%3Eeval%28window.name%29%3C%2Fscript%3E","%2Fphp-ids.org%2Ftrunk%2Fdocs%2Fexamples%2Fexample.php%3Ftest%3D%2522%253E%253Cscript%253Eeval%28window.name%29%253C%2Fscript%253E" +"local/unknown",2009-06-24T12:58:37+02:00,36,"xss csrf id rfe lfi sqli","REQUEST.test=%5C%22%3E%3Cscript%3Eeval%28window.name%29%3C%2Fscript%3E GET.test=%5C%22%3E%3Cscript%3Eeval%28window.name%29%3C%2Fscript%3E","%2Fphp-ids.org%2Ftrunk%2Fdocs%2Fexamples%2Fexample.php%3Ftest%3D%2522%253E%253Cscript%253Eeval%28window.name%29%253C%2Fscript%253E","127.0.0.1" +"local/unknown",2009-06-24T12:59:27+02:00,36,"xss csrf id rfe lfi sqli","REQUEST.test=%5C%22%3E%3Cscript%3Eeval%28window.name%29%3C%2Fscript%3E GET.test=%5C%22%3E%3Cscript%3Eeval%28window.name%29%3C%2Fscript%3E","%2Fphp-ids.org%2Ftrunk%2Fdocs%2Fexamples%2Fexample.php%3Ftest%3D%2522%253E%253Cscript%253Eeval%28window.name%29%253C%2Fscript%253E","127.0.0.1" +"local/unknown",2009-06-24T12:59:29+02:00,36,"xss csrf id rfe lfi sqli","REQUEST.test=%5C%22%3E%3Cscript%3Eeval%28window.name%29%3C%2Fscript%3E GET.test=%5C%22%3E%3Cscript%3Eeval%28window.name%29%3C%2Fscript%3E","%2Fphp-ids.org%2Ftrunk%2Fdocs%2Fexamples%2Fexample.php%3Ftest%3D%2522%253E%253Cscript%253Eeval%28window.name%29%253C%2Fscript%253E","127.0.0.1" +"local/unknown",2009-06-24T12:59:42+02:00,36,"xss csrf id rfe lfi sqli","REQUEST.__wysiwyg=%5C%22%3E%3Cscript%3Eeval%28window.name%29%3C%2Fscript%3E GET.__wysiwyg=%5C%22%3E%3Cscript%3Eeval%28window.name%29%3C%2Fscript%3E","%2Fphp-ids.org%2Ftrunk%2Fdocs%2Fexamples%2Fexample.php%3F__wysiwyg%3D%2522%253E%253Cscript%253Eeval%28window.name%29%253C%2Fscript%253E","127.0.0.1" +"local/unknown",2009-06-24T13:00:01+02:00,36,"xss csrf id rfe lfi sqli","REQUEST.__wysiwyg=%5C%22%3E%3Cscript%3Eeval%28window.name%29%3C%2Fscript%3E GET.__wysiwyg=%5C%22%3E%3Cscript%3Eeval%28window.name%29%3C%2Fscript%3E","%2Fphp-ids.org%2Ftrunk%2Fdocs%2Fexamples%2Fexample.php%3F__wysiwyg%3D%2522%253E%253Cscript%253Eeval%28window.name%29%253C%2Fscript%253E","127.0.0.1" +"local/unknown",2009-06-24T13:00:21+02:00,15,"xss csrf sqli id lfi","REQUEST.__wysiwyg=%3Ca%20href%3D%5C%22http%3A%2F%2Fwww.foo.de%2F%3Fbar%5C%22%3Efoobar%3C%2Fa%3E GET.__wysiwyg=%3Ca%20href%3D%5C%22http%3A%2F%2Fwww.foo.de%2F%3Fbar%5C%22%3Efoobar%3C%2Fa%3E","%2Fphp-ids.org%2Ftrunk%2Fdocs%2Fexamples%2Fexample.php%3F__wysiwyg%3D%253Ca%2520href%3D%2522http%3A%2F%2Fwww.foo.de%2F%3Fbar%2522%253Efoobar%253C%2Fa%253E","127.0.0.1" +"local/unknown",2009-06-24T13:00:27+02:00,15,"xss csrf sqli id lfi","REQUEST.__wysiwygx=%3Ca%20href%3D%5C%22http%3A%2F%2Fwww.foo.de%2F%3Fbar%5C%22%3Efoobar%3C%2Fa%3E GET.__wysiwygx=%3Ca%20href%3D%5C%22http%3A%2F%2Fwww.foo.de%2F%3Fbar%5C%22%3Efoobar%3C%2Fa%3E","%2Fphp-ids.org%2Ftrunk%2Fdocs%2Fexamples%2Fexample.php%3F__wysiwygx%3D%253Ca%2520href%3D%2522http%3A%2F%2Fwww.foo.de%2F%3Fbar%2522%253Efoobar%253C%2Fa%253E","127.0.0.1" +"local/unknown",2009-06-24T13:00:31+02:00,15,"xss csrf sqli id lfi","REQUEST.__wysiwyg=%3Ca%20href%3D%5C%22http%3A%2F%2Fwww.foo.de%2F%3Fbar%5C%22%3Efoobar%3C%2Fa%3E GET.__wysiwyg=%3Ca%20href%3D%5C%22http%3A%2F%2Fwww.foo.de%2F%3Fbar%5C%22%3Efoobar%3C%2Fa%3E","%2Fphp-ids.org%2Ftrunk%2Fdocs%2Fexamples%2Fexample.php%3F__wysiwyg%3D%253Ca%2520href%3D%2522http%3A%2F%2Fwww.foo.de%2F%3Fbar%2522%253Efoobar%253C%2Fa%253E","127.0.0.1" +"local/unknown",2009-06-24T13:01:48+02:00,15,"xss csrf sqli id lfi","REQUEST.__wysiwyg=%3Ca%20href%3D%5C%22http%3A%2F%2Fwww.foo.de%2F%3Fbar%5C%22%3Efoobar%3C%2Fa%3E GET.__wysiwyg=%3Ca%20href%3D%5C%22http%3A%2F%2Fwww.foo.de%2F%3Fbar%5C%22%3Efoobar%3C%2Fa%3E","%2Fphp-ids.org%2Ftrunk%2Fdocs%2Fexamples%2Fexample.php%3F__wysiwyg%3D%253Ca%2520href%3D%2522http%3A%2F%2Fwww.foo.de%2F%3Fbar%2522%253Efoobar%253C%2Fa%253E","127.0.0.1" +"local/unknown",2009-06-24T13:01:49+02:00,15,"xss csrf sqli id lfi","REQUEST.__wysiwyg=%3Ca%20href%3D%5C%22http%3A%2F%2Fwww.foo.de%2F%3Fbar%5C%22%3Efoobar%3C%2Fa%3E GET.__wysiwyg=%3Ca%20href%3D%5C%22http%3A%2F%2Fwww.foo.de%2F%3Fbar%5C%22%3Efoobar%3C%2Fa%3E","%2Fphp-ids.org%2Ftrunk%2Fdocs%2Fexamples%2Fexample.php%3F__wysiwyg%3D%253Ca%2520href%3D%2522http%3A%2F%2Fwww.foo.de%2F%3Fbar%2522%253Efoobar%253C%2Fa%253E","127.0.0.1" +"local/unknown",2009-06-24T13:01:51+02:00,15,"xss csrf sqli id lfi","REQUEST.__wysiwyg=%3Ca%20href%3D%5C%22http%3A%2F%2Fwww.foo.de%2F%3Fbar%5C%22%3Efoobar%3C%2Fa%3E GET.__wysiwyg=%3Ca%20href%3D%5C%22http%3A%2F%2Fwww.foo.de%2F%3Fbar%5C%22%3Efoobar%3C%2Fa%3E","%2Fphp-ids.org%2Ftrunk%2Fdocs%2Fexamples%2Fexample.php%3F__wysiwyg%3D%253Ca%2520href%3D%2522http%3A%2F%2Fwww.foo.de%2F%3Fbar%2522%253Efoobar%253C%2Fa%253E","127.0.0.1" +"local/unknown",2009-06-24T13:04:46+02:00,15,"xss csrf sqli id lfi","REQUEST.__wysiwyg=%3Ca%20href%3D%5C%22http%3A%2F%2Fwww.foo.de%2F%3Fbar%5C%22%3Efoobar%3C%2Fa%3E","%2Fphp-ids.org%2Ftrunk%2Fdocs%2Fexamples%2Fexample.php%3F__wysiwyg%3D%253Ca%2520href%3D%2522http%3A%2F%2Fwww.foo.de%2F%3Fbar%2522%253Efoobar%253C%2Fa%253E","127.0.0.1" +"local/unknown",2009-06-24T13:05:48+02:00,15,"xss csrf sqli id lfi","REQUEST.__wysiwyg=%3Ca%20href%3D%5C%22http%3A%2F%2Fwww.foo.de%2F%3Fbar%5C%22%3Efoobar%3C%2Fa%3E GET.__wysiwyg=%3Ca%20href%3D%5C%22http%3A%2F%2Fwww.foo.de%2F%3Fbar%5C%22%3Efoobar%3C%2Fa%3E","%2Fphp-ids.org%2Ftrunk%2Fdocs%2Fexamples%2Fexample.php%3F__wysiwyg%3D%253Ca%2520href%3D%2522http%3A%2F%2Fwww.foo.de%2F%3Fbar%2522%253Efoobar%253C%2Fa%253E","127.0.0.1" +"%3A%3A1",2014-11-14T21:41:41+01:00,72,"xss csrf id rfe lfi sqli","REQUEST.test%3D%2522%253E%253Cscript%253Eeval%2528window.name%2529%253C%252Fscript%253E+GET.test%3D%2522%253E%253Cscript%253Eeval%2528window.name%2529%253C%252Fscript%253E","%2Fczar%2Fplayground%2Fphpids%2Fdocs%2Fexamples%2Fexample.php%3Ftest%3D%2522%253E%253Cscript%253Eeval%28window.name%29%253C%2Fscript%253E","::1" +"%3A%3A1",2014-11-14T21:41:58+01:00,12,"sqli id lfi","REQUEST.test%3D1%2527+GET.test%3D1%2527","%2Fczar%2Fplayground%2Fphpids%2Fdocs%2Fexamples%2Fexample.php%3Ftest%3D1%2527","::1" +"%3A%3A1",2014-11-14T21:51:04+01:00,72,"xss csrf id rfe lfi sqli","REQUEST.test%3D%2522%253E%253Cscript%253Eeval%2528window.name%2529%253C%252Fscript%253E+GET.test%3D%2522%253E%253Cscript%253Eeval%2528window.name%2529%253C%252Fscript%253E","%2Fczar%2Fplayground%2Fdvwa%2F%3Ftest%3D%2522%253E%253Cscript%253Eeval%28window.name%29%253C%2Fscript%253E","::1" +"%3A%3A1",2014-11-14T21:51:13+01:00,12,"sqli id lfi","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2014-11-14T21:51:39+01:00,12,"sqli id lfi","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2014-11-14T21:51:56+01:00,12,"sqli id lfi","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2014-11-14T21:52:06+01:00,12,"sqli id lfi","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2014-11-14T21:53:03+01:00,42,"xss csrf id rfe lfi","REQUEST.id%3D%253Cscript%253Ealert%2528%252F0%252F%2529%253C%252Fscript%253E+GET.id%3D%253Cscript%253Ealert%2528%252F0%252F%2529%253C%252Fscript%253E","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D%253Cscript%253Ealert%2528%252F0%252F%2529%253C%252Fscript%253E%26Submit%3DSubmit","::1" +"%3A%3A1",2014-11-14T21:53:11+01:00,42,"xss csrf id rfe lfi","REQUEST.id%3D%253Cscript%253Ealert%2528%252F0%252F%2529%253C%252Fscript%253E+GET.id%3D%253Cscript%253Ealert%2528%252F0%252F%2529%253C%252Fscript%253E","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D%253Cscript%253Ealert%2528%252F0%252F%2529%253C%252Fscript%253E%26Submit%3DSubmit","::1" +"%3A%3A1",2014-11-14T21:54:16+01:00,42,"xss csrf id rfe lfi","REQUEST.id%3D%253Cscript%253Ealert%2528%252F0%252F%2529%253C%252Fscript%253E+GET.id%3D%253Cscript%253Ealert%2528%252F0%252F%2529%253C%252Fscript%253E","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D%253Cscript%253Ealert%2528%252F0%252F%2529%253C%252Fscript%253E%26Submit%3DSubmit","::1" +"%3A%3A1",2014-11-14T21:54:17+01:00,42,"xss csrf id rfe lfi","REQUEST.id%3D%253Cscript%253Ealert%2528%252F0%252F%2529%253C%252Fscript%253E+GET.id%3D%253Cscript%253Ealert%2528%252F0%252F%2529%253C%252Fscript%253E","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D%253Cscript%253Ealert%2528%252F0%252F%2529%253C%252Fscript%253E%26Submit%3DSubmit","::1" +"%3A%3A1",2014-11-14T21:55:13+01:00,42,"xss csrf id rfe lfi","REQUEST.id%3D%253Cscript%253Ealert%2528%252F0%252F%2529%253C%252Fscript%253E+GET.id%3D%253Cscript%253Ealert%2528%252F0%252F%2529%253C%252Fscript%253E","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D%253Cscript%253Ealert%2528%252F0%252F%2529%253C%252Fscript%253E%26Submit%3DSubmit","::1" +"%3A%3A1",2014-11-14T21:55:25+01:00,42,"xss csrf id rfe lfi","REQUEST.id%3D%253Cscript%253Ealert%2528%252F0%252F%2529%253C%252Fscript%253E+GET.id%3D%253Cscript%253Ealert%2528%252F0%252F%2529%253C%252Fscript%253E","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D%253Cscript%253Ealert%2528%252F0%252F%2529%253C%252Fscript%253E%26Submit%3DSubmit","::1" +"%3A%3A1",2014-11-15T13:42:51+01:00,16,"xss csrf id rfe","REQUEST.id%3Dalert%2528%2529+GET.id%3Dalert%2528%2529","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3Dalert%2528%2529%26Submit%3DSubmit","::1" +"%3A%3A1",2014-11-15T13:45:45+01:00,10,"Command Execution id","REQUEST.id%3Dping%2520-n%25203%2520localhost+GET.id%3Dping%2520-n%25203%2520localhost","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3Dping%2B-n%2B3%2Blocalhost%26Submit%3DSubmit","::1" +"%3A%3A1",2014-11-15T13:46:48+01:00,10,"Command Execution id","REQUEST.chootid%3Dping%2520-n%25203%2520localhost+GET.chootid%3Dping%2520-n%25203%2520localhost","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3Dhi%26Submit%3DSubmit%26chootid%3Dping%2B-n%2B3%2Blocalhost","::1" +"%3A%3A1",2014-11-15T13:47:38+01:00,12,"sqli id lfi","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2014-11-15T13:48:05+01:00,12,"sqli id lfi","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2014-11-15T13:55:09+01:00,86,"xss csrf id rfe sqli lfi","REQUEST.name%3D%2527%2527%253B%2521--%2522%253CXSS%253E%253D%2526%257B%2528%2529%257D+GET.name%3D%2527%2527%253B%2521--%2522%253CXSS%253E%253D%2526%257B%2528%2529%257D","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fxss_r%2F%3Fname%3D%2527%2527%253B%2521--%2522%253CXSS%253E%253D%2526%257B%2528%2529%257D","::1" +"%3A%3A1",2014-11-15T13:55:38+01:00,70,"xss csrf id rfe lfi","REQUEST.name%3D%253CIMG%2520SRC%253Djavascript%253Aalert%2528%2527XSS%2527%2529%253E+GET.name%3D%253CIMG%2520SRC%253Djavascript%253Aalert%2528%2527XSS%2527%2529%253E","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fxss_r%2F%3Fname%3D%253CIMG%2BSRC%253Djavascript%253Aalert%2528%2527XSS%2527%2529%253E","::1" +"%3A%3A1",2014-11-15T13:55:45+01:00,70,"xss csrf id rfe lfi","REQUEST.name%3D%253CIMG%2520SRC%253Djavascript%253Aalert%2528%2522XSS%2522%2529%253E+GET.name%3D%253CIMG%2520SRC%253Djavascript%253Aalert%2528%2522XSS%2522%2529%253E","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fxss_r%2F%3Fname%3D%253CIMG%2BSRC%253Djavascript%253Aalert%2528%2522XSS%2522%2529%253E","::1" +"%3A%3A1",2014-11-15T13:56:01+01:00,88,"xss csrf id rfe lfi","REQUEST.name%3D%253CIMG%2520SRC%253Djavascript%253Aalert%2528String.fromCharCode%252888%252C83%252C83%2529%2529%253E+GET.name%3D%253CIMG%2520SRC%253Djavascript%253Aalert%2528String.fromCharCode%252888%252C83%252C83%2529%2529%253E","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fxss_r%2F%3Fname%3D%253CIMG%2BSRC%253Djavascript%253Aalert%2528String.fromCharCode%252888%252C83%252C83%2529%2529%253E","::1" +"%3A%3A1",2014-11-15T13:56:12+01:00,18,"xss csrf id rfe lfi","REQUEST.name%3D%253CIMG%2520SRC%253D%2526%25230000106%2526%25230000097%2526%25230000118%2526%25230000097%2526%25230000115%2526%25230000099%2526%25230000114%2526%25230000105%2526%25230000112%2526%25230000116%2526%25230000058%2526%25230000097%2526%2520%25230000108%2526%25230000101%2526%25230000114%2526%25230000116%2526%25230000040%2526%25230000039%2526%25230000088%2526%25230000083%2526%25230000083%2526%25230000039%2526%25230000041%253E+GET.name%3D%253CIMG%2520SRC%253D%2526%25230000106%2526%25230000097%2526%25230000118%2526%25230000097%2526%25230000115%2526%25230000099%2526%25230000114%2526%25230000105%2526%25230000112%2526%25230000116%2526%25230000058%2526%25230000097%2526%2520%25230000108%2526%25230000101%2526%25230000114%2526%25230000116%2526%25230000040%2526%25230000039%2526%25230000088%2526%25230000083%2526%25230000083%2526%25230000039%2526%25230000041%253E","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fxss_r%2F%3Fname%3D%253CIMG%2BSRC%253D%2526%25230000106%2526%25230000097%2526%25230000118%2526%25230000097%2526%25230000115%2526%25230000099%2526%25230000114%2526%25230000105%2526%25230000112%2526%25230000116%2526%25230000058%2526%25230000097%2526%2B%25230000108%2526%25230000101%2526%25230000114%2526%25230000116%2526%25230000040%2526%25230000039%2526%25230000088%2526%25230000083%2526%25230000083%2526%25230000039%2526%25230000041%253E","::1" +"%3A%3A1",2014-11-16T18:11:58+01:00,12,"sqli id lfi","REQUEST.name%3D1%2527+GET.name%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fxss_r%2F%3Fname%3D1%2527","::1" +"%3A%3A1",2014-11-16T18:13:49+01:00,12,"sqli id lfi","REQUEST.name%3D1%2527+GET.name%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fxss_r%2F%3Fname%3D1%2527","::1" +"%3A%3A1",2014-11-16T18:16:01+01:00,12,"sqli id lfi","REQUEST.name%3D1%2527+GET.name%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fxss_r%2F%3Fname%3D1%2527","::1" +"%3A%3A1",2014-11-16T18:16:03+01:00,12,"sqli id lfi","REQUEST.name%3D1%2527+GET.name%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fxss_r%2F%3Fname%3D1%2527","::1" +"%3A%3A1",2014-11-16T18:16:10+01:00,12,"sqli id lfi","REQUEST.name%3D1%2527+GET.name%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fxss_r%2F%3Fname%3D1%2527","::1" +"%3A%3A1",2014-11-16T18:23:22+01:00,12,"sqli id lfi","REQUEST.name%3D1%2527+GET.name%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fxss_r%2F%3Fname%3D1%2527","::1" +"%3A%3A1",2014-11-16T18:23:23+01:00,12,"sqli id lfi","REQUEST.name%3D1%2527+GET.name%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fxss_r%2F%3Fname%3D1%2527","::1" +"%3A%3A1",2014-11-16T18:23:24+01:00,12,"sqli id lfi","REQUEST.name%3D1%2527+GET.name%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fxss_r%2F%3Fname%3D1%2527","::1" +"%3A%3A1",2014-11-16T18:38:09+01:00,12,"sqli id lfi","REQUEST.name%3D1%2527+GET.name%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fxss_r%2F%3Fname%3D1%2527","::1" +"%3A%3A1",2014-11-16T18:38:56+01:00,12,"sqli id lfi","REQUEST.name%3D1%2527+GET.name%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fxss_r%2F%3Fname%3D1%2527","::1" +"%3A%3A1",2014-11-16T18:38:57+01:00,12,"sqli id lfi","REQUEST.name%3D1%2527+GET.name%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fxss_r%2F%3Fname%3D1%2527","::1" +"%3A%3A1",2014-11-16T18:39:04+01:00,12,"sqli id lfi","REQUEST.name%3D1%2527+GET.name%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fxss_r%2F%3Fname%3D1%2527","::1" +"%3A%3A1",2014-11-22T10:43:21+01:00,12,"sqli id lfi","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2014-11-23T11:44:54+01:00,12,"sqli id lfi","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2014-11-23T11:53:26+01:00,12,"sqli id lfi","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2014-11-23T11:53:36+01:00,12,"sqli id lfi","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2014-11-23T11:53:45+01:00,12,"sqli id lfi","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2014-11-23T11:53:51+01:00,12,"sqli id lfi","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2014-11-23T11:54:07+01:00,12,"sqli id lfi","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2014-11-23T11:54:10+01:00,12,"sqli id lfi","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2014-11-23T11:54:12+01:00,12,"sqli id lfi","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2014-11-23T11:57:49+01:00,12,"sqli id lfi","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2014-11-23T11:57:51+01:00,12,"sqli id lfi","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2014-11-23T11:59:49+01:00,12,"sqli id lfi","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2014-11-23T12:00:01+01:00,12,"sqli id lfi","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2014-11-23T12:00:17+01:00,12,"sqli id lfi","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2014-11-23T12:02:06+01:00,12,"sqli id lfi","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2014-11-23T12:02:07+01:00,12,"sqli id lfi","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2014-11-23T12:57:45+01:00,12,"sqli id lfi","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2014-11-23T12:57:47+01:00,12,"sqli id lfi","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2014-11-23T12:57:59+01:00,12,"sqli id lfi","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2014-11-23T12:58:18+01:00,12,"sqli id lfi","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2014-11-23T12:58:22+01:00,12,"sqli id lfi","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2014-11-23T12:59:17+01:00,12,"sqli id lfi","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2014-11-23T12:59:20+01:00,12,"sqli id lfi","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2014-11-23T12:59:21+01:00,12,"sqli id lfi","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2014-11-23T12:59:22+01:00,12,"sqli id lfi","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2014-11-23T12:59:51+01:00,12,"sqli id lfi","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2014-11-23T12:59:54+01:00,12,"sqli id lfi","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2014-11-23T12:59:59+01:00,12,"sqli id lfi","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2014-11-23T13:00:28+01:00,12,"sqli id lfi","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2014-11-23T13:00:30+01:00,12,"sqli id lfi","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2014-11-23T13:00:45+01:00,12,"sqli id lfi","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2014-11-23T13:01:36+01:00,12,"sqli id lfi","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2014-11-23T13:02:01+01:00,12,"sqli id lfi","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2014-11-23T13:02:09+01:00,12,"sqli id lfi","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2014-11-23T13:02:19+01:00,12,"sqli id lfi","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2014-11-23T13:02:27+01:00,12,"sqli id lfi","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2014-11-23T13:02:44+01:00,12,"sqli id lfi","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2014-11-23T13:02:45+01:00,12,"sqli id lfi","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2014-11-23T13:02:45+01:00,12,"sqli id lfi","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2014-11-23T13:02:46+01:00,12,"sqli id lfi","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2014-11-23T13:02:48+01:00,12,"sqli id lfi","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2014-11-23T13:02:50+01:00,12,"sqli id lfi","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2014-11-23T13:03:44+01:00,12,"sqli id lfi","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2014-11-23T13:03:50+01:00,12,"sqli id lfi","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2014-11-23T13:04:12+01:00,6,"sqli id lfi","GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2014-11-23T13:04:16+01:00,12,"sqli id lfi","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2014-11-23T13:04:44+01:00,12,"sqli id lfi","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2014-11-23T13:05:46+01:00,12,"sqli id lfi","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2014-11-23T13:07:22+01:00,12,"sqli id lfi","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2014-11-23T13:07:24+01:00,12,"sqli id lfi","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2014-11-23T13:07:26+01:00,12,"sqli id lfi","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2014-11-23T13:10:27+01:00,12,"sqli id lfi","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2014-11-23T13:11:01+01:00,12,"sqli id lfi","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2014-11-23T13:11:02+01:00,12,"sqli id lfi","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2014-11-23T13:11:39+01:00,12,"sqli id lfi","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2014-11-23T13:13:12+01:00,12,"sqli id lfi","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2014-11-23T13:14:22+01:00,12,"sqli id lfi","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2014-11-23T13:14:55+01:00,12,"sqli id lfi","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2014-11-23T13:15:29+01:00,12,"sqli id lfi","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2014-11-23T13:15:51+01:00,12,"sqli id lfi","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2014-11-23T13:18:21+01:00,12,"sqli id lfi","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2014-11-23T13:18:23+01:00,12,"sqli id lfi","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2014-11-23T13:18:24+01:00,12,"sqli id lfi","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2014-11-23T13:18:25+01:00,12,"sqli id lfi","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2014-11-23T13:18:26+01:00,12,"sqli id lfi","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2014-11-23T13:18:27+01:00,12,"sqli id lfi","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2014-11-23T13:19:15+01:00,12,"sqli id lfi","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2014-11-23T13:19:27+01:00,12,"sqli id lfi","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2014-11-23T13:19:33+01:00,12,"sqli id lfi","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2014-11-23T13:19:46+01:00,12,"sqli id lfi","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2014-11-23T13:20:02+01:00,12,"sqli id lfi","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2014-11-23T13:20:57+01:00,12,"sqli id lfi","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2014-11-23T13:21:04+01:00,12,"sqli id lfi","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2014-11-23T13:21:22+01:00,12,"sqli id lfi","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2014-11-23T13:21:48+01:00,12,"sqli id lfi","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2014-11-23T13:23:08+01:00,12,"sqli id lfi","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2014-11-23T13:24:21+01:00,12,"sqli id lfi","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2014-11-23T13:24:56+01:00,12,"sqli id lfi","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2014-11-23T13:25:01+01:00,12,"sqli id lfi","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2014-11-23T13:25:03+01:00,12,"sqli id lfi","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2014-11-23T13:30:36+01:00,12,"sqli id lfi","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2014-11-23T13:47:22+01:00,12,"sqli id lfi","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2014-11-23T13:47:45+01:00,12,"sqli id lfi","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2014-11-23T14:36:25+01:00,12,"sqli id lfi","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2014-11-23T14:37:19+01:00,12,"sqli id lfi","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2014-11-23T14:37:26+01:00,12,"sqli id lfi","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2014-11-23T14:38:26+01:00,12,"sqli id lfi","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2014-11-23T14:42:13+01:00,24,"sqli id lfi","REQUEST.username%3D1%2527+REQUEST.password%3D1%2527+GET.username%3D1%2527+GET.password%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fbrute%2F%3Fusername%3D1%2527%26password%3D1%2527%26Login%3DLogin","::1" +"%3A%3A1",2014-11-23T14:42:39+01:00,24,"sqli id lfi","REQUEST.username%3D1%2527+REQUEST.password%3D1%2527+GET.username%3D1%2527+GET.password%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fbrute%2F%3Fusername%3D1%2527%26password%3D1%2527%26Login%3DLogin","::1" +"%3A%3A1",2014-11-23T14:47:23+01:00,24,"sqli id lfi","REQUEST.username%3D1%2527+REQUEST.password%3D1%2527+GET.username%3D1%2527+GET.password%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fbrute%2F%3Fusername%3D1%2527%26password%3D1%2527%26Login%3DLogin","::1" +"%3A%3A1",2014-11-23T14:51:48+01:00,24,"sqli id lfi","REQUEST.username%3D1%2527+REQUEST.password%3D1%2527+GET.username%3D1%2527+GET.password%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fbrute%2F%3Fusername%3D1%2527%26password%3D1%2527%26Login%3DLogin","::1" +"%3A%3A1",2014-11-23T14:56:02+01:00,24,"sqli id lfi","REQUEST.username%3D1%2527+REQUEST.password%3D1%2527+GET.username%3D1%2527+GET.password%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fbrute%2F%3Fusername%3D1%2527%26password%3D1%2527%26Login%3DLogin","::1" +"%3A%3A1",2014-11-23T15:44:39+01:00,12,"sqli id lfi","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2014-11-23T15:55:55+01:00,12,"sqli id lfi","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2014-11-23T16:07:00+01:00,12,"sqli id lfi","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2014-11-23T16:11:41+01:00,12,"sqli id lfi","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2014-11-23T16:13:40+01:00,12,"sqli id lfi","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2014-11-23T16:14:38+01:00,12,"sqli id lfi","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2014-11-23T16:15:06+01:00,12,"sqli id lfi","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2014-11-23T16:19:52+01:00,12,"sqli id lfi","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2014-11-23T16:24:22+01:00,6,"xss csrf id","REQUEST.id%3D%25201%253D1--+GET.id%3D%25201%253D1--","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D%2B1%253D1--%26Submit%3DSubmit","::1" +"%3A%3A1",2014-11-24T05:30:10+01:00,12,"sqli id lfi","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2014-11-24T05:30:14+01:00,12,"sqli id lfi","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2014-11-24T05:30:14+01:00,12,"sqli id lfi","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2014-11-24T12:43:21+01:00,12,"sqli id lfi","REQUEST.name%3D1%2527+GET.name%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fxss_r%2F%3Fname%3D1%2527","::1" +"%3A%3A1",2014-11-24T20:00:16+01:00,30,"sqli id lfi","REQUEST.name%3D1%2527+GET.name%3D1%2527+COOKIE.ci_session%3Da%253A5%253A%257Bs%253A10%253A%2522session_id%2522%253Bs%253A32%253A%25226676b3b07a4d838d925143494b678f00%2522%253Bs%253A10%253A%2522ip_address%2522%253Bs%253A3%253A%2522%253A%253A1%2522%253Bs%253A10%253A%2522user_agent%2522%253Bs%253A113%253A%2522Mozilla%252F5.0%2520%2528Windows%2520NT%25206.1%253B%2520Win64%253B%2520x64%2529%2520AppleWebKit%252F537.36%2520%2528KHTML%252C%2520like%2520Gecko%2529%2520Chrome%252F39.0.2171.65%2520Safari%252F537.36%2522%253Bs%253A13%253A%2522last_activity%2522%253Bi%253A1416854864%253Bs%253A9%253A%2522user_data%2522%253Bs%253A0%253A%2522%2522%253B%257D8ca15a722b54589b619b94c750442da596d29f1f","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fxss_r%2F%3Fname%3D1%2527","::1" +"%3A%3A1",2014-11-24T20:00:50+01:00,30,"sqli id lfi","REQUEST.name%3D1%2527+GET.name%3D1%2527+COOKIE.ci_session%3Da%253A5%253A%257Bs%253A10%253A%2522session_id%2522%253Bs%253A32%253A%25226676b3b07a4d838d925143494b678f00%2522%253Bs%253A10%253A%2522ip_address%2522%253Bs%253A3%253A%2522%253A%253A1%2522%253Bs%253A10%253A%2522user_agent%2522%253Bs%253A113%253A%2522Mozilla%252F5.0%2520%2528Windows%2520NT%25206.1%253B%2520Win64%253B%2520x64%2529%2520AppleWebKit%252F537.36%2520%2528KHTML%252C%2520like%2520Gecko%2529%2520Chrome%252F39.0.2171.65%2520Safari%252F537.36%2522%253Bs%253A13%253A%2522last_activity%2522%253Bi%253A1416854864%253Bs%253A9%253A%2522user_data%2522%253Bs%253A0%253A%2522%2522%253B%257D8ca15a722b54589b619b94c750442da596d29f1f","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fxss_r%2F%3Fname%3D1%2527","::1" +"%3A%3A1",2014-11-24T20:02:59+01:00,30,"sqli id lfi","REQUEST.name%3D1%2527+GET.name%3D1%2527+COOKIE.ci_session%3Da%253A5%253A%257Bs%253A10%253A%2522session_id%2522%253Bs%253A32%253A%25226676b3b07a4d838d925143494b678f00%2522%253Bs%253A10%253A%2522ip_address%2522%253Bs%253A3%253A%2522%253A%253A1%2522%253Bs%253A10%253A%2522user_agent%2522%253Bs%253A113%253A%2522Mozilla%252F5.0%2520%2528Windows%2520NT%25206.1%253B%2520Win64%253B%2520x64%2529%2520AppleWebKit%252F537.36%2520%2528KHTML%252C%2520like%2520Gecko%2529%2520Chrome%252F39.0.2171.65%2520Safari%252F537.36%2522%253Bs%253A13%253A%2522last_activity%2522%253Bi%253A1416854864%253Bs%253A9%253A%2522user_data%2522%253Bs%253A0%253A%2522%2522%253B%257D8ca15a722b54589b619b94c750442da596d29f1f","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fxss_r%2F%3Fname%3D1%2527","::1" +"%3A%3A1",2014-11-24T20:26:01+01:00,30,"sqli id lfi","REQUEST.id%3D1%2527+GET.id%3D1%2527+COOKIE.ci_session%3Da%253A5%253A%257Bs%253A10%253A%2522session_id%2522%253Bs%253A32%253A%25226676b3b07a4d838d925143494b678f00%2522%253Bs%253A10%253A%2522ip_address%2522%253Bs%253A3%253A%2522%253A%253A1%2522%253Bs%253A10%253A%2522user_agent%2522%253Bs%253A113%253A%2522Mozilla%252F5.0%2520%2528Windows%2520NT%25206.1%253B%2520Win64%253B%2520x64%2529%2520AppleWebKit%252F537.36%2520%2528KHTML%252C%2520like%2520Gecko%2529%2520Chrome%252F39.0.2171.65%2520Safari%252F537.36%2522%253Bs%253A13%253A%2522last_activity%2522%253Bi%253A1416854864%253Bs%253A9%253A%2522user_data%2522%253Bs%253A0%253A%2522%2522%253B%257D8ca15a722b54589b619b94c750442da596d29f1f","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2014-11-24T20:27:29+01:00,30,"sqli id lfi","REQUEST.id%3D1%2527+GET.id%3D1%2527+COOKIE.ci_session%3Da%253A5%253A%257Bs%253A10%253A%2522session_id%2522%253Bs%253A32%253A%25226676b3b07a4d838d925143494b678f00%2522%253Bs%253A10%253A%2522ip_address%2522%253Bs%253A3%253A%2522%253A%253A1%2522%253Bs%253A10%253A%2522user_agent%2522%253Bs%253A113%253A%2522Mozilla%252F5.0%2520%2528Windows%2520NT%25206.1%253B%2520Win64%253B%2520x64%2529%2520AppleWebKit%252F537.36%2520%2528KHTML%252C%2520like%2520Gecko%2529%2520Chrome%252F39.0.2171.65%2520Safari%252F537.36%2522%253Bs%253A13%253A%2522last_activity%2522%253Bi%253A1416854864%253Bs%253A9%253A%2522user_data%2522%253Bs%253A0%253A%2522%2522%253B%257D8ca15a722b54589b619b94c750442da596d29f1f","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2014-11-24T20:27:41+01:00,30,"sqli id lfi","REQUEST.id%3D1%2527+GET.id%3D1%2527+COOKIE.ci_session%3Da%253A5%253A%257Bs%253A10%253A%2522session_id%2522%253Bs%253A32%253A%25226676b3b07a4d838d925143494b678f00%2522%253Bs%253A10%253A%2522ip_address%2522%253Bs%253A3%253A%2522%253A%253A1%2522%253Bs%253A10%253A%2522user_agent%2522%253Bs%253A113%253A%2522Mozilla%252F5.0%2520%2528Windows%2520NT%25206.1%253B%2520Win64%253B%2520x64%2529%2520AppleWebKit%252F537.36%2520%2528KHTML%252C%2520like%2520Gecko%2529%2520Chrome%252F39.0.2171.65%2520Safari%252F537.36%2522%253Bs%253A13%253A%2522last_activity%2522%253Bi%253A1416854864%253Bs%253A9%253A%2522user_data%2522%253Bs%253A0%253A%2522%2522%253B%257D8ca15a722b54589b619b94c750442da596d29f1f","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2014-11-24T20:27:46+01:00,18,"sqli id lfi","REQUEST.id%3D1%2527+GET.id%3D1%2527+COOKIE.ci_session%3Da%253A5%253A%257Bs%253A10%253A%2522session_id%2522%253Bs%253A32%253A%25226676b3b07a4d838d925143494b678f00%2522%253Bs%253A10%253A%2522ip_address%2522%253Bs%253A3%253A%2522%253A%253A1%2522%253Bs%253A10%253A%2522user_agent%2522%253Bs%253A113%253A%2522Mozilla%252F5.0%2520%2528Windows%2520NT%25206.1%253B%2520Win64%253B%2520x64%2529%2520AppleWebKit%252F537.36%2520%2528KHTML%252C%2520like%2520Gecko%2529%2520Chrome%252F39.0.2171.65%2520Safari%252F537.36%2522%253Bs%253A13%253A%2522last_activity%2522%253Bi%253A1416854864%253Bs%253A9%253A%2522user_data%2522%253Bs%253A0%253A%2522%2522%253B%257D8ca15a722b54589b619b94c750442da596d29f1f","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2014-12-02T11:19:57+01:00,18,"sqli id lfi","COOKIE.ci_session%3Da%253A10%253A%257Bs%253A10%253A%2522session_id%2522%253Bs%253A32%253A%2522a34d080e23eb0a1bf4e6f9a52d36a125%2522%253Bs%253A10%253A%2522ip_address%2522%253Bs%253A3%253A%2522%253A%253A1%2522%253Bs%253A10%253A%2522user_agent%2522%253Bs%253A113%253A%2522Mozilla%252F5.0%2520%2528Windows%2520NT%25206.1%253B%2520Win64%253B%2520x64%2529%2520AppleWebKit%252F537.36%2520%2528KHTML%252C%2520like%2520Gecko%2529%2520Chrome%252F39.0.2171.71%2520Safari%252F537.36%2522%253Bs%253A13%253A%2522last_activity%2522%253Bi%253A1417514309%253Bs%253A9%253A%2522user_data%2522%253Bs%253A0%253A%2522%2522%253Bs%253A8%253A%2522identity%2522%253Bs%253A15%253A%2522admin%2540admin.com%2522%253Bs%253A8%253A%2522username%2522%253Bs%253A13%253A%2522administrator%2522%253Bs%253A5%253A%2522email%2522%253Bs%253A15%253A%2522admin%2540admin.com%2522%253Bs%253A7%253A%2522user_id%2522%253Bs%253A1%253A%25221%2522%253Bs%253A14%253A%2522old_last_login%2522%253Bs%253A10%253A%25221417329311%2522%253B%257D5b27f6a690947255067006681e74cad507ad69a3","%2Fczar%2Fplayground%2Fdvwa%2Flogin.php","::1" +"%3A%3A1",2014-12-02T11:20:58+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2014-12-02T11:21:25+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2014-12-02T11:21:41+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2014-12-09T10:22:27+01:00,0,"","REQUEST.name%3D1%2527+GET.name%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fxss_r%2F%3Fname%3D1%2527","::1" +"%3A%3A1",2014-12-09T10:34:03+01:00,0,"","REQUEST.name%3D1%2527+GET.name%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fxss_r%2F%3Fname%3D1%2527","::1" +"%3A%3A1",2014-12-09T19:03:29+01:00,0,"","REQUEST.name%3D1%2527+GET.name%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fxss_r%2F%3Fname%3D1%2527","::1" +"%3A%3A1",2014-12-09T19:14:48+01:00,0,"","REQUEST.name%3D1%2527+GET.name%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fxss_r%2F%3Fname%3D1%2527","::1" +"%3A%3A1",2014-12-09T19:50:58+01:00,0,"","REQUEST.name%3D1%2527+GET.name%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fxss_r%2F%3Fname%3D1%2527","::1" +"%3A%3A1",2014-12-09T21:22:30+01:00,40,"sqli id lfi","REQUEST.name%3DSELECT%2520column_name%2528s%2529%2520FROM%2520table1%2520UNION%2520ALL%2520SELECT%2520column_name%2528s%2529%2520FROM%2520table2%253B+GET.name%3DSELECT%2520column_name%2528s%2529%2520FROM%2520table1%2520UNION%2520ALL%2520SELECT%2520column_name%2528s%2529%2520FROM%2520table2%253B","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fxss_r%2F%3Fname%3DSELECT%2Bcolumn_name%2528s%2529%2BFROM%2Btable1%2BUNION%2BALL%2BSELECT%2Bcolumn_name%2528s%2529%2BFROM%2Btable2%253B","::1" +"%3A%3A1",2014-12-09T22:31:15+01:00,40,"sqli id lfi","REQUEST.name%3DSELECT%2520column_name%2528s%2529%2520FROM%2520table1%2520UNION%2520ALL%2520SELECT%2520column_name%2528s%2529%2520FROM%2520table2%253B+GET.name%3DSELECT%2520column_name%2528s%2529%2520FROM%2520table1%2520UNION%2520ALL%2520SELECT%2520column_name%2528s%2529%2520FROM%2520table2%253B","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fxss_r%2F%3Fname%3DSELECT%2Bcolumn_name%2528s%2529%2BFROM%2Btable1%2BUNION%2BALL%2BSELECT%2Bcolumn_name%2528s%2529%2BFROM%2Btable2%253B","::1" +"%3A%3A1",2014-12-12T18:14:53+01:00,0,"","REQUEST.name%3D1%2527+GET.name%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fxss_r%2F%3Fname%3D1%2527","::1" +"%3A%3A1",2014-12-13T12:00:33+01:00,0,"","REQUEST.name%3D1%2527+GET.name%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fxss_r%2F%3Fname%3D1%2527","::1" +"%3A%3A1",2014-12-13T16:46:16+01:00,40,"sqli id lfi","REQUEST.name%3DSELECT%2520City%2520FROM%2520Customers%2520UNION%2520ALL%2520SELECT%2520City%2520FROM%2520Suppliers%2520ORDER%2520BY%2520City%253B+GET.name%3DSELECT%2520City%2520FROM%2520Customers%2520UNION%2520ALL%2520SELECT%2520City%2520FROM%2520Suppliers%2520ORDER%2520BY%2520City%253B","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fxss_r%2F%3Fname%3DSELECT%2BCity%2BFROM%2BCustomers%2BUNION%2BALL%2BSELECT%2BCity%2BFROM%2BSuppliers%2BORDER%2BBY%2BCity%253B","::1" +"%3A%3A1",2014-12-15T10:43:24+01:00,0,"","REQUEST.name%3D1%2527+GET.name%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fxss_r%2F%3Fname%3D1%2527","::1" +"%3A%3A1",2015-01-18T11:20:37+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-01-18T11:26:31+01:00,42,"xss csrf id rfe lfi","REQUEST.id%3D%253Cscript%253Ealert%2528%252F0%252F%2529%253C%252Fscript%253E+GET.id%3D%253Cscript%253Ealert%2528%252F0%252F%2529%253C%252Fscript%253E","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D%253Cscript%253Ealert%2528%252F0%252F%2529%253C%252Fscript%253E%26Submit%3DSubmit","::1" +"%3A%3A1",2015-01-18T11:34:37+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-01-18T11:48:51+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T05:30:23+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T05:53:27+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T05:53:30+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T05:53:32+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T05:53:33+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T05:53:33+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T05:53:34+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T05:53:34+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T05:53:34+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T05:53:35+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T05:53:35+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T05:53:35+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T05:53:35+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T05:53:35+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T05:53:36+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T05:53:36+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T05:53:54+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T05:55:03+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T05:55:09+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T05:55:10+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T05:55:11+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T05:55:13+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T05:55:14+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T05:55:35+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T05:55:54+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T05:56:36+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T05:57:15+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T05:57:15+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T05:57:16+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T05:57:54+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T05:58:26+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T05:58:37+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T05:58:38+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T05:59:58+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T06:00:03+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T06:00:04+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T06:00:04+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T06:00:20+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T06:00:38+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T06:00:39+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T06:01:06+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T06:01:36+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T06:02:14+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T06:02:15+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T06:02:16+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T06:04:26+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T06:04:37+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T06:04:38+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T06:04:38+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T06:04:38+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T06:07:10+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T06:07:13+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T06:07:23+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T06:07:24+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T06:07:24+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T06:40:44+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T06:40:44+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T06:40:45+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T06:40:45+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T06:40:45+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T06:55:04+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T06:55:48+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T06:56:04+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T06:56:09+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T06:56:10+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T06:56:11+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T06:57:21+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T06:57:36+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T06:58:00+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T07:53:23+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T07:54:37+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T07:55:03+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T07:55:05+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T07:55:06+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T07:55:06+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T08:08:07+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T08:13:40+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T08:18:26+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T08:18:37+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T08:20:51+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T08:21:53+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T08:21:58+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T08:21:58+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T08:22:05+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T08:23:15+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T08:24:13+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T08:24:13+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T08:24:21+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T08:24:22+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T08:24:23+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T08:25:09+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T08:25:14+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T08:25:15+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T08:25:15+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T08:25:16+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T08:26:41+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T08:29:11+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T08:36:30+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T08:36:35+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T08:36:36+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T08:36:36+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T08:36:37+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T08:45:41+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T08:45:55+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T08:46:05+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T08:46:06+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T08:46:07+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T10:38:53+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T10:39:05+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T10:42:42+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T10:42:48+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T10:42:52+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T10:42:56+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T10:43:00+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T10:43:11+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T10:43:11+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T10:43:11+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T10:43:11+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T10:43:24+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T10:43:24+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T10:43:25+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T10:43:25+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T10:43:25+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T10:46:23+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T10:46:29+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T10:46:29+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T10:46:30+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T10:46:30+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T10:46:46+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T11:58:22+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T12:10:52+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T12:14:14+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T12:17:11+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T12:17:12+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T12:17:20+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T12:17:21+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T12:17:21+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T12:17:21+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T12:17:22+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T12:17:36+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T12:17:37+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T12:17:37+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T12:17:37+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T12:17:37+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T12:17:47+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T12:17:56+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T12:17:56+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T12:17:56+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T12:17:57+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T12:17:57+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T12:18:15+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T12:18:16+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T12:18:17+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T12:18:18+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T12:18:18+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T12:18:24+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T12:18:24+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T12:18:25+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T12:18:25+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T12:18:25+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T12:19:38+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T12:19:40+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T12:19:42+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T12:19:43+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T12:19:43+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T12:19:49+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T12:19:50+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T12:19:51+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T12:19:51+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T12:20:30+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T12:20:30+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T12:20:31+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T12:20:31+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T12:20:32+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T12:20:40+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T12:20:41+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T12:20:53+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T12:20:54+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T12:23:28+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T12:23:36+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T12:23:44+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T12:23:46+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T12:23:47+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T12:23:53+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T12:23:54+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T12:23:54+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T12:23:54+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T12:23:55+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T12:24:04+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T12:24:08+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T12:24:11+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T12:24:12+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T12:24:12+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T12:24:22+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T12:24:23+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T12:24:23+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T12:24:23+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T12:24:24+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T12:24:32+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T12:24:34+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T12:24:35+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T12:24:35+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T12:24:35+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T12:24:44+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T12:24:44+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T12:24:45+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T12:24:45+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T12:24:45+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T12:24:54+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T12:24:54+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T12:24:55+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T12:24:55+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T12:24:55+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T12:28:42+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T12:34:07+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T12:34:11+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T12:34:11+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T12:34:12+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T12:34:12+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T12:38:24+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T12:38:25+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T12:38:26+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T12:38:27+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T12:38:28+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T12:39:45+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T12:40:10+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T12:40:11+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T12:40:11+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T12:40:12+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T12:40:12+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T12:43:16+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T12:44:01+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T12:44:02+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T12:44:03+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T12:44:03+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T12:44:04+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T12:44:44+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T12:44:57+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T12:44:57+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T12:44:58+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T12:44:59+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T12:45:00+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T12:46:08+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T12:46:10+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T12:46:11+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T12:46:11+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T12:46:12+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T12:46:23+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T12:46:24+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T12:46:24+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T12:46:25+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T12:46:26+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T12:46:32+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T12:46:32+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T12:46:33+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T12:46:33+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T12:46:34+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T12:46:43+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T12:46:43+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T12:46:44+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T12:46:44+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T12:46:44+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T12:50:52+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T12:50:53+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T12:50:53+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T12:50:54+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T12:50:54+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T12:51:41+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T12:51:42+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T12:51:43+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T12:51:43+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T12:51:44+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T12:51:51+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T12:51:51+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T12:51:52+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T12:51:53+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T12:51:53+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T12:52:06+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T12:52:06+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T12:52:07+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T12:52:07+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T12:52:07+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T12:52:19+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T12:52:19+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T12:52:20+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T12:52:20+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T12:52:21+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T12:52:43+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T12:52:44+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T12:52:45+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T12:52:45+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T12:52:46+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T12:52:58+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T12:52:59+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T12:53:00+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T12:55:21+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T12:55:33+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T12:55:34+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T12:55:34+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T12:55:35+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T12:55:39+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T12:56:17+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T12:56:18+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T12:56:19+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T12:56:19+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T12:56:20+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T12:56:30+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T12:56:31+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T12:56:31+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T12:56:31+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T12:56:32+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T12:56:47+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T12:56:47+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T12:56:48+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T12:56:48+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T12:56:48+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T12:57:05+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T12:57:05+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T12:57:06+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T12:57:06+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T12:57:07+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T12:57:42+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T12:57:44+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T12:57:45+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T12:57:45+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T12:57:45+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T13:00:06+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T13:00:14+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T13:00:14+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T13:00:15+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T13:00:15+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T13:00:20+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T13:00:29+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T13:00:29+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T13:00:30+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T13:00:30+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T13:00:30+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T13:02:00+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T13:02:05+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T13:02:06+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T13:02:06+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T13:02:07+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T13:02:15+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T13:04:00+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T13:04:00+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T13:04:01+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T13:04:01+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T13:04:22+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T13:05:50+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T13:05:51+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T13:05:51+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T13:05:52+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T13:05:52+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T13:06:02+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T13:06:03+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T13:06:04+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T13:06:04+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T13:06:05+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T13:06:15+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T13:06:16+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T13:06:16+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T13:06:16+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T13:06:17+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T13:06:25+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T13:06:26+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T13:06:27+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T13:06:27+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T13:06:27+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T13:06:35+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T13:06:35+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T13:06:36+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T13:06:36+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T13:06:36+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T13:06:58+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T13:06:58+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T13:06:59+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T13:06:59+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T13:06:59+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T13:07:58+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T13:07:59+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T13:07:59+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T13:07:59+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T13:07:59+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T13:08:10+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T13:08:10+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T13:08:11+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T13:08:11+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T13:08:11+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T13:08:20+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T13:08:20+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T13:08:21+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T13:08:21+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T13:08:21+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T13:08:36+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T13:08:36+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T13:08:37+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T13:08:37+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T13:08:38+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T13:08:59+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T13:09:00+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T13:09:01+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T13:09:01+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T13:09:01+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T13:11:32+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T13:11:33+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T13:11:35+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T13:11:35+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T13:11:36+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T13:11:47+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T13:11:48+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T13:11:48+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T13:11:48+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T13:11:49+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T13:11:58+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T13:11:59+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T13:11:59+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T13:12:00+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T13:12:00+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T13:12:08+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T13:12:08+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T13:12:08+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T13:12:09+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T13:12:09+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T13:12:17+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T13:12:18+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T13:12:18+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T13:12:19+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T13:12:19+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T13:12:39+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T13:12:40+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T13:12:40+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T13:12:41+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T13:12:41+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T13:13:27+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T13:13:28+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T13:13:28+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T13:13:28+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T13:13:28+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T13:13:40+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T13:13:40+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T13:13:41+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T13:13:41+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T13:13:41+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T13:13:49+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T13:13:49+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T13:13:50+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T13:13:50+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T13:13:50+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T13:14:11+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T13:14:11+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T13:14:11+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T13:14:11+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T13:14:12+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T13:14:28+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T13:14:29+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T13:14:29+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T13:14:29+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T13:14:30+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T13:14:46+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T13:14:47+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T13:14:47+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T13:14:47+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T13:14:47+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T13:15:46+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T13:15:46+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T13:15:46+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T13:15:47+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T13:15:47+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T13:15:56+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T13:15:57+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T13:15:57+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T13:15:57+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T13:15:58+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T13:16:10+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T13:16:21+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T13:16:21+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T13:16:21+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T13:16:21+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T13:16:39+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T13:16:39+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T13:16:40+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T13:16:40+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T13:16:40+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T13:16:59+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T13:16:59+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T13:17:00+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T13:17:00+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T13:17:00+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T13:17:55+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T13:17:56+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T13:17:56+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T13:17:56+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T13:17:57+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T13:18:06+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T13:18:06+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T13:18:07+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T13:18:07+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T13:18:07+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T13:18:16+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T13:18:17+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T13:18:17+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T13:18:17+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T13:18:17+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T13:18:25+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T13:18:26+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T13:18:26+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T13:18:27+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T13:18:27+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T13:18:37+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T13:18:37+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T13:18:38+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T13:18:38+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T13:18:38+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T13:19:00+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T13:19:00+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T13:19:01+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T13:19:01+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T13:19:01+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T13:19:27+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T13:19:28+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T13:19:28+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T13:19:28+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T13:19:29+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T13:19:47+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T13:19:48+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T13:19:48+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T13:19:48+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T13:19:48+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T13:20:01+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T13:20:01+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T13:20:02+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T13:20:02+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T13:20:02+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T13:20:08+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T13:20:08+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T13:20:08+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T13:20:09+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T13:20:14+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T18:42:13+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T18:43:25+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T18:44:29+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T18:45:26+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T18:45:37+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T18:52:37+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T19:00:03+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T19:00:09+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T19:00:52+01:00,42,"xss csrf id rfe lfi","REQUEST.id%3D%253Cscript%253Ealert%2528%252F0%252F%2529%253C%252Fscript%253E+GET.id%3D%253Cscript%253Ealert%2528%252F0%252F%2529%253C%252Fscript%253E","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D%253Cscript%253Ealert%2528%252F0%252F%2529%253C%252Fscript%253E%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T19:48:24+01:00,42,"xss csrf id rfe lfi","REQUEST.id%3D%253Cscript%253Ealert%2528%252F0%252F%2529%253C%252Fscript%253E+GET.id%3D%253Cscript%253Ealert%2528%252F0%252F%2529%253C%252Fscript%253E","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D%253Cscript%253Ealert%2528%252F0%252F%2529%253C%252Fscript%253E%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T19:48:47+01:00,42,"xss csrf id rfe lfi","REQUEST.id%3D%253Cscript%253Ealert%2528%252F0%252F%2529%253C%252Fscript%253E+GET.id%3D%253Cscript%253Ealert%2528%252F0%252F%2529%253C%252Fscript%253E","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D%253Cscript%253Ealert%2528%252F0%252F%2529%253C%252Fscript%253E%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T21:46:29+01:00,42,"xss csrf id rfe lfi","REQUEST.id%3D%253Cscript%253Ealert%2528%252F0%252F%2529%253C%252Fscript%253E+GET.id%3D%253Cscript%253Ealert%2528%252F0%252F%2529%253C%252Fscript%253E","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D%253Cscript%253Ealert%2528%252F0%252F%2529%253C%252Fscript%253E%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-11T21:58:05+01:00,42,"xss csrf id rfe lfi","REQUEST.id%3D%253Cscript%253Ealert%2528%252F0%252F%2529%253C%252Fscript%253E+GET.id%3D%253Cscript%253Ealert%2528%252F0%252F%2529%253C%252Fscript%253E","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D%253Cscript%253Ealert%2528%252F0%252F%2529%253C%252Fscript%253E%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-12T05:20:46+01:00,42,"xss csrf id rfe lfi","REQUEST.id%3D%253Cscript%253Ealert%2528%252F0%252F%2529%253C%252Fscript%253E+GET.id%3D%253Cscript%253Ealert%2528%252F0%252F%2529%253C%252Fscript%253E","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D%253Cscript%253Ealert%2528%252F0%252F%2529%253C%252Fscript%253E%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-12T05:43:22+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-12T05:43:58+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-12T06:40:28+01:00,20,"dt id lfi","REQUEST.id%3D..%252F..%252F..%252F..%252F..%252Fetc%252Fpassword+GET.id%3D..%252F..%252F..%252F..%252F..%252Fetc%252Fpassword","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D..%252F..%252F..%252F..%252F..%252Fetc%252Fpassword%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-12T17:20:08+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-12T17:20:35+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-12T17:26:45+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-12T17:26:54+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-12T17:27:39+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-13T09:41:22+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-13T09:42:09+01:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-13T14:23:25+01:00,0,"","GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-13T14:23:49+01:00,0,"","GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-13T14:24:23+01:00,0,"","GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-13T18:28:38+01:00,0,"","GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-13T18:47:53+01:00,0,"","GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-13T20:04:35+01:00,0,"","GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-13T20:20:49+01:00,21,"xss csrf id rfe lfi","GET.id%3D%253Cscript%253Ealert%2528%252Fmaagi%252F%2529%253C%252Fscript%253E","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D%253Cscript%253Ealert%2528%252Fmaagi%252F%2529%253C%252Fscript%253E%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-14T12:22:05+01:00,0,"","GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-14T12:23:17+01:00,21,"xss csrf id rfe lfi","GET.id%3D%253Cscript%253Ealert%2528%252F0%252F%2529%253C%252Fscript%253E","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D%253Cscript%253Ealert%2528%252F0%252F%2529%253C%252Fscript%253E%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-14T12:24:02+01:00,0,"","GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-14T14:28:36+01:00,0,"","GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-14T14:29:51+01:00,0,"","GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-14T16:04:46+01:00,0,"","GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-14T19:49:05+01:00,0,"","GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-24T09:58:24+01:00,0,"","GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-24T09:58:59+01:00,0,"","GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-24T10:31:10+01:00,21,"xss csrf id rfe lfi","GET.id%3D%253Cscript%253Ealert%2528%252F0%252F%2529%253C%252Fscript%253E","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli_blind%2F%3Fid%3D%253Cscript%253Ealert%2528%252F0%252F%2529%253C%252Fscript%253E%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-25T08:49:45+01:00,0,"","GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-25T08:49:57+01:00,21,"xss csrf id rfe lfi","GET.id%3D%253Cscript%253Ealert%2528%252Fmaagi%252F%2529%253C%252Fscript%253E","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D%253Cscript%253Ealert%2528%252Fmaagi%252F%2529%253C%252Fscript%253E%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-28T12:24:15+01:00,0,"","GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-03-31T12:51:22+02:00,0,"","GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-04-03T11:51:21+02:00,33,"xss csrf id rfe lfi sqli","GET.id%3D%2527%2522%2528%2529%252526%2525251%253CScRiPt%2520%253Eprompt%2528910003%2529%253C%25252fScRiPt%253E","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D%2527%2522%2528%2529%252526%2525251%253CScRiPt%2B%253Eprompt%2528910003%2529%253C%25252fScRiPt%253E%26Submit%3DSubmit","::1" +"%3A%3A1",2015-04-03T15:55:48+02:00,0,"","GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-04-03T15:55:50+02:00,0,"","GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-04-03T15:55:50+02:00,0,"","GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-04-03T15:55:50+02:00,0,"","GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-04-03T15:55:50+02:00,0,"","GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-04-03T15:55:51+02:00,0,"","GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-04-03T15:55:51+02:00,0,"","GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-04-03T15:55:51+02:00,0,"","GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-04-03T15:55:52+02:00,0,"","GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-04-03T15:55:52+02:00,0,"","GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-04-03T15:56:02+02:00,0,"","GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-04-03T15:56:15+02:00,0,"","GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-04-03T15:57:53+02:00,0,"","GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-04-03T15:58:37+02:00,0,"","GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-04-03T15:58:41+02:00,0,"","GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-04-03T15:58:43+02:00,0,"","GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-04-03T15:58:46+02:00,0,"","GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-04-03T15:58:48+02:00,0,"","GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-04-03T15:58:51+02:00,0,"","GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-04-03T16:01:22+02:00,0,"","GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-04-03T16:01:25+02:00,0,"","GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-04-03T16:01:28+02:00,0,"","GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-04-03T16:01:29+02:00,0,"","GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-04-03T16:01:31+02:00,0,"","GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-04-03T19:37:32+02:00,21,"xss csrf id rfe lfi","GET.id%3D%253Cscript%253Ealert%2528%252Fmaagi%252F%2529%253C%252Fscript%253E","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D%253Cscript%253Ealert%2528%252Fmaagi%252F%2529%253C%252Fscript%253E%26Submit%3DSubmit","::1" +"%3A%3A1",2015-04-03T22:36:53+02:00,0,"","GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-04-04T06:17:25+02:00,0,"","GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-04-04T06:17:48+02:00,0,"","GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-04-04T06:18:17+02:00,0,"","GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-04-04T06:19:04+02:00,21,"xss csrf id rfe lfi","GET.id%3D%253Cscript%253Ealert%2528%252F0%252F%2529%253C%252Fscript%253E","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D%253Cscript%253Ealert%2528%252F0%252F%2529%253C%252Fscript%253E%26Submit%3DSubmit","::1" +"%3A%3A1",2015-04-04T06:20:37+02:00,21,"xss csrf id rfe lfi","GET.id%3D%253Cscript%253Ealert%2528%252F0%252F%2529%253C%252Fscript%253E","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D%253Cscript%253Ealert%2528%252F0%252F%2529%253C%252Fscript%253E%26Submit%3DSubmit","::1" +"%3A%3A1",2015-04-04T06:21:13+02:00,21,"xss csrf id rfe lfi","GET.id%3D%253Cscript%253Ealert%2528%252F0%252F%2529%253C%252Fscript%253E","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D%253Cscript%253Ealert%2528%252F0%252F%2529%253C%252Fscript%253E%26Submit%3DSubmit","::1" +"%3A%3A1",2015-04-07T10:43:08+02:00,36,"xss csrf id rfe lfi sqli","GET.test%3D%2522%253E%253Cscript%253Eeval%2528window.name%2529%253C%252Fscript%253E","%2Fczar%2Fplayground%2Fdvwa%2Fsecurity.php%3Ftest%3D%2522%253E%253Cscript%253Eeval%28window.name%29%253C%2Fscript%253E","::1" +"%3A%3A1",2015-04-09T15:58:24+00:00,21,"xss csrf id rfe lfi","GET.hi%3D%253Cscript%253Ealert%2528%252F0%252F%2529%253C%252Fscript%253E","%2Fczar%2Fplayground%2Fdemo%2Fwordpress%2F%3Fhi%3D%253Cscript%253Ealert%28%2F0%2F%29%253C%2Fscript%253E","::1" +"%3A%3A1",2015-04-09T16:41:38+00:00,24,"xss csrf id rfe lfi","GET.i%3D%253Cscript%253Ealert%2528%252F0%252F%252F%2529%253C%252Fscript%253E","%2Fczar%2Fplayground%2Fdemo%2Fwordpress%2F%3Fi%3D%253Cscript%253Ealert%28%2F0%2F%2F%29%253C%2Fscript%253E","::1" +"%3A%3A1",2015-04-10T19:19:30+02:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" +"%3A%3A1",2015-04-10T19:19:52+02:00,0,"","REQUEST.id%3D1%2527+GET.id%3D1%2527","%2Fczar%2Fplayground%2Fdvwa%2Fvulnerabilities%2Fsqli%2F%3Fid%3D1%2527%26Submit%3DSubmit","::1" diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier.auto.php b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier.auto.php new file mode 100644 index 0000000..1960c39 --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier.auto.php @@ -0,0 +1,11 @@ +purify($html, $config); +} + +// vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier.includes.php b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier.includes.php new file mode 100644 index 0000000..b9baf8f --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier.includes.php @@ -0,0 +1,214 @@ + $attributes) { + $allowed_elements[$element] = true; + foreach ($attributes as $attribute => $x) { + $allowed_attributes["$element.$attribute"] = true; + } + } + $config->set('HTML.AllowedElements', $allowed_elements); + $config->set('HTML.AllowedAttributes', $allowed_attributes); + $allowed_schemes = array(); + if ($allowed_protocols !== null) { + $config->set('URI.AllowedSchemes', $allowed_protocols); + } + $purifier = new HTMLPurifier($config); + return $purifier->purify($string); +} + +// vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier.path.php b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier.path.php new file mode 100644 index 0000000..39b1b65 --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier.path.php @@ -0,0 +1,11 @@ +config = HTMLPurifier_Config::create($config); + + $this->strategy = new HTMLPurifier_Strategy_Core(); + + } + + /** + * Adds a filter to process the output. First come first serve + * @param $filter HTMLPurifier_Filter object + */ + public function addFilter($filter) { + trigger_error('HTMLPurifier->addFilter() is deprecated, use configuration directives in the Filter namespace or Filter.Custom', E_USER_WARNING); + $this->filters[] = $filter; + } + + /** + * Filters an HTML snippet/document to be XSS-free and standards-compliant. + * + * @param $html String of HTML to purify + * @param $config HTMLPurifier_Config object for this operation, if omitted, + * defaults to the config object specified during this + * object's construction. The parameter can also be any type + * that HTMLPurifier_Config::create() supports. + * @return Purified HTML + */ + public function purify($html, $config = null) { + + // :TODO: make the config merge in, instead of replace + $config = $config ? HTMLPurifier_Config::create($config) : $this->config; + + // implementation is partially environment dependant, partially + // configuration dependant + $lexer = HTMLPurifier_Lexer::create($config); + + $context = new HTMLPurifier_Context(); + + // setup HTML generator + $this->generator = new HTMLPurifier_Generator($config, $context); + $context->register('Generator', $this->generator); + + // set up global context variables + if ($config->get('Core.CollectErrors')) { + // may get moved out if other facilities use it + $language_factory = HTMLPurifier_LanguageFactory::instance(); + $language = $language_factory->create($config, $context); + $context->register('Locale', $language); + + $error_collector = new HTMLPurifier_ErrorCollector($context); + $context->register('ErrorCollector', $error_collector); + } + + // setup id_accumulator context, necessary due to the fact that + // AttrValidator can be called from many places + $id_accumulator = HTMLPurifier_IDAccumulator::build($config, $context); + $context->register('IDAccumulator', $id_accumulator); + + $html = HTMLPurifier_Encoder::convertToUTF8($html, $config, $context); + + // setup filters + $filter_flags = $config->getBatch('Filter'); + $custom_filters = $filter_flags['Custom']; + unset($filter_flags['Custom']); + $filters = array(); + foreach ($filter_flags as $filter => $flag) { + if (!$flag) continue; + if (strpos($filter, '.') !== false) continue; + $class = "HTMLPurifier_Filter_$filter"; + $filters[] = new $class; + } + foreach ($custom_filters as $filter) { + // maybe "HTMLPurifier_Filter_$filter", but be consistent with AutoFormat + $filters[] = $filter; + } + $filters = array_merge($filters, $this->filters); + // maybe prepare(), but later + + for ($i = 0, $filter_size = count($filters); $i < $filter_size; $i++) { + $html = $filters[$i]->preFilter($html, $config, $context); + } + + // purified HTML + $html = + $this->generator->generateFromTokens( + // list of tokens + $this->strategy->execute( + // list of un-purified tokens + $lexer->tokenizeHTML( + // un-purified HTML + $html, $config, $context + ), + $config, $context + ) + ); + + for ($i = $filter_size - 1; $i >= 0; $i--) { + $html = $filters[$i]->postFilter($html, $config, $context); + } + + $html = HTMLPurifier_Encoder::convertFromUTF8($html, $config, $context); + $this->context =& $context; + return $html; + } + + /** + * Filters an array of HTML snippets + * @param $config Optional HTMLPurifier_Config object for this operation. + * See HTMLPurifier::purify() for more details. + * @return Array of purified HTML + */ + public function purifyArray($array_of_html, $config = null) { + $context_array = array(); + foreach ($array_of_html as $key => $html) { + $array_of_html[$key] = $this->purify($html, $config); + $context_array[$key] = $this->context; + } + $this->context = $context_array; + return $array_of_html; + } + + /** + * Singleton for enforcing just one HTML Purifier in your system + * @param $prototype Optional prototype HTMLPurifier instance to + * overload singleton with, or HTMLPurifier_Config + * instance to configure the generated version with. + */ + public static function instance($prototype = null) { + if (!self::$instance || $prototype) { + if ($prototype instanceof HTMLPurifier) { + self::$instance = $prototype; + } elseif ($prototype) { + self::$instance = new HTMLPurifier($prototype); + } else { + self::$instance = new HTMLPurifier(); + } + } + return self::$instance; + } + + /** + * @note Backwards compatibility, see instance() + */ + public static function getInstance($prototype = null) { + return HTMLPurifier::instance($prototype); + } + +} + +// vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier.safe-includes.php b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier.safe-includes.php new file mode 100644 index 0000000..a5c0d5b --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier.safe-includes.php @@ -0,0 +1,208 @@ +attr_collections as $coll_i => $coll) { + if (!isset($this->info[$coll_i])) { + $this->info[$coll_i] = array(); + } + foreach ($coll as $attr_i => $attr) { + if ($attr_i === 0 && isset($this->info[$coll_i][$attr_i])) { + // merge in includes + $this->info[$coll_i][$attr_i] = array_merge( + $this->info[$coll_i][$attr_i], $attr); + continue; + } + $this->info[$coll_i][$attr_i] = $attr; + } + } + } + // perform internal expansions and inclusions + foreach ($this->info as $name => $attr) { + // merge attribute collections that include others + $this->performInclusions($this->info[$name]); + // replace string identifiers with actual attribute objects + $this->expandIdentifiers($this->info[$name], $attr_types); + } + } + + /** + * Takes a reference to an attribute associative array and performs + * all inclusions specified by the zero index. + * @param &$attr Reference to attribute array + */ + public function performInclusions(&$attr) { + if (!isset($attr[0])) return; + $merge = $attr[0]; + $seen = array(); // recursion guard + // loop through all the inclusions + for ($i = 0; isset($merge[$i]); $i++) { + if (isset($seen[$merge[$i]])) continue; + $seen[$merge[$i]] = true; + // foreach attribute of the inclusion, copy it over + if (!isset($this->info[$merge[$i]])) continue; + foreach ($this->info[$merge[$i]] as $key => $value) { + if (isset($attr[$key])) continue; // also catches more inclusions + $attr[$key] = $value; + } + if (isset($this->info[$merge[$i]][0])) { + // recursion + $merge = array_merge($merge, $this->info[$merge[$i]][0]); + } + } + unset($attr[0]); + } + + /** + * Expands all string identifiers in an attribute array by replacing + * them with the appropriate values inside HTMLPurifier_AttrTypes + * @param &$attr Reference to attribute array + * @param $attr_types HTMLPurifier_AttrTypes instance + */ + public function expandIdentifiers(&$attr, $attr_types) { + + // because foreach will process new elements we add, make sure we + // skip duplicates + $processed = array(); + + foreach ($attr as $def_i => $def) { + // skip inclusions + if ($def_i === 0) continue; + + if (isset($processed[$def_i])) continue; + + // determine whether or not attribute is required + if ($required = (strpos($def_i, '*') !== false)) { + // rename the definition + unset($attr[$def_i]); + $def_i = trim($def_i, '*'); + $attr[$def_i] = $def; + } + + $processed[$def_i] = true; + + // if we've already got a literal object, move on + if (is_object($def)) { + // preserve previous required + $attr[$def_i]->required = ($required || $attr[$def_i]->required); + continue; + } + + if ($def === false) { + unset($attr[$def_i]); + continue; + } + + if ($t = $attr_types->get($def)) { + $attr[$def_i] = $t; + $attr[$def_i]->required = $required; + } else { + unset($attr[$def_i]); + } + } + + } + +} + +// vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/AttrDef.php b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/AttrDef.php new file mode 100644 index 0000000..b2e4f36 --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/AttrDef.php @@ -0,0 +1,123 @@ + by removing + * leading and trailing whitespace, ignoring line feeds, and replacing + * carriage returns and tabs with spaces. While most useful for HTML + * attributes specified as CDATA, it can also be applied to most CSS + * values. + * + * @note This method is not entirely standards compliant, as trim() removes + * more types of whitespace than specified in the spec. In practice, + * this is rarely a problem, as those extra characters usually have + * already been removed by HTMLPurifier_Encoder. + * + * @warning This processing is inconsistent with XML's whitespace handling + * as specified by section 3.3.3 and referenced XHTML 1.0 section + * 4.7. However, note that we are NOT necessarily + * parsing XML, thus, this behavior may still be correct. We + * assume that newlines have been normalized. + */ + public function parseCDATA($string) { + $string = trim($string); + $string = str_replace(array("\n", "\t", "\r"), ' ', $string); + return $string; + } + + /** + * Factory method for creating this class from a string. + * @param $string String construction info + * @return Created AttrDef object corresponding to $string + */ + public function make($string) { + // default implementation, return a flyweight of this object. + // If $string has an effect on the returned object (i.e. you + // need to overload this method), it is best + // to clone or instantiate new copies. (Instantiation is safer.) + return $this; + } + + /** + * Removes spaces from rgb(0, 0, 0) so that shorthand CSS properties work + * properly. THIS IS A HACK! + */ + protected function mungeRgb($string) { + return preg_replace('/rgb\((\d+)\s*,\s*(\d+)\s*,\s*(\d+)\)/', 'rgb(\1,\2,\3)', $string); + } + + /** + * Parses a possibly escaped CSS string and returns the "pure" + * version of it. + */ + protected function expandCSSEscape($string) { + // flexibly parse it + $ret = ''; + for ($i = 0, $c = strlen($string); $i < $c; $i++) { + if ($string[$i] === '\\') { + $i++; + if ($i >= $c) { + $ret .= '\\'; + break; + } + if (ctype_xdigit($string[$i])) { + $code = $string[$i]; + for ($a = 1, $i++; $i < $c && $a < 6; $i++, $a++) { + if (!ctype_xdigit($string[$i])) break; + $code .= $string[$i]; + } + // We have to be extremely careful when adding + // new characters, to make sure we're not breaking + // the encoding. + $char = HTMLPurifier_Encoder::unichr(hexdec($code)); + if (HTMLPurifier_Encoder::cleanUTF8($char) === '') continue; + $ret .= $char; + if ($i < $c && trim($string[$i]) !== '') $i--; + continue; + } + if ($string[$i] === "\n") continue; + } + $ret .= $string[$i]; + } + return $ret; + } + +} + +// vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/AttrDef/CSS.php b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/AttrDef/CSS.php new file mode 100644 index 0000000..953e706 --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/AttrDef/CSS.php @@ -0,0 +1,87 @@ +parseCDATA($css); + + $definition = $config->getCSSDefinition(); + + // we're going to break the spec and explode by semicolons. + // This is because semicolon rarely appears in escaped form + // Doing this is generally flaky but fast + // IT MIGHT APPEAR IN URIs, see HTMLPurifier_AttrDef_CSSURI + // for details + + $declarations = explode(';', $css); + $propvalues = array(); + + /** + * Name of the current CSS property being validated. + */ + $property = false; + $context->register('CurrentCSSProperty', $property); + + foreach ($declarations as $declaration) { + if (!$declaration) continue; + if (!strpos($declaration, ':')) continue; + list($property, $value) = explode(':', $declaration, 2); + $property = trim($property); + $value = trim($value); + $ok = false; + do { + if (isset($definition->info[$property])) { + $ok = true; + break; + } + if (ctype_lower($property)) break; + $property = strtolower($property); + if (isset($definition->info[$property])) { + $ok = true; + break; + } + } while(0); + if (!$ok) continue; + // inefficient call, since the validator will do this again + if (strtolower(trim($value)) !== 'inherit') { + // inherit works for everything (but only on the base property) + $result = $definition->info[$property]->validate( + $value, $config, $context ); + } else { + $result = 'inherit'; + } + if ($result === false) continue; + $propvalues[$property] = $result; + } + + $context->destroy('CurrentCSSProperty'); + + // procedure does not write the new CSS simultaneously, so it's + // slightly inefficient, but it's the only way of getting rid of + // duplicates. Perhaps config to optimize it, but not now. + + $new_declarations = ''; + foreach ($propvalues as $prop => $value) { + $new_declarations .= "$prop:$value;"; + } + + return $new_declarations ? $new_declarations : false; + + } + +} + +// vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/AttrDef/CSS/AlphaValue.php b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/AttrDef/CSS/AlphaValue.php new file mode 100644 index 0000000..292c040 --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/AttrDef/CSS/AlphaValue.php @@ -0,0 +1,21 @@ + 1.0) $result = '1'; + return $result; + } + +} + +// vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/AttrDef/CSS/Background.php b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/AttrDef/CSS/Background.php new file mode 100644 index 0000000..3a3d20c --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/AttrDef/CSS/Background.php @@ -0,0 +1,87 @@ +getCSSDefinition(); + $this->info['background-color'] = $def->info['background-color']; + $this->info['background-image'] = $def->info['background-image']; + $this->info['background-repeat'] = $def->info['background-repeat']; + $this->info['background-attachment'] = $def->info['background-attachment']; + $this->info['background-position'] = $def->info['background-position']; + } + + public function validate($string, $config, $context) { + + // regular pre-processing + $string = $this->parseCDATA($string); + if ($string === '') return false; + + // munge rgb() decl if necessary + $string = $this->mungeRgb($string); + + // assumes URI doesn't have spaces in it + $bits = explode(' ', strtolower($string)); // bits to process + + $caught = array(); + $caught['color'] = false; + $caught['image'] = false; + $caught['repeat'] = false; + $caught['attachment'] = false; + $caught['position'] = false; + + $i = 0; // number of catches + $none = false; + + foreach ($bits as $bit) { + if ($bit === '') continue; + foreach ($caught as $key => $status) { + if ($key != 'position') { + if ($status !== false) continue; + $r = $this->info['background-' . $key]->validate($bit, $config, $context); + } else { + $r = $bit; + } + if ($r === false) continue; + if ($key == 'position') { + if ($caught[$key] === false) $caught[$key] = ''; + $caught[$key] .= $r . ' '; + } else { + $caught[$key] = $r; + } + $i++; + break; + } + } + + if (!$i) return false; + if ($caught['position'] !== false) { + $caught['position'] = $this->info['background-position']-> + validate($caught['position'], $config, $context); + } + + $ret = array(); + foreach ($caught as $value) { + if ($value === false) continue; + $ret[] = $value; + } + + if (empty($ret)) return false; + return implode(' ', $ret); + + } + +} + +// vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/AttrDef/CSS/BackgroundPosition.php b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/AttrDef/CSS/BackgroundPosition.php new file mode 100644 index 0000000..fae82ea --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/AttrDef/CSS/BackgroundPosition.php @@ -0,0 +1,133 @@ + | | left | center | right + ] + [ + | | top | center | bottom + ]? + ] | + [ // this signifies that the vertical and horizontal adjectives + // can be arbitrarily ordered, however, there can only be two, + // one of each, or none at all + [ + left | center | right + ] || + [ + top | center | bottom + ] + ] + top, left = 0% + center, (none) = 50% + bottom, right = 100% +*/ + +/* QuirksMode says: + keyword + length/percentage must be ordered correctly, as per W3C + + Internet Explorer and Opera, however, support arbitrary ordering. We + should fix it up. + + Minor issue though, not strictly necessary. +*/ + +// control freaks may appreciate the ability to convert these to +// percentages or something, but it's not necessary + +/** + * Validates the value of background-position. + */ +class HTMLPurifier_AttrDef_CSS_BackgroundPosition extends HTMLPurifier_AttrDef +{ + + protected $length; + protected $percentage; + + public function __construct() { + $this->length = new HTMLPurifier_AttrDef_CSS_Length(); + $this->percentage = new HTMLPurifier_AttrDef_CSS_Percentage(); + } + + public function validate($string, $config, $context) { + $string = $this->parseCDATA($string); + $bits = explode(' ', $string); + + $keywords = array(); + $keywords['h'] = false; // left, right + $keywords['v'] = false; // top, bottom + $keywords['ch'] = false; // center (first word) + $keywords['cv'] = false; // center (second word) + $measures = array(); + + $i = 0; + + $lookup = array( + 'top' => 'v', + 'bottom' => 'v', + 'left' => 'h', + 'right' => 'h', + 'center' => 'c' + ); + + foreach ($bits as $bit) { + if ($bit === '') continue; + + // test for keyword + $lbit = ctype_lower($bit) ? $bit : strtolower($bit); + if (isset($lookup[$lbit])) { + $status = $lookup[$lbit]; + if ($status == 'c') { + if ($i == 0) { + $status = 'ch'; + } else { + $status = 'cv'; + } + } + $keywords[$status] = $lbit; + $i++; + } + + // test for length + $r = $this->length->validate($bit, $config, $context); + if ($r !== false) { + $measures[] = $r; + $i++; + } + + // test for percentage + $r = $this->percentage->validate($bit, $config, $context); + if ($r !== false) { + $measures[] = $r; + $i++; + } + + } + + if (!$i) return false; // no valid values were caught + + $ret = array(); + + // first keyword + if ($keywords['h']) $ret[] = $keywords['h']; + elseif ($keywords['ch']) { + $ret[] = $keywords['ch']; + $keywords['cv'] = false; // prevent re-use: center = center center + } + elseif (count($measures)) $ret[] = array_shift($measures); + + if ($keywords['v']) $ret[] = $keywords['v']; + elseif ($keywords['cv']) $ret[] = $keywords['cv']; + elseif (count($measures)) $ret[] = array_shift($measures); + + if (empty($ret)) return false; + return implode(' ', $ret); + + } + +} + +// vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/AttrDef/CSS/Border.php b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/AttrDef/CSS/Border.php new file mode 100644 index 0000000..42a1d1b --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/AttrDef/CSS/Border.php @@ -0,0 +1,43 @@ +getCSSDefinition(); + $this->info['border-width'] = $def->info['border-width']; + $this->info['border-style'] = $def->info['border-style']; + $this->info['border-top-color'] = $def->info['border-top-color']; + } + + public function validate($string, $config, $context) { + $string = $this->parseCDATA($string); + $string = $this->mungeRgb($string); + $bits = explode(' ', $string); + $done = array(); // segments we've finished + $ret = ''; // return value + foreach ($bits as $bit) { + foreach ($this->info as $propname => $validator) { + if (isset($done[$propname])) continue; + $r = $validator->validate($bit, $config, $context); + if ($r !== false) { + $ret .= $r . ' '; + $done[$propname] = true; + break; + } + } + } + return rtrim($ret); + } + +} + +// vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/AttrDef/CSS/Color.php b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/AttrDef/CSS/Color.php new file mode 100644 index 0000000..07f95a6 --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/AttrDef/CSS/Color.php @@ -0,0 +1,78 @@ +get('Core.ColorKeywords'); + + $color = trim($color); + if ($color === '') return false; + + $lower = strtolower($color); + if (isset($colors[$lower])) return $colors[$lower]; + + if (strpos($color, 'rgb(') !== false) { + // rgb literal handling + $length = strlen($color); + if (strpos($color, ')') !== $length - 1) return false; + $triad = substr($color, 4, $length - 4 - 1); + $parts = explode(',', $triad); + if (count($parts) !== 3) return false; + $type = false; // to ensure that they're all the same type + $new_parts = array(); + foreach ($parts as $part) { + $part = trim($part); + if ($part === '') return false; + $length = strlen($part); + if ($part[$length - 1] === '%') { + // handle percents + if (!$type) { + $type = 'percentage'; + } elseif ($type !== 'percentage') { + return false; + } + $num = (float) substr($part, 0, $length - 1); + if ($num < 0) $num = 0; + if ($num > 100) $num = 100; + $new_parts[] = "$num%"; + } else { + // handle integers + if (!$type) { + $type = 'integer'; + } elseif ($type !== 'integer') { + return false; + } + $num = (int) $part; + if ($num < 0) $num = 0; + if ($num > 255) $num = 255; + $new_parts[] = (string) $num; + } + } + $new_triad = implode(',', $new_parts); + $color = "rgb($new_triad)"; + } else { + // hexadecimal handling + if ($color[0] === '#') { + $hex = substr($color, 1); + } else { + $hex = $color; + $color = '#' . $color; + } + $length = strlen($hex); + if ($length !== 3 && $length !== 6) return false; + if (!ctype_xdigit($hex)) return false; + } + + return $color; + + } + +} + +// vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/AttrDef/CSS/Composite.php b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/AttrDef/CSS/Composite.php new file mode 100644 index 0000000..de1289c --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/AttrDef/CSS/Composite.php @@ -0,0 +1,38 @@ +defs = $defs; + } + + public function validate($string, $config, $context) { + foreach ($this->defs as $i => $def) { + $result = $this->defs[$i]->validate($string, $config, $context); + if ($result !== false) return $result; + } + return false; + } + +} + +// vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/AttrDef/CSS/DenyElementDecorator.php b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/AttrDef/CSS/DenyElementDecorator.php new file mode 100644 index 0000000..6599c5b --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/AttrDef/CSS/DenyElementDecorator.php @@ -0,0 +1,28 @@ +def = $def; + $this->element = $element; + } + /** + * Checks if CurrentToken is set and equal to $this->element + */ + public function validate($string, $config, $context) { + $token = $context->get('CurrentToken', true); + if ($token && $token->name == $this->element) return false; + return $this->def->validate($string, $config, $context); + } +} + +// vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/AttrDef/CSS/Filter.php b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/AttrDef/CSS/Filter.php new file mode 100644 index 0000000..147894b --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/AttrDef/CSS/Filter.php @@ -0,0 +1,54 @@ +intValidator = new HTMLPurifier_AttrDef_Integer(); + } + + public function validate($value, $config, $context) { + $value = $this->parseCDATA($value); + if ($value === 'none') return $value; + // if we looped this we could support multiple filters + $function_length = strcspn($value, '('); + $function = trim(substr($value, 0, $function_length)); + if ($function !== 'alpha' && + $function !== 'Alpha' && + $function !== 'progid:DXImageTransform.Microsoft.Alpha' + ) return false; + $cursor = $function_length + 1; + $parameters_length = strcspn($value, ')', $cursor); + $parameters = substr($value, $cursor, $parameters_length); + $params = explode(',', $parameters); + $ret_params = array(); + $lookup = array(); + foreach ($params as $param) { + list($key, $value) = explode('=', $param); + $key = trim($key); + $value = trim($value); + if (isset($lookup[$key])) continue; + if ($key !== 'opacity') continue; + $value = $this->intValidator->validate($value, $config, $context); + if ($value === false) continue; + $int = (int) $value; + if ($int > 100) $value = '100'; + if ($int < 0) $value = '0'; + $ret_params[] = "$key=$value"; + $lookup[$key] = true; + } + $ret_parameters = implode(',', $ret_params); + $ret_function = "$function($ret_parameters)"; + return $ret_function; + } + +} + +// vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/AttrDef/CSS/Font.php b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/AttrDef/CSS/Font.php new file mode 100644 index 0000000..699ee0b --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/AttrDef/CSS/Font.php @@ -0,0 +1,149 @@ +getCSSDefinition(); + $this->info['font-style'] = $def->info['font-style']; + $this->info['font-variant'] = $def->info['font-variant']; + $this->info['font-weight'] = $def->info['font-weight']; + $this->info['font-size'] = $def->info['font-size']; + $this->info['line-height'] = $def->info['line-height']; + $this->info['font-family'] = $def->info['font-family']; + } + + public function validate($string, $config, $context) { + + static $system_fonts = array( + 'caption' => true, + 'icon' => true, + 'menu' => true, + 'message-box' => true, + 'small-caption' => true, + 'status-bar' => true + ); + + // regular pre-processing + $string = $this->parseCDATA($string); + if ($string === '') return false; + + // check if it's one of the keywords + $lowercase_string = strtolower($string); + if (isset($system_fonts[$lowercase_string])) { + return $lowercase_string; + } + + $bits = explode(' ', $string); // bits to process + $stage = 0; // this indicates what we're looking for + $caught = array(); // which stage 0 properties have we caught? + $stage_1 = array('font-style', 'font-variant', 'font-weight'); + $final = ''; // output + + for ($i = 0, $size = count($bits); $i < $size; $i++) { + if ($bits[$i] === '') continue; + switch ($stage) { + + // attempting to catch font-style, font-variant or font-weight + case 0: + foreach ($stage_1 as $validator_name) { + if (isset($caught[$validator_name])) continue; + $r = $this->info[$validator_name]->validate( + $bits[$i], $config, $context); + if ($r !== false) { + $final .= $r . ' '; + $caught[$validator_name] = true; + break; + } + } + // all three caught, continue on + if (count($caught) >= 3) $stage = 1; + if ($r !== false) break; + + // attempting to catch font-size and perhaps line-height + case 1: + $found_slash = false; + if (strpos($bits[$i], '/') !== false) { + list($font_size, $line_height) = + explode('/', $bits[$i]); + if ($line_height === '') { + // ooh, there's a space after the slash! + $line_height = false; + $found_slash = true; + } + } else { + $font_size = $bits[$i]; + $line_height = false; + } + $r = $this->info['font-size']->validate( + $font_size, $config, $context); + if ($r !== false) { + $final .= $r; + // attempt to catch line-height + if ($line_height === false) { + // we need to scroll forward + for ($j = $i + 1; $j < $size; $j++) { + if ($bits[$j] === '') continue; + if ($bits[$j] === '/') { + if ($found_slash) { + return false; + } else { + $found_slash = true; + continue; + } + } + $line_height = $bits[$j]; + break; + } + } else { + // slash already found + $found_slash = true; + $j = $i; + } + if ($found_slash) { + $i = $j; + $r = $this->info['line-height']->validate( + $line_height, $config, $context); + if ($r !== false) { + $final .= '/' . $r; + } + } + $final .= ' '; + $stage = 2; + break; + } + return false; + + // attempting to catch font-family + case 2: + $font_family = + implode(' ', array_slice($bits, $i, $size - $i)); + $r = $this->info['font-family']->validate( + $font_family, $config, $context); + if ($r !== false) { + $final .= $r . ' '; + // processing completed successfully + return rtrim($final); + } + return false; + } + } + return false; + } + +} + +// vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/AttrDef/CSS/FontFamily.php b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/AttrDef/CSS/FontFamily.php new file mode 100644 index 0000000..0d9a4e1 --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/AttrDef/CSS/FontFamily.php @@ -0,0 +1,197 @@ +mask = '- '; + for ($c = 'a'; $c <= 'z'; $c++) $this->mask .= $c; + for ($c = 'A'; $c <= 'Z'; $c++) $this->mask .= $c; + for ($c = '0'; $c <= '9'; $c++) $this->mask .= $c; // cast-y, but should be fine + // special bytes used by UTF-8 + for ($i = 0x80; $i <= 0xFF; $i++) { + // We don't bother excluding invalid bytes in this range, + // because the our restriction of well-formed UTF-8 will + // prevent these from ever occurring. + $this->mask .= chr($i); + } + + /* + PHP's internal strcspn implementation is + O(length of string * length of mask), making it inefficient + for large masks. However, it's still faster than + preg_match 8) + for (p = s1;;) { + spanp = s2; + do { + if (*spanp == c || p == s1_end) { + return p - s1; + } + } while (spanp++ < (s2_end - 1)); + c = *++p; + } + */ + // possible optimization: invert the mask. + } + + public function validate($string, $config, $context) { + static $generic_names = array( + 'serif' => true, + 'sans-serif' => true, + 'monospace' => true, + 'fantasy' => true, + 'cursive' => true + ); + $allowed_fonts = $config->get('CSS.AllowedFonts'); + + // assume that no font names contain commas in them + $fonts = explode(',', $string); + $final = ''; + foreach($fonts as $font) { + $font = trim($font); + if ($font === '') continue; + // match a generic name + if (isset($generic_names[$font])) { + if ($allowed_fonts === null || isset($allowed_fonts[$font])) { + $final .= $font . ', '; + } + continue; + } + // match a quoted name + if ($font[0] === '"' || $font[0] === "'") { + $length = strlen($font); + if ($length <= 2) continue; + $quote = $font[0]; + if ($font[$length - 1] !== $quote) continue; + $font = substr($font, 1, $length - 2); + } + + $font = $this->expandCSSEscape($font); + + // $font is a pure representation of the font name + + if ($allowed_fonts !== null && !isset($allowed_fonts[$font])) { + continue; + } + + if (ctype_alnum($font) && $font !== '') { + // very simple font, allow it in unharmed + $final .= $font . ', '; + continue; + } + + // bugger out on whitespace. form feed (0C) really + // shouldn't show up regardless + $font = str_replace(array("\n", "\t", "\r", "\x0C"), ' ', $font); + + // Here, there are various classes of characters which need + // to be treated differently: + // - Alphanumeric characters are essentially safe. We + // handled these above. + // - Spaces require quoting, though most parsers will do + // the right thing if there aren't any characters that + // can be misinterpreted + // - Dashes rarely occur, but they fairly unproblematic + // for parsing/rendering purposes. + // The above characters cover the majority of Western font + // names. + // - Arbitrary Unicode characters not in ASCII. Because + // most parsers give little thought to Unicode, treatment + // of these codepoints is basically uniform, even for + // punctuation-like codepoints. These characters can + // show up in non-Western pages and are supported by most + // major browsers, for example: "ＭＳ 明朝" is a + // legitimate font-name + // . See + // the CSS3 spec for more examples: + // + // You can see live samples of these on the Internet: + // + // However, most of these fonts have ASCII equivalents: + // for example, 'MS Mincho', and it's considered + // professional to use ASCII font names instead of + // Unicode font names. Thanks Takeshi Terada for + // providing this information. + // The following characters, to my knowledge, have not been + // used to name font names. + // - Single quote. While theoretically you might find a + // font name that has a single quote in its name (serving + // as an apostrophe, e.g. Dave's Scribble), I haven't + // been able to find any actual examples of this. + // Internet Explorer's cssText translation (which I + // believe is invoked by innerHTML) normalizes any + // quoting to single quotes, and fails to escape single + // quotes. (Note that this is not IE's behavior for all + // CSS properties, just some sort of special casing for + // font-family). So a single quote *cannot* be used + // safely in the font-family context if there will be an + // innerHTML/cssText translation. Note that Firefox 3.x + // does this too. + // - Double quote. In IE, these get normalized to + // single-quotes, no matter what the encoding. (Fun + // fact, in IE8, the 'content' CSS property gained + // support, where they special cased to preserve encoded + // double quotes, but still translate unadorned double + // quotes into single quotes.) So, because their + // fixpoint behavior is identical to single quotes, they + // cannot be allowed either. Firefox 3.x displays + // single-quote style behavior. + // - Backslashes are reduced by one (so \\ -> \) every + // iteration, so they cannot be used safely. This shows + // up in IE7, IE8 and FF3 + // - Semicolons, commas and backticks are handled properly. + // - The rest of the ASCII punctuation is handled properly. + // We haven't checked what browsers do to unadorned + // versions, but this is not important as long as the + // browser doesn't /remove/ surrounding quotes (as IE does + // for HTML). + // + // With these results in hand, we conclude that there are + // various levels of safety: + // - Paranoid: alphanumeric, spaces and dashes(?) + // - International: Paranoid + non-ASCII Unicode + // - Edgy: Everything except quotes, backslashes + // - NoJS: Standards compliance, e.g. sod IE. Note that + // with some judicious character escaping (since certain + // types of escaping doesn't work) this is theoretically + // OK as long as innerHTML/cssText is not called. + // We believe that international is a reasonable default + // (that we will implement now), and once we do more + // extensive research, we may feel comfortable with dropping + // it down to edgy. + + // Edgy: alphanumeric, spaces, dashes and Unicode. Use of + // str(c)spn assumes that the string was already well formed + // Unicode (which of course it is). + if (strspn($font, $this->mask) !== strlen($font)) { + continue; + } + + // Historical: + // In the absence of innerHTML/cssText, these ugly + // transforms don't pose a security risk (as \\ and \" + // might--these escapes are not supported by most browsers). + // We could try to be clever and use single-quote wrapping + // when there is a double quote present, but I have choosen + // not to implement that. (NOTE: you can reduce the amount + // of escapes by one depending on what quoting style you use) + // $font = str_replace('\\', '\\5C ', $font); + // $font = str_replace('"', '\\22 ', $font); + // $font = str_replace("'", '\\27 ', $font); + + // font possibly with spaces, requires quoting + $final .= "'$font', "; + } + $final = rtrim($final, ', '); + if ($final === '') return false; + return $final; + } + +} + +// vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/AttrDef/CSS/ImportantDecorator.php b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/AttrDef/CSS/ImportantDecorator.php new file mode 100644 index 0000000..4e6b35e --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/AttrDef/CSS/ImportantDecorator.php @@ -0,0 +1,40 @@ +def = $def; + $this->allow = $allow; + } + /** + * Intercepts and removes !important if necessary + */ + public function validate($string, $config, $context) { + // test for ! and important tokens + $string = trim($string); + $is_important = false; + // :TODO: optimization: test directly for !important and ! important + if (strlen($string) >= 9 && substr($string, -9) === 'important') { + $temp = rtrim(substr($string, 0, -9)); + // use a temp, because we might want to restore important + if (strlen($temp) >= 1 && substr($temp, -1) === '!') { + $string = rtrim(substr($temp, 0, -1)); + $is_important = true; + } + } + $string = $this->def->validate($string, $config, $context); + if ($this->allow && $is_important) $string .= ' !important'; + return $string; + } +} + +// vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/AttrDef/CSS/Length.php b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/AttrDef/CSS/Length.php new file mode 100644 index 0000000..a07ec58 --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/AttrDef/CSS/Length.php @@ -0,0 +1,47 @@ +min = $min !== null ? HTMLPurifier_Length::make($min) : null; + $this->max = $max !== null ? HTMLPurifier_Length::make($max) : null; + } + + public function validate($string, $config, $context) { + $string = $this->parseCDATA($string); + + // Optimizations + if ($string === '') return false; + if ($string === '0') return '0'; + if (strlen($string) === 1) return false; + + $length = HTMLPurifier_Length::make($string); + if (!$length->isValid()) return false; + + if ($this->min) { + $c = $length->compareTo($this->min); + if ($c === false) return false; + if ($c < 0) return false; + } + if ($this->max) { + $c = $length->compareTo($this->max); + if ($c === false) return false; + if ($c > 0) return false; + } + + return $length->toString(); + } + +} + +// vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/AttrDef/CSS/ListStyle.php b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/AttrDef/CSS/ListStyle.php new file mode 100644 index 0000000..4406868 --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/AttrDef/CSS/ListStyle.php @@ -0,0 +1,78 @@ +getCSSDefinition(); + $this->info['list-style-type'] = $def->info['list-style-type']; + $this->info['list-style-position'] = $def->info['list-style-position']; + $this->info['list-style-image'] = $def->info['list-style-image']; + } + + public function validate($string, $config, $context) { + + // regular pre-processing + $string = $this->parseCDATA($string); + if ($string === '') return false; + + // assumes URI doesn't have spaces in it + $bits = explode(' ', strtolower($string)); // bits to process + + $caught = array(); + $caught['type'] = false; + $caught['position'] = false; + $caught['image'] = false; + + $i = 0; // number of catches + $none = false; + + foreach ($bits as $bit) { + if ($i >= 3) return; // optimization bit + if ($bit === '') continue; + foreach ($caught as $key => $status) { + if ($status !== false) continue; + $r = $this->info['list-style-' . $key]->validate($bit, $config, $context); + if ($r === false) continue; + if ($r === 'none') { + if ($none) continue; + else $none = true; + if ($key == 'image') continue; + } + $caught[$key] = $r; + $i++; + break; + } + } + + if (!$i) return false; + + $ret = array(); + + // construct type + if ($caught['type']) $ret[] = $caught['type']; + + // construct image + if ($caught['image']) $ret[] = $caught['image']; + + // construct position + if ($caught['position']) $ret[] = $caught['position']; + + if (empty($ret)) return false; + return implode(' ', $ret); + + } + +} + +// vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/AttrDef/CSS/Multiple.php b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/AttrDef/CSS/Multiple.php new file mode 100644 index 0000000..4d62a40 --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/AttrDef/CSS/Multiple.php @@ -0,0 +1,58 @@ +single = $single; + $this->max = $max; + } + + public function validate($string, $config, $context) { + $string = $this->parseCDATA($string); + if ($string === '') return false; + $parts = explode(' ', $string); // parseCDATA replaced \r, \t and \n + $length = count($parts); + $final = ''; + for ($i = 0, $num = 0; $i < $length && $num < $this->max; $i++) { + if (ctype_space($parts[$i])) continue; + $result = $this->single->validate($parts[$i], $config, $context); + if ($result !== false) { + $final .= $result . ' '; + $num++; + } + } + if ($final === '') return false; + return rtrim($final); + } + +} + +// vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/AttrDef/CSS/Number.php b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/AttrDef/CSS/Number.php new file mode 100644 index 0000000..3f99e12 --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/AttrDef/CSS/Number.php @@ -0,0 +1,69 @@ +non_negative = $non_negative; + } + + /** + * @warning Some contexts do not pass $config, $context. These + * variables should not be used without checking HTMLPurifier_Length + */ + public function validate($number, $config, $context) { + + $number = $this->parseCDATA($number); + + if ($number === '') return false; + if ($number === '0') return '0'; + + $sign = ''; + switch ($number[0]) { + case '-': + if ($this->non_negative) return false; + $sign = '-'; + case '+': + $number = substr($number, 1); + } + + if (ctype_digit($number)) { + $number = ltrim($number, '0'); + return $number ? $sign . $number : '0'; + } + + // Period is the only non-numeric character allowed + if (strpos($number, '.') === false) return false; + + list($left, $right) = explode('.', $number, 2); + + if ($left === '' && $right === '') return false; + if ($left !== '' && !ctype_digit($left)) return false; + + $left = ltrim($left, '0'); + $right = rtrim($right, '0'); + + if ($right === '') { + return $left ? $sign . $left : '0'; + } elseif (!ctype_digit($right)) { + return false; + } + + return $sign . $left . '.' . $right; + + } + +} + +// vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/AttrDef/CSS/Percentage.php b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/AttrDef/CSS/Percentage.php new file mode 100644 index 0000000..c34b8fc --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/AttrDef/CSS/Percentage.php @@ -0,0 +1,40 @@ +number_def = new HTMLPurifier_AttrDef_CSS_Number($non_negative); + } + + public function validate($string, $config, $context) { + + $string = $this->parseCDATA($string); + + if ($string === '') return false; + $length = strlen($string); + if ($length === 1) return false; + if ($string[$length - 1] !== '%') return false; + + $number = substr($string, 0, $length - 1); + $number = $this->number_def->validate($number, $config, $context); + + if ($number === false) return false; + return "$number%"; + + } + +} + +// vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/AttrDef/CSS/TextDecoration.php b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/AttrDef/CSS/TextDecoration.php new file mode 100644 index 0000000..772c922 --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/AttrDef/CSS/TextDecoration.php @@ -0,0 +1,38 @@ + true, + 'overline' => true, + 'underline' => true, + ); + + $string = strtolower($this->parseCDATA($string)); + + if ($string === 'none') return $string; + + $parts = explode(' ', $string); + $final = ''; + foreach ($parts as $part) { + if (isset($allowed_values[$part])) { + $final .= $part . ' '; + } + } + $final = rtrim($final); + if ($final === '') return false; + return $final; + + } + +} + +// vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/AttrDef/CSS/URI.php b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/AttrDef/CSS/URI.php new file mode 100644 index 0000000..c2f767e --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/AttrDef/CSS/URI.php @@ -0,0 +1,61 @@ +parseCDATA($uri_string); + if (strpos($uri_string, 'url(') !== 0) return false; + $uri_string = substr($uri_string, 4); + $new_length = strlen($uri_string) - 1; + if ($uri_string[$new_length] != ')') return false; + $uri = trim(substr($uri_string, 0, $new_length)); + + if (!empty($uri) && ($uri[0] == "'" || $uri[0] == '"')) { + $quote = $uri[0]; + $new_length = strlen($uri) - 1; + if ($uri[$new_length] !== $quote) return false; + $uri = substr($uri, 1, $new_length - 1); + } + + $uri = $this->expandCSSEscape($uri); + + $result = parent::validate($uri, $config, $context); + + if ($result === false) return false; + + // extra sanity check; should have been done by URI + $result = str_replace(array('"', "\\", "\n", "\x0c", "\r"), "", $result); + + // suspicious characters are ()'; we're going to percent encode + // them for safety. + $result = str_replace(array('(', ')', "'"), array('%28', '%29', '%27'), $result); + + // there's an extra bug where ampersands lose their escaping on + // an innerHTML cycle, so a very unlucky query parameter could + // then change the meaning of the URL. Unfortunately, there's + // not much we can do about that... + + return "url(\"$result\")"; + + } + +} + +// vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/AttrDef/Enum.php b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/AttrDef/Enum.php new file mode 100644 index 0000000..5d603eb --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/AttrDef/Enum.php @@ -0,0 +1,65 @@ +valid_values = array_flip($valid_values); + $this->case_sensitive = $case_sensitive; + } + + public function validate($string, $config, $context) { + $string = trim($string); + if (!$this->case_sensitive) { + // we may want to do full case-insensitive libraries + $string = ctype_lower($string) ? $string : strtolower($string); + } + $result = isset($this->valid_values[$string]); + + return $result ? $string : false; + } + + /** + * @param $string In form of comma-delimited list of case-insensitive + * valid values. Example: "foo,bar,baz". Prepend "s:" to make + * case sensitive + */ + public function make($string) { + if (strlen($string) > 2 && $string[0] == 's' && $string[1] == ':') { + $string = substr($string, 2); + $sensitive = true; + } else { + $sensitive = false; + } + $values = explode(',', $string); + return new HTMLPurifier_AttrDef_Enum($values, $sensitive); + } + +} + +// vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/AttrDef/HTML/Bool.php b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/AttrDef/HTML/Bool.php new file mode 100644 index 0000000..e06987e --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/AttrDef/HTML/Bool.php @@ -0,0 +1,28 @@ +name = $name;} + + public function validate($string, $config, $context) { + if (empty($string)) return false; + return $this->name; + } + + /** + * @param $string Name of attribute + */ + public function make($string) { + return new HTMLPurifier_AttrDef_HTML_Bool($string); + } + +} + +// vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/AttrDef/HTML/Class.php b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/AttrDef/HTML/Class.php new file mode 100644 index 0000000..370068d --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/AttrDef/HTML/Class.php @@ -0,0 +1,34 @@ +getDefinition('HTML')->doctype->name; + if ($name == "XHTML 1.1" || $name == "XHTML 2.0") { + return parent::split($string, $config, $context); + } else { + return preg_split('/\s+/', $string); + } + } + protected function filter($tokens, $config, $context) { + $allowed = $config->get('Attr.AllowedClasses'); + $forbidden = $config->get('Attr.ForbiddenClasses'); + $ret = array(); + foreach ($tokens as $token) { + if ( + ($allowed === null || isset($allowed[$token])) && + !isset($forbidden[$token]) && + // We need this O(n) check because of PHP's array + // implementation that casts -0 to 0. + !in_array($token, $ret, true) + ) { + $ret[] = $token; + } + } + return $ret; + } +} diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/AttrDef/HTML/Color.php b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/AttrDef/HTML/Color.php new file mode 100644 index 0000000..d01e204 --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/AttrDef/HTML/Color.php @@ -0,0 +1,32 @@ +get('Core.ColorKeywords'); + + $string = trim($string); + + if (empty($string)) return false; + if (isset($colors[$string])) return $colors[$string]; + if ($string[0] === '#') $hex = substr($string, 1); + else $hex = $string; + + $length = strlen($hex); + if ($length !== 3 && $length !== 6) return false; + if (!ctype_xdigit($hex)) return false; + if ($length === 3) $hex = $hex[0].$hex[0].$hex[1].$hex[1].$hex[2].$hex[2]; + + return "#$hex"; + + } + +} + +// vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/AttrDef/HTML/FrameTarget.php b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/AttrDef/HTML/FrameTarget.php new file mode 100644 index 0000000..ae6ea7c --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/AttrDef/HTML/FrameTarget.php @@ -0,0 +1,21 @@ +valid_values === false) $this->valid_values = $config->get('Attr.AllowedFrameTargets'); + return parent::validate($string, $config, $context); + } + +} + +// vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/AttrDef/HTML/ID.php b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/AttrDef/HTML/ID.php new file mode 100644 index 0000000..81d0376 --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/AttrDef/HTML/ID.php @@ -0,0 +1,70 @@ +get('Attr.EnableID')) return false; + + $id = trim($id); // trim it first + + if ($id === '') return false; + + $prefix = $config->get('Attr.IDPrefix'); + if ($prefix !== '') { + $prefix .= $config->get('Attr.IDPrefixLocal'); + // prevent re-appending the prefix + if (strpos($id, $prefix) !== 0) $id = $prefix . $id; + } elseif ($config->get('Attr.IDPrefixLocal') !== '') { + trigger_error('%Attr.IDPrefixLocal cannot be used unless '. + '%Attr.IDPrefix is set', E_USER_WARNING); + } + + //if (!$this->ref) { + $id_accumulator =& $context->get('IDAccumulator'); + if (isset($id_accumulator->ids[$id])) return false; + //} + + // we purposely avoid using regex, hopefully this is faster + + if (ctype_alpha($id)) { + $result = true; + } else { + if (!ctype_alpha(@$id[0])) return false; + $trim = trim( // primitive style of regexps, I suppose + $id, + 'A..Za..z0..9:-._' + ); + $result = ($trim === ''); + } + + $regexp = $config->get('Attr.IDBlacklistRegexp'); + if ($regexp && preg_match($regexp, $id)) { + return false; + } + + if (/*!$this->ref && */$result) $id_accumulator->add($id); + + // if no change was made to the ID, return the result + // else, return the new id if stripping whitespace made it + // valid, or return false. + return $result ? $id : false; + + } + +} + +// vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/AttrDef/HTML/Length.php b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/AttrDef/HTML/Length.php new file mode 100644 index 0000000..a242f9c --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/AttrDef/HTML/Length.php @@ -0,0 +1,41 @@ + 100) return '100%'; + + return ((string) $points) . '%'; + + } + +} + +// vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/AttrDef/HTML/LinkTypes.php b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/AttrDef/HTML/LinkTypes.php new file mode 100644 index 0000000..76d25ed --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/AttrDef/HTML/LinkTypes.php @@ -0,0 +1,53 @@ + 'AllowedRel', + 'rev' => 'AllowedRev' + ); + if (!isset($configLookup[$name])) { + trigger_error('Unrecognized attribute name for link '. + 'relationship.', E_USER_ERROR); + return; + } + $this->name = $configLookup[$name]; + } + + public function validate($string, $config, $context) { + + $allowed = $config->get('Attr.' . $this->name); + if (empty($allowed)) return false; + + $string = $this->parseCDATA($string); + $parts = explode(' ', $string); + + // lookup to prevent duplicates + $ret_lookup = array(); + foreach ($parts as $part) { + $part = strtolower(trim($part)); + if (!isset($allowed[$part])) continue; + $ret_lookup[$part] = true; + } + + if (empty($ret_lookup)) return false; + $string = implode(' ', array_keys($ret_lookup)); + + return $string; + + } + +} + +// vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/AttrDef/HTML/MultiLength.php b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/AttrDef/HTML/MultiLength.php new file mode 100644 index 0000000..c72fc76 --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/AttrDef/HTML/MultiLength.php @@ -0,0 +1,41 @@ +split($string, $config, $context); + $tokens = $this->filter($tokens, $config, $context); + if (empty($tokens)) return false; + return implode(' ', $tokens); + + } + + /** + * Splits a space separated list of tokens into its constituent parts. + */ + protected function split($string, $config, $context) { + // OPTIMIZABLE! + // do the preg_match, capture all subpatterns for reformulation + + // we don't support U+00A1 and up codepoints or + // escaping because I don't know how to do that with regexps + // and plus it would complicate optimization efforts (you never + // see that anyway). + $pattern = '/(?:(?<=\s)|\A)'. // look behind for space or string start + '((?:--|-?[A-Za-z_])[A-Za-z_\-0-9]*)'. + '(?:(?=\s)|\z)/'; // look ahead for space or string end + preg_match_all($pattern, $string, $matches); + return $matches[1]; + } + + /** + * Template method for removing certain tokens based on arbitrary criteria. + * @note If we wanted to be really functional, we'd do an array_filter + * with a callback. But... we're not. + */ + protected function filter($tokens, $config, $context) { + return $tokens; + } + +} + +// vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/AttrDef/HTML/Pixels.php b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/AttrDef/HTML/Pixels.php new file mode 100644 index 0000000..4cb2c1b --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/AttrDef/HTML/Pixels.php @@ -0,0 +1,48 @@ +max = $max; + } + + public function validate($string, $config, $context) { + + $string = trim($string); + if ($string === '0') return $string; + if ($string === '') return false; + $length = strlen($string); + if (substr($string, $length - 2) == 'px') { + $string = substr($string, 0, $length - 2); + } + if (!is_numeric($string)) return false; + $int = (int) $string; + + if ($int < 0) return '0'; + + // upper-bound value, extremely high values can + // crash operating systems, see + // WARNING, above link WILL crash you if you're using Windows + + if ($this->max !== null && $int > $this->max) return (string) $this->max; + + return (string) $int; + + } + + public function make($string) { + if ($string === '') $max = null; + else $max = (int) $string; + $class = get_class($this); + return new $class($max); + } + +} + +// vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/AttrDef/Integer.php b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/AttrDef/Integer.php new file mode 100644 index 0000000..d59738d --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/AttrDef/Integer.php @@ -0,0 +1,73 @@ +negative = $negative; + $this->zero = $zero; + $this->positive = $positive; + } + + public function validate($integer, $config, $context) { + + $integer = $this->parseCDATA($integer); + if ($integer === '') return false; + + // we could possibly simply typecast it to integer, but there are + // certain fringe cases that must not return an integer. + + // clip leading sign + if ( $this->negative && $integer[0] === '-' ) { + $digits = substr($integer, 1); + if ($digits === '0') $integer = '0'; // rm minus sign for zero + } elseif( $this->positive && $integer[0] === '+' ) { + $digits = $integer = substr($integer, 1); // rm unnecessary plus + } else { + $digits = $integer; + } + + // test if it's numeric + if (!ctype_digit($digits)) return false; + + // perform scope tests + if (!$this->zero && $integer == 0) return false; + if (!$this->positive && $integer > 0) return false; + if (!$this->negative && $integer < 0) return false; + + return $integer; + + } + +} + +// vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/AttrDef/Lang.php b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/AttrDef/Lang.php new file mode 100644 index 0000000..10e6da5 --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/AttrDef/Lang.php @@ -0,0 +1,73 @@ + 8 || !ctype_alnum($subtags[1])) { + return $new_string; + } + if (!ctype_lower($subtags[1])) $subtags[1] = strtolower($subtags[1]); + + $new_string .= '-' . $subtags[1]; + if ($num_subtags == 2) return $new_string; + + // process all other subtags, index 2 and up + for ($i = 2; $i < $num_subtags; $i++) { + $length = strlen($subtags[$i]); + if ($length == 0 || $length > 8 || !ctype_alnum($subtags[$i])) { + return $new_string; + } + if (!ctype_lower($subtags[$i])) { + $subtags[$i] = strtolower($subtags[$i]); + } + $new_string .= '-' . $subtags[$i]; + } + + return $new_string; + + } + +} + +// vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/AttrDef/Switch.php b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/AttrDef/Switch.php new file mode 100644 index 0000000..c9e3ed1 --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/AttrDef/Switch.php @@ -0,0 +1,34 @@ +tag = $tag; + $this->withTag = $with_tag; + $this->withoutTag = $without_tag; + } + + public function validate($string, $config, $context) { + $token = $context->get('CurrentToken', true); + if (!$token || $token->name !== $this->tag) { + return $this->withoutTag->validate($string, $config, $context); + } else { + return $this->withTag->validate($string, $config, $context); + } + } + +} + +// vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/AttrDef/Text.php b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/AttrDef/Text.php new file mode 100644 index 0000000..c6216cc --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/AttrDef/Text.php @@ -0,0 +1,15 @@ +parseCDATA($string); + } + +} + +// vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/AttrDef/URI.php b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/AttrDef/URI.php new file mode 100644 index 0000000..01a6d83 --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/AttrDef/URI.php @@ -0,0 +1,77 @@ +parser = new HTMLPurifier_URIParser(); + $this->embedsResource = (bool) $embeds_resource; + } + + public function make($string) { + $embeds = (bool) $string; + return new HTMLPurifier_AttrDef_URI($embeds); + } + + public function validate($uri, $config, $context) { + + if ($config->get('URI.Disable')) return false; + + $uri = $this->parseCDATA($uri); + + // parse the URI + $uri = $this->parser->parse($uri); + if ($uri === false) return false; + + // add embedded flag to context for validators + $context->register('EmbeddedURI', $this->embedsResource); + + $ok = false; + do { + + // generic validation + $result = $uri->validate($config, $context); + if (!$result) break; + + // chained filtering + $uri_def = $config->getDefinition('URI'); + $result = $uri_def->filter($uri, $config, $context); + if (!$result) break; + + // scheme-specific validation + $scheme_obj = $uri->getSchemeObj($config, $context); + if (!$scheme_obj) break; + if ($this->embedsResource && !$scheme_obj->browsable) break; + $result = $scheme_obj->validate($uri, $config, $context); + if (!$result) break; + + // Post chained filtering + $result = $uri_def->postFilter($uri, $config, $context); + if (!$result) break; + + // survived gauntlet + $ok = true; + + } while (false); + + $context->destroy('EmbeddedURI'); + if (!$ok) return false; + + // back to string + return $uri->toString(); + + } + +} + +// vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/AttrDef/URI/Email.php b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/AttrDef/URI/Email.php new file mode 100644 index 0000000..bfee9d1 --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/AttrDef/URI/Email.php @@ -0,0 +1,17 @@ +" + // that needs more percent encoding to be done + if ($string == '') return false; + $string = trim($string); + $result = preg_match('/^[A-Z0-9._%-]+@[A-Z0-9.-]+\.[A-Z]{2,4}$/i', $string); + return $result ? $string : false; + } + +} + +// vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/AttrDef/URI/Host.php b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/AttrDef/URI/Host.php new file mode 100644 index 0000000..feca469 --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/AttrDef/URI/Host.php @@ -0,0 +1,68 @@ +ipv4 = new HTMLPurifier_AttrDef_URI_IPv4(); + $this->ipv6 = new HTMLPurifier_AttrDef_URI_IPv6(); + } + + public function validate($string, $config, $context) { + $length = strlen($string); + // empty hostname is OK; it's usually semantically equivalent: + // the default host as defined by a URI scheme is used: + // + // If the URI scheme defines a default for host, then that + // default applies when the host subcomponent is undefined + // or when the registered name is empty (zero length). + if ($string === '') return ''; + if ($length > 1 && $string[0] === '[' && $string[$length-1] === ']') { + //IPv6 + $ip = substr($string, 1, $length - 2); + $valid = $this->ipv6->validate($ip, $config, $context); + if ($valid === false) return false; + return '['. $valid . ']'; + } + + // need to do checks on unusual encodings too + $ipv4 = $this->ipv4->validate($string, $config, $context); + if ($ipv4 !== false) return $ipv4; + + // A regular domain name. + + // This breaks I18N domain names, but we don't have proper IRI support, + // so force users to insert Punycode. If there's complaining we'll + // try to fix things into an international friendly form. + + // The productions describing this are: + $a = '[a-z]'; // alpha + $an = '[a-z0-9]'; // alphanum + $and = '[a-z0-9-]'; // alphanum | "-" + // domainlabel = alphanum | alphanum *( alphanum | "-" ) alphanum + $domainlabel = "$an($and*$an)?"; + // toplabel = alpha | alpha *( alphanum | "-" ) alphanum + $toplabel = "$a($and*$an)?"; + // hostname = *( domainlabel "." ) toplabel [ "." ] + $match = preg_match("/^($domainlabel\.)*$toplabel\.?$/i", $string); + if (!$match) return false; + + return $string; + } + +} + +// vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/AttrDef/URI/IPv4.php b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/AttrDef/URI/IPv4.php new file mode 100644 index 0000000..ec4cf59 --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/AttrDef/URI/IPv4.php @@ -0,0 +1,39 @@ +ip4) $this->_loadRegex(); + + if (preg_match('#^' . $this->ip4 . '$#s', $aIP)) + { + return $aIP; + } + + return false; + + } + + /** + * Lazy load function to prevent regex from being stuffed in + * cache. + */ + protected function _loadRegex() { + $oct = '(?:25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9][0-9]|[0-9])'; // 0-255 + $this->ip4 = "(?:{$oct}\\.{$oct}\\.{$oct}\\.{$oct})"; + } + +} + +// vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/AttrDef/URI/IPv6.php b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/AttrDef/URI/IPv6.php new file mode 100644 index 0000000..9454e9b --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/AttrDef/URI/IPv6.php @@ -0,0 +1,99 @@ +ip4) $this->_loadRegex(); + + $original = $aIP; + + $hex = '[0-9a-fA-F]'; + $blk = '(?:' . $hex . '{1,4})'; + $pre = '(?:/(?:12[0-8]|1[0-1][0-9]|[1-9][0-9]|[0-9]))'; // /0 - /128 + + // prefix check + if (strpos($aIP, '/') !== false) + { + if (preg_match('#' . $pre . '$#s', $aIP, $find)) + { + $aIP = substr($aIP, 0, 0-strlen($find[0])); + unset($find); + } + else + { + return false; + } + } + + // IPv4-compatiblity check + if (preg_match('#(?<=:'.')' . $this->ip4 . '$#s', $aIP, $find)) + { + $aIP = substr($aIP, 0, 0-strlen($find[0])); + $ip = explode('.', $find[0]); + $ip = array_map('dechex', $ip); + $aIP .= $ip[0] . $ip[1] . ':' . $ip[2] . $ip[3]; + unset($find, $ip); + } + + // compression check + $aIP = explode('::', $aIP); + $c = count($aIP); + if ($c > 2) + { + return false; + } + elseif ($c == 2) + { + list($first, $second) = $aIP; + $first = explode(':', $first); + $second = explode(':', $second); + + if (count($first) + count($second) > 8) + { + return false; + } + + while(count($first) < 8) + { + array_push($first, '0'); + } + + array_splice($first, 8 - count($second), 8, $second); + $aIP = $first; + unset($first,$second); + } + else + { + $aIP = explode(':', $aIP[0]); + } + $c = count($aIP); + + if ($c != 8) + { + return false; + } + + // All the pieces should be 16-bit hex strings. Are they? + foreach ($aIP as $piece) + { + if (!preg_match('#^[0-9a-fA-F]{4}$#s', sprintf('%04s', $piece))) + { + return false; + } + } + + return $original; + + } + +} + +// vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/AttrTransform.php b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/AttrTransform.php new file mode 100644 index 0000000..e61d3e0 --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/AttrTransform.php @@ -0,0 +1,56 @@ +confiscateAttr($attr, 'background'); + // some validation should happen here + + $this->prependCSS($attr, "background-image:url($background);"); + + return $attr; + + } + +} + +// vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/AttrTransform/BdoDir.php b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/AttrTransform/BdoDir.php new file mode 100644 index 0000000..4d1a056 --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/AttrTransform/BdoDir.php @@ -0,0 +1,19 @@ +get('Attr.DefaultTextDir'); + return $attr; + } + +} + +// vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/AttrTransform/BgColor.php b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/AttrTransform/BgColor.php new file mode 100644 index 0000000..ad3916b --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/AttrTransform/BgColor.php @@ -0,0 +1,23 @@ +confiscateAttr($attr, 'bgcolor'); + // some validation should happen here + + $this->prependCSS($attr, "background-color:$bgcolor;"); + + return $attr; + + } + +} + +// vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/AttrTransform/BoolToCSS.php b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/AttrTransform/BoolToCSS.php new file mode 100644 index 0000000..51159b6 --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/AttrTransform/BoolToCSS.php @@ -0,0 +1,36 @@ +attr = $attr; + $this->css = $css; + } + + public function transform($attr, $config, $context) { + if (!isset($attr[$this->attr])) return $attr; + unset($attr[$this->attr]); + $this->prependCSS($attr, $this->css); + return $attr; + } + +} + +// vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/AttrTransform/Border.php b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/AttrTransform/Border.php new file mode 100644 index 0000000..476b0b0 --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/AttrTransform/Border.php @@ -0,0 +1,18 @@ +confiscateAttr($attr, 'border'); + // some validation should happen here + $this->prependCSS($attr, "border:{$border_width}px solid;"); + return $attr; + } + +} + +// vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/AttrTransform/EnumToCSS.php b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/AttrTransform/EnumToCSS.php new file mode 100644 index 0000000..2a5b451 --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/AttrTransform/EnumToCSS.php @@ -0,0 +1,58 @@ +attr = $attr; + $this->enumToCSS = $enum_to_css; + $this->caseSensitive = (bool) $case_sensitive; + } + + public function transform($attr, $config, $context) { + + if (!isset($attr[$this->attr])) return $attr; + + $value = trim($attr[$this->attr]); + unset($attr[$this->attr]); + + if (!$this->caseSensitive) $value = strtolower($value); + + if (!isset($this->enumToCSS[$value])) { + return $attr; + } + + $this->prependCSS($attr, $this->enumToCSS[$value]); + + return $attr; + + } + +} + +// vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/AttrTransform/ImgRequired.php b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/AttrTransform/ImgRequired.php new file mode 100644 index 0000000..7f0e4b7 --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/AttrTransform/ImgRequired.php @@ -0,0 +1,43 @@ +get('Core.RemoveInvalidImg')) return $attr; + $attr['src'] = $config->get('Attr.DefaultInvalidImage'); + $src = false; + } + + if (!isset($attr['alt'])) { + if ($src) { + $alt = $config->get('Attr.DefaultImageAlt'); + if ($alt === null) { + // truncate if the alt is too long + $attr['alt'] = substr(basename($attr['src']),0,40); + } else { + $attr['alt'] = $alt; + } + } else { + $attr['alt'] = $config->get('Attr.DefaultInvalidImageAlt'); + } + } + + return $attr; + + } + +} + +// vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/AttrTransform/ImgSpace.php b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/AttrTransform/ImgSpace.php new file mode 100644 index 0000000..fd84c10 --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/AttrTransform/ImgSpace.php @@ -0,0 +1,44 @@ + array('left', 'right'), + 'vspace' => array('top', 'bottom') + ); + + public function __construct($attr) { + $this->attr = $attr; + if (!isset($this->css[$attr])) { + trigger_error(htmlspecialchars($attr) . ' is not valid space attribute'); + } + } + + public function transform($attr, $config, $context) { + + if (!isset($attr[$this->attr])) return $attr; + + $width = $this->confiscateAttr($attr, $this->attr); + // some validation could happen here + + if (!isset($this->css[$this->attr])) return $attr; + + $style = ''; + foreach ($this->css[$this->attr] as $suffix) { + $property = "margin-$suffix"; + $style .= "$property:{$width}px;"; + } + + $this->prependCSS($attr, $style); + + return $attr; + + } + +} + +// vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/AttrTransform/Input.php b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/AttrTransform/Input.php new file mode 100644 index 0000000..1682955 --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/AttrTransform/Input.php @@ -0,0 +1,40 @@ +pixels = new HTMLPurifier_AttrDef_HTML_Pixels(); + } + + public function transform($attr, $config, $context) { + if (!isset($attr['type'])) $t = 'text'; + else $t = strtolower($attr['type']); + if (isset($attr['checked']) && $t !== 'radio' && $t !== 'checkbox') { + unset($attr['checked']); + } + if (isset($attr['maxlength']) && $t !== 'text' && $t !== 'password') { + unset($attr['maxlength']); + } + if (isset($attr['size']) && $t !== 'text' && $t !== 'password') { + $result = $this->pixels->validate($attr['size'], $config, $context); + if ($result === false) unset($attr['size']); + else $attr['size'] = $result; + } + if (isset($attr['src']) && $t !== 'image') { + unset($attr['src']); + } + if (!isset($attr['value']) && ($t === 'radio' || $t === 'checkbox')) { + $attr['value'] = ''; + } + return $attr; + } + +} + +// vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/AttrTransform/Lang.php b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/AttrTransform/Lang.php new file mode 100644 index 0000000..5869e7f --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/AttrTransform/Lang.php @@ -0,0 +1,28 @@ +name = $name; + $this->cssName = $css_name ? $css_name : $name; + } + + public function transform($attr, $config, $context) { + if (!isset($attr[$this->name])) return $attr; + $length = $this->confiscateAttr($attr, $this->name); + if(ctype_digit($length)) $length .= 'px'; + $this->prependCSS($attr, $this->cssName . ":$length;"); + return $attr; + } + +} + +// vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/AttrTransform/Name.php b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/AttrTransform/Name.php new file mode 100644 index 0000000..15315bc --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/AttrTransform/Name.php @@ -0,0 +1,21 @@ +get('HTML.Attr.Name.UseCDATA')) return $attr; + if (!isset($attr['name'])) return $attr; + $id = $this->confiscateAttr($attr, 'name'); + if ( isset($attr['id'])) return $attr; + $attr['id'] = $id; + return $attr; + } + +} + +// vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/AttrTransform/NameSync.php b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/AttrTransform/NameSync.php new file mode 100644 index 0000000..a95638c --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/AttrTransform/NameSync.php @@ -0,0 +1,27 @@ +idDef = new HTMLPurifier_AttrDef_HTML_ID(); + } + + public function transform($attr, $config, $context) { + if (!isset($attr['name'])) return $attr; + $name = $attr['name']; + if (isset($attr['id']) && $attr['id'] === $name) return $attr; + $result = $this->idDef->validate($name, $config, $context); + if ($result === false) unset($attr['name']); + else $attr['name'] = $result; + return $attr; + } + +} + +// vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/AttrTransform/Nofollow.php b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/AttrTransform/Nofollow.php new file mode 100644 index 0000000..573b42c --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/AttrTransform/Nofollow.php @@ -0,0 +1,41 @@ +parser = new HTMLPurifier_URIParser(); + } + + public function transform($attr, $config, $context) { + + if (!isset($attr['href'])) { + return $attr; + } + + // XXX Kind of inefficient + $url = $this->parser->parse($attr['href']); + $scheme = $url->getSchemeObj($config, $context); + + if (!is_null($url->host) && $scheme !== false && $scheme->browsable) { + if (isset($attr['rel'])) { + $attr['rel'] .= ' nofollow'; + } else { + $attr['rel'] = 'nofollow'; + } + } + + return $attr; + + } + +} + +// vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/AttrTransform/SafeEmbed.php b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/AttrTransform/SafeEmbed.php new file mode 100644 index 0000000..4da4499 --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/AttrTransform/SafeEmbed.php @@ -0,0 +1,15 @@ +uri = new HTMLPurifier_AttrDef_URI(true); // embedded + $this->wmode = new HTMLPurifier_AttrDef_Enum(array('window', 'opaque', 'transparent')); + } + + public function transform($attr, $config, $context) { + // If we add support for other objects, we'll need to alter the + // transforms. + switch ($attr['name']) { + // application/x-shockwave-flash + // Keep this synchronized with Injector/SafeObject.php + case 'allowScriptAccess': + $attr['value'] = 'never'; + break; + case 'allowNetworking': + $attr['value'] = 'internal'; + break; + case 'allowFullScreen': + if ($config->get('HTML.FlashAllowFullScreen')) { + $attr['value'] = ($attr['value'] == 'true') ? 'true' : 'false'; + } else { + $attr['value'] = 'false'; + } + break; + case 'wmode': + $attr['value'] = $this->wmode->validate($attr['value'], $config, $context); + break; + case 'movie': + case 'src': + $attr['name'] = "movie"; + $attr['value'] = $this->uri->validate($attr['value'], $config, $context); + break; + case 'flashvars': + // we're going to allow arbitrary inputs to the SWF, on + // the reasoning that it could only hack the SWF, not us. + break; + // add other cases to support other param name/value pairs + default: + $attr['name'] = $attr['value'] = null; + } + return $attr; + } +} + +// vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/AttrTransform/ScriptRequired.php b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/AttrTransform/ScriptRequired.php new file mode 100644 index 0000000..4499050 --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/AttrTransform/ScriptRequired.php @@ -0,0 +1,16 @@ + + */ +class HTMLPurifier_AttrTransform_ScriptRequired extends HTMLPurifier_AttrTransform +{ + public function transform($attr, $config, $context) { + if (!isset($attr['type'])) { + $attr['type'] = 'text/javascript'; + } + return $attr; + } +} + +// vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/AttrTransform/Textarea.php b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/AttrTransform/Textarea.php new file mode 100644 index 0000000..81ac348 --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/AttrTransform/Textarea.php @@ -0,0 +1,18 @@ + + */ +class HTMLPurifier_AttrTransform_Textarea extends HTMLPurifier_AttrTransform +{ + + public function transform($attr, $config, $context) { + // Calculated from Firefox + if (!isset($attr['cols'])) $attr['cols'] = '22'; + if (!isset($attr['rows'])) $attr['rows'] = '3'; + return $attr; + } + +} + +// vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/AttrTypes.php b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/AttrTypes.php new file mode 100644 index 0000000..fc2ea4e --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/AttrTypes.php @@ -0,0 +1,77 @@ +info['Enum'] = new HTMLPurifier_AttrDef_Enum(); + $this->info['Bool'] = new HTMLPurifier_AttrDef_HTML_Bool(); + + $this->info['CDATA'] = new HTMLPurifier_AttrDef_Text(); + $this->info['ID'] = new HTMLPurifier_AttrDef_HTML_ID(); + $this->info['Length'] = new HTMLPurifier_AttrDef_HTML_Length(); + $this->info['MultiLength'] = new HTMLPurifier_AttrDef_HTML_MultiLength(); + $this->info['NMTOKENS'] = new HTMLPurifier_AttrDef_HTML_Nmtokens(); + $this->info['Pixels'] = new HTMLPurifier_AttrDef_HTML_Pixels(); + $this->info['Text'] = new HTMLPurifier_AttrDef_Text(); + $this->info['URI'] = new HTMLPurifier_AttrDef_URI(); + $this->info['LanguageCode'] = new HTMLPurifier_AttrDef_Lang(); + $this->info['Color'] = new HTMLPurifier_AttrDef_HTML_Color(); + + // unimplemented aliases + $this->info['ContentType'] = new HTMLPurifier_AttrDef_Text(); + $this->info['ContentTypes'] = new HTMLPurifier_AttrDef_Text(); + $this->info['Charsets'] = new HTMLPurifier_AttrDef_Text(); + $this->info['Character'] = new HTMLPurifier_AttrDef_Text(); + + // "proprietary" types + $this->info['Class'] = new HTMLPurifier_AttrDef_HTML_Class(); + + // number is really a positive integer (one or more digits) + // FIXME: ^^ not always, see start and value of list items + $this->info['Number'] = new HTMLPurifier_AttrDef_Integer(false, false, true); + } + + /** + * Retrieves a type + * @param $type String type name + * @return Object AttrDef for type + */ + public function get($type) { + + // determine if there is any extra info tacked on + if (strpos($type, '#') !== false) list($type, $string) = explode('#', $type, 2); + else $string = ''; + + if (!isset($this->info[$type])) { + trigger_error('Cannot retrieve undefined attribute type ' . $type, E_USER_ERROR); + return; + } + + return $this->info[$type]->make($string); + + } + + /** + * Sets a new implementation for a type + * @param $type String type name + * @param $impl Object AttrDef for type + */ + public function set($type, $impl) { + $this->info[$type] = $impl; + } +} + +// vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/AttrValidator.php b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/AttrValidator.php new file mode 100644 index 0000000..829a0f8 --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/AttrValidator.php @@ -0,0 +1,162 @@ +getHTMLDefinition(); + $e =& $context->get('ErrorCollector', true); + + // initialize IDAccumulator if necessary + $ok =& $context->get('IDAccumulator', true); + if (!$ok) { + $id_accumulator = HTMLPurifier_IDAccumulator::build($config, $context); + $context->register('IDAccumulator', $id_accumulator); + } + + // initialize CurrentToken if necessary + $current_token =& $context->get('CurrentToken', true); + if (!$current_token) $context->register('CurrentToken', $token); + + if ( + !$token instanceof HTMLPurifier_Token_Start && + !$token instanceof HTMLPurifier_Token_Empty + ) return $token; + + // create alias to global definition array, see also $defs + // DEFINITION CALL + $d_defs = $definition->info_global_attr; + + // don't update token until the very end, to ensure an atomic update + $attr = $token->attr; + + // do global transformations (pre) + // nothing currently utilizes this + foreach ($definition->info_attr_transform_pre as $transform) { + $attr = $transform->transform($o = $attr, $config, $context); + if ($e) { + if ($attr != $o) $e->send(E_NOTICE, 'AttrValidator: Attributes transformed', $o, $attr); + } + } + + // do local transformations only applicable to this element (pre) + // ex.

to

+ foreach ($definition->info[$token->name]->attr_transform_pre as $transform) { + $attr = $transform->transform($o = $attr, $config, $context); + if ($e) { + if ($attr != $o) $e->send(E_NOTICE, 'AttrValidator: Attributes transformed', $o, $attr); + } + } + + // create alias to this element's attribute definition array, see + // also $d_defs (global attribute definition array) + // DEFINITION CALL + $defs = $definition->info[$token->name]->attr; + + $attr_key = false; + $context->register('CurrentAttr', $attr_key); + + // iterate through all the attribute keypairs + // Watch out for name collisions: $key has previously been used + foreach ($attr as $attr_key => $value) { + + // call the definition + if ( isset($defs[$attr_key]) ) { + // there is a local definition defined + if ($defs[$attr_key] === false) { + // We've explicitly been told not to allow this element. + // This is usually when there's a global definition + // that must be overridden. + // Theoretically speaking, we could have a + // AttrDef_DenyAll, but this is faster! + $result = false; + } else { + // validate according to the element's definition + $result = $defs[$attr_key]->validate( + $value, $config, $context + ); + } + } elseif ( isset($d_defs[$attr_key]) ) { + // there is a global definition defined, validate according + // to the global definition + $result = $d_defs[$attr_key]->validate( + $value, $config, $context + ); + } else { + // system never heard of the attribute? DELETE! + $result = false; + } + + // put the results into effect + if ($result === false || $result === null) { + // this is a generic error message that should replaced + // with more specific ones when possible + if ($e) $e->send(E_ERROR, 'AttrValidator: Attribute removed'); + + // remove the attribute + unset($attr[$attr_key]); + } elseif (is_string($result)) { + // generally, if a substitution is happening, there + // was some sort of implicit correction going on. We'll + // delegate it to the attribute classes to say exactly what. + + // simple substitution + $attr[$attr_key] = $result; + } else { + // nothing happens + } + + // we'd also want slightly more complicated substitution + // involving an array as the return value, + // although we're not sure how colliding attributes would + // resolve (certain ones would be completely overriden, + // others would prepend themselves). + } + + $context->destroy('CurrentAttr'); + + // post transforms + + // global (error reporting untested) + foreach ($definition->info_attr_transform_post as $transform) { + $attr = $transform->transform($o = $attr, $config, $context); + if ($e) { + if ($attr != $o) $e->send(E_NOTICE, 'AttrValidator: Attributes transformed', $o, $attr); + } + } + + // local (error reporting untested) + foreach ($definition->info[$token->name]->attr_transform_post as $transform) { + $attr = $transform->transform($o = $attr, $config, $context); + if ($e) { + if ($attr != $o) $e->send(E_NOTICE, 'AttrValidator: Attributes transformed', $o, $attr); + } + } + + $token->attr = $attr; + + // destroy CurrentToken if we made it ourselves + if (!$current_token) $context->destroy('CurrentToken'); + + } + + +} + +// vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/Bootstrap.php b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/Bootstrap.php new file mode 100644 index 0000000..607c5b1 --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/Bootstrap.php @@ -0,0 +1,104 @@ + +if (!defined('PHP_EOL')) { + switch (strtoupper(substr(PHP_OS, 0, 3))) { + case 'WIN': + define('PHP_EOL', "\r\n"); + break; + case 'DAR': + define('PHP_EOL', "\r"); + break; + default: + define('PHP_EOL', "\n"); + } +} + +/** + * Bootstrap class that contains meta-functionality for HTML Purifier such as + * the autoload function. + * + * @note + * This class may be used without any other files from HTML Purifier. + */ +class HTMLPurifier_Bootstrap +{ + + /** + * Autoload function for HTML Purifier + * @param $class Class to load + */ + public static function autoload($class) { + $file = HTMLPurifier_Bootstrap::getPath($class); + if (!$file) return false; + // Technically speaking, it should be ok and more efficient to + // just do 'require', but Antonio Parraga reports that with + // Zend extensions such as Zend debugger and APC, this invariant + // may be broken. Since we have efficient alternatives, pay + // the cost here and avoid the bug. + require_once HTMLPURIFIER_PREFIX . '/' . $file; + return true; + } + + /** + * Returns the path for a specific class. + */ + public static function getPath($class) { + if (strncmp('HTMLPurifier', $class, 12) !== 0) return false; + // Custom implementations + if (strncmp('HTMLPurifier_Language_', $class, 22) === 0) { + $code = str_replace('_', '-', substr($class, 22)); + $file = 'HTMLPurifier/Language/classes/' . $code . '.php'; + } else { + $file = str_replace('_', '/', $class) . '.php'; + } + if (!file_exists(HTMLPURIFIER_PREFIX . '/' . $file)) return false; + return $file; + } + + /** + * "Pre-registers" our autoloader on the SPL stack. + */ + public static function registerAutoload() { + $autoload = array('HTMLPurifier_Bootstrap', 'autoload'); + if ( ($funcs = spl_autoload_functions()) === false ) { + spl_autoload_register($autoload); + } elseif (function_exists('spl_autoload_unregister')) { + $buggy = version_compare(PHP_VERSION, '5.2.11', '<'); + $compat = version_compare(PHP_VERSION, '5.1.2', '<=') && + version_compare(PHP_VERSION, '5.1.0', '>='); + foreach ($funcs as $func) { + if ($buggy && is_array($func)) { + // :TRICKY: There are some compatibility issues and some + // places where we need to error out + $reflector = new ReflectionMethod($func[0], $func[1]); + if (!$reflector->isStatic()) { + throw new Exception(' + HTML Purifier autoloader registrar is not compatible + with non-static object methods due to PHP Bug #44144; + Please do not use HTMLPurifier.autoload.php (or any + file that includes this file); instead, place the code: + spl_autoload_register(array(\'HTMLPurifier_Bootstrap\', \'autoload\')) + after your own autoloaders. + '); + } + // Suprisingly, spl_autoload_register supports the + // Class::staticMethod callback format, although call_user_func doesn't + if ($compat) $func = implode('::', $func); + } + spl_autoload_unregister($func); + } + spl_autoload_register($autoload); + foreach ($funcs as $func) spl_autoload_register($func); + } + } + +} + +// vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/CSSDefinition.php b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/CSSDefinition.php new file mode 100644 index 0000000..91619f5 --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/CSSDefinition.php @@ -0,0 +1,322 @@ +info['text-align'] = new HTMLPurifier_AttrDef_Enum( + array('left', 'right', 'center', 'justify'), false); + + $border_style = + $this->info['border-bottom-style'] = + $this->info['border-right-style'] = + $this->info['border-left-style'] = + $this->info['border-top-style'] = new HTMLPurifier_AttrDef_Enum( + array('none', 'hidden', 'dotted', 'dashed', 'solid', 'double', + 'groove', 'ridge', 'inset', 'outset'), false); + + $this->info['border-style'] = new HTMLPurifier_AttrDef_CSS_Multiple($border_style); + + $this->info['clear'] = new HTMLPurifier_AttrDef_Enum( + array('none', 'left', 'right', 'both'), false); + $this->info['float'] = new HTMLPurifier_AttrDef_Enum( + array('none', 'left', 'right'), false); + $this->info['font-style'] = new HTMLPurifier_AttrDef_Enum( + array('normal', 'italic', 'oblique'), false); + $this->info['font-variant'] = new HTMLPurifier_AttrDef_Enum( + array('normal', 'small-caps'), false); + + $uri_or_none = new HTMLPurifier_AttrDef_CSS_Composite( + array( + new HTMLPurifier_AttrDef_Enum(array('none')), + new HTMLPurifier_AttrDef_CSS_URI() + ) + ); + + $this->info['list-style-position'] = new HTMLPurifier_AttrDef_Enum( + array('inside', 'outside'), false); + $this->info['list-style-type'] = new HTMLPurifier_AttrDef_Enum( + array('disc', 'circle', 'square', 'decimal', 'lower-roman', + 'upper-roman', 'lower-alpha', 'upper-alpha', 'none'), false); + $this->info['list-style-image'] = $uri_or_none; + + $this->info['list-style'] = new HTMLPurifier_AttrDef_CSS_ListStyle($config); + + $this->info['text-transform'] = new HTMLPurifier_AttrDef_Enum( + array('capitalize', 'uppercase', 'lowercase', 'none'), false); + $this->info['color'] = new HTMLPurifier_AttrDef_CSS_Color(); + + $this->info['background-image'] = $uri_or_none; + $this->info['background-repeat'] = new HTMLPurifier_AttrDef_Enum( + array('repeat', 'repeat-x', 'repeat-y', 'no-repeat') + ); + $this->info['background-attachment'] = new HTMLPurifier_AttrDef_Enum( + array('scroll', 'fixed') + ); + $this->info['background-position'] = new HTMLPurifier_AttrDef_CSS_BackgroundPosition(); + + $border_color = + $this->info['border-top-color'] = + $this->info['border-bottom-color'] = + $this->info['border-left-color'] = + $this->info['border-right-color'] = + $this->info['background-color'] = new HTMLPurifier_AttrDef_CSS_Composite(array( + new HTMLPurifier_AttrDef_Enum(array('transparent')), + new HTMLPurifier_AttrDef_CSS_Color() + )); + + $this->info['background'] = new HTMLPurifier_AttrDef_CSS_Background($config); + + $this->info['border-color'] = new HTMLPurifier_AttrDef_CSS_Multiple($border_color); + + $border_width = + $this->info['border-top-width'] = + $this->info['border-bottom-width'] = + $this->info['border-left-width'] = + $this->info['border-right-width'] = new HTMLPurifier_AttrDef_CSS_Composite(array( + new HTMLPurifier_AttrDef_Enum(array('thin', 'medium', 'thick')), + new HTMLPurifier_AttrDef_CSS_Length('0') //disallow negative + )); + + $this->info['border-width'] = new HTMLPurifier_AttrDef_CSS_Multiple($border_width); + + $this->info['letter-spacing'] = new HTMLPurifier_AttrDef_CSS_Composite(array( + new HTMLPurifier_AttrDef_Enum(array('normal')), + new HTMLPurifier_AttrDef_CSS_Length() + )); + + $this->info['word-spacing'] = new HTMLPurifier_AttrDef_CSS_Composite(array( + new HTMLPurifier_AttrDef_Enum(array('normal')), + new HTMLPurifier_AttrDef_CSS_Length() + )); + + $this->info['font-size'] = new HTMLPurifier_AttrDef_CSS_Composite(array( + new HTMLPurifier_AttrDef_Enum(array('xx-small', 'x-small', + 'small', 'medium', 'large', 'x-large', 'xx-large', + 'larger', 'smaller')), + new HTMLPurifier_AttrDef_CSS_Percentage(), + new HTMLPurifier_AttrDef_CSS_Length() + )); + + $this->info['line-height'] = new HTMLPurifier_AttrDef_CSS_Composite(array( + new HTMLPurifier_AttrDef_Enum(array('normal')), + new HTMLPurifier_AttrDef_CSS_Number(true), // no negatives + new HTMLPurifier_AttrDef_CSS_Length('0'), + new HTMLPurifier_AttrDef_CSS_Percentage(true) + )); + + $margin = + $this->info['margin-top'] = + $this->info['margin-bottom'] = + $this->info['margin-left'] = + $this->info['margin-right'] = new HTMLPurifier_AttrDef_CSS_Composite(array( + new HTMLPurifier_AttrDef_CSS_Length(), + new HTMLPurifier_AttrDef_CSS_Percentage(), + new HTMLPurifier_AttrDef_Enum(array('auto')) + )); + + $this->info['margin'] = new HTMLPurifier_AttrDef_CSS_Multiple($margin); + + // non-negative + $padding = + $this->info['padding-top'] = + $this->info['padding-bottom'] = + $this->info['padding-left'] = + $this->info['padding-right'] = new HTMLPurifier_AttrDef_CSS_Composite(array( + new HTMLPurifier_AttrDef_CSS_Length('0'), + new HTMLPurifier_AttrDef_CSS_Percentage(true) + )); + + $this->info['padding'] = new HTMLPurifier_AttrDef_CSS_Multiple($padding); + + $this->info['text-indent'] = new HTMLPurifier_AttrDef_CSS_Composite(array( + new HTMLPurifier_AttrDef_CSS_Length(), + new HTMLPurifier_AttrDef_CSS_Percentage() + )); + + $trusted_wh = new HTMLPurifier_AttrDef_CSS_Composite(array( + new HTMLPurifier_AttrDef_CSS_Length('0'), + new HTMLPurifier_AttrDef_CSS_Percentage(true), + new HTMLPurifier_AttrDef_Enum(array('auto')) + )); + $max = $config->get('CSS.MaxImgLength'); + + $this->info['width'] = + $this->info['height'] = + $max === null ? + $trusted_wh : + new HTMLPurifier_AttrDef_Switch('img', + // For img tags: + new HTMLPurifier_AttrDef_CSS_Composite(array( + new HTMLPurifier_AttrDef_CSS_Length('0', $max), + new HTMLPurifier_AttrDef_Enum(array('auto')) + )), + // For everyone else: + $trusted_wh + ); + + $this->info['text-decoration'] = new HTMLPurifier_AttrDef_CSS_TextDecoration(); + + $this->info['font-family'] = new HTMLPurifier_AttrDef_CSS_FontFamily(); + + // this could use specialized code + $this->info['font-weight'] = new HTMLPurifier_AttrDef_Enum( + array('normal', 'bold', 'bolder', 'lighter', '100', '200', '300', + '400', '500', '600', '700', '800', '900'), false); + + // MUST be called after other font properties, as it references + // a CSSDefinition object + $this->info['font'] = new HTMLPurifier_AttrDef_CSS_Font($config); + + // same here + $this->info['border'] = + $this->info['border-bottom'] = + $this->info['border-top'] = + $this->info['border-left'] = + $this->info['border-right'] = new HTMLPurifier_AttrDef_CSS_Border($config); + + $this->info['border-collapse'] = new HTMLPurifier_AttrDef_Enum(array( + 'collapse', 'separate')); + + $this->info['caption-side'] = new HTMLPurifier_AttrDef_Enum(array( + 'top', 'bottom')); + + $this->info['table-layout'] = new HTMLPurifier_AttrDef_Enum(array( + 'auto', 'fixed')); + + $this->info['vertical-align'] = new HTMLPurifier_AttrDef_CSS_Composite(array( + new HTMLPurifier_AttrDef_Enum(array('baseline', 'sub', 'super', + 'top', 'text-top', 'middle', 'bottom', 'text-bottom')), + new HTMLPurifier_AttrDef_CSS_Length(), + new HTMLPurifier_AttrDef_CSS_Percentage() + )); + + $this->info['border-spacing'] = new HTMLPurifier_AttrDef_CSS_Multiple(new HTMLPurifier_AttrDef_CSS_Length(), 2); + + // partial support + $this->info['white-space'] = new HTMLPurifier_AttrDef_Enum(array('nowrap')); + + if ($config->get('CSS.Proprietary')) { + $this->doSetupProprietary($config); + } + + if ($config->get('CSS.AllowTricky')) { + $this->doSetupTricky($config); + } + + if ($config->get('CSS.Trusted')) { + $this->doSetupTrusted($config); + } + + $allow_important = $config->get('CSS.AllowImportant'); + // wrap all attr-defs with decorator that handles !important + foreach ($this->info as $k => $v) { + $this->info[$k] = new HTMLPurifier_AttrDef_CSS_ImportantDecorator($v, $allow_important); + } + + $this->setupConfigStuff($config); + } + + protected function doSetupProprietary($config) { + // Internet Explorer only scrollbar colors + $this->info['scrollbar-arrow-color'] = new HTMLPurifier_AttrDef_CSS_Color(); + $this->info['scrollbar-base-color'] = new HTMLPurifier_AttrDef_CSS_Color(); + $this->info['scrollbar-darkshadow-color'] = new HTMLPurifier_AttrDef_CSS_Color(); + $this->info['scrollbar-face-color'] = new HTMLPurifier_AttrDef_CSS_Color(); + $this->info['scrollbar-highlight-color'] = new HTMLPurifier_AttrDef_CSS_Color(); + $this->info['scrollbar-shadow-color'] = new HTMLPurifier_AttrDef_CSS_Color(); + + // technically not proprietary, but CSS3, and no one supports it + $this->info['opacity'] = new HTMLPurifier_AttrDef_CSS_AlphaValue(); + $this->info['-moz-opacity'] = new HTMLPurifier_AttrDef_CSS_AlphaValue(); + $this->info['-khtml-opacity'] = new HTMLPurifier_AttrDef_CSS_AlphaValue(); + + // only opacity, for now + $this->info['filter'] = new HTMLPurifier_AttrDef_CSS_Filter(); + + } + + protected function doSetupTricky($config) { + $this->info['display'] = new HTMLPurifier_AttrDef_Enum(array( + 'inline', 'block', 'list-item', 'run-in', 'compact', + 'marker', 'table', 'inline-table', 'table-row-group', + 'table-header-group', 'table-footer-group', 'table-row', + 'table-column-group', 'table-column', 'table-cell', 'table-caption', 'none' + )); + $this->info['visibility'] = new HTMLPurifier_AttrDef_Enum(array( + 'visible', 'hidden', 'collapse' + )); + $this->info['overflow'] = new HTMLPurifier_AttrDef_Enum(array('visible', 'hidden', 'auto', 'scroll')); + } + + protected function doSetupTrusted($config) { + $this->info['position'] = new HTMLPurifier_AttrDef_Enum(array( + 'static', 'relative', 'absolute', 'fixed' + )); + $this->info['top'] = + $this->info['left'] = + $this->info['right'] = + $this->info['bottom'] = new HTMLPurifier_AttrDef_CSS_Composite(array( + new HTMLPurifier_AttrDef_CSS_Length(), + new HTMLPurifier_AttrDef_CSS_Percentage(), + new HTMLPurifier_AttrDef_Enum(array('auto')), + )); + $this->info['z-index'] = new HTMLPurifier_AttrDef_CSS_Composite(array( + new HTMLPurifier_AttrDef_Integer(), + new HTMLPurifier_AttrDef_Enum(array('auto')), + )); + } + + /** + * Performs extra config-based processing. Based off of + * HTMLPurifier_HTMLDefinition. + * @todo Refactor duplicate elements into common class (probably using + * composition, not inheritance). + */ + protected function setupConfigStuff($config) { + + // setup allowed elements + $support = "(for information on implementing this, see the ". + "support forums) "; + $allowed_properties = $config->get('CSS.AllowedProperties'); + if ($allowed_properties !== null) { + foreach ($this->info as $name => $d) { + if(!isset($allowed_properties[$name])) unset($this->info[$name]); + unset($allowed_properties[$name]); + } + // emit errors + foreach ($allowed_properties as $name => $d) { + // :TODO: Is this htmlspecialchars() call really necessary? + $name = htmlspecialchars($name); + trigger_error("Style attribute '$name' is not supported $support", E_USER_WARNING); + } + } + + $forbidden_properties = $config->get('CSS.ForbiddenProperties'); + if ($forbidden_properties !== null) { + foreach ($this->info as $name => $d) { + if (isset($forbidden_properties[$name])) { + unset($this->info[$name]); + } + } + } + + } +} + +// vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ChildDef.php b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ChildDef.php new file mode 100644 index 0000000..c5d5216 --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ChildDef.php @@ -0,0 +1,48 @@ +elements; + } + + /** + * Validates nodes according to definition and returns modification. + * + * @param $tokens_of_children Array of HTMLPurifier_Token + * @param $config HTMLPurifier_Config object + * @param $context HTMLPurifier_Context object + * @return bool true to leave nodes as is + * @return bool false to remove parent node + * @return array of replacement child tokens + */ + abstract public function validateChildren($tokens_of_children, $config, $context); +} + +// vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ChildDef/Chameleon.php b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ChildDef/Chameleon.php new file mode 100644 index 0000000..15c364e --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ChildDef/Chameleon.php @@ -0,0 +1,48 @@ +inline = new HTMLPurifier_ChildDef_Optional($inline); + $this->block = new HTMLPurifier_ChildDef_Optional($block); + $this->elements = $this->block->elements; + } + + public function validateChildren($tokens_of_children, $config, $context) { + if ($context->get('IsInline') === false) { + return $this->block->validateChildren( + $tokens_of_children, $config, $context); + } else { + return $this->inline->validateChildren( + $tokens_of_children, $config, $context); + } + } +} + +// vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ChildDef/Custom.php b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ChildDef/Custom.php new file mode 100644 index 0000000..b68047b --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ChildDef/Custom.php @@ -0,0 +1,90 @@ +dtd_regex = $dtd_regex; + $this->_compileRegex(); + } + /** + * Compiles the PCRE regex from a DTD regex ($dtd_regex to $_pcre_regex) + */ + protected function _compileRegex() { + $raw = str_replace(' ', '', $this->dtd_regex); + if ($raw{0} != '(') { + $raw = "($raw)"; + } + $el = '[#a-zA-Z0-9_.-]+'; + $reg = $raw; + + // COMPLICATED! AND MIGHT BE BUGGY! I HAVE NO CLUE WHAT I'M + // DOING! Seriously: if there's problems, please report them. + + // collect all elements into the $elements array + preg_match_all("/$el/", $reg, $matches); + foreach ($matches[0] as $match) { + $this->elements[$match] = true; + } + + // setup all elements as parentheticals with leading commas + $reg = preg_replace("/$el/", '(,\\0)', $reg); + + // remove commas when they were not solicited + $reg = preg_replace("/([^,(|]\(+),/", '\\1', $reg); + + // remove all non-paranthetical commas: they are handled by first regex + $reg = preg_replace("/,\(/", '(', $reg); + + $this->_pcre_regex = $reg; + } + public function validateChildren($tokens_of_children, $config, $context) { + $list_of_children = ''; + $nesting = 0; // depth into the nest + foreach ($tokens_of_children as $token) { + if (!empty($token->is_whitespace)) continue; + + $is_child = ($nesting == 0); // direct + + if ($token instanceof HTMLPurifier_Token_Start) { + $nesting++; + } elseif ($token instanceof HTMLPurifier_Token_End) { + $nesting--; + } + + if ($is_child) { + $list_of_children .= $token->name . ','; + } + } + // add leading comma to deal with stray comma declarations + $list_of_children = ',' . rtrim($list_of_children, ','); + $okay = + preg_match( + '/^,?'.$this->_pcre_regex.'$/', + $list_of_children + ); + + return (bool) $okay; + } +} + +// vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ChildDef/Empty.php b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ChildDef/Empty.php new file mode 100644 index 0000000..13171f6 --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ChildDef/Empty.php @@ -0,0 +1,20 @@ +whitespace) return $tokens_of_children; + else return array(); + } + return $result; + } +} + +// vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ChildDef/Required.php b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ChildDef/Required.php new file mode 100644 index 0000000..4889f24 --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ChildDef/Required.php @@ -0,0 +1,117 @@ + $x) { + $elements[$i] = true; + if (empty($i)) unset($elements[$i]); // remove blank + } + } + $this->elements = $elements; + } + public $allow_empty = false; + public $type = 'required'; + public function validateChildren($tokens_of_children, $config, $context) { + // Flag for subclasses + $this->whitespace = false; + + // if there are no tokens, delete parent node + if (empty($tokens_of_children)) return false; + + // the new set of children + $result = array(); + + // current depth into the nest + $nesting = 0; + + // whether or not we're deleting a node + $is_deleting = false; + + // whether or not parsed character data is allowed + // this controls whether or not we silently drop a tag + // or generate escaped HTML from it + $pcdata_allowed = isset($this->elements['#PCDATA']); + + // a little sanity check to make sure it's not ALL whitespace + $all_whitespace = true; + + // some configuration + $escape_invalid_children = $config->get('Core.EscapeInvalidChildren'); + + // generator + $gen = new HTMLPurifier_Generator($config, $context); + + foreach ($tokens_of_children as $token) { + if (!empty($token->is_whitespace)) { + $result[] = $token; + continue; + } + $all_whitespace = false; // phew, we're not talking about whitespace + + $is_child = ($nesting == 0); + + if ($token instanceof HTMLPurifier_Token_Start) { + $nesting++; + } elseif ($token instanceof HTMLPurifier_Token_End) { + $nesting--; + } + + if ($is_child) { + $is_deleting = false; + if (!isset($this->elements[$token->name])) { + $is_deleting = true; + if ($pcdata_allowed && $token instanceof HTMLPurifier_Token_Text) { + $result[] = $token; + } elseif ($pcdata_allowed && $escape_invalid_children) { + $result[] = new HTMLPurifier_Token_Text( + $gen->generateFromToken($token) + ); + } + continue; + } + } + if (!$is_deleting || ($pcdata_allowed && $token instanceof HTMLPurifier_Token_Text)) { + $result[] = $token; + } elseif ($pcdata_allowed && $escape_invalid_children) { + $result[] = + new HTMLPurifier_Token_Text( + $gen->generateFromToken($token) + ); + } else { + // drop silently + } + } + if (empty($result)) return false; + if ($all_whitespace) { + $this->whitespace = true; + return false; + } + if ($tokens_of_children == $result) return true; + return $result; + } +} + +// vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ChildDef/StrictBlockquote.php b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ChildDef/StrictBlockquote.php new file mode 100644 index 0000000..dfae8a6 --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ChildDef/StrictBlockquote.php @@ -0,0 +1,88 @@ +init($config); + return $this->fake_elements; + } + + public function validateChildren($tokens_of_children, $config, $context) { + + $this->init($config); + + // trick the parent class into thinking it allows more + $this->elements = $this->fake_elements; + $result = parent::validateChildren($tokens_of_children, $config, $context); + $this->elements = $this->real_elements; + + if ($result === false) return array(); + if ($result === true) $result = $tokens_of_children; + + $def = $config->getHTMLDefinition(); + $block_wrap_start = new HTMLPurifier_Token_Start($def->info_block_wrapper); + $block_wrap_end = new HTMLPurifier_Token_End( $def->info_block_wrapper); + $is_inline = false; + $depth = 0; + $ret = array(); + + // assuming that there are no comment tokens + foreach ($result as $i => $token) { + $token = $result[$i]; + // ifs are nested for readability + if (!$is_inline) { + if (!$depth) { + if ( + ($token instanceof HTMLPurifier_Token_Text && !$token->is_whitespace) || + (!$token instanceof HTMLPurifier_Token_Text && !isset($this->elements[$token->name])) + ) { + $is_inline = true; + $ret[] = $block_wrap_start; + } + } + } else { + if (!$depth) { + // starting tokens have been inline text / empty + if ($token instanceof HTMLPurifier_Token_Start || $token instanceof HTMLPurifier_Token_Empty) { + if (isset($this->elements[$token->name])) { + // ended + $ret[] = $block_wrap_end; + $is_inline = false; + } + } + } + } + $ret[] = $token; + if ($token instanceof HTMLPurifier_Token_Start) $depth++; + if ($token instanceof HTMLPurifier_Token_End) $depth--; + } + if ($is_inline) $ret[] = $block_wrap_end; + return $ret; + } + + private function init($config) { + if (!$this->init) { + $def = $config->getHTMLDefinition(); + // allow all inline elements + $this->real_elements = $this->elements; + $this->fake_elements = $def->info_content_sets['Flow']; + $this->fake_elements['#PCDATA'] = true; + $this->init = true; + } + } +} + +// vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ChildDef/Table.php b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ChildDef/Table.php new file mode 100644 index 0000000..34f0227 --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ChildDef/Table.php @@ -0,0 +1,142 @@ + true, 'tbody' => true, 'thead' => true, + 'tfoot' => true, 'caption' => true, 'colgroup' => true, 'col' => true); + public function __construct() {} + public function validateChildren($tokens_of_children, $config, $context) { + if (empty($tokens_of_children)) return false; + + // this ensures that the loop gets run one last time before closing + // up. It's a little bit of a hack, but it works! Just make sure you + // get rid of the token later. + $tokens_of_children[] = false; + + // only one of these elements is allowed in a table + $caption = false; + $thead = false; + $tfoot = false; + + // as many of these as you want + $cols = array(); + $content = array(); + + $nesting = 0; // current depth so we can determine nodes + $is_collecting = false; // are we globbing together tokens to package + // into one of the collectors? + $collection = array(); // collected nodes + $tag_index = 0; // the first node might be whitespace, + // so this tells us where the start tag is + + foreach ($tokens_of_children as $token) { + $is_child = ($nesting == 0); + + if ($token === false) { + // terminating sequence started + } elseif ($token instanceof HTMLPurifier_Token_Start) { + $nesting++; + } elseif ($token instanceof HTMLPurifier_Token_End) { + $nesting--; + } + + // handle node collection + if ($is_collecting) { + if ($is_child) { + // okay, let's stash the tokens away + // first token tells us the type of the collection + switch ($collection[$tag_index]->name) { + case 'tr': + case 'tbody': + $content[] = $collection; + break; + case 'caption': + if ($caption !== false) break; + $caption = $collection; + break; + case 'thead': + case 'tfoot': + // access the appropriate variable, $thead or $tfoot + $var = $collection[$tag_index]->name; + if ($$var === false) { + $$var = $collection; + } else { + // transmutate the first and less entries into + // tbody tags, and then put into content + $collection[$tag_index]->name = 'tbody'; + $collection[count($collection)-1]->name = 'tbody'; + $content[] = $collection; + } + break; + case 'colgroup': + $cols[] = $collection; + break; + } + $collection = array(); + $is_collecting = false; + $tag_index = 0; + } else { + // add the node to the collection + $collection[] = $token; + } + } + + // terminate + if ($token === false) break; + + if ($is_child) { + // determine what we're dealing with + if ($token->name == 'col') { + // the only empty tag in the possie, we can handle it + // immediately + $cols[] = array_merge($collection, array($token)); + $collection = array(); + $tag_index = 0; + continue; + } + switch($token->name) { + case 'caption': + case 'colgroup': + case 'thead': + case 'tfoot': + case 'tbody': + case 'tr': + $is_collecting = true; + $collection[] = $token; + continue; + default: + if (!empty($token->is_whitespace)) { + $collection[] = $token; + $tag_index++; + } + continue; + } + } + } + + if (empty($content)) return false; + + $ret = array(); + if ($caption !== false) $ret = array_merge($ret, $caption); + if ($cols !== false) foreach ($cols as $token_array) $ret = array_merge($ret, $token_array); + if ($thead !== false) $ret = array_merge($ret, $thead); + if ($tfoot !== false) $ret = array_merge($ret, $tfoot); + foreach ($content as $token_array) $ret = array_merge($ret, $token_array); + if (!empty($collection) && $is_collecting == false){ + // grab the trailing space + $ret = array_merge($ret, $collection); + } + + array_pop($tokens_of_children); // remove phantom token + + return ($ret === $tokens_of_children) ? true : $ret; + + } +} + +// vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/Config.php b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/Config.php new file mode 100644 index 0000000..c6f2cea --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/Config.php @@ -0,0 +1,746 @@ +defaultPlist; + $this->plist = new HTMLPurifier_PropertyList($parent); + $this->def = $definition; // keep a copy around for checking + $this->parser = new HTMLPurifier_VarParser_Flexible(); + } + + /** + * Convenience constructor that creates a config object based on a mixed var + * @param mixed $config Variable that defines the state of the config + * object. Can be: a HTMLPurifier_Config() object, + * an array of directives based on loadArray(), + * or a string filename of an ini file. + * @param HTMLPurifier_ConfigSchema Schema object + * @return Configured HTMLPurifier_Config object + */ + public static function create($config, $schema = null) + { + if ($config instanceof HTMLPurifier_Config) { + // pass-through + return $config; + } + if (!$schema) { + $ret = HTMLPurifier_Config::createDefault(); + } else { + $ret = new HTMLPurifier_Config($schema); + } + if (is_string($config)) $ret->loadIni($config); + elseif (is_array($config)) $ret->loadArray($config); + return $ret; + } + + /** + * Creates a new config object that inherits from a previous one. + * @param HTMLPurifier_Config $config Configuration object to inherit + * from. + * @return HTMLPurifier_Config object with $config as its parent. + */ + public static function inherit(HTMLPurifier_Config $config) + { + return new HTMLPurifier_Config($config->def, $config->plist); + } + + /** + * Convenience constructor that creates a default configuration object. + * @return Default HTMLPurifier_Config object. + */ + public static function createDefault() + { + $definition = HTMLPurifier_ConfigSchema::instance(); + $config = new HTMLPurifier_Config($definition); + return $config; + } + + /** + * Retreives a value from the configuration. + * @param $key String key + */ + public function get($key, $a = null) + { + if ($a !== null) { + $this->triggerError("Using deprecated API: use \$config->get('$key.$a') instead", E_USER_WARNING); + $key = "$key.$a"; + } + if (!$this->finalized) $this->autoFinalize(); + if (!isset($this->def->info[$key])) { + // can't add % due to SimpleTest bug + $this->triggerError('Cannot retrieve value of undefined directive ' . htmlspecialchars($key), + E_USER_WARNING); + return; + } + if (isset($this->def->info[$key]->isAlias)) { + $d = $this->def->info[$key]; + $this->triggerError('Cannot get value from aliased directive, use real name ' . $d->key, + E_USER_ERROR); + return; + } + if ($this->lock) { + list($ns) = explode('.', $key); + if ($ns !== $this->lock) { + $this->triggerError('Cannot get value of namespace ' . $ns . ' when lock for ' . $this->lock . ' is active, this probably indicates a Definition setup method is accessing directives that are not within its namespace', E_USER_ERROR); + return; + } + } + return $this->plist->get($key); + } + + /** + * Retreives an array of directives to values from a given namespace + * @param $namespace String namespace + */ + public function getBatch($namespace) + { + if (!$this->finalized) $this->autoFinalize(); + $full = $this->getAll(); + if (!isset($full[$namespace])) { + $this->triggerError('Cannot retrieve undefined namespace ' . htmlspecialchars($namespace), + E_USER_WARNING); + return; + } + return $full[$namespace]; + } + + /** + * Returns a md5 signature of a segment of the configuration object + * that uniquely identifies that particular configuration + * @note Revision is handled specially and is removed from the batch + * before processing! + * @param $namespace Namespace to get serial for + */ + public function getBatchSerial($namespace) + { + if (empty($this->serials[$namespace])) { + $batch = $this->getBatch($namespace); + unset($batch['DefinitionRev']); + $this->serials[$namespace] = md5(serialize($batch)); + } + return $this->serials[$namespace]; + } + + /** + * Returns a md5 signature for the entire configuration object + * that uniquely identifies that particular configuration + */ + public function getSerial() + { + if (empty($this->serial)) { + $this->serial = md5(serialize($this->getAll())); + } + return $this->serial; + } + + /** + * Retrieves all directives, organized by namespace + * @warning This is a pretty inefficient function, avoid if you can + */ + public function getAll() + { + if (!$this->finalized) $this->autoFinalize(); + $ret = array(); + foreach ($this->plist->squash() as $name => $value) { + list($ns, $key) = explode('.', $name, 2); + $ret[$ns][$key] = $value; + } + return $ret; + } + + /** + * Sets a value to configuration. + * @param $key String key + * @param $value Mixed value + */ + public function set($key, $value, $a = null) + { + if (strpos($key, '.') === false) { + $namespace = $key; + $directive = $value; + $value = $a; + $key = "$key.$directive"; + $this->triggerError("Using deprecated API: use \$config->set('$key', ...) instead", E_USER_NOTICE); + } else { + list($namespace) = explode('.', $key); + } + if ($this->isFinalized('Cannot set directive after finalization')) return; + if (!isset($this->def->info[$key])) { + $this->triggerError('Cannot set undefined directive ' . htmlspecialchars($key) . ' to value', + E_USER_WARNING); + return; + } + $def = $this->def->info[$key]; + + if (isset($def->isAlias)) { + if ($this->aliasMode) { + $this->triggerError('Double-aliases not allowed, please fix ' . + 'ConfigSchema bug with' . $key, E_USER_ERROR); + return; + } + $this->aliasMode = true; + $this->set($def->key, $value); + $this->aliasMode = false; + $this->triggerError("$key is an alias, preferred directive name is {$def->key}", E_USER_NOTICE); + return; + } + + // Raw type might be negative when using the fully optimized form + // of stdclass, which indicates allow_null == true + $rtype = is_int($def) ? $def : $def->type; + if ($rtype < 0) { + $type = -$rtype; + $allow_null = true; + } else { + $type = $rtype; + $allow_null = isset($def->allow_null); + } + + try { + $value = $this->parser->parse($value, $type, $allow_null); + } catch (HTMLPurifier_VarParserException $e) { + $this->triggerError('Value for ' . $key . ' is of invalid type, should be ' . HTMLPurifier_VarParser::getTypeName($type), E_USER_WARNING); + return; + } + if (is_string($value) && is_object($def)) { + // resolve value alias if defined + if (isset($def->aliases[$value])) { + $value = $def->aliases[$value]; + } + // check to see if the value is allowed + if (isset($def->allowed) && !isset($def->allowed[$value])) { + $this->triggerError('Value not supported, valid values are: ' . + $this->_listify($def->allowed), E_USER_WARNING); + return; + } + } + $this->plist->set($key, $value); + + // reset definitions if the directives they depend on changed + // this is a very costly process, so it's discouraged + // with finalization + if ($namespace == 'HTML' || $namespace == 'CSS' || $namespace == 'URI') { + $this->definitions[$namespace] = null; + } + + $this->serials[$namespace] = false; + } + + /** + * Convenience function for error reporting + */ + private function _listify($lookup) + { + $list = array(); + foreach ($lookup as $name => $b) $list[] = $name; + return implode(', ', $list); + } + + /** + * Retrieves object reference to the HTML definition. + * @param $raw Return a copy that has not been setup yet. Must be + * called before it's been setup, otherwise won't work. + * @param $optimized If true, this method may return null, to + * indicate that a cached version of the modified + * definition object is available and no further edits + * are necessary. Consider using + * maybeGetRawHTMLDefinition, which is more explicitly + * named, instead. + */ + public function getHTMLDefinition($raw = false, $optimized = false) + { + return $this->getDefinition('HTML', $raw, $optimized); + } + + /** + * Retrieves object reference to the CSS definition + * @param $raw Return a copy that has not been setup yet. Must be + * called before it's been setup, otherwise won't work. + * @param $optimized If true, this method may return null, to + * indicate that a cached version of the modified + * definition object is available and no further edits + * are necessary. Consider using + * maybeGetRawCSSDefinition, which is more explicitly + * named, instead. + */ + public function getCSSDefinition($raw = false, $optimized = false) + { + return $this->getDefinition('CSS', $raw, $optimized); + } + + /** + * Retrieves object reference to the URI definition + * @param $raw Return a copy that has not been setup yet. Must be + * called before it's been setup, otherwise won't work. + * @param $optimized If true, this method may return null, to + * indicate that a cached version of the modified + * definition object is available and no further edits + * are necessary. Consider using + * maybeGetRawURIDefinition, which is more explicitly + * named, instead. + */ + public function getURIDefinition($raw = false, $optimized = false) + { + return $this->getDefinition('URI', $raw, $optimized); + } + + /** + * Retrieves a definition + * @param $type Type of definition: HTML, CSS, etc + * @param $raw Whether or not definition should be returned raw + * @param $optimized Only has an effect when $raw is true. Whether + * or not to return null if the result is already present in + * the cache. This is off by default for backwards + * compatibility reasons, but you need to do things this + * way in order to ensure that caching is done properly. + * Check out enduser-customize.html for more details. + * We probably won't ever change this default, as much as the + * maybe semantics is the "right thing to do." + */ + public function getDefinition($type, $raw = false, $optimized = false) + { + if ($optimized && !$raw) { + throw new HTMLPurifier_Exception("Cannot set optimized = true when raw = false"); + } + if (!$this->finalized) $this->autoFinalize(); + // temporarily suspend locks, so we can handle recursive definition calls + $lock = $this->lock; + $this->lock = null; + $factory = HTMLPurifier_DefinitionCacheFactory::instance(); + $cache = $factory->create($type, $this); + $this->lock = $lock; + if (!$raw) { + // full definition + // --------------- + // check if definition is in memory + if (!empty($this->definitions[$type])) { + $def = $this->definitions[$type]; + // check if the definition is setup + if ($def->setup) { + return $def; + } else { + $def->setup($this); + if ($def->optimized) $cache->add($def, $this); + return $def; + } + } + // check if definition is in cache + $def = $cache->get($this); + if ($def) { + // definition in cache, save to memory and return it + $this->definitions[$type] = $def; + return $def; + } + // initialize it + $def = $this->initDefinition($type); + // set it up + $this->lock = $type; + $def->setup($this); + $this->lock = null; + // save in cache + $cache->add($def, $this); + // return it + return $def; + } else { + // raw definition + // -------------- + // check preconditions + $def = null; + if ($optimized) { + if (is_null($this->get($type . '.DefinitionID'))) { + // fatally error out if definition ID not set + throw new HTMLPurifier_Exception("Cannot retrieve raw version without specifying %$type.DefinitionID"); + } + } + if (!empty($this->definitions[$type])) { + $def = $this->definitions[$type]; + if ($def->setup && !$optimized) { + $extra = $this->chatty ? " (try moving this code block earlier in your initialization)" : ""; + throw new HTMLPurifier_Exception("Cannot retrieve raw definition after it has already been setup" . $extra); + } + if ($def->optimized === null) { + $extra = $this->chatty ? " (try flushing your cache)" : ""; + throw new HTMLPurifier_Exception("Optimization status of definition is unknown" . $extra); + } + if ($def->optimized !== $optimized) { + $msg = $optimized ? "optimized" : "unoptimized"; + $extra = $this->chatty ? " (this backtrace is for the first inconsistent call, which was for a $msg raw definition)" : ""; + throw new HTMLPurifier_Exception("Inconsistent use of optimized and unoptimized raw definition retrievals" . $extra); + } + } + // check if definition was in memory + if ($def) { + if ($def->setup) { + // invariant: $optimized === true (checked above) + return null; + } else { + return $def; + } + } + // if optimized, check if definition was in cache + // (because we do the memory check first, this formulation + // is prone to cache slamming, but I think + // guaranteeing that either /all/ of the raw + // setup code or /none/ of it is run is more important.) + if ($optimized) { + // This code path only gets run once; once we put + // something in $definitions (which is guaranteed by the + // trailing code), we always short-circuit above. + $def = $cache->get($this); + if ($def) { + // save the full definition for later, but don't + // return it yet + $this->definitions[$type] = $def; + return null; + } + } + // check invariants for creation + if (!$optimized) { + if (!is_null($this->get($type . '.DefinitionID'))) { + if ($this->chatty) { + $this->triggerError("Due to a documentation error in previous version of HTML Purifier, your definitions are not being cached. If this is OK, you can remove the %$type.DefinitionRev and %$type.DefinitionID declaration. Otherwise, modify your code to use maybeGetRawDefinition, and test if the returned value is null before making any edits (if it is null, that means that a cached version is available, and no raw operations are necessary). See Customize for more details", E_USER_WARNING); + } else { + $this->triggerError("Useless DefinitionID declaration", E_USER_WARNING); + } + } + } + // initialize it + $def = $this->initDefinition($type); + $def->optimized = $optimized; + return $def; + } + throw new HTMLPurifier_Exception("The impossible happened!"); + } + + private function initDefinition($type) + { + // quick checks failed, let's create the object + if ($type == 'HTML') { + $def = new HTMLPurifier_HTMLDefinition(); + } elseif ($type == 'CSS') { + $def = new HTMLPurifier_CSSDefinition(); + } elseif ($type == 'URI') { + $def = new HTMLPurifier_URIDefinition(); + } else { + throw new HTMLPurifier_Exception("Definition of $type type not supported"); + } + $this->definitions[$type] = $def; + return $def; + } + + public function maybeGetRawDefinition($name) + { + return $this->getDefinition($name, true, true); + } + + public function maybeGetRawHTMLDefinition() + { + return $this->getDefinition('HTML', true, true); + } + + public function maybeGetRawCSSDefinition() + { + return $this->getDefinition('CSS', true, true); + } + + public function maybeGetRawURIDefinition() + { + return $this->getDefinition('URI', true, true); + } + + /** + * Loads configuration values from an array with the following structure: + * Namespace.Directive => Value + * @param $config_array Configuration associative array + */ + public function loadArray($config_array) + { + if ($this->isFinalized('Cannot load directives after finalization')) return; + foreach ($config_array as $key => $value) { + $key = str_replace('_', '.', $key); + if (strpos($key, '.') !== false) { + $this->set($key, $value); + } else { + $namespace = $key; + $namespace_values = $value; + foreach ($namespace_values as $directive => $value) { + $this->set($namespace . '.' . $directive, $value); + } + } + } + } + + /** + * Returns a list of array(namespace, directive) for all directives + * that are allowed in a web-form context as per an allowed + * namespaces/directives list. + * @param $allowed List of allowed namespaces/directives + */ + public static function getAllowedDirectivesForForm($allowed, $schema = null) + { + if (!$schema) { + $schema = HTMLPurifier_ConfigSchema::instance(); + } + if ($allowed !== true) { + if (is_string($allowed)) $allowed = array($allowed); + $allowed_ns = array(); + $allowed_directives = array(); + $blacklisted_directives = array(); + foreach ($allowed as $ns_or_directive) { + if (strpos($ns_or_directive, '.') !== false) { + // directive + if ($ns_or_directive[0] == '-') { + $blacklisted_directives[substr($ns_or_directive, 1)] = true; + } else { + $allowed_directives[$ns_or_directive] = true; + } + } else { + // namespace + $allowed_ns[$ns_or_directive] = true; + } + } + } + $ret = array(); + foreach ($schema->info as $key => $def) { + list($ns, $directive) = explode('.', $key, 2); + if ($allowed !== true) { + if (isset($blacklisted_directives["$ns.$directive"])) continue; + if (!isset($allowed_directives["$ns.$directive"]) && !isset($allowed_ns[$ns])) continue; + } + if (isset($def->isAlias)) continue; + if ($directive == 'DefinitionID' || $directive == 'DefinitionRev') continue; + $ret[] = array($ns, $directive); + } + return $ret; + } + + /** + * Loads configuration values from $_GET/$_POST that were posted + * via ConfigForm + * @param $array $_GET or $_POST array to import + * @param $index Index/name that the config variables are in + * @param $allowed List of allowed namespaces/directives + * @param $mq_fix Boolean whether or not to enable magic quotes fix + * @param $schema Instance of HTMLPurifier_ConfigSchema to use, if not global copy + */ + public static function loadArrayFromForm($array, $index = false, $allowed = true, $mq_fix = true, $schema = null) + { + $ret = HTMLPurifier_Config::prepareArrayFromForm($array, $index, $allowed, $mq_fix, $schema); + $config = HTMLPurifier_Config::create($ret, $schema); + return $config; + } + + /** + * Merges in configuration values from $_GET/$_POST to object. NOT STATIC. + * @note Same parameters as loadArrayFromForm + */ + public function mergeArrayFromForm($array, $index = false, $allowed = true, $mq_fix = true) + { + $ret = HTMLPurifier_Config::prepareArrayFromForm($array, $index, $allowed, $mq_fix, $this->def); + $this->loadArray($ret); + } + + /** + * Prepares an array from a form into something usable for the more + * strict parts of HTMLPurifier_Config + */ + public static function prepareArrayFromForm($array, $index = false, $allowed = true, $mq_fix = true, $schema = null) + { + if ($index !== false) $array = (isset($array[$index]) && is_array($array[$index])) ? $array[$index] : array(); + $mq = $mq_fix && function_exists('get_magic_quotes_gpc') && get_magic_quotes_gpc(); + + $allowed = HTMLPurifier_Config::getAllowedDirectivesForForm($allowed, $schema); + $ret = array(); + foreach ($allowed as $key) { + list($ns, $directive) = $key; + $skey = "$ns.$directive"; + if (!empty($array["Null_$skey"])) { + $ret[$ns][$directive] = null; + continue; + } + if (!isset($array[$skey])) continue; + $value = $mq ? stripslashes($array[$skey]) : $array[$skey]; + $ret[$ns][$directive] = $value; + } + return $ret; + } + + /** + * Loads configuration values from an ini file + * @param $filename Name of ini file + */ + public function loadIni($filename) + { + if ($this->isFinalized('Cannot load directives after finalization')) return; + if (function_exists('parse_ini_file')) { + $array = parse_ini_file($filename, true); + } else { + $fileContent = file_get_contents($filename); + $array = parse_ini_string($fileContent, true); + } + + $this->loadArray($array); + } + + /** + * Checks whether or not the configuration object is finalized. + * @param $error String error message, or false for no error + */ + public function isFinalized($error = false) + { + if ($this->finalized && $error) { + $this->triggerError($error, E_USER_ERROR); + } + return $this->finalized; + } + + /** + * Finalizes configuration only if auto finalize is on and not + * already finalized + */ + public function autoFinalize() + { + if ($this->autoFinalize) { + $this->finalize(); + } else { + $this->plist->squash(true); + } + } + + /** + * Finalizes a configuration object, prohibiting further change + */ + public function finalize() + { + $this->finalized = true; + unset($this->parser); + } + + /** + * Produces a nicely formatted error message by supplying the + * stack frame information OUTSIDE of HTMLPurifier_Config. + */ + protected function triggerError($msg, $no) + { + // determine previous stack frame + $extra = ''; + if ($this->chatty) { + $trace = debug_backtrace(); + // zip(tail(trace), trace) -- but PHP is not Haskell har har + for ($i = 0, $c = count($trace); $i < $c - 1; $i++) { + if ($trace[$i + 1]['class'] === 'HTMLPurifier_Config') { + continue; + } + $frame = $trace[$i]; + $extra = " invoked on line {$frame['line']} in file {$frame['file']}"; + break; + } + } + trigger_error($msg . $extra, $no); + } + + /** + * Returns a serialized form of the configuration object that can + * be reconstituted. + */ + public function serialize() + { + $this->getDefinition('HTML'); + $this->getDefinition('CSS'); + $this->getDefinition('URI'); + return serialize($this); + } + +} + +// vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigDef.php b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigDef.php new file mode 100644 index 0000000..fe35e7a --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigDef.php @@ -0,0 +1,9 @@ +type = $type; + if ( $allow_null !== null) $this->allow_null = $allow_null; + if ( $allowed !== null) $this->allowed = $allowed; + if ( $aliases !== null) $this->aliases = $aliases; + } + + /** + * Allowed type of the directive. Values are: + * - string + * - istring (case insensitive string) + * - int + * - float + * - bool + * - lookup (array of value => true) + * - list (regular numbered index array) + * - hash (array of key => value) + * - mixed (anything goes) + */ + public $type = 'mixed'; + + /** + * Is null allowed? Has no effect for mixed type. + * @bool + */ + public $allow_null = false; + + /** + * Lookup table of allowed values of the element, bool true if all allowed. + */ + public $allowed = true; + + /** + * Hash of value aliases, i.e. values that are equivalent. + */ + public $aliases = array(); + +} + diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigDef/DirectiveAlias.php b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigDef/DirectiveAlias.php new file mode 100644 index 0000000..98b8edd --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigDef/DirectiveAlias.php @@ -0,0 +1,24 @@ +namespace = $namespace; + $this->name = $name; + } +} + diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigDef/Namespace.php b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigDef/Namespace.php new file mode 100644 index 0000000..f282065 --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigDef/Namespace.php @@ -0,0 +1,10 @@ + array( + * 'Directive' => new stdclass(), + * ) + * ) + * + * The stdclass may have the following properties: + * + * - If isAlias isn't set: + * - type: Integer type of directive, see HTMLPurifier_VarParser for definitions + * - allow_null: If set, this directive allows null values + * - aliases: If set, an associative array of value aliases to real values + * - allowed: If set, a lookup array of allowed (string) values + * - If isAlias is set: + * - namespace: Namespace this directive aliases to + * - name: Directive name this directive aliases to + * + * In certain degenerate cases, stdclass will actually be an integer. In + * that case, the value is equivalent to an stdclass with the type + * property set to the integer. If the integer is negative, type is + * equal to the absolute value of integer, and allow_null is true. + * + * This class is friendly with HTMLPurifier_Config. If you need introspection + * about the schema, you're better of using the ConfigSchema_Interchange, + * which uses more memory but has much richer information. + */ + public $info = array(); + + /** + * Application-wide singleton + */ + static protected $singleton; + + public function __construct() { + $this->defaultPlist = new HTMLPurifier_PropertyList(); + } + + /** + * Unserializes the default ConfigSchema. + */ + public static function makeFromSerial() { + $contents = file_get_contents(HTMLPURIFIER_PREFIX . '/HTMLPurifier/ConfigSchema/schema.ser'); + $r = unserialize($contents); + if (!$r) { + $hash = sha1($contents); + trigger_error("Unserialization of configuration schema failed, sha1 of file was $hash", E_USER_ERROR); + } + return $r; + } + + /** + * Retrieves an instance of the application-wide configuration definition. + */ + public static function instance($prototype = null) { + if ($prototype !== null) { + HTMLPurifier_ConfigSchema::$singleton = $prototype; + } elseif (HTMLPurifier_ConfigSchema::$singleton === null || $prototype === true) { + HTMLPurifier_ConfigSchema::$singleton = HTMLPurifier_ConfigSchema::makeFromSerial(); + } + return HTMLPurifier_ConfigSchema::$singleton; + } + + /** + * Defines a directive for configuration + * @warning Will fail of directive's namespace is defined. + * @warning This method's signature is slightly different from the legacy + * define() static method! Beware! + * @param $namespace Namespace the directive is in + * @param $name Key of directive + * @param $default Default value of directive + * @param $type Allowed type of the directive. See + * HTMLPurifier_DirectiveDef::$type for allowed values + * @param $allow_null Whether or not to allow null values + */ + public function add($key, $default, $type, $allow_null) { + $obj = new stdclass(); + $obj->type = is_int($type) ? $type : HTMLPurifier_VarParser::$types[$type]; + if ($allow_null) $obj->allow_null = true; + $this->info[$key] = $obj; + $this->defaults[$key] = $default; + $this->defaultPlist->set($key, $default); + } + + /** + * Defines a directive value alias. + * + * Directive value aliases are convenient for developers because it lets + * them set a directive to several values and get the same result. + * @param $namespace Directive's namespace + * @param $name Name of Directive + * @param $aliases Hash of aliased values to the real alias + */ + public function addValueAliases($key, $aliases) { + if (!isset($this->info[$key]->aliases)) { + $this->info[$key]->aliases = array(); + } + foreach ($aliases as $alias => $real) { + $this->info[$key]->aliases[$alias] = $real; + } + } + + /** + * Defines a set of allowed values for a directive. + * @warning This is slightly different from the corresponding static + * method definition. + * @param $namespace Namespace of directive + * @param $name Name of directive + * @param $allowed Lookup array of allowed values + */ + public function addAllowedValues($key, $allowed) { + $this->info[$key]->allowed = $allowed; + } + + /** + * Defines a directive alias for backwards compatibility + * @param $namespace + * @param $name Directive that will be aliased + * @param $new_namespace + * @param $new_name Directive that the alias will be to + */ + public function addAlias($key, $new_key) { + $obj = new stdclass; + $obj->key = $new_key; + $obj->isAlias = true; + $this->info[$key] = $obj; + } + + /** + * Replaces any stdclass that only has the type property with type integer. + */ + public function postProcess() { + foreach ($this->info as $key => $v) { + if (count((array) $v) == 1) { + $this->info[$key] = $v->type; + } elseif (count((array) $v) == 2 && isset($v->allow_null)) { + $this->info[$key] = -$v->type; + } + } + } + +} + +// vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/Builder/ConfigSchema.php b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/Builder/ConfigSchema.php new file mode 100644 index 0000000..c05668a --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/Builder/ConfigSchema.php @@ -0,0 +1,44 @@ +directives as $d) { + $schema->add( + $d->id->key, + $d->default, + $d->type, + $d->typeAllowsNull + ); + if ($d->allowed !== null) { + $schema->addAllowedValues( + $d->id->key, + $d->allowed + ); + } + foreach ($d->aliases as $alias) { + $schema->addAlias( + $alias->key, + $d->id->key + ); + } + if ($d->valueAliases !== null) { + $schema->addValueAliases( + $d->id->key, + $d->valueAliases + ); + } + } + $schema->postProcess(); + return $schema; + } + +} + +// vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/Builder/Xml.php b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/Builder/Xml.php new file mode 100644 index 0000000..244561a --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/Builder/Xml.php @@ -0,0 +1,106 @@ +startElement('div'); + + $purifier = HTMLPurifier::getInstance(); + $html = $purifier->purify($html); + $this->writeAttribute('xmlns', 'http://www.w3.org/1999/xhtml'); + $this->writeRaw($html); + + $this->endElement(); // div + } + + protected function export($var) { + if ($var === array()) return 'array()'; + return var_export($var, true); + } + + public function build($interchange) { + // global access, only use as last resort + $this->interchange = $interchange; + + $this->setIndent(true); + $this->startDocument('1.0', 'UTF-8'); + $this->startElement('configdoc'); + $this->writeElement('title', $interchange->name); + + foreach ($interchange->directives as $directive) { + $this->buildDirective($directive); + } + + if ($this->namespace) $this->endElement(); // namespace + + $this->endElement(); // configdoc + $this->flush(); + } + + public function buildDirective($directive) { + + // Kludge, although I suppose having a notion of a "root namespace" + // certainly makes things look nicer when documentation is built. + // Depends on things being sorted. + if (!$this->namespace || $this->namespace !== $directive->id->getRootNamespace()) { + if ($this->namespace) $this->endElement(); // namespace + $this->namespace = $directive->id->getRootNamespace(); + $this->startElement('namespace'); + $this->writeAttribute('id', $this->namespace); + $this->writeElement('name', $this->namespace); + } + + $this->startElement('directive'); + $this->writeAttribute('id', $directive->id->toString()); + + $this->writeElement('name', $directive->id->getDirective()); + + $this->startElement('aliases'); + foreach ($directive->aliases as $alias) $this->writeElement('alias', $alias->toString()); + $this->endElement(); // aliases + + $this->startElement('constraints'); + if ($directive->version) $this->writeElement('version', $directive->version); + $this->startElement('type'); + if ($directive->typeAllowsNull) $this->writeAttribute('allow-null', 'yes'); + $this->text($directive->type); + $this->endElement(); // type + if ($directive->allowed) { + $this->startElement('allowed'); + foreach ($directive->allowed as $value => $x) $this->writeElement('value', $value); + $this->endElement(); // allowed + } + $this->writeElement('default', $this->export($directive->default)); + $this->writeAttribute('xml:space', 'preserve'); + if ($directive->external) { + $this->startElement('external'); + foreach ($directive->external as $project) $this->writeElement('project', $project); + $this->endElement(); + } + $this->endElement(); // constraints + + if ($directive->deprecatedVersion) { + $this->startElement('deprecated'); + $this->writeElement('version', $directive->deprecatedVersion); + $this->writeElement('use', $directive->deprecatedUse->toString()); + $this->endElement(); // deprecated + } + + $this->startElement('description'); + $this->writeHTMLDiv($directive->description); + $this->endElement(); // description + + $this->endElement(); // directive + } + +} + +// vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/Exception.php b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/Exception.php new file mode 100644 index 0000000..2671516 --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/Exception.php @@ -0,0 +1,11 @@ + array(directive info) + */ + public $directives = array(); + + /** + * Adds a directive array to $directives + */ + public function addDirective($directive) { + if (isset($this->directives[$i = $directive->id->toString()])) { + throw new HTMLPurifier_ConfigSchema_Exception("Cannot redefine directive '$i'"); + } + $this->directives[$i] = $directive; + } + + /** + * Convenience function to perform standard validation. Throws exception + * on failed validation. + */ + public function validate() { + $validator = new HTMLPurifier_ConfigSchema_Validator(); + return $validator->validate($this); + } + +} + +// vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/Interchange/Directive.php b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/Interchange/Directive.php new file mode 100644 index 0000000..ac8be0d --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/Interchange/Directive.php @@ -0,0 +1,77 @@ + true). + * Null if all values are allowed. + */ + public $allowed; + + /** + * List of aliases for the directive, + * e.g. array(new HTMLPurifier_ConfigSchema_Interchange_Id('Ns', 'Dir'))). + */ + public $aliases = array(); + + /** + * Hash of value aliases, e.g. array('alt' => 'real'). Null if value + * aliasing is disabled (necessary for non-scalar types). + */ + public $valueAliases; + + /** + * Version of HTML Purifier the directive was introduced, e.g. '1.3.1'. + * Null if the directive has always existed. + */ + public $version; + + /** + * ID of directive that supercedes this old directive, is an instance + * of HTMLPurifier_ConfigSchema_Interchange_Id. Null if not deprecated. + */ + public $deprecatedUse; + + /** + * Version of HTML Purifier this directive was deprecated. Null if not + * deprecated. + */ + public $deprecatedVersion; + + /** + * List of external projects this directive depends on, e.g. array('CSSTidy'). + */ + public $external = array(); + +} + +// vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/Interchange/Id.php b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/Interchange/Id.php new file mode 100644 index 0000000..b9b3c6f --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/Interchange/Id.php @@ -0,0 +1,37 @@ +key = $key; + } + + /** + * @warning This is NOT magic, to ensure that people don't abuse SPL and + * cause problems for PHP 5.0 support. + */ + public function toString() { + return $this->key; + } + + public function getRootNamespace() { + return substr($this->key, 0, strpos($this->key, ".")); + } + + public function getDirective() { + return substr($this->key, strpos($this->key, ".") + 1); + } + + public static function make($id) { + return new HTMLPurifier_ConfigSchema_Interchange_Id($id); + } + +} + +// vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/Interchange/Namespace.php b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/Interchange/Namespace.php new file mode 100644 index 0000000..3ffac0a --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/Interchange/Namespace.php @@ -0,0 +1,21 @@ +varParser = $varParser ? $varParser : new HTMLPurifier_VarParser_Native(); + } + + public static function buildFromDirectory($dir = null) { + $builder = new HTMLPurifier_ConfigSchema_InterchangeBuilder(); + $interchange = new HTMLPurifier_ConfigSchema_Interchange(); + return $builder->buildDir($interchange, $dir); + } + + public function buildDir($interchange, $dir = null) { + if (!$dir) $dir = HTMLPURIFIER_PREFIX . '/HTMLPurifier/ConfigSchema/schema'; + if (file_exists($dir . '/info.ini')) { + $info = parse_ini_file($dir . '/info.ini'); + $interchange->name = $info['name']; + } + + $files = array(); + $dh = opendir($dir); + while (false !== ($file = readdir($dh))) { + if (!$file || $file[0] == '.' || strrchr($file, '.') !== '.txt') { + continue; + } + $files[] = $file; + } + closedir($dh); + + sort($files); + foreach ($files as $file) { + $this->buildFile($interchange, $dir . '/' . $file); + } + + return $interchange; + } + + public function buildFile($interchange, $file) { + $parser = new HTMLPurifier_StringHashParser(); + $this->build( + $interchange, + new HTMLPurifier_StringHash( $parser->parseFile($file) ) + ); + } + + /** + * Builds an interchange object based on a hash. + * @param $interchange HTMLPurifier_ConfigSchema_Interchange object to build + * @param $hash HTMLPurifier_ConfigSchema_StringHash source data + */ + public function build($interchange, $hash) { + if (!$hash instanceof HTMLPurifier_StringHash) { + $hash = new HTMLPurifier_StringHash($hash); + } + if (!isset($hash['ID'])) { + throw new HTMLPurifier_ConfigSchema_Exception('Hash does not have any ID'); + } + if (strpos($hash['ID'], '.') === false) { + if (count($hash) == 2 && isset($hash['DESCRIPTION'])) { + $hash->offsetGet('DESCRIPTION'); // prevent complaining + } else { + throw new HTMLPurifier_ConfigSchema_Exception('All directives must have a namespace'); + } + } else { + $this->buildDirective($interchange, $hash); + } + $this->_findUnused($hash); + } + + public function buildDirective($interchange, $hash) { + $directive = new HTMLPurifier_ConfigSchema_Interchange_Directive(); + + // These are required elements: + $directive->id = $this->id($hash->offsetGet('ID')); + $id = $directive->id->toString(); // convenience + + if (isset($hash['TYPE'])) { + $type = explode('/', $hash->offsetGet('TYPE')); + if (isset($type[1])) $directive->typeAllowsNull = true; + $directive->type = $type[0]; + } else { + throw new HTMLPurifier_ConfigSchema_Exception("TYPE in directive hash '$id' not defined"); + } + + if (isset($hash['DEFAULT'])) { + try { + $directive->default = $this->varParser->parse($hash->offsetGet('DEFAULT'), $directive->type, $directive->typeAllowsNull); + } catch (HTMLPurifier_VarParserException $e) { + throw new HTMLPurifier_ConfigSchema_Exception($e->getMessage() . " in DEFAULT in directive hash '$id'"); + } + } + + if (isset($hash['DESCRIPTION'])) { + $directive->description = $hash->offsetGet('DESCRIPTION'); + } + + if (isset($hash['ALLOWED'])) { + $directive->allowed = $this->lookup($this->evalArray($hash->offsetGet('ALLOWED'))); + } + + if (isset($hash['VALUE-ALIASES'])) { + $directive->valueAliases = $this->evalArray($hash->offsetGet('VALUE-ALIASES')); + } + + if (isset($hash['ALIASES'])) { + $raw_aliases = trim($hash->offsetGet('ALIASES')); + $aliases = preg_split('/\s*,\s*/', $raw_aliases); + foreach ($aliases as $alias) { + $directive->aliases[] = $this->id($alias); + } + } + + if (isset($hash['VERSION'])) { + $directive->version = $hash->offsetGet('VERSION'); + } + + if (isset($hash['DEPRECATED-USE'])) { + $directive->deprecatedUse = $this->id($hash->offsetGet('DEPRECATED-USE')); + } + + if (isset($hash['DEPRECATED-VERSION'])) { + $directive->deprecatedVersion = $hash->offsetGet('DEPRECATED-VERSION'); + } + + if (isset($hash['EXTERNAL'])) { + $directive->external = preg_split('/\s*,\s*/', trim($hash->offsetGet('EXTERNAL'))); + } + + $interchange->addDirective($directive); + } + + /** + * Evaluates an array PHP code string without array() wrapper + */ + protected function evalArray($contents) { + return eval('return array('. $contents .');'); + } + + /** + * Converts an array list into a lookup array. + */ + protected function lookup($array) { + $ret = array(); + foreach ($array as $val) $ret[$val] = true; + return $ret; + } + + /** + * Convenience function that creates an HTMLPurifier_ConfigSchema_Interchange_Id + * object based on a string Id. + */ + protected function id($id) { + return HTMLPurifier_ConfigSchema_Interchange_Id::make($id); + } + + /** + * Triggers errors for any unused keys passed in the hash; such keys + * may indicate typos, missing values, etc. + * @param $hash Instance of ConfigSchema_StringHash to check. + */ + protected function _findUnused($hash) { + $accessed = $hash->getAccessed(); + foreach ($hash as $k => $v) { + if (!isset($accessed[$k])) { + trigger_error("String hash key '$k' not used by builder", E_USER_NOTICE); + } + } + } + +} + +// vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/Validator.php b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/Validator.php new file mode 100644 index 0000000..f374f6a --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/Validator.php @@ -0,0 +1,206 @@ +parser = new HTMLPurifier_VarParser(); + } + + /** + * Validates a fully-formed interchange object. Throws an + * HTMLPurifier_ConfigSchema_Exception if there's a problem. + */ + public function validate($interchange) { + $this->interchange = $interchange; + $this->aliases = array(); + // PHP is a bit lax with integer <=> string conversions in + // arrays, so we don't use the identical !== comparison + foreach ($interchange->directives as $i => $directive) { + $id = $directive->id->toString(); + if ($i != $id) $this->error(false, "Integrity violation: key '$i' does not match internal id '$id'"); + $this->validateDirective($directive); + } + return true; + } + + /** + * Validates a HTMLPurifier_ConfigSchema_Interchange_Id object. + */ + public function validateId($id) { + $id_string = $id->toString(); + $this->context[] = "id '$id_string'"; + if (!$id instanceof HTMLPurifier_ConfigSchema_Interchange_Id) { + // handled by InterchangeBuilder + $this->error(false, 'is not an instance of HTMLPurifier_ConfigSchema_Interchange_Id'); + } + // keys are now unconstrained (we might want to narrow down to A-Za-z0-9.) + // we probably should check that it has at least one namespace + $this->with($id, 'key') + ->assertNotEmpty() + ->assertIsString(); // implicit assertIsString handled by InterchangeBuilder + array_pop($this->context); + } + + /** + * Validates a HTMLPurifier_ConfigSchema_Interchange_Directive object. + */ + public function validateDirective($d) { + $id = $d->id->toString(); + $this->context[] = "directive '$id'"; + $this->validateId($d->id); + + $this->with($d, 'description') + ->assertNotEmpty(); + + // BEGIN - handled by InterchangeBuilder + $this->with($d, 'type') + ->assertNotEmpty(); + $this->with($d, 'typeAllowsNull') + ->assertIsBool(); + try { + // This also tests validity of $d->type + $this->parser->parse($d->default, $d->type, $d->typeAllowsNull); + } catch (HTMLPurifier_VarParserException $e) { + $this->error('default', 'had error: ' . $e->getMessage()); + } + // END - handled by InterchangeBuilder + + if (!is_null($d->allowed) || !empty($d->valueAliases)) { + // allowed and valueAliases require that we be dealing with + // strings, so check for that early. + $d_int = HTMLPurifier_VarParser::$types[$d->type]; + if (!isset(HTMLPurifier_VarParser::$stringTypes[$d_int])) { + $this->error('type', 'must be a string type when used with allowed or value aliases'); + } + } + + $this->validateDirectiveAllowed($d); + $this->validateDirectiveValueAliases($d); + $this->validateDirectiveAliases($d); + + array_pop($this->context); + } + + /** + * Extra validation if $allowed member variable of + * HTMLPurifier_ConfigSchema_Interchange_Directive is defined. + */ + public function validateDirectiveAllowed($d) { + if (is_null($d->allowed)) return; + $this->with($d, 'allowed') + ->assertNotEmpty() + ->assertIsLookup(); // handled by InterchangeBuilder + if (is_string($d->default) && !isset($d->allowed[$d->default])) { + $this->error('default', 'must be an allowed value'); + } + $this->context[] = 'allowed'; + foreach ($d->allowed as $val => $x) { + if (!is_string($val)) $this->error("value $val", 'must be a string'); + } + array_pop($this->context); + } + + /** + * Extra validation if $valueAliases member variable of + * HTMLPurifier_ConfigSchema_Interchange_Directive is defined. + */ + public function validateDirectiveValueAliases($d) { + if (is_null($d->valueAliases)) return; + $this->with($d, 'valueAliases') + ->assertIsArray(); // handled by InterchangeBuilder + $this->context[] = 'valueAliases'; + foreach ($d->valueAliases as $alias => $real) { + if (!is_string($alias)) $this->error("alias $alias", 'must be a string'); + if (!is_string($real)) $this->error("alias target $real from alias '$alias'", 'must be a string'); + if ($alias === $real) { + $this->error("alias '$alias'", "must not be an alias to itself"); + } + } + if (!is_null($d->allowed)) { + foreach ($d->valueAliases as $alias => $real) { + if (isset($d->allowed[$alias])) { + $this->error("alias '$alias'", 'must not be an allowed value'); + } elseif (!isset($d->allowed[$real])) { + $this->error("alias '$alias'", 'must be an alias to an allowed value'); + } + } + } + array_pop($this->context); + } + + /** + * Extra validation if $aliases member variable of + * HTMLPurifier_ConfigSchema_Interchange_Directive is defined. + */ + public function validateDirectiveAliases($d) { + $this->with($d, 'aliases') + ->assertIsArray(); // handled by InterchangeBuilder + $this->context[] = 'aliases'; + foreach ($d->aliases as $alias) { + $this->validateId($alias); + $s = $alias->toString(); + if (isset($this->interchange->directives[$s])) { + $this->error("alias '$s'", 'collides with another directive'); + } + if (isset($this->aliases[$s])) { + $other_directive = $this->aliases[$s]; + $this->error("alias '$s'", "collides with alias for directive '$other_directive'"); + } + $this->aliases[$s] = $d->id->toString(); + } + array_pop($this->context); + } + + // protected helper functions + + /** + * Convenience function for generating HTMLPurifier_ConfigSchema_ValidatorAtom + * for validating simple member variables of objects. + */ + protected function with($obj, $member) { + return new HTMLPurifier_ConfigSchema_ValidatorAtom($this->getFormattedContext(), $obj, $member); + } + + /** + * Emits an error, providing helpful context. + */ + protected function error($target, $msg) { + if ($target !== false) $prefix = ucfirst($target) . ' in ' . $this->getFormattedContext(); + else $prefix = ucfirst($this->getFormattedContext()); + throw new HTMLPurifier_ConfigSchema_Exception(trim($prefix . ' ' . $msg)); + } + + /** + * Returns a formatted context string. + */ + protected function getFormattedContext() { + return implode(' in ', array_reverse($this->context)); + } + +} + +// vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/ValidatorAtom.php b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/ValidatorAtom.php new file mode 100644 index 0000000..b95aea1 --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/ValidatorAtom.php @@ -0,0 +1,66 @@ +context = $context; + $this->obj = $obj; + $this->member = $member; + $this->contents =& $obj->$member; + } + + public function assertIsString() { + if (!is_string($this->contents)) $this->error('must be a string'); + return $this; + } + + public function assertIsBool() { + if (!is_bool($this->contents)) $this->error('must be a boolean'); + return $this; + } + + public function assertIsArray() { + if (!is_array($this->contents)) $this->error('must be an array'); + return $this; + } + + public function assertNotNull() { + if ($this->contents === null) $this->error('must not be null'); + return $this; + } + + public function assertAlnum() { + $this->assertIsString(); + if (!ctype_alnum($this->contents)) $this->error('must be alphanumeric'); + return $this; + } + + public function assertNotEmpty() { + if (empty($this->contents)) $this->error('must not be empty'); + return $this; + } + + public function assertIsLookup() { + $this->assertIsArray(); + foreach ($this->contents as $v) { + if ($v !== true) $this->error('must be a lookup array'); + } + return $this; + } + + protected function error($msg) { + throw new HTMLPurifier_ConfigSchema_Exception(ucfirst($this->member) . ' in ' . $this->context . ' ' . $msg); + } + +} + +// vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema.ser b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema.ser new file mode 100644 index 0000000000000000000000000000000000000000..245ba5d2d09c71529c7e1357160a3393ff280a4d GIT binary patch literal 14140 zcmeHOTT>g$5k5b~#i_ic$|?jn$CjV4KxI_`QwY~Nc{;U7gP5?|RrX>-T>kI*zMh_o zmKE3!NnT`^jkMj<)6=(^>HYXLI(ReM`*?kRcG*_;)|%?iaar8j%x%`@O}+O%8x8m0@#*m0Xz#dbs=;xdmtW0doM&}yz;W@u9vvKQ5+_x*GS^wP zG)~6;=-YRQz~rfjE0c4AZNx7L5jx38ne}sR#wW+u$2#}E(oUSx(^a-K$9dDy%u|am zS#B4?vj+8ML>9C^9PLfr<5!k*a9ps8ioZ4w&55l@0(;)bCyo^DPmAm( zH`9~7_cx<`&N@`Wq^xf2VquD4)nJytDa-WaL!Qm=b6aC&o_cWblzL^B=3(ttA7-AO zTvq1RJ|s&XdYgLMSvk+(kZ2P+wQWi$x5}CUKVD{4wyd)ConOI_c8fgYwr*Suz9nflp*KB7qQ0hJtDlLY`;ve zfH*IznJ{~fL*`tUW46wU`ghyhm2JbQvNvtRJai#Nua0Lkm!;Fyx~!V4K*T5&{s`3T z%FgeDorf@5AeqIaESS2I+=$YIa#@vYQ#ID-K0|k8p##5Iy#$n9~4%9f}G zi%5tML7SP%q89wyNRl1|?)dyNqatDhE>dJAR8y^NUAx$@qoa3+j0Xh7xU9_Jc)6?$ zs9#L}II$0B;sZvEc!(V1GSAJtIjyR)+Vr1N%j)mu@oQNvB=%tEZ(@^GR+VKz13{@@ z-|q8|CP2m2yXTXMe-1O2RaUry#UYc)@f$Y;q({Sg9!GH;zroyP4(&bV?LKGXHw;?0 z)jCf|`yeXgZ9BiKZRUqj++@OU5cu`ZHeu96{*Z!1%RM1BgJP6LX{-$lFz49oCl~!iJXhFIG&BC)A1d)g*kKzjNBH5@uTc&r@7(!B#fnmLZ5nG*>zYl zw5^**h7?V}vw~mK86vmU-4+VEU>L$_A|JLfl}l=W4w2{QnJpUpi-yDG!r>Qr!Cj5n ze__7nFt6w?6`j?DesTp_jfKJ#+~ZYq3@Au*CVH`)7Ijm#bKNb}s90GdZ6>S6p{sHB zph{fo#OAQypu2w_Vx3AleQ0Rp8LjjoFX#95K>Q@`*0_P@+qq|R)NN;k=fz&z#baVp zEMTipA3F4hGX0}$uiG1Oq{Jrd%>$=DHbyU`Pt$!&yo6jy=`n!BV2G}idR{Kt+;2w* zu%;vOuzG=W=pddKbr(d+3X9nBcbsRip)pTjzqR~CdJ9BR9$987y=rXE!}Jz%Iz2KhDp_ZeH*B6r#jt)@Bqe+K(7SR&oWD^FCb$sX$>m_u<~agg3b$qfRxfjg zb3nRYe-7Z@xycp%?syzaB?7U#p8c);M1L`0JE>E@rP)lX(asMzGOUm}GQAI3>nz#;OH!)VSdB8QL!ZxZJY^&VvmrK>#6`NBM@qalb;HBt++38? zd0D`F>RzaVJB2SZa-n5O$Y8^7lAw1@gXDJWf(HB=YCi3pp#+zn0Y&6CvST4dvH8_} z)xpR%o%%yoCn-i{^it@Qp$j3%so_FSdGy#EvJghtq@+oRFczY%d6x{!hoh3m*epy{ z@PwfGrz+wC#!;SpW$LnpEoCYG$ef6ILRT>#OI|{yVyLcs(sMs$UQyn8c5jYv>N3Yw z#p|RRpSN-{_2oyn`RK{q47Na>8Pt~s$781k4>+WK!ojMt3ta!DM-ifcUT0ZEk}O=8 z;L=^BKRxY;=nVz8R4meUM6k$T{`$)zYjAwrHAGx<1=d88>>47whRCiVvTKM)8|8A> z5Q#mRT|;Eo5ZN_Eb`6oit|1~llU+k(*AQVJaMuuF*JalbaqoL}4UzwALj*k-G&a`S z5oHesO%^tzP1IX;*atw=MTGxPgV=+VKI#jf(aG;kWXc5<+#J8%E?j8D8Y+T`i=oAqocElBj zcDN&uhi$|@9U$VK{jy$Za&NKqac;BN*L((^qMkzAP1M=|r`XXu`U1VSF3m$z)Ei+{ z9)aRrz*e7*b+8qMrYNR>PK>AseoSyF(Jl#(f3K#hq5Yc>yQmbEKpo;NiZ`K#w0j5W zu?>~t6h34`1yR&>HRz1+FqY>X_k*+cJCnW&N_6M<>-u?6jEjVhW(k%>U!xLC<0p~O zh^i#ap5v#0FVSBCrIG+&lnR#zst3L(35E%z0DSSK4DI%WsJ&sqz9p{D988#b8VnLJ7RmUkZ zCnAjRI6Z;`74wC>^)|JBAf*Llk9T5SdYxKt6 z;Bp8M<-my{k<*6&QM-G_E&@b%4zFm0ceq;FhwNa)_}yD3??rcjOU?j(4Ltx4T>~?R zws3_f1$a0H7PEu_Iok{HP-(0zQCjyss%k~YC_rL!FM1w|5fL6yv#nr^$oxVyB9gZX zNkAq25s7SbgWW!cSBV{1%Kt_U_;C9g6zZathB>~KS6N@M*pJNCZ!Sc~^XB?*EAXtd z`I0^E4$QH`7yTQ@ykN8+oVnL-M3rpynLj1;p^jXh1gMJMP&nfC5$hnTgTNt_z*D9N z(1L{)EC1OyNfhYfzApnHD0OY!(^QO{4AgO-X{Dfr_futo6wOWWQD~WJ_0dllW zU=OAi%#fEGH+NnKJQco`!I7%S0@*vfX#%{b<6rsZ05~U6(UD_wH2mdBL#HC| zR4)LRw7O%xVzO|8+l&|q7;m`1lZK3V&Aa8vA>GYHvuat1sNs6Qm|5I9&a{%?AOJN7qF7<-F^-}SEy1aR9?RH9x*5&s3;3TgwV^- zFt^LQ0HZ@dc=S_*?HGam3ZR1*W4|iu;xSRGW>DWFqI6k4zZDS`pUO6_Px}^xy!JQf zj*R{qhICUf(-x4Gn>w7$ws1YK%F9r$UgfqTyVM*}cfs{}WS3ImxGu8G*BChD3Ajr~ zAq#rIT}s3_u|FM&M8a>JymYGO&8tUV|8l|GgB^>DC3;Brgn$}yaRf_{=+Iq$l@P~= zD5U&7DG%_9`KiPN+4Xef)9d082`?i(xGUO5+93+x0?UiG=}PLi3MykVpNEC{{gt8B zLr#!cPCxFL3EvaCigBp1jvYF{G1s8!hmE<(RAq&Yd1*R@Jbg0%HsqKNehECrdB1=E E4@82k;{X5v literal 0 HcmV?d00001 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Attr.AllowedClasses.txt b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Attr.AllowedClasses.txt new file mode 100644 index 0000000..0517fed --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Attr.AllowedClasses.txt @@ -0,0 +1,8 @@ +Attr.AllowedClasses +TYPE: lookup/null +VERSION: 4.0.0 +DEFAULT: null +--DESCRIPTION-- +List of allowed class values in the class attribute. By default, this is null, +which means all classes are allowed. +--# vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Attr.AllowedFrameTargets.txt b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Attr.AllowedFrameTargets.txt new file mode 100644 index 0000000..249edd6 --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Attr.AllowedFrameTargets.txt @@ -0,0 +1,12 @@ +Attr.AllowedFrameTargets +TYPE: lookup +DEFAULT: array() +--DESCRIPTION-- +Lookup table of all allowed link frame targets. Some commonly used link +targets include _blank, _self, _parent and _top. Values should be +lowercase, as validation will be done in a case-sensitive manner despite +W3C's recommendation. XHTML 1.0 Strict does not permit the target attribute +so this directive will have no effect in that doctype. XHTML 1.1 does not +enable the Target module by default, you will have to manually enable it +(see the module documentation for more details.) +--# vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Attr.AllowedRel.txt b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Attr.AllowedRel.txt new file mode 100644 index 0000000..9a8fa6a --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Attr.AllowedRel.txt @@ -0,0 +1,9 @@ +Attr.AllowedRel +TYPE: lookup +VERSION: 1.6.0 +DEFAULT: array() +--DESCRIPTION-- +List of allowed forward document relationships in the rel attribute. Common +values may be nofollow or print. By default, this is empty, meaning that no +document relationships are allowed. +--# vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Attr.AllowedRev.txt b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Attr.AllowedRev.txt new file mode 100644 index 0000000..b017883 --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Attr.AllowedRev.txt @@ -0,0 +1,9 @@ +Attr.AllowedRev +TYPE: lookup +VERSION: 1.6.0 +DEFAULT: array() +--DESCRIPTION-- +List of allowed reverse document relationships in the rev attribute. This +attribute is a bit of an edge-case; if you don't know what it is for, stay +away. +--# vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Attr.ClassUseCDATA.txt b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Attr.ClassUseCDATA.txt new file mode 100644 index 0000000..e774b82 --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Attr.ClassUseCDATA.txt @@ -0,0 +1,19 @@ +Attr.ClassUseCDATA +TYPE: bool/null +DEFAULT: null +VERSION: 4.0.0 +--DESCRIPTION-- +If null, class will auto-detect the doctype and, if matching XHTML 1.1 or +XHTML 2.0, will use the restrictive NMTOKENS specification of class. Otherwise, +it will use a relaxed CDATA definition. If true, the relaxed CDATA definition +is forced; if false, the NMTOKENS definition is forced. To get behavior +of HTML Purifier prior to 4.0.0, set this directive to false. + +Some rational behind the auto-detection: +in previous versions of HTML Purifier, it was assumed that the form of +class was NMTOKENS, as specified by the XHTML Modularization (representing +XHTML 1.1 and XHTML 2.0). The DTDs for HTML 4.01 and XHTML 1.0, however +specify class as CDATA. HTML 5 effectively defines it as CDATA, but +with the additional constraint that each name should be unique (this is not +explicitly outlined in previous specifications). +--# vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Attr.DefaultImageAlt.txt b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Attr.DefaultImageAlt.txt new file mode 100644 index 0000000..533165e --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Attr.DefaultImageAlt.txt @@ -0,0 +1,11 @@ +Attr.DefaultImageAlt +TYPE: string/null +DEFAULT: null +VERSION: 3.2.0 +--DESCRIPTION-- +This is the content of the alt tag of an image if the user had not +previously specified an alt attribute. This applies to all images without +a valid alt attribute, as opposed to %Attr.DefaultInvalidImageAlt, which +only applies to invalid images, and overrides in the case of an invalid image. +Default behavior with null is to use the basename of the src tag for the alt. +--# vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Attr.DefaultInvalidImage.txt b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Attr.DefaultInvalidImage.txt new file mode 100644 index 0000000..9eb7e38 --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Attr.DefaultInvalidImage.txt @@ -0,0 +1,9 @@ +Attr.DefaultInvalidImage +TYPE: string +DEFAULT: '' +--DESCRIPTION-- +This is the default image an img tag will be pointed to if it does not have +a valid src attribute. In future versions, we may allow the image tag to +be removed completely, but due to design issues, this is not possible right +now. +--# vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Attr.DefaultInvalidImageAlt.txt b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Attr.DefaultInvalidImageAlt.txt new file mode 100644 index 0000000..2f17bf4 --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Attr.DefaultInvalidImageAlt.txt @@ -0,0 +1,8 @@ +Attr.DefaultInvalidImageAlt +TYPE: string +DEFAULT: 'Invalid image' +--DESCRIPTION-- +This is the content of the alt tag of an invalid image if the user had not +previously specified an alt attribute. It has no effect when the image is +valid but there was no alt attribute present. +--# vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Attr.DefaultTextDir.txt b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Attr.DefaultTextDir.txt new file mode 100644 index 0000000..52654b5 --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Attr.DefaultTextDir.txt @@ -0,0 +1,10 @@ +Attr.DefaultTextDir +TYPE: string +DEFAULT: 'ltr' +--DESCRIPTION-- +Defines the default text direction (ltr or rtl) of the document being +parsed. This generally is the same as the value of the dir attribute in +HTML, or ltr if that is not specified. +--ALLOWED-- +'ltr', 'rtl' +--# vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Attr.EnableID.txt b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Attr.EnableID.txt new file mode 100644 index 0000000..6440d21 --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Attr.EnableID.txt @@ -0,0 +1,16 @@ +Attr.EnableID +TYPE: bool +DEFAULT: false +VERSION: 1.2.0 +--DESCRIPTION-- +Allows the ID attribute in HTML. This is disabled by default due to the +fact that without proper configuration user input can easily break the +validation of a webpage by specifying an ID that is already on the +surrounding HTML. If you don't mind throwing caution to the wind, enable +this directive, but I strongly recommend you also consider blacklisting IDs +you use (%Attr.IDBlacklist) or prefixing all user supplied IDs +(%Attr.IDPrefix). When set to true HTML Purifier reverts to the behavior of +pre-1.2.0 versions. +--ALIASES-- +HTML.EnableAttrID +--# vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Attr.ForbiddenClasses.txt b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Attr.ForbiddenClasses.txt new file mode 100644 index 0000000..f31d226 --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Attr.ForbiddenClasses.txt @@ -0,0 +1,8 @@ +Attr.ForbiddenClasses +TYPE: lookup +VERSION: 4.0.0 +DEFAULT: array() +--DESCRIPTION-- +List of forbidden class values in the class attribute. By default, this is +empty, which means that no classes are forbidden. See also %Attr.AllowedClasses. +--# vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Attr.IDBlacklist.txt b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Attr.IDBlacklist.txt new file mode 100644 index 0000000..5f2b5e3 --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Attr.IDBlacklist.txt @@ -0,0 +1,5 @@ +Attr.IDBlacklist +TYPE: list +DEFAULT: array() +DESCRIPTION: Array of IDs not allowed in the document. +--# vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Attr.IDBlacklistRegexp.txt b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Attr.IDBlacklistRegexp.txt new file mode 100644 index 0000000..6f58245 --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Attr.IDBlacklistRegexp.txt @@ -0,0 +1,9 @@ +Attr.IDBlacklistRegexp +TYPE: string/null +VERSION: 1.6.0 +DEFAULT: NULL +--DESCRIPTION-- +PCRE regular expression to be matched against all IDs. If the expression is +matches, the ID is rejected. Use this with care: may cause significant +degradation. ID matching is done after all other validation. +--# vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Attr.IDPrefix.txt b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Attr.IDPrefix.txt new file mode 100644 index 0000000..cc49d43 --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Attr.IDPrefix.txt @@ -0,0 +1,12 @@ +Attr.IDPrefix +TYPE: string +VERSION: 1.2.0 +DEFAULT: '' +--DESCRIPTION-- +String to prefix to IDs. If you have no idea what IDs your pages may use, +you may opt to simply add a prefix to all user-submitted ID attributes so +that they are still usable, but will not conflict with core page IDs. +Example: setting the directive to 'user_' will result in a user submitted +'foo' to become 'user_foo' Be sure to set %HTML.EnableAttrID to true +before using this. +--# vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Attr.IDPrefixLocal.txt b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Attr.IDPrefixLocal.txt new file mode 100644 index 0000000..2c5924a --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Attr.IDPrefixLocal.txt @@ -0,0 +1,14 @@ +Attr.IDPrefixLocal +TYPE: string +VERSION: 1.2.0 +DEFAULT: '' +--DESCRIPTION-- +Temporary prefix for IDs used in conjunction with %Attr.IDPrefix. If you +need to allow multiple sets of user content on web page, you may need to +have a seperate prefix that changes with each iteration. This way, +seperately submitted user content displayed on the same page doesn't +clobber each other. Ideal values are unique identifiers for the content it +represents (i.e. the id of the row in the database). Be sure to add a +seperator (like an underscore) at the end. Warning: this directive will +not work unless %Attr.IDPrefix is set to a non-empty value! +--# vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Attr.txt b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Attr.txt new file mode 100644 index 0000000..2d72049 --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Attr.txt @@ -0,0 +1,3 @@ +Attr +DESCRIPTION: Features regarding attribute validation. +--# vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/AutoFormat.AutoParagraph.txt b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/AutoFormat.AutoParagraph.txt new file mode 100644 index 0000000..d5caa1b --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/AutoFormat.AutoParagraph.txt @@ -0,0 +1,31 @@ +AutoFormat.AutoParagraph +TYPE: bool +VERSION: 2.0.1 +DEFAULT: false +--DESCRIPTION-- + +

+ This directive turns on auto-paragraphing, where double newlines are + converted in to paragraphs whenever possible. Auto-paragraphing: +

+
    +
  • Always applies to inline elements or text in the root node,
    • +
  • Applies to inline elements or text with double newlines in nodes + that allow paragraph tags,
    • +
  • Applies to double newlines in paragraph tags
    • +
+

+ p tags must be allowed for this directive to take effect. + We do not use br tags for paragraphing, as that is + semantically incorrect. +

+

+ To prevent auto-paragraphing as a content-producer, refrain from using + double-newlines except to specify a new paragraph or in contexts where + it has special meaning (whitespace usually has no meaning except in + tags like pre, so this should not be difficult.) To prevent + the paragraphing of inline text adjacent to block elements, wrap them + in div tags (the behavior is slightly different outside of + the root node.) +

+--# vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/AutoFormat.Custom.txt b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/AutoFormat.Custom.txt new file mode 100644 index 0000000..2a47648 --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/AutoFormat.Custom.txt @@ -0,0 +1,12 @@ +AutoFormat.Custom +TYPE: list +VERSION: 2.0.1 +DEFAULT: array() +--DESCRIPTION-- + +

+ This directive can be used to add custom auto-format injectors. + Specify an array of injector names (class name minus the prefix) + or concrete implementations. Injector class must exist. +

+--# vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/AutoFormat.DisplayLinkURI.txt b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/AutoFormat.DisplayLinkURI.txt new file mode 100644 index 0000000..663064a --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/AutoFormat.DisplayLinkURI.txt @@ -0,0 +1,11 @@ +AutoFormat.DisplayLinkURI +TYPE: bool +VERSION: 3.2.0 +DEFAULT: false +--DESCRIPTION-- +

+ This directive turns on the in-text display of URIs in <a> tags, and disables + those links. For example, example becomes + example (http://example.com). +

+--# vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/AutoFormat.Linkify.txt b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/AutoFormat.Linkify.txt new file mode 100644 index 0000000..3a48ba9 --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/AutoFormat.Linkify.txt @@ -0,0 +1,12 @@ +AutoFormat.Linkify +TYPE: bool +VERSION: 2.0.1 +DEFAULT: false +--DESCRIPTION-- + +

+ This directive turns on linkification, auto-linking http, ftp and + https URLs. a tags with the href attribute + must be allowed. +

+--# vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/AutoFormat.PurifierLinkify.DocURL.txt b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/AutoFormat.PurifierLinkify.DocURL.txt new file mode 100644 index 0000000..db58b13 --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/AutoFormat.PurifierLinkify.DocURL.txt @@ -0,0 +1,12 @@ +AutoFormat.PurifierLinkify.DocURL +TYPE: string +VERSION: 2.0.1 +DEFAULT: '#%s' +ALIASES: AutoFormatParam.PurifierLinkifyDocURL +--DESCRIPTION-- +

+ Location of configuration documentation to link to, let %s substitute + into the configuration's namespace and directive names sans the percent + sign. +

+--# vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/AutoFormat.PurifierLinkify.txt b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/AutoFormat.PurifierLinkify.txt new file mode 100644 index 0000000..7996488 --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/AutoFormat.PurifierLinkify.txt @@ -0,0 +1,12 @@ +AutoFormat.PurifierLinkify +TYPE: bool +VERSION: 2.0.1 +DEFAULT: false +--DESCRIPTION-- + +

+ Internal auto-formatter that converts configuration directives in + syntax %Namespace.Directive to links. a tags + with the href attribute must be allowed. +

+--# vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/AutoFormat.RemoveEmpty.RemoveNbsp.Exceptions.txt b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/AutoFormat.RemoveEmpty.RemoveNbsp.Exceptions.txt new file mode 100644 index 0000000..35c393b --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/AutoFormat.RemoveEmpty.RemoveNbsp.Exceptions.txt @@ -0,0 +1,11 @@ +AutoFormat.RemoveEmpty.RemoveNbsp.Exceptions +TYPE: lookup +VERSION: 4.0.0 +DEFAULT: array('td' => true, 'th' => true) +--DESCRIPTION-- +

+ When %AutoFormat.RemoveEmpty and %AutoFormat.RemoveEmpty.RemoveNbsp + are enabled, this directive defines what HTML elements should not be + removede if they have only a non-breaking space in them. +

+--# vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/AutoFormat.RemoveEmpty.RemoveNbsp.txt b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/AutoFormat.RemoveEmpty.RemoveNbsp.txt new file mode 100644 index 0000000..ca17eb1 --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/AutoFormat.RemoveEmpty.RemoveNbsp.txt @@ -0,0 +1,15 @@ +AutoFormat.RemoveEmpty.RemoveNbsp +TYPE: bool +VERSION: 4.0.0 +DEFAULT: false +--DESCRIPTION-- +

+ When enabled, HTML Purifier will treat any elements that contain only + non-breaking spaces as well as regular whitespace as empty, and remove + them when %AutoForamt.RemoveEmpty is enabled. +

+

+ See %AutoFormat.RemoveEmpty.RemoveNbsp.Exceptions for a list of elements + that don't have this behavior applied to them. +

+--# vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/AutoFormat.RemoveEmpty.txt b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/AutoFormat.RemoveEmpty.txt new file mode 100644 index 0000000..34657ba --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/AutoFormat.RemoveEmpty.txt @@ -0,0 +1,46 @@ +AutoFormat.RemoveEmpty +TYPE: bool +VERSION: 3.2.0 +DEFAULT: false +--DESCRIPTION-- +

+ When enabled, HTML Purifier will attempt to remove empty elements that + contribute no semantic information to the document. The following types + of nodes will be removed: +

+
  • + Tags with no attributes and no content, and that are not empty + elements (remove <a></a> but not + <br />), and +
    • +
  • + Tags with no content, except for:
      +
    • The colgroup element, or
      • +
    • + Elements with the id or name attribute, + when those attributes are permitted on those elements. +
      • +
    • +
+

+ Please be very careful when using this functionality; while it may not + seem that empty elements contain useful information, they can alter the + layout of a document given appropriate styling. This directive is most + useful when you are processing machine-generated HTML, please avoid using + it on regular user HTML. +

+

+ Elements that contain only whitespace will be treated as empty. Non-breaking + spaces, however, do not count as whitespace. See + %AutoFormat.RemoveEmpty.RemoveNbsp for alternate behavior. +

+

+ This algorithm is not perfect; you may still notice some empty tags, + particularly if a node had elements, but those elements were later removed + because they were not permitted in that context, or tags that, after + being auto-closed by another tag, where empty. This is for safety reasons + to prevent clever code from breaking validation. The general rule of thumb: + if a tag looked empty on the way in, it will get removed; if HTML Purifier + made it empty, it will stay. +

+--# vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/AutoFormat.RemoveSpansWithoutAttributes.txt b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/AutoFormat.RemoveSpansWithoutAttributes.txt new file mode 100644 index 0000000..dde990a --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/AutoFormat.RemoveSpansWithoutAttributes.txt @@ -0,0 +1,11 @@ +AutoFormat.RemoveSpansWithoutAttributes +TYPE: bool +VERSION: 4.0.1 +DEFAULT: false +--DESCRIPTION-- +

+ This directive causes span tags without any attributes + to be removed. It will also remove spans that had all attributes + removed during processing. +

+--# vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/AutoFormat.txt b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/AutoFormat.txt new file mode 100644 index 0000000..161a52e --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/AutoFormat.txt @@ -0,0 +1,3 @@ +AutoFormat +DESCRIPTION: Configuration for activating auto-formatting functionality (also known as Injectors) +--# vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/AutoFormatParam.PurifierLinkifyDocURL.txt b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/AutoFormatParam.PurifierLinkifyDocURL.txt new file mode 100644 index 0000000..3e8309e --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/AutoFormatParam.PurifierLinkifyDocURL.txt @@ -0,0 +1,12 @@ +AutoFormatParam.PurifierLinkifyDocURL +TYPE: string +VERSION: 2.0.1 +DEFAULT: '#%s' +--DESCRIPTION-- + +

+ Location of configuration documentation to link to, let %s substitute + into the configuration's namespace and directive names sans the percent + sign. +

+--# vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/AutoFormatParam.txt b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/AutoFormatParam.txt new file mode 100644 index 0000000..6097a55 --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/AutoFormatParam.txt @@ -0,0 +1,3 @@ +AutoFormatParam +DESCRIPTION: Configuration for customizing auto-formatting functionality +--# vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/CSS.AllowImportant.txt b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/CSS.AllowImportant.txt new file mode 100644 index 0000000..b324608 --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/CSS.AllowImportant.txt @@ -0,0 +1,8 @@ +CSS.AllowImportant +TYPE: bool +DEFAULT: false +VERSION: 3.1.0 +--DESCRIPTION-- +This parameter determines whether or not !important cascade modifiers should +be allowed in user CSS. If false, !important will stripped. +--# vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/CSS.AllowTricky.txt b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/CSS.AllowTricky.txt new file mode 100644 index 0000000..748be0e --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/CSS.AllowTricky.txt @@ -0,0 +1,11 @@ +CSS.AllowTricky +TYPE: bool +DEFAULT: false +VERSION: 3.1.0 +--DESCRIPTION-- +This parameter determines whether or not to allow "tricky" CSS properties and +values. Tricky CSS properties/values can drastically modify page layout or +be used for deceptive practices but do not directly constitute a security risk. +For example, display:none; is considered a tricky property that +will only be allowed if this directive is set to true. +--# vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/CSS.AllowedFonts.txt b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/CSS.AllowedFonts.txt new file mode 100644 index 0000000..3fd4654 --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/CSS.AllowedFonts.txt @@ -0,0 +1,12 @@ +CSS.AllowedFonts +TYPE: lookup/null +VERSION: 4.3.0 +DEFAULT: NULL +--DESCRIPTION-- +

+ Allows you to manually specify a set of allowed fonts. If + NULL, all fonts are allowed. This directive + affects generic names (serif, sans-serif, monospace, cursive, + fantasy) as well as specific font families. +

+--# vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/CSS.AllowedProperties.txt b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/CSS.AllowedProperties.txt new file mode 100644 index 0000000..460112e --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/CSS.AllowedProperties.txt @@ -0,0 +1,18 @@ +CSS.AllowedProperties +TYPE: lookup/null +VERSION: 3.1.0 +DEFAULT: NULL +--DESCRIPTION-- + +

+ If HTML Purifier's style attributes set is unsatisfactory for your needs, + you can overload it with your own list of tags to allow. Note that this + method is subtractive: it does its job by taking away from HTML Purifier + usual feature set, so you cannot add an attribute that HTML Purifier never + supported in the first place. +

+

+ Warning: If another directive conflicts with the + elements here, that directive will win and override. +

+--# vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/CSS.DefinitionRev.txt b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/CSS.DefinitionRev.txt new file mode 100644 index 0000000..5cb7dda --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/CSS.DefinitionRev.txt @@ -0,0 +1,11 @@ +CSS.DefinitionRev +TYPE: int +VERSION: 2.0.0 +DEFAULT: 1 +--DESCRIPTION-- + +

+ Revision identifier for your custom definition. See + %HTML.DefinitionRev for details. +

+--# vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/CSS.ForbiddenProperties.txt b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/CSS.ForbiddenProperties.txt new file mode 100644 index 0000000..f1f5c5f --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/CSS.ForbiddenProperties.txt @@ -0,0 +1,13 @@ +CSS.ForbiddenProperties +TYPE: lookup +VERSION: 4.2.0 +DEFAULT: array() +--DESCRIPTION-- +

+ This is the logical inverse of %CSS.AllowedProperties, and it will + override that directive or any other directive. If possible, + %CSS.AllowedProperties is recommended over this directive, + because it can sometimes be difficult to tell whether or not you've + forbidden all of the CSS properties you truly would like to disallow. +

+--# vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/CSS.MaxImgLength.txt b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/CSS.MaxImgLength.txt new file mode 100644 index 0000000..7a32914 --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/CSS.MaxImgLength.txt @@ -0,0 +1,16 @@ +CSS.MaxImgLength +TYPE: string/null +DEFAULT: '1200px' +VERSION: 3.1.1 +--DESCRIPTION-- +

+ This parameter sets the maximum allowed length on img tags, + effectively the width and height properties. + Only absolute units of measurement (in, pt, pc, mm, cm) and pixels (px) are allowed. This is + in place to prevent imagecrash attacks, disable with null at your own risk. + This directive is similar to %HTML.MaxImgLength, and both should be + concurrently edited, although there are + subtle differences in the input format (the CSS max is a number with + a unit). +

+--# vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/CSS.Proprietary.txt b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/CSS.Proprietary.txt new file mode 100644 index 0000000..148eedb --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/CSS.Proprietary.txt @@ -0,0 +1,10 @@ +CSS.Proprietary +TYPE: bool +VERSION: 3.0.0 +DEFAULT: false +--DESCRIPTION-- + +

+ Whether or not to allow safe, proprietary CSS values. +

+--# vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/CSS.Trusted.txt b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/CSS.Trusted.txt new file mode 100644 index 0000000..e733a61 --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/CSS.Trusted.txt @@ -0,0 +1,9 @@ +CSS.Trusted +TYPE: bool +VERSION: 4.2.1 +DEFAULT: false +--DESCRIPTION-- +Indicates whether or not the user's CSS input is trusted or not. If the +input is trusted, a more expansive set of allowed properties. See +also %HTML.Trusted. +--# vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/CSS.txt b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/CSS.txt new file mode 100644 index 0000000..d14b490 --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/CSS.txt @@ -0,0 +1,3 @@ +CSS +DESCRIPTION: Configuration regarding allowed CSS. +--# vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Cache.DefinitionImpl.txt b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Cache.DefinitionImpl.txt new file mode 100644 index 0000000..c486724 --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Cache.DefinitionImpl.txt @@ -0,0 +1,14 @@ +Cache.DefinitionImpl +TYPE: string/null +VERSION: 2.0.0 +DEFAULT: 'Serializer' +--DESCRIPTION-- + +This directive defines which method to use when caching definitions, +the complex data-type that makes HTML Purifier tick. Set to null +to disable caching (not recommended, as you will see a definite +performance degradation). + +--ALIASES-- +Core.DefinitionCache +--# vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Cache.SerializerPath.txt b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Cache.SerializerPath.txt new file mode 100644 index 0000000..5403650 --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Cache.SerializerPath.txt @@ -0,0 +1,13 @@ +Cache.SerializerPath +TYPE: string/null +VERSION: 2.0.0 +DEFAULT: NULL +--DESCRIPTION-- + +

+ Absolute path with no trailing slash to store serialized definitions in. + Default is within the + HTML Purifier library inside DefinitionCache/Serializer. This + path must be writable by the webserver. +

+--# vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Cache.SerializerPermissions.txt b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Cache.SerializerPermissions.txt new file mode 100644 index 0000000..b2b83d9 --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Cache.SerializerPermissions.txt @@ -0,0 +1,11 @@ +Cache.SerializerPermissions +TYPE: int +VERSION: 4.3.0 +DEFAULT: 0755 +--DESCRIPTION-- + +

+ Directory permissions of the files and directories created inside + the DefinitionCache/Serializer or other custom serializer path. +

+--# vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Cache.txt b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Cache.txt new file mode 100644 index 0000000..57f3023 --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Cache.txt @@ -0,0 +1,3 @@ +Cache +DESCRIPTION: Configuration for DefinitionCache and related subclasses. +--# vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Core.AggressivelyFixLt.txt b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Core.AggressivelyFixLt.txt new file mode 100644 index 0000000..568cbf3 --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Core.AggressivelyFixLt.txt @@ -0,0 +1,18 @@ +Core.AggressivelyFixLt +TYPE: bool +VERSION: 2.1.0 +DEFAULT: true +--DESCRIPTION-- +

+ This directive enables aggressive pre-filter fixes HTML Purifier can + perform in order to ensure that open angled-brackets do not get killed + during parsing stage. Enabling this will result in two preg_replace_callback + calls and at least two preg_replace calls for every HTML document parsed; + if your users make very well-formed HTML, you can set this directive false. + This has no effect when DirectLex is used. +

+

+ Notice: This directive's default turned from false to true + in HTML Purifier 3.2.0. +

+--# vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Core.CollectErrors.txt b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Core.CollectErrors.txt new file mode 100644 index 0000000..d731791 --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Core.CollectErrors.txt @@ -0,0 +1,12 @@ +Core.CollectErrors +TYPE: bool +VERSION: 2.0.0 +DEFAULT: false +--DESCRIPTION-- + +Whether or not to collect errors found while filtering the document. This +is a useful way to give feedback to your users. Warning: +Currently this feature is very patchy and experimental, with lots of +possible error messages not yet implemented. It will not cause any +problems, but it may not help your users either. +--# vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Core.ColorKeywords.txt b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Core.ColorKeywords.txt new file mode 100644 index 0000000..08b381d --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Core.ColorKeywords.txt @@ -0,0 +1,28 @@ +Core.ColorKeywords +TYPE: hash +VERSION: 2.0.0 +--DEFAULT-- +array ( + 'maroon' => '#800000', + 'red' => '#FF0000', + 'orange' => '#FFA500', + 'yellow' => '#FFFF00', + 'olive' => '#808000', + 'purple' => '#800080', + 'fuchsia' => '#FF00FF', + 'white' => '#FFFFFF', + 'lime' => '#00FF00', + 'green' => '#008000', + 'navy' => '#000080', + 'blue' => '#0000FF', + 'aqua' => '#00FFFF', + 'teal' => '#008080', + 'black' => '#000000', + 'silver' => '#C0C0C0', + 'gray' => '#808080', +) +--DESCRIPTION-- + +Lookup array of color names to six digit hexadecimal number corresponding +to color, with preceding hash mark. Used when parsing colors. +--# vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Core.ConvertDocumentToFragment.txt b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Core.ConvertDocumentToFragment.txt new file mode 100644 index 0000000..64b114f --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Core.ConvertDocumentToFragment.txt @@ -0,0 +1,14 @@ +Core.ConvertDocumentToFragment +TYPE: bool +DEFAULT: true +--DESCRIPTION-- + +This parameter determines whether or not the filter should convert +input that is a full document with html and body tags to a fragment +of just the contents of a body tag. This parameter is simply something +HTML Purifier can do during an edge-case: for most inputs, this +processing is not necessary. + +--ALIASES-- +Core.AcceptFullDocuments +--# vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Core.DirectLexLineNumberSyncInterval.txt b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Core.DirectLexLineNumberSyncInterval.txt new file mode 100644 index 0000000..36f16e0 --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Core.DirectLexLineNumberSyncInterval.txt @@ -0,0 +1,17 @@ +Core.DirectLexLineNumberSyncInterval +TYPE: int +VERSION: 2.0.0 +DEFAULT: 0 +--DESCRIPTION-- + +

+ Specifies the number of tokens the DirectLex line number tracking + implementations should process before attempting to resyncronize the + current line count by manually counting all previous new-lines. When + at 0, this functionality is disabled. Lower values will decrease + performance, and this is only strictly necessary if the counting + algorithm is buggy (in which case you should report it as a bug). + This has no effect when %Core.MaintainLineNumbers is disabled or DirectLex is + not being used. +

+--# vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Core.Encoding.txt b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Core.Encoding.txt new file mode 100644 index 0000000..8bfb47c --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Core.Encoding.txt @@ -0,0 +1,15 @@ +Core.Encoding +TYPE: istring +DEFAULT: 'utf-8' +--DESCRIPTION-- +If for some reason you are unable to convert all webpages to UTF-8, you can +use this directive as a stop-gap compatibility change to let HTML Purifier +deal with non UTF-8 input. This technique has notable deficiencies: +absolutely no characters outside of the selected character encoding will be +preserved, not even the ones that have been ampersand escaped (this is due +to a UTF-8 specific feature that automatically resolves all +entities), making it pretty useless for anything except the most I18N-blind +applications, although %Core.EscapeNonASCIICharacters offers fixes this +trouble with another tradeoff. This directive only accepts ISO-8859-1 if +iconv is not enabled. +--# vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Core.EscapeInvalidChildren.txt b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Core.EscapeInvalidChildren.txt new file mode 100644 index 0000000..4d5b505 --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Core.EscapeInvalidChildren.txt @@ -0,0 +1,10 @@ +Core.EscapeInvalidChildren +TYPE: bool +DEFAULT: false +--DESCRIPTION-- +When true, a child is found that is not allowed in the context of the +parent element will be transformed into text as if it were ASCII. When +false, that element and all internal tags will be dropped, though text will +be preserved. There is no option for dropping the element but preserving +child nodes. +--# vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Core.EscapeInvalidTags.txt b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Core.EscapeInvalidTags.txt new file mode 100644 index 0000000..a7a5b24 --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Core.EscapeInvalidTags.txt @@ -0,0 +1,7 @@ +Core.EscapeInvalidTags +TYPE: bool +DEFAULT: false +--DESCRIPTION-- +When true, invalid tags will be written back to the document as plain text. +Otherwise, they are silently dropped. +--# vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Core.EscapeNonASCIICharacters.txt b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Core.EscapeNonASCIICharacters.txt new file mode 100644 index 0000000..abb4999 --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Core.EscapeNonASCIICharacters.txt @@ -0,0 +1,13 @@ +Core.EscapeNonASCIICharacters +TYPE: bool +VERSION: 1.4.0 +DEFAULT: false +--DESCRIPTION-- +This directive overcomes a deficiency in %Core.Encoding by blindly +converting all non-ASCII characters into decimal numeric entities before +converting it to its native encoding. This means that even characters that +can be expressed in the non-UTF-8 encoding will be entity-ized, which can +be a real downer for encodings like Big5. It also assumes that the ASCII +repetoire is available, although this is the case for almost all encodings. +Anyway, use UTF-8! +--# vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Core.HiddenElements.txt b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Core.HiddenElements.txt new file mode 100644 index 0000000..915391e --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Core.HiddenElements.txt @@ -0,0 +1,19 @@ +Core.HiddenElements +TYPE: lookup +--DEFAULT-- +array ( + 'script' => true, + 'style' => true, +) +--DESCRIPTION-- + +

+ This directive is a lookup array of elements which should have their + contents removed when they are not allowed by the HTML definition. + For example, the contents of a script tag are not + normally shown in a document, so if script tags are to be removed, + their contents should be removed to. This is opposed to a b + tag, which defines some presentational changes but does not hide its + contents. +

+--# vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Core.Language.txt b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Core.Language.txt new file mode 100644 index 0000000..233fca1 --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Core.Language.txt @@ -0,0 +1,10 @@ +Core.Language +TYPE: string +VERSION: 2.0.0 +DEFAULT: 'en' +--DESCRIPTION-- + +ISO 639 language code for localizable things in HTML Purifier to use, +which is mainly error reporting. There is currently only an English (en) +translation, so this directive is currently useless. +--# vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Core.LexerImpl.txt b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Core.LexerImpl.txt new file mode 100644 index 0000000..8983e2c --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Core.LexerImpl.txt @@ -0,0 +1,34 @@ +Core.LexerImpl +TYPE: mixed/null +VERSION: 2.0.0 +DEFAULT: NULL +--DESCRIPTION-- + +

+ This parameter determines what lexer implementation can be used. The + valid values are: +

+
+
null
+
+ Recommended, the lexer implementation will be auto-detected based on + your PHP-version and configuration. +
+
string lexer identifier
+
+ This is a slim way of manually overridding the implementation. + Currently recognized values are: DOMLex (the default PHP5 +implementation) + and DirectLex (the default PHP4 implementation). Only use this if + you know what you are doing: usually, the auto-detection will + manage things for cases you aren't even aware of. +
+
object lexer instance
+
+ Super-advanced: you can specify your own, custom, implementation that + implements the interface defined by HTMLPurifier_Lexer. + I may remove this option simply because I don't expect anyone + to use it. +
+
+--# vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Core.MaintainLineNumbers.txt b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Core.MaintainLineNumbers.txt new file mode 100644 index 0000000..eb841a7 --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Core.MaintainLineNumbers.txt @@ -0,0 +1,16 @@ +Core.MaintainLineNumbers +TYPE: bool/null +VERSION: 2.0.0 +DEFAULT: NULL +--DESCRIPTION-- + +

+ If true, HTML Purifier will add line number information to all tokens. + This is useful when error reporting is turned on, but can result in + significant performance degradation and should not be used when + unnecessary. This directive must be used with the DirectLex lexer, + as the DOMLex lexer does not (yet) support this functionality. + If the value is null, an appropriate value will be selected based + on other configuration. +

+--# vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Core.NormalizeNewlines.txt b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Core.NormalizeNewlines.txt new file mode 100644 index 0000000..d77f536 --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Core.NormalizeNewlines.txt @@ -0,0 +1,11 @@ +Core.NormalizeNewlines +TYPE: bool +VERSION: 4.2.0 +DEFAULT: true +--DESCRIPTION-- +

+ Whether or not to normalize newlines to the operating + system default. When false, HTML Purifier + will attempt to preserve mixed newline files. +

+--# vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Core.RemoveInvalidImg.txt b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Core.RemoveInvalidImg.txt new file mode 100644 index 0000000..4070c2a --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Core.RemoveInvalidImg.txt @@ -0,0 +1,12 @@ +Core.RemoveInvalidImg +TYPE: bool +DEFAULT: true +VERSION: 1.3.0 +--DESCRIPTION-- + +

+ This directive enables pre-emptive URI checking in img + tags, as the attribute validation strategy is not authorized to + remove elements from the document. Revert to pre-1.3.0 behavior by setting to false. +

+--# vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Core.RemoveProcessingInstructions.txt b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Core.RemoveProcessingInstructions.txt new file mode 100644 index 0000000..3397d9f --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Core.RemoveProcessingInstructions.txt @@ -0,0 +1,11 @@ +Core.RemoveProcessingInstructions +TYPE: bool +VERSION: 4.2.0 +DEFAULT: false +--DESCRIPTION-- +Instead of escaping processing instructions in the form <? ... +?>, remove it out-right. This may be useful if the HTML +you are validating contains XML processing instruction gunk, however, +it can also be user-unfriendly for people attempting to post PHP +snippets. +--# vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Core.RemoveScriptContents.txt b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Core.RemoveScriptContents.txt new file mode 100644 index 0000000..a4cd966 --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Core.RemoveScriptContents.txt @@ -0,0 +1,12 @@ +Core.RemoveScriptContents +TYPE: bool/null +DEFAULT: NULL +VERSION: 2.0.0 +DEPRECATED-VERSION: 2.1.0 +DEPRECATED-USE: Core.HiddenElements +--DESCRIPTION-- +

+ This directive enables HTML Purifier to remove not only script tags + but all of their contents. +

+--# vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Core.txt b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Core.txt new file mode 100644 index 0000000..5edfe07 --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Core.txt @@ -0,0 +1,3 @@ +Core +DESCRIPTION: Core features that are always available. +--# vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Filter.Custom.txt b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Filter.Custom.txt new file mode 100644 index 0000000..3db50ef --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Filter.Custom.txt @@ -0,0 +1,11 @@ +Filter.Custom +TYPE: list +VERSION: 3.1.0 +DEFAULT: array() +--DESCRIPTION-- +

+ This directive can be used to add custom filters; it is nearly the + equivalent of the now deprecated HTMLPurifier->addFilter() + method. Specify an array of concrete implementations. +

+--# vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Filter.ExtractStyleBlocks.Escaping.txt b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Filter.ExtractStyleBlocks.Escaping.txt new file mode 100644 index 0000000..16829bc --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Filter.ExtractStyleBlocks.Escaping.txt @@ -0,0 +1,14 @@ +Filter.ExtractStyleBlocks.Escaping +TYPE: bool +VERSION: 3.0.0 +DEFAULT: true +ALIASES: Filter.ExtractStyleBlocksEscaping, FilterParam.ExtractStyleBlocksEscaping +--DESCRIPTION-- + +

+ Whether or not to escape the dangerous characters <, > and & + as \3C, \3E and \26, respectively. This is can be safely set to false + if the contents of StyleBlocks will be placed in an external stylesheet, + where there is no risk of it being interpreted as HTML. +

+--# vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Filter.ExtractStyleBlocks.Scope.txt b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Filter.ExtractStyleBlocks.Scope.txt new file mode 100644 index 0000000..7f95f54 --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Filter.ExtractStyleBlocks.Scope.txt @@ -0,0 +1,29 @@ +Filter.ExtractStyleBlocks.Scope +TYPE: string/null +VERSION: 3.0.0 +DEFAULT: NULL +ALIASES: Filter.ExtractStyleBlocksScope, FilterParam.ExtractStyleBlocksScope +--DESCRIPTION-- + +

+ If you would like users to be able to define external stylesheets, but + only allow them to specify CSS declarations for a specific node and + prevent them from fiddling with other elements, use this directive. + It accepts any valid CSS selector, and will prepend this to any + CSS declaration extracted from the document. For example, if this + directive is set to #user-content and a user uses the + selector a:hover, the final selector will be + #user-content a:hover. +

+

+ The comma shorthand may be used; consider the above example, with + #user-content, #user-content2, the final selector will + be #user-content a:hover, #user-content2 a:hover. +

+

+ Warning: It is possible for users to bypass this measure + using a naughty + selector. This is a bug in CSS Tidy 1.3, not HTML + Purifier, and I am working to get it fixed. Until then, HTML Purifier + performs a basic check to prevent this. +

+--# vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Filter.ExtractStyleBlocks.TidyImpl.txt b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Filter.ExtractStyleBlocks.TidyImpl.txt new file mode 100644 index 0000000..6c231b2 --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Filter.ExtractStyleBlocks.TidyImpl.txt @@ -0,0 +1,16 @@ +Filter.ExtractStyleBlocks.TidyImpl +TYPE: mixed/null +VERSION: 3.1.0 +DEFAULT: NULL +ALIASES: FilterParam.ExtractStyleBlocksTidyImpl +--DESCRIPTION-- +

+ If left NULL, HTML Purifier will attempt to instantiate a csstidy + class to use for internal cleaning. This will usually be good enough. +

+

+ However, for trusted user input, you can set this to false to + disable cleaning. In addition, you can supply your own concrete implementation + of Tidy's interface to use, although I don't know why you'd want to do that. +

+--# vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Filter.ExtractStyleBlocks.txt b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Filter.ExtractStyleBlocks.txt new file mode 100644 index 0000000..078d087 --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Filter.ExtractStyleBlocks.txt @@ -0,0 +1,74 @@ +Filter.ExtractStyleBlocks +TYPE: bool +VERSION: 3.1.0 +DEFAULT: false +EXTERNAL: CSSTidy +--DESCRIPTION-- +

+ This directive turns on the style block extraction filter, which removes + style blocks from input HTML, cleans them up with CSSTidy, + and places them in the StyleBlocks context variable, for further + use by you, usually to be placed in an external stylesheet, or a + style block in the head of your document. +

+

+ Sample usage: +

+
';
+?>
+
+
+
+  Filter.ExtractStyleBlocks
+body {color:#F00;} Some text';
+
+    $config = HTMLPurifier_Config::createDefault();
+    $config->set('Filter', 'ExtractStyleBlocks', true);
+    $purifier = new HTMLPurifier($config);
+
+    $html = $purifier->purify($dirty);
+
+    // This implementation writes the stylesheets to the styles/ directory.
+    // You can also echo the styles inside the document, but it's a bit
+    // more difficult to make sure they get interpreted properly by
+    // browsers; try the usual CSS armoring techniques.
+    $styles = $purifier->context->get('StyleBlocks');
+    $dir = 'styles/';
+    if (!is_dir($dir)) mkdir($dir);
+    $hash = sha1($_GET['html']);
+    foreach ($styles as $i => $style) {
+        file_put_contents($name = $dir . $hash . "_$i");
+        echo '';
+    }
+?>
+
+
+  

+    
+  

+
+
+]]>
+

+ Warning: It is possible for a user to mount an + imagecrash attack using this CSS. Counter-measures are difficult; + it is not simply enough to limit the range of CSS lengths (using + relative lengths with many nesting levels allows for large values + to be attained without actually specifying them in the stylesheet), + and the flexible nature of selectors makes it difficult to selectively + disable lengths on image tags (HTML Purifier, however, does disable + CSS width and height in inline styling). There are probably two effective + counter measures: an explicit width and height set to auto in all + images in your document (unlikely) or the disabling of width and + height (somewhat reasonable). Whether or not these measures should be + used is left to the reader. +

+--# vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Filter.YouTube.txt b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Filter.YouTube.txt new file mode 100644 index 0000000..321eaa2 --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Filter.YouTube.txt @@ -0,0 +1,16 @@ +Filter.YouTube +TYPE: bool +VERSION: 3.1.0 +DEFAULT: false +--DESCRIPTION-- +

+ Warning: Deprecated in favor of %HTML.SafeObject and + %Output.FlashCompat (turn both on to allow YouTube videos and other + Flash content). +

+

+ This directive enables YouTube video embedding in HTML Purifier. Check + this document + on embedding videos for more information on what this filter does. +

+--# vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Filter.txt b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Filter.txt new file mode 100644 index 0000000..f2d25a1 --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Filter.txt @@ -0,0 +1,3 @@ +Filter +DESCRIPTION: Directives for turning filters on and off, or specifying custom filters. +--# vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/FilterParam.ExtractStyleBlocksEscaping.txt b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/FilterParam.ExtractStyleBlocksEscaping.txt new file mode 100644 index 0000000..d436ed0 --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/FilterParam.ExtractStyleBlocksEscaping.txt @@ -0,0 +1,14 @@ +FilterParam.ExtractStyleBlocksEscaping +TYPE: bool +VERSION: 3.0.0 +DEFAULT: true +ALIASES: Filter.ExtractStyleBlocksEscaping +--DESCRIPTION-- + +

+ Whether or not to escape the dangerous characters <, > and & + as \3C, \3E and \26, respectively. This is can be safely set to false + if the contents of StyleBlocks will be placed in an external stylesheet, + where there is no risk of it being interpreted as HTML. +

+--# vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/FilterParam.ExtractStyleBlocksScope.txt b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/FilterParam.ExtractStyleBlocksScope.txt new file mode 100644 index 0000000..3943529 --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/FilterParam.ExtractStyleBlocksScope.txt @@ -0,0 +1,29 @@ +FilterParam.ExtractStyleBlocksScope +TYPE: string/null +VERSION: 3.0.0 +DEFAULT: NULL +ALIASES: Filter.ExtractStyleBlocksScope +--DESCRIPTION-- + +

+ If you would like users to be able to define external stylesheets, but + only allow them to specify CSS declarations for a specific node and + prevent them from fiddling with other elements, use this directive. + It accepts any valid CSS selector, and will prepend this to any + CSS declaration extracted from the document. For example, if this + directive is set to #user-content and a user uses the + selector a:hover, the final selector will be + #user-content a:hover. +

+

+ The comma shorthand may be used; consider the above example, with + #user-content, #user-content2, the final selector will + be #user-content a:hover, #user-content2 a:hover. +

+

+ Warning: It is possible for users to bypass this measure + using a naughty + selector. This is a bug in CSS Tidy 1.3, not HTML + Purifier, and I am working to get it fixed. Until then, HTML Purifier + performs a basic check to prevent this. +

+--# vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/FilterParam.ExtractStyleBlocksTidyImpl.txt b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/FilterParam.ExtractStyleBlocksTidyImpl.txt new file mode 100644 index 0000000..cafccf8 --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/FilterParam.ExtractStyleBlocksTidyImpl.txt @@ -0,0 +1,15 @@ +FilterParam.ExtractStyleBlocksTidyImpl +TYPE: mixed/null +VERSION: 3.1.0 +DEFAULT: NULL +--DESCRIPTION-- +

+ If left NULL, HTML Purifier will attempt to instantiate a csstidy + class to use for internal cleaning. This will usually be good enough. +

+

+ However, for trusted user input, you can set this to false to + disable cleaning. In addition, you can supply your own concrete implementation + of Tidy's interface to use, although I don't know why you'd want to do that. +

+--# vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/FilterParam.txt b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/FilterParam.txt new file mode 100644 index 0000000..dff9784 --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/FilterParam.txt @@ -0,0 +1,3 @@ +FilterParam +DESCRIPTION: Configuration for filters. +--# vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/HTML.Allowed.txt b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/HTML.Allowed.txt new file mode 100644 index 0000000..0b2c106 --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/HTML.Allowed.txt @@ -0,0 +1,25 @@ +HTML.Allowed +TYPE: itext/null +VERSION: 2.0.0 +DEFAULT: NULL +--DESCRIPTION-- + +

+ This is a preferred convenience directive that combines + %HTML.AllowedElements and %HTML.AllowedAttributes. + Specify elements and attributes that are allowed using: + element1[attr1|attr2],element2.... For example, + if you would like to only allow paragraphs and links, specify + a[href],p. You can specify attributes that apply + to all elements using an asterisk, e.g. *[lang]. + You can also use newlines instead of commas to separate elements. +

+

+ Warning: + All of the constraints on the component directives are still enforced. + The syntax is a subset of TinyMCE's valid_elements + whitelist: directly copy-pasting it here will probably result in + broken whitelists. If %HTML.AllowedElements or %HTML.AllowedAttributes + are set, this directive has no effect. +

+--# vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/HTML.AllowedAttributes.txt b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/HTML.AllowedAttributes.txt new file mode 100644 index 0000000..fcf093f --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/HTML.AllowedAttributes.txt @@ -0,0 +1,19 @@ +HTML.AllowedAttributes +TYPE: lookup/null +VERSION: 1.3.0 +DEFAULT: NULL +--DESCRIPTION-- + +

+ If HTML Purifier's attribute set is unsatisfactory, overload it! + The syntax is "tag.attr" or "*.attr" for the global attributes + (style, id, class, dir, lang, xml:lang). +

+

+ Warning: If another directive conflicts with the + elements here, that directive will win and override. For + example, %HTML.EnableAttrID will take precedence over *.id in this + directive. You must set that directive to true before you can use + IDs at all. +

+--# vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/HTML.AllowedElements.txt b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/HTML.AllowedElements.txt new file mode 100644 index 0000000..1d3fa79 --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/HTML.AllowedElements.txt @@ -0,0 +1,23 @@ +HTML.AllowedElements +TYPE: lookup/null +VERSION: 1.3.0 +DEFAULT: NULL +--DESCRIPTION-- +

+ If HTML Purifier's tag set is unsatisfactory for your needs, you can + overload it with your own list of tags to allow. If you change + this, you probably also want to change %HTML.AllowedAttributes; see + also %HTML.Allowed which lets you set allowed elements and + attributes at the same time. +

+

+ If you attempt to allow an element that HTML Purifier does not know + about, HTML Purifier will raise an error. You will need to manually + tell HTML Purifier about this element by using the + advanced customization features. +

+

+ Warning: If another directive conflicts with the + elements here, that directive will win and override. +

+--# vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/HTML.AllowedModules.txt b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/HTML.AllowedModules.txt new file mode 100644 index 0000000..5a59a55 --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/HTML.AllowedModules.txt @@ -0,0 +1,20 @@ +HTML.AllowedModules +TYPE: lookup/null +VERSION: 2.0.0 +DEFAULT: NULL +--DESCRIPTION-- + +

+ A doctype comes with a set of usual modules to use. Without having + to mucking about with the doctypes, you can quickly activate or + disable these modules by specifying which modules you wish to allow + with this directive. This is most useful for unit testing specific + modules, although end users may find it useful for their own ends. +

+

+ If you specify a module that does not exist, the manager will silently + fail to use it, so be careful! User-defined modules are not affected + by this directive. Modules defined in %HTML.CoreModules are not + affected by this directive. +

+--# vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/HTML.Attr.Name.UseCDATA.txt b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/HTML.Attr.Name.UseCDATA.txt new file mode 100644 index 0000000..151fb7b --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/HTML.Attr.Name.UseCDATA.txt @@ -0,0 +1,11 @@ +HTML.Attr.Name.UseCDATA +TYPE: bool +DEFAULT: false +VERSION: 4.0.0 +--DESCRIPTION-- +The W3C specification DTD defines the name attribute to be CDATA, not ID, due +to limitations of DTD. In certain documents, this relaxed behavior is desired, +whether it is to specify duplicate names, or to specify names that would be +illegal IDs (for example, names that begin with a digit.) Set this configuration +directive to true to use the relaxed parsing rules. +--# vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/HTML.BlockWrapper.txt b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/HTML.BlockWrapper.txt new file mode 100644 index 0000000..45ae469 --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/HTML.BlockWrapper.txt @@ -0,0 +1,18 @@ +HTML.BlockWrapper +TYPE: string +VERSION: 1.3.0 +DEFAULT: 'p' +--DESCRIPTION-- + +

+ String name of element to wrap inline elements that are inside a block + context. This only occurs in the children of blockquote in strict mode. +

+

+ Example: by default value, + <blockquote>Foo</blockquote> would become + <blockquote><p>Foo</p></blockquote>. + The <p> tags can be replaced with whatever you desire, + as long as it is a block level element. +

+--# vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/HTML.CoreModules.txt b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/HTML.CoreModules.txt new file mode 100644 index 0000000..5246188 --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/HTML.CoreModules.txt @@ -0,0 +1,23 @@ +HTML.CoreModules +TYPE: lookup +VERSION: 2.0.0 +--DEFAULT-- +array ( + 'Structure' => true, + 'Text' => true, + 'Hypertext' => true, + 'List' => true, + 'NonXMLCommonAttributes' => true, + 'XMLCommonAttributes' => true, + 'CommonAttributes' => true, +) +--DESCRIPTION-- + +

+ Certain modularized doctypes (XHTML, namely), have certain modules + that must be included for the doctype to be an conforming document + type: put those modules here. By default, XHTML's core modules + are used. You can set this to a blank array to disable core module + protection, but this is not recommended. +

+--# vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/HTML.CustomDoctype.txt b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/HTML.CustomDoctype.txt new file mode 100644 index 0000000..a64e3d7 --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/HTML.CustomDoctype.txt @@ -0,0 +1,9 @@ +HTML.CustomDoctype +TYPE: string/null +VERSION: 2.0.1 +DEFAULT: NULL +--DESCRIPTION-- + +A custom doctype for power-users who defined there own document +type. This directive only applies when %HTML.Doctype is blank. +--# vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/HTML.DefinitionID.txt b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/HTML.DefinitionID.txt new file mode 100644 index 0000000..103db75 --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/HTML.DefinitionID.txt @@ -0,0 +1,33 @@ +HTML.DefinitionID +TYPE: string/null +DEFAULT: NULL +VERSION: 2.0.0 +--DESCRIPTION-- + +

+ Unique identifier for a custom-built HTML definition. If you edit + the raw version of the HTMLDefinition, introducing changes that the + configuration object does not reflect, you must specify this variable. + If you change your custom edits, you should change this directive, or + clear your cache. Example: +

+
+$config = HTMLPurifier_Config::createDefault();
+$config->set('HTML', 'DefinitionID', '1');
+$def = $config->getHTMLDefinition();
+$def->addAttribute('a', 'tabindex', 'Number');
+
+

+ In the above example, the configuration is still at the defaults, but + using the advanced API, an extra attribute has been added. The + configuration object normally has no way of knowing that this change + has taken place, so it needs an extra directive: %HTML.DefinitionID. + If someone else attempts to use the default configuration, these two + pieces of code will not clobber each other in the cache, since one has + an extra directive attached to it. +

+

+ You must specify a value to this directive to use the + advanced API features. +

+--# vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/HTML.DefinitionRev.txt b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/HTML.DefinitionRev.txt new file mode 100644 index 0000000..229ae02 --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/HTML.DefinitionRev.txt @@ -0,0 +1,16 @@ +HTML.DefinitionRev +TYPE: int +VERSION: 2.0.0 +DEFAULT: 1 +--DESCRIPTION-- + +

+ Revision identifier for your custom definition specified in + %HTML.DefinitionID. This serves the same purpose: uniquely identifying + your custom definition, but this one does so in a chronological + context: revision 3 is more up-to-date then revision 2. Thus, when + this gets incremented, the cache handling is smart enough to clean + up any older revisions of your definition as well as flush the + cache. +

+--# vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/HTML.Doctype.txt b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/HTML.Doctype.txt new file mode 100644 index 0000000..9dab497 --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/HTML.Doctype.txt @@ -0,0 +1,11 @@ +HTML.Doctype +TYPE: string/null +DEFAULT: NULL +--DESCRIPTION-- +Doctype to use during filtering. Technically speaking this is not actually +a doctype (as it does not identify a corresponding DTD), but we are using +this name for sake of simplicity. When non-blank, this will override any +older directives like %HTML.XHTML or %HTML.Strict. +--ALLOWED-- +'HTML 4.01 Transitional', 'HTML 4.01 Strict', 'XHTML 1.0 Transitional', 'XHTML 1.0 Strict', 'XHTML 1.1' +--# vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/HTML.FlashAllowFullScreen.txt b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/HTML.FlashAllowFullScreen.txt new file mode 100644 index 0000000..7878dc0 --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/HTML.FlashAllowFullScreen.txt @@ -0,0 +1,11 @@ +HTML.FlashAllowFullScreen +TYPE: bool +VERSION: 4.2.0 +DEFAULT: false +--DESCRIPTION-- +

+ Whether or not to permit embedded Flash content from + %HTML.SafeObject to expand to the full screen. Corresponds to + the allowFullScreen parameter. +

+--# vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/HTML.ForbiddenAttributes.txt b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/HTML.ForbiddenAttributes.txt new file mode 100644 index 0000000..57358f9 --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/HTML.ForbiddenAttributes.txt @@ -0,0 +1,21 @@ +HTML.ForbiddenAttributes +TYPE: lookup +VERSION: 3.1.0 +DEFAULT: array() +--DESCRIPTION-- +

+ While this directive is similar to %HTML.AllowedAttributes, for + forwards-compatibility with XML, this attribute has a different syntax. Instead of + tag.attr, use tag@attr. To disallow href + attributes in a tags, set this directive to + a@href. You can also disallow an attribute globally with + attr or *@attr (either syntax is fine; the latter + is provided for consistency with %HTML.AllowedAttributes). +

+

+ Warning: This directive complements %HTML.ForbiddenElements, + accordingly, check + out that directive for a discussion of why you + should think twice before using this directive. +

+--# vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/HTML.ForbiddenElements.txt b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/HTML.ForbiddenElements.txt new file mode 100644 index 0000000..93a53e1 --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/HTML.ForbiddenElements.txt @@ -0,0 +1,20 @@ +HTML.ForbiddenElements +TYPE: lookup +VERSION: 3.1.0 +DEFAULT: array() +--DESCRIPTION-- +

+ This was, perhaps, the most requested feature ever in HTML + Purifier. Please don't abuse it! This is the logical inverse of + %HTML.AllowedElements, and it will override that directive, or any + other directive. +

+

+ If possible, %HTML.Allowed is recommended over this directive, because it + can sometimes be difficult to tell whether or not you've forbidden all of + the behavior you would like to disallow. If you forbid img + with the expectation of preventing images on your site, you'll be in for + a nasty surprise when people start using the background-image + CSS property. +

+--# vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/HTML.MaxImgLength.txt b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/HTML.MaxImgLength.txt new file mode 100644 index 0000000..e424c38 --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/HTML.MaxImgLength.txt @@ -0,0 +1,14 @@ +HTML.MaxImgLength +TYPE: int/null +DEFAULT: 1200 +VERSION: 3.1.1 +--DESCRIPTION-- +

+ This directive controls the maximum number of pixels in the width and + height attributes in img tags. This is + in place to prevent imagecrash attacks, disable with null at your own risk. + This directive is similar to %CSS.MaxImgLength, and both should be + concurrently edited, although there are + subtle differences in the input format (the HTML max is an integer). +

+--# vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/HTML.Nofollow.txt b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/HTML.Nofollow.txt new file mode 100644 index 0000000..700b309 --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/HTML.Nofollow.txt @@ -0,0 +1,7 @@ +HTML.Nofollow +TYPE: bool +VERSION: 4.3.0 +DEFAULT: FALSE +--DESCRIPTION-- +If enabled, nofollow rel attributes are added to all outgoing links. +--# vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/HTML.Parent.txt b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/HTML.Parent.txt new file mode 100644 index 0000000..62e8e16 --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/HTML.Parent.txt @@ -0,0 +1,12 @@ +HTML.Parent +TYPE: string +VERSION: 1.3.0 +DEFAULT: 'div' +--DESCRIPTION-- + +

+ String name of element that HTML fragment passed to library will be + inserted in. An interesting variation would be using span as the + parent element, meaning that only inline tags would be allowed. +

+--# vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/HTML.Proprietary.txt b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/HTML.Proprietary.txt new file mode 100644 index 0000000..dfb7204 --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/HTML.Proprietary.txt @@ -0,0 +1,12 @@ +HTML.Proprietary +TYPE: bool +VERSION: 3.1.0 +DEFAULT: false +--DESCRIPTION-- +

+ Whether or not to allow proprietary elements and attributes in your + documents, as per HTMLPurifier_HTMLModule_Proprietary. + Warning: This can cause your documents to stop + validating! +

+--# vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/HTML.SafeEmbed.txt b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/HTML.SafeEmbed.txt new file mode 100644 index 0000000..cdda09a --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/HTML.SafeEmbed.txt @@ -0,0 +1,13 @@ +HTML.SafeEmbed +TYPE: bool +VERSION: 3.1.1 +DEFAULT: false +--DESCRIPTION-- +

+ Whether or not to permit embed tags in documents, with a number of extra + security features added to prevent script execution. This is similar to + what websites like MySpace do to embed tags. Embed is a proprietary + element and will cause your website to stop validating; you should + see if you can use %Output.FlashCompat with %HTML.SafeObject instead + first.

+--# vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/HTML.SafeObject.txt b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/HTML.SafeObject.txt new file mode 100644 index 0000000..ceb342e --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/HTML.SafeObject.txt @@ -0,0 +1,13 @@ +HTML.SafeObject +TYPE: bool +VERSION: 3.1.1 +DEFAULT: false +--DESCRIPTION-- +

+ Whether or not to permit object tags in documents, with a number of extra + security features added to prevent script execution. This is similar to + what websites like MySpace do to object tags. You should also enable + %Output.FlashCompat in order to generate Internet Explorer + compatibility code for your object tags. +

+--# vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/HTML.Strict.txt b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/HTML.Strict.txt new file mode 100644 index 0000000..a8b1de5 --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/HTML.Strict.txt @@ -0,0 +1,9 @@ +HTML.Strict +TYPE: bool +VERSION: 1.3.0 +DEFAULT: false +DEPRECATED-VERSION: 1.7.0 +DEPRECATED-USE: HTML.Doctype +--DESCRIPTION-- +Determines whether or not to use Transitional (loose) or Strict rulesets. +--# vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/HTML.TidyAdd.txt b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/HTML.TidyAdd.txt new file mode 100644 index 0000000..b4c271b --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/HTML.TidyAdd.txt @@ -0,0 +1,8 @@ +HTML.TidyAdd +TYPE: lookup +VERSION: 2.0.0 +DEFAULT: array() +--DESCRIPTION-- + +Fixes to add to the default set of Tidy fixes as per your level. +--# vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/HTML.TidyLevel.txt b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/HTML.TidyLevel.txt new file mode 100644 index 0000000..4186ccd --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/HTML.TidyLevel.txt @@ -0,0 +1,24 @@ +HTML.TidyLevel +TYPE: string +VERSION: 2.0.0 +DEFAULT: 'medium' +--DESCRIPTION-- + +

General level of cleanliness the Tidy module should enforce. +There are four allowed values:

+
+
none
+
No extra tidying should be done
+
light
+
Only fix elements that would be discarded otherwise due to + lack of support in doctype
+
medium
+
Enforce best practices
+
heavy
+
Transform all deprecated elements and attributes to standards + compliant equivalents
+
+ +--ALLOWED-- +'none', 'light', 'medium', 'heavy' +--# vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/HTML.TidyRemove.txt b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/HTML.TidyRemove.txt new file mode 100644 index 0000000..996762b --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/HTML.TidyRemove.txt @@ -0,0 +1,8 @@ +HTML.TidyRemove +TYPE: lookup +VERSION: 2.0.0 +DEFAULT: array() +--DESCRIPTION-- + +Fixes to remove from the default set of Tidy fixes as per your level. +--# vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/HTML.Trusted.txt b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/HTML.Trusted.txt new file mode 100644 index 0000000..1db9237 --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/HTML.Trusted.txt @@ -0,0 +1,9 @@ +HTML.Trusted +TYPE: bool +VERSION: 2.0.0 +DEFAULT: false +--DESCRIPTION-- +Indicates whether or not the user input is trusted or not. If the input is +trusted, a more expansive set of allowed tags and attributes will be used. +See also %CSS.Trusted. +--# vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/HTML.XHTML.txt b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/HTML.XHTML.txt new file mode 100644 index 0000000..2a47e38 --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/HTML.XHTML.txt @@ -0,0 +1,11 @@ +HTML.XHTML +TYPE: bool +DEFAULT: true +VERSION: 1.1.0 +DEPRECATED-VERSION: 1.7.0 +DEPRECATED-USE: HTML.Doctype +--DESCRIPTION-- +Determines whether or not output is XHTML 1.0 or HTML 4.01 flavor. +--ALIASES-- +Core.XHTML +--# vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/HTML.txt b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/HTML.txt new file mode 100644 index 0000000..f32ceb5 --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/HTML.txt @@ -0,0 +1,3 @@ +HTML +DESCRIPTION: Configuration regarding allowed HTML. +--# vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Output.CommentScriptContents.txt b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Output.CommentScriptContents.txt new file mode 100644 index 0000000..08921fd --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Output.CommentScriptContents.txt @@ -0,0 +1,10 @@ +Output.CommentScriptContents +TYPE: bool +VERSION: 2.0.0 +DEFAULT: true +--DESCRIPTION-- +Determines whether or not HTML Purifier should attempt to fix up the +contents of script tags for legacy browsers with comments. +--ALIASES-- +Core.CommentScriptContents +--# vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Output.FixInnerHTML.txt b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Output.FixInnerHTML.txt new file mode 100644 index 0000000..d6f0d9f --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Output.FixInnerHTML.txt @@ -0,0 +1,15 @@ +Output.FixInnerHTML +TYPE: bool +VERSION: 4.3.0 +DEFAULT: true +--DESCRIPTION-- +

+ If true, HTML Purifier will protect against Internet Explorer's + mishandling of the innerHTML attribute by appending + a space to any attribute that does not contain angled brackets, spaces + or quotes, but contains a backtick. This slightly changes the + semantics of any given attribute, so if this is unacceptable and + you do not use innerHTML on any of your pages, you can + turn this directive off. +

+--# vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Output.FlashCompat.txt b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Output.FlashCompat.txt new file mode 100644 index 0000000..93398e8 --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Output.FlashCompat.txt @@ -0,0 +1,11 @@ +Output.FlashCompat +TYPE: bool +VERSION: 4.1.0 +DEFAULT: false +--DESCRIPTION-- +

+ If true, HTML Purifier will generate Internet Explorer compatibility + code for all object code. This is highly recommended if you enable + %HTML.SafeObject. +

+--# vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Output.Newline.txt b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Output.Newline.txt new file mode 100644 index 0000000..79f8ad8 --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Output.Newline.txt @@ -0,0 +1,13 @@ +Output.Newline +TYPE: string/null +VERSION: 2.0.1 +DEFAULT: NULL +--DESCRIPTION-- + +

+ Newline string to format final output with. If left null, HTML Purifier + will auto-detect the default newline type of the system and use that; + you can manually override it here. Remember, \r\n is Windows, \r + is Mac, and \n is Unix. +

+--# vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Output.SortAttr.txt b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Output.SortAttr.txt new file mode 100644 index 0000000..232b023 --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Output.SortAttr.txt @@ -0,0 +1,14 @@ +Output.SortAttr +TYPE: bool +VERSION: 3.2.0 +DEFAULT: false +--DESCRIPTION-- +

+ If true, HTML Purifier will sort attributes by name before writing them back + to the document, converting a tag like: <el b="" a="" c="" /> + to <el a="" b="" c="" />. This is a workaround for + a bug in FCKeditor which causes it to swap attributes order, adding noise + to text diffs. If you're not seeing this bug, chances are, you don't need + this directive. +

+--# vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Output.TidyFormat.txt b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Output.TidyFormat.txt new file mode 100644 index 0000000..06bab00 --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Output.TidyFormat.txt @@ -0,0 +1,25 @@ +Output.TidyFormat +TYPE: bool +VERSION: 1.1.1 +DEFAULT: false +--DESCRIPTION-- +

+ Determines whether or not to run Tidy on the final output for pretty + formatting reasons, such as indentation and wrap. +

+

+ This can greatly improve readability for editors who are hand-editing + the HTML, but is by no means necessary as HTML Purifier has already + fixed all major errors the HTML may have had. Tidy is a non-default + extension, and this directive will silently fail if Tidy is not + available. +

+

+ If you are looking to make the overall look of your page's source + better, I recommend running Tidy on the entire page rather than just + user-content (after all, the indentation relative to the containing + blocks will be incorrect). +

+--ALIASES-- +Core.TidyFormat +--# vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Output.txt b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Output.txt new file mode 100644 index 0000000..7849d60 --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Output.txt @@ -0,0 +1,3 @@ +Output +DESCRIPTION: Configuration relating to the generation of (X)HTML. +--# vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Test.ForceNoIconv.txt b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Test.ForceNoIconv.txt new file mode 100644 index 0000000..071bc02 --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Test.ForceNoIconv.txt @@ -0,0 +1,7 @@ +Test.ForceNoIconv +TYPE: bool +DEFAULT: false +--DESCRIPTION-- +When set to true, HTMLPurifier_Encoder will act as if iconv does not exist +and use only pure PHP implementations. +--# vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Test.txt b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Test.txt new file mode 100644 index 0000000..5025f9d --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/Test.txt @@ -0,0 +1,3 @@ +Test +DESCRIPTION: Developer testing configuration for our unit tests. +--# vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/URI.AllowedSchemes.txt b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/URI.AllowedSchemes.txt new file mode 100644 index 0000000..666635a --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/URI.AllowedSchemes.txt @@ -0,0 +1,17 @@ +URI.AllowedSchemes +TYPE: lookup +--DEFAULT-- +array ( + 'http' => true, + 'https' => true, + 'mailto' => true, + 'ftp' => true, + 'nntp' => true, + 'news' => true, +) +--DESCRIPTION-- +Whitelist that defines the schemes that a URI is allowed to have. This +prevents XSS attacks from using pseudo-schemes like javascript or mocha. +There is also support for the data and file +URI schemes, but they are not enabled by default. +--# vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/URI.Base.txt b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/URI.Base.txt new file mode 100644 index 0000000..876f068 --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/URI.Base.txt @@ -0,0 +1,17 @@ +URI.Base +TYPE: string/null +VERSION: 2.1.0 +DEFAULT: NULL +--DESCRIPTION-- + +

+ The base URI is the URI of the document this purified HTML will be + inserted into. This information is important if HTML Purifier needs + to calculate absolute URIs from relative URIs, such as when %URI.MakeAbsolute + is on. You may use a non-absolute URI for this value, but behavior + may vary (%URI.MakeAbsolute deals nicely with both absolute and + relative paths, but forwards-compatibility is not guaranteed). + Warning: If set, the scheme on this URI + overrides the one specified by %URI.DefaultScheme. +

+--# vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/URI.DefaultScheme.txt b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/URI.DefaultScheme.txt new file mode 100644 index 0000000..728e378 --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/URI.DefaultScheme.txt @@ -0,0 +1,10 @@ +URI.DefaultScheme +TYPE: string +DEFAULT: 'http' +--DESCRIPTION-- + +

+ Defines through what scheme the output will be served, in order to + select the proper object validator when no scheme information is present. +

+--# vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/URI.DefinitionID.txt b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/URI.DefinitionID.txt new file mode 100644 index 0000000..f05312b --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/URI.DefinitionID.txt @@ -0,0 +1,11 @@ +URI.DefinitionID +TYPE: string/null +VERSION: 2.1.0 +DEFAULT: NULL +--DESCRIPTION-- + +

+ Unique identifier for a custom-built URI definition. If you want + to add custom URIFilters, you must specify this value. +

+--# vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/URI.DefinitionRev.txt b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/URI.DefinitionRev.txt new file mode 100644 index 0000000..80cfea9 --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/URI.DefinitionRev.txt @@ -0,0 +1,11 @@ +URI.DefinitionRev +TYPE: int +VERSION: 2.1.0 +DEFAULT: 1 +--DESCRIPTION-- + +

+ Revision identifier for your custom definition. See + %HTML.DefinitionRev for details. +

+--# vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/URI.Disable.txt b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/URI.Disable.txt new file mode 100644 index 0000000..71ce025 --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/URI.Disable.txt @@ -0,0 +1,14 @@ +URI.Disable +TYPE: bool +VERSION: 1.3.0 +DEFAULT: false +--DESCRIPTION-- + +

+ Disables all URIs in all forms. Not sure why you'd want to do that + (after all, the Internet's founded on the notion of a hyperlink). +

+ +--ALIASES-- +Attr.DisableURI +--# vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/URI.DisableExternal.txt b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/URI.DisableExternal.txt new file mode 100644 index 0000000..13c122c --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/URI.DisableExternal.txt @@ -0,0 +1,11 @@ +URI.DisableExternal +TYPE: bool +VERSION: 1.2.0 +DEFAULT: false +--DESCRIPTION-- +Disables links to external websites. This is a highly effective anti-spam +and anti-pagerank-leech measure, but comes at a hefty price: nolinks or +images outside of your domain will be allowed. Non-linkified URIs will +still be preserved. If you want to be able to link to subdomains or use +absolute URIs, specify %URI.Host for your website. +--# vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/URI.DisableExternalResources.txt b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/URI.DisableExternalResources.txt new file mode 100644 index 0000000..abcc1ef --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/URI.DisableExternalResources.txt @@ -0,0 +1,13 @@ +URI.DisableExternalResources +TYPE: bool +VERSION: 1.3.0 +DEFAULT: false +--DESCRIPTION-- +Disables the embedding of external resources, preventing users from +embedding things like images from other hosts. This prevents access +tracking (good for email viewers), bandwidth leeching, cross-site request +forging, goatse.cx posting, and other nasties, but also results in a loss +of end-user functionality (they can't directly post a pic they posted from +Flickr anymore). Use it if you don't have a robust user-content moderation +team. +--# vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/URI.DisableResources.txt b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/URI.DisableResources.txt new file mode 100644 index 0000000..f891de4 --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/URI.DisableResources.txt @@ -0,0 +1,15 @@ +URI.DisableResources +TYPE: bool +VERSION: 4.2.0 +DEFAULT: false +--DESCRIPTION-- +

+ Disables embedding resources, essentially meaning no pictures. You can + still link to them though. See %URI.DisableExternalResources for why + this might be a good idea. +

+

+ Note: While this directive has been available since 1.3.0, + it didn't actually start doing anything until 4.2.0. +

+--# vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/URI.Host.txt b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/URI.Host.txt new file mode 100644 index 0000000..ee83b12 --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/URI.Host.txt @@ -0,0 +1,19 @@ +URI.Host +TYPE: string/null +VERSION: 1.2.0 +DEFAULT: NULL +--DESCRIPTION-- + +

+ Defines the domain name of the server, so we can determine whether or + an absolute URI is from your website or not. Not strictly necessary, + as users should be using relative URIs to reference resources on your + website. It will, however, let you use absolute URIs to link to + subdomains of the domain you post here: i.e. example.com will allow + sub.example.com. However, higher up domains will still be excluded: + if you set %URI.Host to sub.example.com, example.com will be blocked. + Note: This directive overrides %URI.Base because + a given page may be on a sub-domain, but you wish HTML Purifier to be + more relaxed and allow some of the parent domains too. +

+--# vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/URI.HostBlacklist.txt b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/URI.HostBlacklist.txt new file mode 100644 index 0000000..0b6df76 --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/URI.HostBlacklist.txt @@ -0,0 +1,9 @@ +URI.HostBlacklist +TYPE: list +VERSION: 1.3.0 +DEFAULT: array() +--DESCRIPTION-- +List of strings that are forbidden in the host of any URI. Use it to kill +domain names of spam, etc. Note that it will catch anything in the domain, +so moo.com will catch moo.com.example.com. +--# vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/URI.MakeAbsolute.txt b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/URI.MakeAbsolute.txt new file mode 100644 index 0000000..4214900 --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/URI.MakeAbsolute.txt @@ -0,0 +1,13 @@ +URI.MakeAbsolute +TYPE: bool +VERSION: 2.1.0 +DEFAULT: false +--DESCRIPTION-- + +

+ Converts all URIs into absolute forms. This is useful when the HTML + being filtered assumes a specific base path, but will actually be + viewed in a different context (and setting an alternate base URI is + not possible). %URI.Base must be set for this directive to work. +

+--# vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/URI.Munge.txt b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/URI.Munge.txt new file mode 100644 index 0000000..58c81dc --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/URI.Munge.txt @@ -0,0 +1,83 @@ +URI.Munge +TYPE: string/null +VERSION: 1.3.0 +DEFAULT: NULL +--DESCRIPTION-- + +

+ Munges all browsable (usually http, https and ftp) + absolute URIs into another URI, usually a URI redirection service. + This directive accepts a URI, formatted with a %s where + the url-encoded original URI should be inserted (sample: + http://www.google.com/url?q=%s). +

+

+ Uses for this directive: +

+
    +
  • + Prevent PageRank leaks, while being fairly transparent + to users (you may also want to add some client side JavaScript to + override the text in the statusbar). Notice: + Many security experts believe that this form of protection does not deter spam-bots. +
    • +
  • + Redirect users to a splash page telling them they are leaving your + website. While this is poor usability practice, it is often mandated + in corporate environments. +
    • +
+

+ Prior to HTML Purifier 3.1.1, this directive also enabled the munging + of browsable external resources, which could break things if your redirection + script was a splash page or used meta tags. To revert to + previous behavior, please use %URI.MungeResources. +

+

+ You may want to also use %URI.MungeSecretKey along with this directive + in order to enforce what URIs your redirector script allows. Open + redirector scripts can be a security risk and negatively affect the + reputation of your domain name. +

+

+ Starting with HTML Purifier 3.1.1, there is also these substitutions: +

+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
KeyDescriptionExample <a href="">
%r1 - The URI embeds a resource
(blank) - The URI is merely a link
%nThe name of the tag this URI came froma
%mThe name of the attribute this URI came fromhref
%pThe name of the CSS property this URI came from, or blank if irrelevant
+

+ Admittedly, these letters are somewhat arbitrary; the only stipulation + was that they couldn't be a through f. r is for resource (I would have preferred + e, but you take what you can get), n is for name, m + was picked because it came after n (and I couldn't use a), p is for + property. +

+--# vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/URI.MungeResources.txt b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/URI.MungeResources.txt new file mode 100644 index 0000000..6fce0fd --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/URI.MungeResources.txt @@ -0,0 +1,17 @@ +URI.MungeResources +TYPE: bool +VERSION: 3.1.1 +DEFAULT: false +--DESCRIPTION-- +

+ If true, any URI munging directives like %URI.Munge + will also apply to embedded resources, such as <img src="">. + Be careful enabling this directive if you have a redirector script + that does not use the Location HTTP header; all of your images + and other embedded resources will break. +

+

+ Warning: It is strongly advised you use this in conjunction + %URI.MungeSecretKey to mitigate the security risk of an open redirector. +

+--# vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/URI.MungeSecretKey.txt b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/URI.MungeSecretKey.txt new file mode 100644 index 0000000..0d00f62 --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/URI.MungeSecretKey.txt @@ -0,0 +1,30 @@ +URI.MungeSecretKey +TYPE: string/null +VERSION: 3.1.1 +DEFAULT: NULL +--DESCRIPTION-- +

+ This directive enables secure checksum generation along with %URI.Munge. + It should be set to a secure key that is not shared with anyone else. + The checksum can be placed in the URI using %t. Use of this checksum + affords an additional level of protection by allowing a redirector + to check if a URI has passed through HTML Purifier with this line: +

+ +
$checksum === sha1($secret_key . ':' . $url)
+ +

+ If the output is TRUE, the redirector script should accept the URI. +

+ +

+ Please note that it would still be possible for an attacker to procure + secure hashes en-mass by abusing your website's Preview feature or the + like, but this service affords an additional level of protection + that should be combined with website blacklisting. +

+ +

+ Remember this has no effect if %URI.Munge is not on. +

+--# vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/URI.OverrideAllowedSchemes.txt b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/URI.OverrideAllowedSchemes.txt new file mode 100644 index 0000000..23331a4 --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/URI.OverrideAllowedSchemes.txt @@ -0,0 +1,9 @@ +URI.OverrideAllowedSchemes +TYPE: bool +DEFAULT: true +--DESCRIPTION-- +If this is set to true (which it is by default), you can override +%URI.AllowedSchemes by simply registering a HTMLPurifier_URIScheme to the +registry. If false, you will also have to update that directive in order +to add more schemes. +--# vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/URI.txt b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/URI.txt new file mode 100644 index 0000000..a13060f --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/URI.txt @@ -0,0 +1,3 @@ +URI +DESCRIPTION: Features regarding Uniform Resource Identifiers. +--# vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/info.ini b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/info.ini new file mode 100644 index 0000000..5de4505 --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ConfigSchema/schema/info.ini @@ -0,0 +1,3 @@ +name = "HTML Purifier" + +; vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ContentSets.php b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ContentSets.php new file mode 100644 index 0000000..3b6e96f --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ContentSets.php @@ -0,0 +1,155 @@ + true) indexed by name. + * @note This is in HTMLPurifier_HTMLDefinition->info_content_sets + */ + public $lookup = array(); + + /** + * Synchronized list of defined content sets (keys of info) + */ + protected $keys = array(); + /** + * Synchronized list of defined content values (values of info) + */ + protected $values = array(); + + /** + * Merges in module's content sets, expands identifiers in the content + * sets and populates the keys, values and lookup member variables. + * @param $modules List of HTMLPurifier_HTMLModule + */ + public function __construct($modules) { + if (!is_array($modules)) $modules = array($modules); + // populate content_sets based on module hints + // sorry, no way of overloading + foreach ($modules as $module_i => $module) { + foreach ($module->content_sets as $key => $value) { + $temp = $this->convertToLookup($value); + if (isset($this->lookup[$key])) { + // add it into the existing content set + $this->lookup[$key] = array_merge($this->lookup[$key], $temp); + } else { + $this->lookup[$key] = $temp; + } + } + } + $old_lookup = false; + while ($old_lookup !== $this->lookup) { + $old_lookup = $this->lookup; + foreach ($this->lookup as $i => $set) { + $add = array(); + foreach ($set as $element => $x) { + if (isset($this->lookup[$element])) { + $add += $this->lookup[$element]; + unset($this->lookup[$i][$element]); + } + } + $this->lookup[$i] += $add; + } + } + + foreach ($this->lookup as $key => $lookup) { + $this->info[$key] = implode(' | ', array_keys($lookup)); + } + $this->keys = array_keys($this->info); + $this->values = array_values($this->info); + } + + /** + * Accepts a definition; generates and assigns a ChildDef for it + * @param $def HTMLPurifier_ElementDef reference + * @param $module Module that defined the ElementDef + */ + public function generateChildDef(&$def, $module) { + if (!empty($def->child)) return; // already done! + $content_model = $def->content_model; + if (is_string($content_model)) { + // Assume that $this->keys is alphanumeric + $def->content_model = preg_replace_callback( + '/\b(' . implode('|', $this->keys) . ')\b/', + array($this, 'generateChildDefCallback'), + $content_model + ); + //$def->content_model = str_replace( + // $this->keys, $this->values, $content_model); + } + $def->child = $this->getChildDef($def, $module); + } + + public function generateChildDefCallback($matches) { + return $this->info[$matches[0]]; + } + + /** + * Instantiates a ChildDef based on content_model and content_model_type + * member variables in HTMLPurifier_ElementDef + * @note This will also defer to modules for custom HTMLPurifier_ChildDef + * subclasses that need content set expansion + * @param $def HTMLPurifier_ElementDef to have ChildDef extracted + * @return HTMLPurifier_ChildDef corresponding to ElementDef + */ + public function getChildDef($def, $module) { + $value = $def->content_model; + if (is_object($value)) { + trigger_error( + 'Literal object child definitions should be stored in '. + 'ElementDef->child not ElementDef->content_model', + E_USER_NOTICE + ); + return $value; + } + switch ($def->content_model_type) { + case 'required': + return new HTMLPurifier_ChildDef_Required($value); + case 'optional': + return new HTMLPurifier_ChildDef_Optional($value); + case 'empty': + return new HTMLPurifier_ChildDef_Empty(); + case 'custom': + return new HTMLPurifier_ChildDef_Custom($value); + } + // defer to its module + $return = false; + if ($module->defines_child_def) { // save a func call + $return = $module->getChildDef($def); + } + if ($return !== false) return $return; + // error-out + trigger_error( + 'Could not determine which ChildDef class to instantiate', + E_USER_ERROR + ); + return false; + } + + /** + * Converts a string list of elements separated by pipes into + * a lookup array. + * @param $string List of elements + * @return Lookup array of elements + */ + protected function convertToLookup($string) { + $array = explode('|', str_replace(' ', '', $string)); + $ret = array(); + foreach ($array as $i => $k) { + $ret[$k] = true; + } + return $ret; + } + +} + +// vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/Context.php b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/Context.php new file mode 100644 index 0000000..9ddf0c5 --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/Context.php @@ -0,0 +1,82 @@ +_storage[$name])) { + trigger_error("Name $name produces collision, cannot re-register", + E_USER_ERROR); + return; + } + $this->_storage[$name] =& $ref; + } + + /** + * Retrieves a variable reference from the context. + * @param $name String name + * @param $ignore_error Boolean whether or not to ignore error + */ + public function &get($name, $ignore_error = false) { + if (!isset($this->_storage[$name])) { + if (!$ignore_error) { + trigger_error("Attempted to retrieve non-existent variable $name", + E_USER_ERROR); + } + $var = null; // so we can return by reference + return $var; + } + return $this->_storage[$name]; + } + + /** + * Destorys a variable in the context. + * @param $name String name + */ + public function destroy($name) { + if (!isset($this->_storage[$name])) { + trigger_error("Attempted to destroy non-existent variable $name", + E_USER_ERROR); + return; + } + unset($this->_storage[$name]); + } + + /** + * Checks whether or not the variable exists. + * @param $name String name + */ + public function exists($name) { + return isset($this->_storage[$name]); + } + + /** + * Loads a series of variables from an associative array + * @param $context_array Assoc array of variables to load + */ + public function loadArray($context_array) { + foreach ($context_array as $key => $discard) { + $this->register($key, $context_array[$key]); + } + } + +} + +// vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/Definition.php b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/Definition.php new file mode 100644 index 0000000..c7f82eb --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/Definition.php @@ -0,0 +1,50 @@ +setup) return; + $this->setup = true; + $this->doSetup($config); + } + +} + +// vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/DefinitionCache.php b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/DefinitionCache.php new file mode 100644 index 0000000..c6e1e38 --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/DefinitionCache.php @@ -0,0 +1,108 @@ +type = $type; + } + + /** + * Generates a unique identifier for a particular configuration + * @param Instance of HTMLPurifier_Config + */ + public function generateKey($config) { + return $config->version . ',' . // possibly replace with function calls + $config->getBatchSerial($this->type) . ',' . + $config->get($this->type . '.DefinitionRev'); + } + + /** + * Tests whether or not a key is old with respect to the configuration's + * version and revision number. + * @param $key Key to test + * @param $config Instance of HTMLPurifier_Config to test against + */ + public function isOld($key, $config) { + if (substr_count($key, ',') < 2) return true; + list($version, $hash, $revision) = explode(',', $key, 3); + $compare = version_compare($version, $config->version); + // version mismatch, is always old + if ($compare != 0) return true; + // versions match, ids match, check revision number + if ( + $hash == $config->getBatchSerial($this->type) && + $revision < $config->get($this->type . '.DefinitionRev') + ) return true; + return false; + } + + /** + * Checks if a definition's type jives with the cache's type + * @note Throws an error on failure + * @param $def Definition object to check + * @return Boolean true if good, false if not + */ + public function checkDefType($def) { + if ($def->type !== $this->type) { + trigger_error("Cannot use definition of type {$def->type} in cache for {$this->type}"); + return false; + } + return true; + } + + /** + * Adds a definition object to the cache + */ + abstract public function add($def, $config); + + /** + * Unconditionally saves a definition object to the cache + */ + abstract public function set($def, $config); + + /** + * Replace an object in the cache + */ + abstract public function replace($def, $config); + + /** + * Retrieves a definition object from the cache + */ + abstract public function get($config); + + /** + * Removes a definition object to the cache + */ + abstract public function remove($config); + + /** + * Clears all objects from cache + */ + abstract public function flush($config); + + /** + * Clears all expired (older version or revision) objects from cache + * @note Be carefuly implementing this method as flush. Flush must + * not interfere with other Definition types, and cleanup() + * should not be repeatedly called by userland code. + */ + abstract public function cleanup($config); + +} + +// vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/DefinitionCache/Decorator.php b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/DefinitionCache/Decorator.php new file mode 100644 index 0000000..b0fb6d0 --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/DefinitionCache/Decorator.php @@ -0,0 +1,62 @@ +copy(); + // reference is necessary for mocks in PHP 4 + $decorator->cache =& $cache; + $decorator->type = $cache->type; + return $decorator; + } + + /** + * Cross-compatible clone substitute + */ + public function copy() { + return new HTMLPurifier_DefinitionCache_Decorator(); + } + + public function add($def, $config) { + return $this->cache->add($def, $config); + } + + public function set($def, $config) { + return $this->cache->set($def, $config); + } + + public function replace($def, $config) { + return $this->cache->replace($def, $config); + } + + public function get($config) { + return $this->cache->get($config); + } + + public function remove($config) { + return $this->cache->remove($config); + } + + public function flush($config) { + return $this->cache->flush($config); + } + + public function cleanup($config) { + return $this->cache->cleanup($config); + } + +} + +// vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/DefinitionCache/Decorator/Cleanup.php b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/DefinitionCache/Decorator/Cleanup.php new file mode 100644 index 0000000..d4cc35c --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/DefinitionCache/Decorator/Cleanup.php @@ -0,0 +1,43 @@ +definitions[$this->generateKey($config)] = $def; + return $status; + } + + public function set($def, $config) { + $status = parent::set($def, $config); + if ($status) $this->definitions[$this->generateKey($config)] = $def; + return $status; + } + + public function replace($def, $config) { + $status = parent::replace($def, $config); + if ($status) $this->definitions[$this->generateKey($config)] = $def; + return $status; + } + + public function get($config) { + $key = $this->generateKey($config); + if (isset($this->definitions[$key])) return $this->definitions[$key]; + $this->definitions[$key] = parent::get($config); + return $this->definitions[$key]; + } + +} + +// vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/DefinitionCache/Decorator/Template.php.in b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/DefinitionCache/Decorator/Template.php.in new file mode 100644 index 0000000..21a8fcf --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/DefinitionCache/Decorator/Template.php.in @@ -0,0 +1,47 @@ +checkDefType($def)) return; + $file = $this->generateFilePath($config); + if (file_exists($file)) return false; + if (!$this->_prepareDir($config)) return false; + return $this->_write($file, serialize($def), $config); + } + + public function set($def, $config) { + if (!$this->checkDefType($def)) return; + $file = $this->generateFilePath($config); + if (!$this->_prepareDir($config)) return false; + return $this->_write($file, serialize($def), $config); + } + + public function replace($def, $config) { + if (!$this->checkDefType($def)) return; + $file = $this->generateFilePath($config); + if (!file_exists($file)) return false; + if (!$this->_prepareDir($config)) return false; + return $this->_write($file, serialize($def), $config); + } + + public function get($config) { + $file = $this->generateFilePath($config); + if (!file_exists($file)) return false; + return unserialize(file_get_contents($file)); + } + + public function remove($config) { + $file = $this->generateFilePath($config); + if (!file_exists($file)) return false; + return unlink($file); + } + + public function flush($config) { + if (!$this->_prepareDir($config)) return false; + $dir = $this->generateDirectoryPath($config); + $dh = opendir($dir); + while (false !== ($filename = readdir($dh))) { + if (empty($filename)) continue; + if ($filename[0] === '.') continue; + unlink($dir . '/' . $filename); + } + } + + public function cleanup($config) { + if (!$this->_prepareDir($config)) return false; + $dir = $this->generateDirectoryPath($config); + $dh = opendir($dir); + while (false !== ($filename = readdir($dh))) { + if (empty($filename)) continue; + if ($filename[0] === '.') continue; + $key = substr($filename, 0, strlen($filename) - 4); + if ($this->isOld($key, $config)) unlink($dir . '/' . $filename); + } + } + + /** + * Generates the file path to the serial file corresponding to + * the configuration and definition name + * @todo Make protected + */ + public function generateFilePath($config) { + $key = $this->generateKey($config); + return $this->generateDirectoryPath($config) . '/' . $key . '.ser'; + } + + /** + * Generates the path to the directory contain this cache's serial files + * @note No trailing slash + * @todo Make protected + */ + public function generateDirectoryPath($config) { + $base = $this->generateBaseDirectoryPath($config); + return $base . '/' . $this->type; + } + + /** + * Generates path to base directory that contains all definition type + * serials + * @todo Make protected + */ + public function generateBaseDirectoryPath($config) { + $base = $config->get('Cache.SerializerPath'); + $base = is_null($base) ? HTMLPURIFIER_PREFIX . '/HTMLPurifier/DefinitionCache/Serializer' : $base; + return $base; + } + + /** + * Convenience wrapper function for file_put_contents + * @param $file File name to write to + * @param $data Data to write into file + * @param $config Config object + * @return Number of bytes written if success, or false if failure. + */ + private function _write($file, $data, $config) { + $result = file_put_contents($file, $data); + if ($result !== false) { + // set permissions of the new file (no execute) + $chmod = $config->get('Cache.SerializerPermissions'); + if (!$chmod) { + $chmod = 0644; // invalid config or simpletest + } + $chmod = $chmod & 0666; + chmod($file, $chmod); + } + return $result; + } + + /** + * Prepares the directory that this type stores the serials in + * @param $config Config object + * @return True if successful + */ + private function _prepareDir($config) { + $directory = $this->generateDirectoryPath($config); + $chmod = $config->get('Cache.SerializerPermissions'); + if (!$chmod) { + $chmod = 0755; // invalid config or simpletest + } + if (!is_dir($directory)) { + $base = $this->generateBaseDirectoryPath($config); + if (!is_dir($base)) { + trigger_error('Base directory '.$base.' does not exist, + please create or change using %Cache.SerializerPath', + E_USER_WARNING); + return false; + } elseif (!$this->_testPermissions($base, $chmod)) { + return false; + } + $old = umask(0000); + mkdir($directory, $chmod); + umask($old); + } elseif (!$this->_testPermissions($directory, $chmod)) { + return false; + } + return true; + } + + /** + * Tests permissions on a directory and throws out friendly + * error messages and attempts to chmod it itself if possible + * @param $dir Directory path + * @param $chmod Permissions + * @return True if directory writable + */ + private function _testPermissions($dir, $chmod) { + // early abort, if it is writable, everything is hunky-dory + if (is_writable($dir)) return true; + if (!is_dir($dir)) { + // generally, you'll want to handle this beforehand + // so a more specific error message can be given + trigger_error('Directory '.$dir.' does not exist', + E_USER_WARNING); + return false; + } + if (function_exists('posix_getuid')) { + // POSIX system, we can give more specific advice + if (fileowner($dir) === posix_getuid()) { + // we can chmod it ourselves + $chmod = $chmod | 0700; + if (chmod($dir, $chmod)) return true; + } elseif (filegroup($dir) === posix_getgid()) { + $chmod = $chmod | 0070; + } else { + // PHP's probably running as nobody, so we'll + // need to give global permissions + $chmod = $chmod | 0777; + } + trigger_error('Directory '.$dir.' not writable, '. + 'please chmod to ' . decoct($chmod), + E_USER_WARNING); + } else { + // generic error message + trigger_error('Directory '.$dir.' not writable, '. + 'please alter file permissions', + E_USER_WARNING); + } + return false; + } + +} + +// vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/DefinitionCache/Serializer/CSS/4.1.0,801ad73acbcf9d3127e1d01768d26453,1.ser b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/DefinitionCache/Serializer/CSS/4.1.0,801ad73acbcf9d3127e1d01768d26453,1.ser new file mode 100644 index 0000000000000000000000000000000000000000..7af3bad39add6809e13aad6ebb9556b78522d0d0 GIT binary patch literal 22628 zcmeHPTaVke67FyDV*vw}?e#_bbegs}1=1#H((}5IEqTpTS#l^TyJ?aC-fxB+NzSfa zM`9#3=u4udDRM;4<(mun%AYR$(SP6m{PK07)lNnF?!}uo-$y%@s9dGV$e;OtX8znC zq8;J{jG<^5^J%GWdV;Tw`>af!JMytoz?MaE;wKVnA0rr+tq; zwlO<_H!W2x2SXtX;$X?zfN#>nQ0RhMv2;0;yxApn_;V5G>If+?+6!WnspOud!frfX zJ_L^p9rtE_Ews90dJNBn>M2*)KPED(mx&fJ`RwpHnpTS0ZTBZIqIEdTDX#hRd z-x`YjzIqLNH+w)4yEJj8Hk+deUOLEOlIlYc6H5_}K!eJGH@4J3EC_9%ZesPWVEZ)f z-~2#x@dCaNv;w^9ll!Iw8J;X50mTeU8jrWZ5rB=>v3ItELXA~s*=~GH3G4v?_b9ru zc)&U;Wac9NBX$GWu`L5wIB2=r!WloIKYh2hAT?AOOQ;put-wj+(inh7h_ACcf7SD}tAuR=}0He=- z)^ET5WZ@gM2^_~`pfhqX@fwu!$!qBP+WhJ>!PeCTXOUO>L$Xcb`0<+%_>(tZpLVgY zgD+`99brQ9oZyr%XeH+>xT_xcalW<>HxqgAU@X9&hM;e~+ymF3dImfh|V=8mZWw^PFww4xeYMMTNtfVYD zY@#sxHOkTg+)Qx~!b#V8EEwgwjx9W4z>iAfeQ{m)5~$)02XBn7gFHi0C3ME>&wI{> z!tKMRz=)hfCg=bjL5F8GIDVb6b@}4U2}RFgzg!1NwgXspv81g+e*`cAEg7f(!A71I z5(~kmo5Fd51ZZu^%1fK|A;oqK!iU_ZF=C@GOfr_`#FW&-u`hTQpF!srXBlwpCfNRt zFkg{`V@H_7aC{5B0LiRTrK4liukX(B4=j~XVjNJ8F%xNH4hE5Gt(rJ?O-zg}Oww`n zX8)W#1w^SWZ;El!2Mm?I4^#D99>}74?T)L(g6ExqI z68c)aVH2AKJ+NSLl-yIK?Ug^n&YsmPFHN^Hs);v|HW}Ui0wx7-)1MU8q(84!J03!z zc+X;G>#xkPX=jPBn3=j7BW#C28fk-^mrXZa{ElC^tGtfMKmp9eT@u{~P0~Wwe(bgV zKvDBFQ@PV)cgChy|BpOx#v^dSSjCX;tPpCOjGplWXKrn27qIu!1dyYx*8U96O-r+D z@|>J58wyzvywk+gPzWRNRON+-LKWnpGEy!~`bC9a*(R%zPra%eiUDx~{fTB1cKzg6 zi$MiLQaGmioDxTA)JqWHx`1WS1%V9Xw$(cNgmwvGE(rh>e0&^p z)rsIH80lJz1x{rT3Zg<;RLII&-Z;>v5|uzc4^g&IC4iZyY@#XvjKY5-hOd0e|Kly5 z#?&6WDgm%;_*I6%2*-9EXY4}30`JBuiN^cLl&1Grc7a?&J1OHThQ6%pHNjaD@aux9 zEx2u9z7AEvLT(126RuzVYj>#&`2+wuK;NrmY^#j>6VTEOUd&R6V=bvexXkUcEnmM? zX_`8eI5B;m*vOKks8Xg=xppw>q;X%{XIpBdXrZYW? zYT6ch6tOj-$e|)_M-z;V(Bw*!wjv1bx230FRmvaHu`0!0aIL0FaAwy@JtP5Jb=YTlx)l ztZibU5hr$H(m!JoECTArpJY){vjDY+LOUcpo=c@(8yVpkS)`rj(GjDMljlErlFSF_9a08^36KA{Npkfr{w+*iR zjfeIl4$J>&rt0YQhJ4_Iv#dp9(c}Um=(~DO-`)Zd^9?hkOz`_Ajrlw!X#!5b;fkWY zz5Hi};2oXgqw8q!J3rmvX~s_rYUigVo^JSQg{K8St?{(vCmhmK{>nVkdCRqVbX9-V zTm=9S5Iefy!|5eqBR+h#7!&7E4d`I0u(zpbA4f3J3{=9+^I>uv^$>yE@?97)bFAxi*QaQz;y^P z90NFT2F-=zvjow`=Ax1I5T@0lfy-Ik%z810(N$r?S*<+4{dMCw_yDJ}J>NIK`+`{v z2EWQlvaTD_VMb8*KGM0`2C=(~BAbSON)Ns%d#(uEK!7(mQ%?B9B!W3kl@%Mqpu7cH zf#ZtwH<{Inp9!Mib#s26(u@Q`P2m}?RXn*9Q51Z2wG6*iH8ZODhgP#14}A!kD0@@D zRabjn7c}bvC_$>MrE^)S4L&`KHqYNz2!HhwOm$wO!t!LVMkMLFZdY1>Kz!Z99+ww! iU39OIqAI$3&;e@?SEpQ?E{};-;V#w!G!t!S9yP{ z--(jrwDUUX@AS$O!El&$UVrLuY+kG4T^vrrq(CirT<-35`<=W9l5r5HN!WQk?Dt+v zr9n}kj-bEGI=B0sQ5@tsE8Xl}tMm=-M2+%(g9Ev(zrm;W`<)5ib`t#^j#+aTHShI1 zS@>-hW$x5JId1MmxB>5rtBp@?RQ>*K=YI9#t&6CL@l~iAg@sigg%`#B>&=VHvR?H6 z!g>$Be7R?}7_4!m<95@_zDs744u%|^+e5FN1#vVU;CB{cXaemWR14fh)|^rlvuVZ`Kx z(HN)VpvZzGKTfmBV4C5LgMPPv#Sg+uU%#H_MRfzG?r9Xu{My81Zw%G}uW;^unsQAA zvFlvS@gR=V^FcV77MHbUQCv>Zy3FI$J)^}?*Om;#=6+)(>Y_r|2cs-aE+@76Mo}UC z&sE0>aGbb{D19Buy5Tjv&^LDlosFS^hK-VM9{1I+3?ttdu0-w`3`0Iam%1{VDlkgg6hA!lmr#ll zbfdpE90T5bDVq2O_<5r&n)-?`S(3DQ3iqVLzrs=do*}0Hahmv3=!SX`@9mq{9*n;F zF2lu{dmDUIluT#79^Q;;&}gdwz64q5yAt;dXGH-3FFy&D#KExod`y#n9Ui=WbM!{< z;3P+vVAY8!-xt?Z4I*QXA&A4TT9y-qgjQK~-MJyw(MAQ~>YJKFJ)MxifC{NbkLEHFV(u%CV zj{>@`1o#Yis3%Hf#))m5;LIYXqPT}*1GxlZgw`44_|;{QBa_A;=NUi_KuO7`;f=94 zo+;q0Fc!yH9N8YU%HoijAb)OfV{l_|)7a%0+^hs{gc~=wF}N|fF}Q)qe3b$m2(}<$ zYzJ)iO7W-Po`ETE2wvZmI)ndweqV}QA$Nj^YZ_#E2zd=&1CpM`Be?ZYuR<7l1u2w@ zvZrAN=~wYCA=9r<;zHxe!{#mJ`Sn1yJNGH~cmcKTOQe``+!b2!*954OARpyv)Y z+`*R?$VCCwBs+iMt5AJyROk)*XXWmbk{Yy>l)p4HSfBbcU{f9 zuI61=^Pa1D&(*x=YTk1-@41@yT+Mr~<~>*Qo~wD!)x7U&-go!xyLPw z_qy%{dR_Mhy{>zOUe~=tuj^i-*L5xQx~_>{*SFF0ZS;H_5D-$z1w}~Dx6$)$Kw9Xo z`ZjvL4G0h2Ro}*jZ)3x^vEka-a@B3Q+VTuFfz4_inU*|S_Xtyb%pH^_G{JvhBt;cLK#8HObzTbx-S`T zAR`rH1cMtBTA0wngcd6nT0lrZYbQe+LmNXILz~s14R?}|*O0X<4Jr+D408-~40BeF zIo_bj5XTV55XTT_9f+fDA%-}HIEFZeIIBY(@g0H`r#*+&Z5oF>QY9{rhjgj~0;13` zCvmnbw>V=u@7y>%hJ%>*#uOhodSl8AhXbn`rFPnZ`&FAnT00pBh5n7EHsscUVGq-9ijEu51jU#H4O_J z^}=SouvIT?*9$wYKvu!=Z^|lMhg3ZaS|FiC%6mMWD5D6Rx%&7**cs?;U}TG6$XGC1 zrh@1WAt`9GPHT1FvP3D+5*Qf->G44(P}F!ndes=86+{tPS%eVGmDC3|L19)ejC}!P z%zzqhK48a&h)?l24}EA6%(EvQYGj=oGPh7$WFSi4mb8lRM0vyA;ybl1GO(aa+?iTL0&@{w zd zEnfGCO__0@Wq^CaClt&Ep9Y@>p9Y^bdygWs{2;gH2O)gIB*);>;M3sK;M3sqe(9CK zl|vkE=xOL_=xOL_=&9%lL+&e0J?9L()z9*}fw%fw&ROI@>LYg7w8p8dyb<{uCGe}X z&xMx=3eY7~2Dy<-L`TcssK1Nriq27gPamX}Z-fkWu(X0c_m;$Y@)9sEH*7a-e>Aq6 z|AZ_#^PgC67S^UkYKzumKwFGWk|lSVA*nct7%1LClUhsl zLH!Dt2bW92Qhf*;ONUdRhQm^Qgp%@`UOZUy&Z>%PO3C*umR8^{KlL|nGF|858+?e8 zuSZB#o_91Nhx!O5!32(qU{~Q%{)Xwz!|`W^3b?ClknqS^D9mbW?W4B4w~vorv!52= zOuMa2F^x?G@_C=o-2#Jveq9K5G6=tC=|_I z``UexH}^}@X70D8yaB_|@I}IGF1%?K_pugtr0gl+!oLm=s<0}x(h#LSKl<#I_`Ypv~V-dluS2B-Vw1Hkkthro3 zE2QC#n;`L47hl$n_Tl*JTztjm8caOX*FDI^R~UA6Gr-{DH5YctEk1B?Nv2q>6u1HX zDf5z7>v!Jsm_Bd1)lm5wj^FV7*3#H!tl^G?0o9{dTZ?TrH#dB2v(MqTS%esPWvW6n zS`SzzOAc!#Mh}!L=Z3Y87iNc$^BR=l&y@Z*y*?_gkBbmBkHZ|UgySG7@3Fn0Ej5Xa3H>jYrZn%+I`XfbL6m?vZ=BL3J!u7}K z6n!Q0@^?;Z$eJouP-y@J{w$CF)^;I3Y!IL~pemp~1D+flMi*i1%zv;vpe&pO7u4a* zH+GY?5vGcdQM|ddwGUx(f>_3?JAF`VZBwO}n5hUHiA1qz2QG{`!BV-iaLOJRoJQ*koc#%f;1LdK>dLWJgjG~2Oie5=$k16HI(;A zD0hEl93cXlmiR)j_SFLVtq6vU-=Jl{MAMT8=Akek9c9tfdz9lImvg*Uzpv7qdrF<2 zcFsDiM_y!P)TMY(v#5ks{KykSSU=50$Dy$@rg=Tuj;(B4*%gp}N4v0>xw5ge*B+7T z#^@rTt5Jd=nzp~+a$D`KeOVkxThMg}J$JC-4%~Kh+r{18cANNZw~62On|OE0_V*Nb z^t!G)dtKL`w!hCDzke^^qP0fyB~JoYqP=K=w!dd|$8TCh!LE?8#Z+Hy+s7 zgcEm(8<`?Y8BkE~rA#%YFP$%92kAXI@$Ar7gckj#6zFd`d$r5ZEvwAgyOf`|{XI=Z zZGT^`-WRsiU*;}gnY_>T_a?a$HNrC|;xBV$Kehe+aGbWazZVBnkZMW!2ay4mX+uHh z!YAAk_gvz*qMDc?d^GejN?Cyby$qyDUI}^u=t3S7X!+6lPi%EACUHLw$Yy8wSamL~ zl^?eu()dOo_AWxjFJ-rGqBG{YwaOau+coZiFH;QW3;1d>g_P{qo7VU4#7ym@(aw=9OKk#I4`Q# zM`0XKVYDLoTyAUh@lm~0r_V-d6tuQRFu<5MXyr#SZsS}LREpZS{^EgzSMDMGYqPVw60 zU}EtW_Z8VJ<{LhI3xw29vcpd#s;Q@-Cs{h1%EvMg5-4bvo=cILphU=zfOJ*IAP*8t z%hN&KJvWVn<;!Q2NswJG{kS89XS!DgLfNLQEfC(Lw|Mt05 zBV{ptW6ab+hb*rKe6q-< zu1+TOs$J&pyT`Dk2pTykd{$2+lmn9+ly3!m^V{>A11cVgnIhopO5uKaf-}@vlF~Wb zE|JiH3{tY9iY?weOvhNzRrxdw%B(puaf{5rKq(BvvX@8Xn}*bPs| zpoQPwTJV2}p)ep=k!sJK^*6V+3C!%Hl=K)XR$xSTpM(l0iPp`N=>12-f}<5~H+2VC zkhl43mKV`623`p%$;T-b$}JNNR+=75=JMqXm|Ju%`PxI`sbcvt`|k-l{^7(|5(#4p zH+Qd-Xgt5ri+7-mZrbEv}Jz1KH4HZ^eVs*P$od;Lyx)NH%=Y z#7qAH2rp9SD3IP(aDK8EEhogi(fpX)+NqFo%U6=);uxQElK>832!o0M< zk}YBuHFmTOZuQSuTtsawcmq%a&|7x>m?CRcFf7GNHM(m_ZTfC9EiTKHd2^936x*;! zi_58~ZqW~+JfPB%dPt1Ymip=76_B*jxf*DJLXoW*5AZvqSpH#b}x?VW^h`*b(FW|Zn3m3BWMD87Rarh_imBcq&9MfP4kvD zrdCDX@Q+eA3Owfw%;7k*(PbyXSz{6<(d0HeDPU|R#|OWAvmC#* zCNZcn0=mKRZ6x+^kZdh%^*^8Amuek+3_frgWVw1jl0-Eg!L5gSwX`+Hrh-p|h&7lL z?-E9gQ+4k3-Ns?_mhy3!obvH3M1yqT3y`p)e+6#>i<}AfLKg^h&qe#(bAdqjTp-Xr z*HL>e#OS^YF}m;W*?0HsyL)<=x|Hi+7F*;@7a1m;48w8$In2}9Gl-liTIe8#kCk^J z!nQfjY^ht2T&!zb>JBq|8w#5Lh;OCRtNEo)*Pc6&aV|5!~`MRzN_hj-&`&wm?C&oEtII0W)$j7k7z;Gw)3T?6hgmg2gF=FZmE+-=(r z`t0MQ!M8P-E?Rk1g4*|!lS-mmDw&r^YGGEwYP0^<#%3vHqu=qD%S0%}CMM02#{8|y zui@s1*^-2vT=begGRFJ2_j2aH9(C+yx8^6JpD(+$qQdG)??^C48r>6KjN+NZop7$( zn3ln;NJnv+3%9GL3s}eMws@mc3o4^@@HkCC@Y~r6i5(XP6gC0$(D!Ztc$s5aex9$u znH<}j8mED60mE-({e7|S!rLwON7T<-GCTDKz6JAe$){c4ICy8mCo=N-%B_wrK*$AT zXlHC?m&;y_gB+F(S)YMSYJ(=UqKJyprm-YqFIC;G$!pL(=2mKMrE1~@xkTjp0_&(u z$*$KhQJ61T3jlmcX6j3l`oxzcP^vGPTPa`&`2HN-N;%L7k=hdRl{k&)iBUQMuPZct zPJ!Mq?!7T!LA{cBws%Ryf*+JNRJ`#bLv?3u5SOc)963f7GRW&W5}&uV0hzcKc}0Yj zxDuY>ALdVTw^NnUIPR=n)9OAbiwT`)oV#zS4Dc8`8hEv3sQEj%#RQs6(!S| zXCc7-BL+}2T4;f2ctIBWtU9=7I71{{AGrgS!~volIzFUDs!E!%u3!zosfqZdL5{G+jzUO!lzxg(@Dv}N?)wWnb+oJ<#u>NZ%2u2&BlLhz!>>aLyIUPnm z7|}YmrA8aEqt79a8wW{|4?u+nQKBLGbR)k8+Q^2mH6dqEWYJgAg|y)yZ0ldi<0dT}r=4HIxj!=#}R_fg}a!#gf70K{ zNmVsG&Fz63mP=wyBP?5U70p$PV_2p9#^kU-!wxu1BkY-HtgF?^uDSajLA3>HFqpvG zKolukT_Dp^H*Kf152vLBnl)v~JM`!pw z&F~|cFz{bRAvkdA0URoB;sDxU{BnulA2l}or?IzjG(ya6{6nm5{36CSe!t-_4<>Bu zEa2VYgl7uoO2YwNCs;uC9hXSbEnz%lwhU;V2PYTdI*?Xg{<}Mh;G{~`Qn4LFktT)&T<&sRk3p0$H?l256~9Z4 zEQGxgy`$MbS)kUn3Yu4@V8u*!iG;-Japtw8xH9$ytN=osBjQ-j4(i;g6>Qa1s{6ha zC5{}Z;|u>lsxgrvz+057hcDT44YIINFKpHeTlKyFJvPP zM&xaI4PCELrOr;5()Qg3fAs1zI`O5qx4xF4l z%+hHVg)mU^iQw>}a!EfCZDY1wOgyPYWAKoJ1B>vV>Op}=#>Mz>HjE>9BH;-vhF@O2 z`tRn!t5; zU7Qw^xW^jH!(R%fRV*j!uXu$HRjph2Zd_~ysFxho!9i!!GOA5 S3=Vm>yazBbESz5LpZ^CBB80C1 literal 0 HcmV?d00001 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/DefinitionCache/Serializer/README b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/DefinitionCache/Serializer/README new file mode 100644 index 0000000..2e35c1c --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/DefinitionCache/Serializer/README @@ -0,0 +1,3 @@ +This is a dummy file to prevent Git from ignoring this empty directory. + + vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/DefinitionCache/Serializer/URI/4.0.0,05c766101e813c246917b022f97b5e6e,1.ser b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/DefinitionCache/Serializer/URI/4.0.0,05c766101e813c246917b022f97b5e6e,1.ser new file mode 100644 index 0000000000000000000000000000000000000000..b0563a0823d425716aed44185de4926044c3c056 GIT binary patch literal 327 zcmZvXO$)*>42JzJIeJ?Cg!CpN6a2!Dv$Wc>Vx42n4kG*SrX47PwLn;UCK)EuMc_zTf#ubx*!O=h!hwYW-Cx%<$Ewq!r6SYRqKI1HsujWgK?G rl=K5@6MxbXm literal 0 HcmV?d00001 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/DefinitionCacheFactory.php b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/DefinitionCacheFactory.php new file mode 100644 index 0000000..a6ead62 --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/DefinitionCacheFactory.php @@ -0,0 +1,91 @@ + array()); + protected $implementations = array(); + protected $decorators = array(); + + /** + * Initialize default decorators + */ + public function setup() { + $this->addDecorator('Cleanup'); + } + + /** + * Retrieves an instance of global definition cache factory. + */ + public static function instance($prototype = null) { + static $instance; + if ($prototype !== null) { + $instance = $prototype; + } elseif ($instance === null || $prototype === true) { + $instance = new HTMLPurifier_DefinitionCacheFactory(); + $instance->setup(); + } + return $instance; + } + + /** + * Registers a new definition cache object + * @param $short Short name of cache object, for reference + * @param $long Full class name of cache object, for construction + */ + public function register($short, $long) { + $this->implementations[$short] = $long; + } + + /** + * Factory method that creates a cache object based on configuration + * @param $name Name of definitions handled by cache + * @param $config Instance of HTMLPurifier_Config + */ + public function create($type, $config) { + $method = $config->get('Cache.DefinitionImpl'); + if ($method === null) { + return new HTMLPurifier_DefinitionCache_Null($type); + } + if (!empty($this->caches[$method][$type])) { + return $this->caches[$method][$type]; + } + if ( + isset($this->implementations[$method]) && + class_exists($class = $this->implementations[$method], false) + ) { + $cache = new $class($type); + } else { + if ($method != 'Serializer') { + trigger_error("Unrecognized DefinitionCache $method, using Serializer instead", E_USER_WARNING); + } + $cache = new HTMLPurifier_DefinitionCache_Serializer($type); + } + foreach ($this->decorators as $decorator) { + $new_cache = $decorator->decorate($cache); + // prevent infinite recursion in PHP 4 + unset($cache); + $cache = $new_cache; + } + $this->caches[$method][$type] = $cache; + return $this->caches[$method][$type]; + } + + /** + * Registers a decorator to add to all new cache objects + * @param + */ + public function addDecorator($decorator) { + if (is_string($decorator)) { + $class = "HTMLPurifier_DefinitionCache_Decorator_$decorator"; + $decorator = new $class; + } + $this->decorators[$decorator->name] = $decorator; + } + +} + +// vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/Doctype.php b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/Doctype.php new file mode 100644 index 0000000..1e3c574 --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/Doctype.php @@ -0,0 +1,60 @@ +renderDoctype. + * If structure changes, please update that function. + */ +class HTMLPurifier_Doctype +{ + /** + * Full name of doctype + */ + public $name; + + /** + * List of standard modules (string identifiers or literal objects) + * that this doctype uses + */ + public $modules = array(); + + /** + * List of modules to use for tidying up code + */ + public $tidyModules = array(); + + /** + * Is the language derived from XML (i.e. XHTML)? + */ + public $xml = true; + + /** + * List of aliases for this doctype + */ + public $aliases = array(); + + /** + * Public DTD identifier + */ + public $dtdPublic; + + /** + * System DTD identifier + */ + public $dtdSystem; + + public function __construct($name = null, $xml = true, $modules = array(), + $tidyModules = array(), $aliases = array(), $dtd_public = null, $dtd_system = null + ) { + $this->name = $name; + $this->xml = $xml; + $this->modules = $modules; + $this->tidyModules = $tidyModules; + $this->aliases = $aliases; + $this->dtdPublic = $dtd_public; + $this->dtdSystem = $dtd_system; + } +} + +// vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/DoctypeRegistry.php b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/DoctypeRegistry.php new file mode 100644 index 0000000..86049e9 --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/DoctypeRegistry.php @@ -0,0 +1,103 @@ +doctypes[$doctype->name] = $doctype; + $name = $doctype->name; + // hookup aliases + foreach ($doctype->aliases as $alias) { + if (isset($this->doctypes[$alias])) continue; + $this->aliases[$alias] = $name; + } + // remove old aliases + if (isset($this->aliases[$name])) unset($this->aliases[$name]); + return $doctype; + } + + /** + * Retrieves reference to a doctype of a certain name + * @note This function resolves aliases + * @note When possible, use the more fully-featured make() + * @param $doctype Name of doctype + * @return Editable doctype object + */ + public function get($doctype) { + if (isset($this->aliases[$doctype])) $doctype = $this->aliases[$doctype]; + if (!isset($this->doctypes[$doctype])) { + trigger_error('Doctype ' . htmlspecialchars($doctype) . ' does not exist', E_USER_ERROR); + $anon = new HTMLPurifier_Doctype($doctype); + return $anon; + } + return $this->doctypes[$doctype]; + } + + /** + * Creates a doctype based on a configuration object, + * will perform initialization on the doctype + * @note Use this function to get a copy of doctype that config + * can hold on to (this is necessary in order to tell + * Generator whether or not the current document is XML + * based or not). + */ + public function make($config) { + return clone $this->get($this->getDoctypeFromConfig($config)); + } + + /** + * Retrieves the doctype from the configuration object + */ + public function getDoctypeFromConfig($config) { + // recommended test + $doctype = $config->get('HTML.Doctype'); + if (!empty($doctype)) return $doctype; + $doctype = $config->get('HTML.CustomDoctype'); + if (!empty($doctype)) return $doctype; + // backwards-compatibility + if ($config->get('HTML.XHTML')) { + $doctype = 'XHTML 1.0'; + } else { + $doctype = 'HTML 4.01'; + } + if ($config->get('HTML.Strict')) { + $doctype .= ' Strict'; + } else { + $doctype .= ' Transitional'; + } + return $doctype; + } + +} + +// vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ElementDef.php b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ElementDef.php new file mode 100644 index 0000000..5498d95 --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ElementDef.php @@ -0,0 +1,183 @@ +setup(), this array may also + * contain an array at index 0 that indicates which attribute + * collections to load into the full array. It may also + * contain string indentifiers in lieu of HTMLPurifier_AttrDef, + * see HTMLPurifier_AttrTypes on how they are expanded during + * HTMLPurifier_HTMLDefinition->setup() processing. + */ + public $attr = array(); + + /** + * Indexed list of tag's HTMLPurifier_AttrTransform to be done before validation + */ + public $attr_transform_pre = array(); + + /** + * Indexed list of tag's HTMLPurifier_AttrTransform to be done after validation + */ + public $attr_transform_post = array(); + + /** + * HTMLPurifier_ChildDef of this tag. + */ + public $child; + + /** + * Abstract string representation of internal ChildDef rules. See + * HTMLPurifier_ContentSets for how this is parsed and then transformed + * into an HTMLPurifier_ChildDef. + * @warning This is a temporary variable that is not available after + * being processed by HTMLDefinition + */ + public $content_model; + + /** + * Value of $child->type, used to determine which ChildDef to use, + * used in combination with $content_model. + * @warning This must be lowercase + * @warning This is a temporary variable that is not available after + * being processed by HTMLDefinition + */ + public $content_model_type; + + + + /** + * Does the element have a content model (#PCDATA | Inline)*? This + * is important for chameleon ins and del processing in + * HTMLPurifier_ChildDef_Chameleon. Dynamically set: modules don't + * have to worry about this one. + */ + public $descendants_are_inline = false; + + /** + * List of the names of required attributes this element has. Dynamically + * populated by HTMLPurifier_HTMLDefinition::getElement + */ + public $required_attr = array(); + + /** + * Lookup table of tags excluded from all descendants of this tag. + * @note SGML permits exclusions for all descendants, but this is + * not possible with DTDs or XML Schemas. W3C has elected to + * use complicated compositions of content_models to simulate + * exclusion for children, but we go the simpler, SGML-style + * route of flat-out exclusions, which correctly apply to + * all descendants and not just children. Note that the XHTML + * Modularization Abstract Modules are blithely unaware of such + * distinctions. + */ + public $excludes = array(); + + /** + * This tag is explicitly auto-closed by the following tags. + */ + public $autoclose = array(); + + /** + * If a foreign element is found in this element, test if it is + * allowed by this sub-element; if it is, instead of closing the + * current element, place it inside this element. + */ + public $wrap; + + /** + * Whether or not this is a formatting element affected by the + * "Active Formatting Elements" algorithm. + */ + public $formatting; + + /** + * Low-level factory constructor for creating new standalone element defs + */ + public static function create($content_model, $content_model_type, $attr) { + $def = new HTMLPurifier_ElementDef(); + $def->content_model = $content_model; + $def->content_model_type = $content_model_type; + $def->attr = $attr; + return $def; + } + + /** + * Merges the values of another element definition into this one. + * Values from the new element def take precedence if a value is + * not mergeable. + */ + public function mergeIn($def) { + + // later keys takes precedence + foreach($def->attr as $k => $v) { + if ($k === 0) { + // merge in the includes + // sorry, no way to override an include + foreach ($v as $v2) { + $this->attr[0][] = $v2; + } + continue; + } + if ($v === false) { + if (isset($this->attr[$k])) unset($this->attr[$k]); + continue; + } + $this->attr[$k] = $v; + } + $this->_mergeAssocArray($this->attr_transform_pre, $def->attr_transform_pre); + $this->_mergeAssocArray($this->attr_transform_post, $def->attr_transform_post); + $this->_mergeAssocArray($this->excludes, $def->excludes); + + if(!empty($def->content_model)) { + $this->content_model = + str_replace("#SUPER", $this->content_model, $def->content_model); + $this->child = false; + } + if(!empty($def->content_model_type)) { + $this->content_model_type = $def->content_model_type; + $this->child = false; + } + if(!is_null($def->child)) $this->child = $def->child; + if(!is_null($def->formatting)) $this->formatting = $def->formatting; + if($def->descendants_are_inline) $this->descendants_are_inline = $def->descendants_are_inline; + + } + + /** + * Merges one array into another, removes values which equal false + * @param $a1 Array by reference that is merged into + * @param $a2 Array that merges into $a1 + */ + private function _mergeAssocArray(&$a1, $a2) { + foreach ($a2 as $k => $v) { + if ($v === false) { + if (isset($a1[$k])) unset($a1[$k]); + continue; + } + $a1[$k] = $v; + } + } + +} + +// vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/Encoder.php b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/Encoder.php new file mode 100644 index 0000000..2b3140c --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/Encoder.php @@ -0,0 +1,426 @@ + under the + * LGPL license. Notes on what changed are inside, but in general, + * the original code transformed UTF-8 text into an array of integer + * Unicode codepoints. Understandably, transforming that back to + * a string would be somewhat expensive, so the function was modded to + * directly operate on the string. However, this discourages code + * reuse, and the logic enumerated here would be useful for any + * function that needs to be able to understand UTF-8 characters. + * As of right now, only smart lossless character encoding converters + * would need that, and I'm probably not going to implement them. + * Once again, PHP 6 should solve all our problems. + */ + public static function cleanUTF8($str, $force_php = false) { + + // UTF-8 validity is checked since PHP 4.3.5 + // This is an optimization: if the string is already valid UTF-8, no + // need to do PHP stuff. 99% of the time, this will be the case. + // The regexp matches the XML char production, as well as well as excluding + // non-SGML codepoints U+007F to U+009F + if (preg_match('/^[\x{9}\x{A}\x{D}\x{20}-\x{7E}\x{A0}-\x{D7FF}\x{E000}-\x{FFFD}\x{10000}-\x{10FFFF}]*$/Du', $str)) { + return $str; + } + + $mState = 0; // cached expected number of octets after the current octet + // until the beginning of the next UTF8 character sequence + $mUcs4 = 0; // cached Unicode character + $mBytes = 1; // cached expected number of octets in the current sequence + + // original code involved an $out that was an array of Unicode + // codepoints. Instead of having to convert back into UTF-8, we've + // decided to directly append valid UTF-8 characters onto a string + // $out once they're done. $char accumulates raw bytes, while $mUcs4 + // turns into the Unicode code point, so there's some redundancy. + + $out = ''; + $char = ''; + + $len = strlen($str); + for($i = 0; $i < $len; $i++) { + $in = ord($str{$i}); + $char .= $str[$i]; // append byte to char + if (0 == $mState) { + // When mState is zero we expect either a US-ASCII character + // or a multi-octet sequence. + if (0 == (0x80 & ($in))) { + // US-ASCII, pass straight through. + if (($in <= 31 || $in == 127) && + !($in == 9 || $in == 13 || $in == 10) // save \r\t\n + ) { + // control characters, remove + } else { + $out .= $char; + } + // reset + $char = ''; + $mBytes = 1; + } elseif (0xC0 == (0xE0 & ($in))) { + // First octet of 2 octet sequence + $mUcs4 = ($in); + $mUcs4 = ($mUcs4 & 0x1F) << 6; + $mState = 1; + $mBytes = 2; + } elseif (0xE0 == (0xF0 & ($in))) { + // First octet of 3 octet sequence + $mUcs4 = ($in); + $mUcs4 = ($mUcs4 & 0x0F) << 12; + $mState = 2; + $mBytes = 3; + } elseif (0xF0 == (0xF8 & ($in))) { + // First octet of 4 octet sequence + $mUcs4 = ($in); + $mUcs4 = ($mUcs4 & 0x07) << 18; + $mState = 3; + $mBytes = 4; + } elseif (0xF8 == (0xFC & ($in))) { + // First octet of 5 octet sequence. + // + // This is illegal because the encoded codepoint must be + // either: + // (a) not the shortest form or + // (b) outside the Unicode range of 0-0x10FFFF. + // Rather than trying to resynchronize, we will carry on + // until the end of the sequence and let the later error + // handling code catch it. + $mUcs4 = ($in); + $mUcs4 = ($mUcs4 & 0x03) << 24; + $mState = 4; + $mBytes = 5; + } elseif (0xFC == (0xFE & ($in))) { + // First octet of 6 octet sequence, see comments for 5 + // octet sequence. + $mUcs4 = ($in); + $mUcs4 = ($mUcs4 & 1) << 30; + $mState = 5; + $mBytes = 6; + } else { + // Current octet is neither in the US-ASCII range nor a + // legal first octet of a multi-octet sequence. + $mState = 0; + $mUcs4 = 0; + $mBytes = 1; + $char = ''; + } + } else { + // When mState is non-zero, we expect a continuation of the + // multi-octet sequence + if (0x80 == (0xC0 & ($in))) { + // Legal continuation. + $shift = ($mState - 1) * 6; + $tmp = $in; + $tmp = ($tmp & 0x0000003F) << $shift; + $mUcs4 |= $tmp; + + if (0 == --$mState) { + // End of the multi-octet sequence. mUcs4 now contains + // the final Unicode codepoint to be output + + // Check for illegal sequences and codepoints. + + // From Unicode 3.1, non-shortest form is illegal + if (((2 == $mBytes) && ($mUcs4 < 0x0080)) || + ((3 == $mBytes) && ($mUcs4 < 0x0800)) || + ((4 == $mBytes) && ($mUcs4 < 0x10000)) || + (4 < $mBytes) || + // From Unicode 3.2, surrogate characters = illegal + (($mUcs4 & 0xFFFFF800) == 0xD800) || + // Codepoints outside the Unicode range are illegal + ($mUcs4 > 0x10FFFF) + ) { + + } elseif (0xFEFF != $mUcs4 && // omit BOM + // check for valid Char unicode codepoints + ( + 0x9 == $mUcs4 || + 0xA == $mUcs4 || + 0xD == $mUcs4 || + (0x20 <= $mUcs4 && 0x7E >= $mUcs4) || + // 7F-9F is not strictly prohibited by XML, + // but it is non-SGML, and thus we don't allow it + (0xA0 <= $mUcs4 && 0xD7FF >= $mUcs4) || + (0x10000 <= $mUcs4 && 0x10FFFF >= $mUcs4) + ) + ) { + $out .= $char; + } + // initialize UTF8 cache (reset) + $mState = 0; + $mUcs4 = 0; + $mBytes = 1; + $char = ''; + } + } else { + // ((0xC0 & (*in) != 0x80) && (mState != 0)) + // Incomplete multi-octet sequence. + // used to result in complete fail, but we'll reset + $mState = 0; + $mUcs4 = 0; + $mBytes = 1; + $char =''; + } + } + } + return $out; + } + + /** + * Translates a Unicode codepoint into its corresponding UTF-8 character. + * @note Based on Feyd's function at + * , + * which is in public domain. + * @note While we're going to do code point parsing anyway, a good + * optimization would be to refuse to translate code points that + * are non-SGML characters. However, this could lead to duplication. + * @note This is very similar to the unichr function in + * maintenance/generate-entity-file.php (although this is superior, + * due to its sanity checks). + */ + + // +----------+----------+----------+----------+ + // | 33222222 | 22221111 | 111111 | | + // | 10987654 | 32109876 | 54321098 | 76543210 | bit + // +----------+----------+----------+----------+ + // | | | | 0xxxxxxx | 1 byte 0x00000000..0x0000007F + // | | | 110yyyyy | 10xxxxxx | 2 byte 0x00000080..0x000007FF + // | | 1110zzzz | 10yyyyyy | 10xxxxxx | 3 byte 0x00000800..0x0000FFFF + // | 11110www | 10wwzzzz | 10yyyyyy | 10xxxxxx | 4 byte 0x00010000..0x0010FFFF + // +----------+----------+----------+----------+ + // | 00000000 | 00011111 | 11111111 | 11111111 | Theoretical upper limit of legal scalars: 2097151 (0x001FFFFF) + // | 00000000 | 00010000 | 11111111 | 11111111 | Defined upper limit of legal scalar codes + // +----------+----------+----------+----------+ + + public static function unichr($code) { + if($code > 1114111 or $code < 0 or + ($code >= 55296 and $code <= 57343) ) { + // bits are set outside the "valid" range as defined + // by UNICODE 4.1.0 + return ''; + } + + $x = $y = $z = $w = 0; + if ($code < 128) { + // regular ASCII character + $x = $code; + } else { + // set up bits for UTF-8 + $x = ($code & 63) | 128; + if ($code < 2048) { + $y = (($code & 2047) >> 6) | 192; + } else { + $y = (($code & 4032) >> 6) | 128; + if($code < 65536) { + $z = (($code >> 12) & 15) | 224; + } else { + $z = (($code >> 12) & 63) | 128; + $w = (($code >> 18) & 7) | 240; + } + } + } + // set up the actual character + $ret = ''; + if($w) $ret .= chr($w); + if($z) $ret .= chr($z); + if($y) $ret .= chr($y); + $ret .= chr($x); + + return $ret; + } + + /** + * Converts a string to UTF-8 based on configuration. + */ + public static function convertToUTF8($str, $config, $context) { + $encoding = $config->get('Core.Encoding'); + if ($encoding === 'utf-8') return $str; + static $iconv = null; + if ($iconv === null) $iconv = function_exists('iconv'); + set_error_handler(array('HTMLPurifier_Encoder', 'muteErrorHandler')); + if ($iconv && !$config->get('Test.ForceNoIconv')) { + $str = iconv($encoding, 'utf-8//IGNORE', $str); + if ($str === false) { + // $encoding is not a valid encoding + restore_error_handler(); + trigger_error('Invalid encoding ' . $encoding, E_USER_ERROR); + return ''; + } + // If the string is bjorked by Shift_JIS or a similar encoding + // that doesn't support all of ASCII, convert the naughty + // characters to their true byte-wise ASCII/UTF-8 equivalents. + $str = strtr($str, HTMLPurifier_Encoder::testEncodingSupportsASCII($encoding)); + restore_error_handler(); + return $str; + } elseif ($encoding === 'iso-8859-1') { + $str = utf8_encode($str); + restore_error_handler(); + return $str; + } + trigger_error('Encoding not supported, please install iconv', E_USER_ERROR); + } + + /** + * Converts a string from UTF-8 based on configuration. + * @note Currently, this is a lossy conversion, with unexpressable + * characters being omitted. + */ + public static function convertFromUTF8($str, $config, $context) { + $encoding = $config->get('Core.Encoding'); + if ($encoding === 'utf-8') return $str; + static $iconv = null; + if ($iconv === null) $iconv = function_exists('iconv'); + if ($escape = $config->get('Core.EscapeNonASCIICharacters')) { + $str = HTMLPurifier_Encoder::convertToASCIIDumbLossless($str); + } + set_error_handler(array('HTMLPurifier_Encoder', 'muteErrorHandler')); + if ($iconv && !$config->get('Test.ForceNoIconv')) { + // Undo our previous fix in convertToUTF8, otherwise iconv will barf + $ascii_fix = HTMLPurifier_Encoder::testEncodingSupportsASCII($encoding); + if (!$escape && !empty($ascii_fix)) { + $clear_fix = array(); + foreach ($ascii_fix as $utf8 => $native) $clear_fix[$utf8] = ''; + $str = strtr($str, $clear_fix); + } + $str = strtr($str, array_flip($ascii_fix)); + // Normal stuff + $str = iconv('utf-8', $encoding . '//IGNORE', $str); + restore_error_handler(); + return $str; + } elseif ($encoding === 'iso-8859-1') { + $str = utf8_decode($str); + restore_error_handler(); + return $str; + } + trigger_error('Encoding not supported', E_USER_ERROR); + } + + /** + * Lossless (character-wise) conversion of HTML to ASCII + * @param $str UTF-8 string to be converted to ASCII + * @returns ASCII encoded string with non-ASCII character entity-ized + * @warning Adapted from MediaWiki, claiming fair use: this is a common + * algorithm. If you disagree with this license fudgery, + * implement it yourself. + * @note Uses decimal numeric entities since they are best supported. + * @note This is a DUMB function: it has no concept of keeping + * character entities that the projected character encoding + * can allow. We could possibly implement a smart version + * but that would require it to also know which Unicode + * codepoints the charset supported (not an easy task). + * @note Sort of with cleanUTF8() but it assumes that $str is + * well-formed UTF-8 + */ + public static function convertToASCIIDumbLossless($str) { + $bytesleft = 0; + $result = ''; + $working = 0; + $len = strlen($str); + for( $i = 0; $i < $len; $i++ ) { + $bytevalue = ord( $str[$i] ); + if( $bytevalue <= 0x7F ) { //0xxx xxxx + $result .= chr( $bytevalue ); + $bytesleft = 0; + } elseif( $bytevalue <= 0xBF ) { //10xx xxxx + $working = $working << 6; + $working += ($bytevalue & 0x3F); + $bytesleft--; + if( $bytesleft <= 0 ) { + $result .= "&#" . $working . ";"; + } + } elseif( $bytevalue <= 0xDF ) { //110x xxxx + $working = $bytevalue & 0x1F; + $bytesleft = 1; + } elseif( $bytevalue <= 0xEF ) { //1110 xxxx + $working = $bytevalue & 0x0F; + $bytesleft = 2; + } else { //1111 0xxx + $working = $bytevalue & 0x07; + $bytesleft = 3; + } + } + return $result; + } + + /** + * This expensive function tests whether or not a given character + * encoding supports ASCII. 7/8-bit encodings like Shift_JIS will + * fail this test, and require special processing. Variable width + * encodings shouldn't ever fail. + * + * @param string $encoding Encoding name to test, as per iconv format + * @param bool $bypass Whether or not to bypass the precompiled arrays. + * @return Array of UTF-8 characters to their corresponding ASCII, + * which can be used to "undo" any overzealous iconv action. + */ + public static function testEncodingSupportsASCII($encoding, $bypass = false) { + static $encodings = array(); + if (!$bypass) { + if (isset($encodings[$encoding])) return $encodings[$encoding]; + $lenc = strtolower($encoding); + switch ($lenc) { + case 'shift_jis': + return array("\xC2\xA5" => '\\', "\xE2\x80\xBE" => '~'); + case 'johab': + return array("\xE2\x82\xA9" => '\\'); + } + if (strpos($lenc, 'iso-8859-') === 0) return array(); + } + $ret = array(); + set_error_handler(array('HTMLPurifier_Encoder', 'muteErrorHandler')); + if (iconv('UTF-8', $encoding, 'a') === false) return false; + for ($i = 0x20; $i <= 0x7E; $i++) { // all printable ASCII chars + $c = chr($i); // UTF-8 char + $r = iconv('UTF-8', "$encoding//IGNORE", $c); // initial conversion + if ( + $r === '' || + // This line is needed for iconv implementations that do not + // omit characters that do not exist in the target character set + ($r === $c && iconv($encoding, 'UTF-8//IGNORE', $r) !== $c) + ) { + // Reverse engineer: what's the UTF-8 equiv of this byte + // sequence? This assumes that there's no variable width + // encoding that doesn't support ASCII. + $ret[iconv($encoding, 'UTF-8//IGNORE', $c)] = $c; + } + } + restore_error_handler(); + $encodings[$encoding] = $ret; + return $ret; + } + + +} + +// vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/EntityLookup.php b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/EntityLookup.php new file mode 100644 index 0000000..b4dfce9 --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/EntityLookup.php @@ -0,0 +1,44 @@ +table = unserialize(file_get_contents($file)); + } + + /** + * Retrieves sole instance of the object. + * @param Optional prototype of custom lookup table to overload with. + */ + public static function instance($prototype = false) { + // no references, since PHP doesn't copy unless modified + static $instance = null; + if ($prototype) { + $instance = $prototype; + } elseif (!$instance) { + $instance = new HTMLPurifier_EntityLookup(); + $instance->setup(); + } + return $instance; + } + +} + +// vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/EntityLookup/entities.ser b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/EntityLookup/entities.ser new file mode 100644 index 0000000..e8b0812 --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/EntityLookup/entities.ser @@ -0,0 +1 @@ +a:253:{s:4:"fnof";s:2:"ƒ";s:5:"Alpha";s:2:"Α";s:4:"Beta";s:2:"Β";s:5:"Gamma";s:2:"Γ";s:5:"Delta";s:2:"Δ";s:7:"Epsilon";s:2:"Ε";s:4:"Zeta";s:2:"Ζ";s:3:"Eta";s:2:"Η";s:5:"Theta";s:2:"Θ";s:4:"Iota";s:2:"Ι";s:5:"Kappa";s:2:"Κ";s:6:"Lambda";s:2:"Λ";s:2:"Mu";s:2:"Μ";s:2:"Nu";s:2:"Ν";s:2:"Xi";s:2:"Ξ";s:7:"Omicron";s:2:"Ο";s:2:"Pi";s:2:"Π";s:3:"Rho";s:2:"Ρ";s:5:"Sigma";s:2:"Σ";s:3:"Tau";s:2:"Τ";s:7:"Upsilon";s:2:"Υ";s:3:"Phi";s:2:"Φ";s:3:"Chi";s:2:"Χ";s:3:"Psi";s:2:"Ψ";s:5:"Omega";s:2:"Ω";s:5:"alpha";s:2:"α";s:4:"beta";s:2:"β";s:5:"gamma";s:2:"γ";s:5:"delta";s:2:"δ";s:7:"epsilon";s:2:"ε";s:4:"zeta";s:2:"ζ";s:3:"eta";s:2:"η";s:5:"theta";s:2:"θ";s:4:"iota";s:2:"ι";s:5:"kappa";s:2:"κ";s:6:"lambda";s:2:"λ";s:2:"mu";s:2:"μ";s:2:"nu";s:2:"ν";s:2:"xi";s:2:"ξ";s:7:"omicron";s:2:"ο";s:2:"pi";s:2:"π";s:3:"rho";s:2:"ρ";s:6:"sigmaf";s:2:"ς";s:5:"sigma";s:2:"σ";s:3:"tau";s:2:"τ";s:7:"upsilon";s:2:"υ";s:3:"phi";s:2:"φ";s:3:"chi";s:2:"χ";s:3:"psi";s:2:"ψ";s:5:"omega";s:2:"ω";s:8:"thetasym";s:2:"ϑ";s:5:"upsih";s:2:"ϒ";s:3:"piv";s:2:"ϖ";s:4:"bull";s:3:"•";s:6:"hellip";s:3:"…";s:5:"prime";s:3:"′";s:5:"Prime";s:3:"″";s:5:"oline";s:3:"‾";s:5:"frasl";s:3:"⁄";s:6:"weierp";s:3:"℘";s:5:"image";s:3:"ℑ";s:4:"real";s:3:"ℜ";s:5:"trade";s:3:"™";s:7:"alefsym";s:3:"ℵ";s:4:"larr";s:3:"←";s:4:"uarr";s:3:"↑";s:4:"rarr";s:3:"→";s:4:"darr";s:3:"↓";s:4:"harr";s:3:"↔";s:5:"crarr";s:3:"↵";s:4:"lArr";s:3:"⇐";s:4:"uArr";s:3:"⇑";s:4:"rArr";s:3:"⇒";s:4:"dArr";s:3:"⇓";s:4:"hArr";s:3:"⇔";s:6:"forall";s:3:"∀";s:4:"part";s:3:"∂";s:5:"exist";s:3:"∃";s:5:"empty";s:3:"∅";s:5:"nabla";s:3:"∇";s:4:"isin";s:3:"∈";s:5:"notin";s:3:"∉";s:2:"ni";s:3:"∋";s:4:"prod";s:3:"∏";s:3:"sum";s:3:"∑";s:5:"minus";s:3:"−";s:6:"lowast";s:3:"∗";s:5:"radic";s:3:"√";s:4:"prop";s:3:"∝";s:5:"infin";s:3:"∞";s:3:"ang";s:3:"∠";s:3:"and";s:3:"∧";s:2:"or";s:3:"∨";s:3:"cap";s:3:"∩";s:3:"cup";s:3:"∪";s:3:"int";s:3:"∫";s:6:"there4";s:3:"∴";s:3:"sim";s:3:"∼";s:4:"cong";s:3:"≅";s:5:"asymp";s:3:"≈";s:2:"ne";s:3:"≠";s:5:"equiv";s:3:"≡";s:2:"le";s:3:"≤";s:2:"ge";s:3:"≥";s:3:"sub";s:3:"⊂";s:3:"sup";s:3:"⊃";s:4:"nsub";s:3:"⊄";s:4:"sube";s:3:"⊆";s:4:"supe";s:3:"⊇";s:5:"oplus";s:3:"⊕";s:6:"otimes";s:3:"⊗";s:4:"perp";s:3:"⊥";s:4:"sdot";s:3:"⋅";s:5:"lceil";s:3:"⌈";s:5:"rceil";s:3:"⌉";s:6:"lfloor";s:3:"⌊";s:6:"rfloor";s:3:"⌋";s:4:"lang";s:3:"〈";s:4:"rang";s:3:"〉";s:3:"loz";s:3:"◊";s:6:"spades";s:3:"♠";s:5:"clubs";s:3:"♣";s:6:"hearts";s:3:"♥";s:5:"diams";s:3:"♦";s:4:"quot";s:1:""";s:3:"amp";s:1:"&";s:2:"lt";s:1:"<";s:2:"gt";s:1:">";s:4:"apos";s:1:"'";s:5:"OElig";s:2:"Œ";s:5:"oelig";s:2:"œ";s:6:"Scaron";s:2:"Š";s:6:"scaron";s:2:"š";s:4:"Yuml";s:2:"Ÿ";s:4:"circ";s:2:"ˆ";s:5:"tilde";s:2:"˜";s:4:"ensp";s:3:" ";s:4:"emsp";s:3:" ";s:6:"thinsp";s:3:" ";s:4:"zwnj";s:3:"‌";s:3:"zwj";s:3:"‍";s:3:"lrm";s:3:"‎";s:3:"rlm";s:3:"‏";s:5:"ndash";s:3:"–";s:5:"mdash";s:3:"—";s:5:"lsquo";s:3:"‘";s:5:"rsquo";s:3:"’";s:5:"sbquo";s:3:"‚";s:5:"ldquo";s:3:"“";s:5:"rdquo";s:3:"”";s:5:"bdquo";s:3:"„";s:6:"dagger";s:3:"†";s:6:"Dagger";s:3:"‡";s:6:"permil";s:3:"‰";s:6:"lsaquo";s:3:"‹";s:6:"rsaquo";s:3:"›";s:4:"euro";s:3:"€";s:4:"nbsp";s:2:" ";s:5:"iexcl";s:2:"¡";s:4:"cent";s:2:"¢";s:5:"pound";s:2:"£";s:6:"curren";s:2:"¤";s:3:"yen";s:2:"¥";s:6:"brvbar";s:2:"¦";s:4:"sect";s:2:"§";s:3:"uml";s:2:"¨";s:4:"copy";s:2:"©";s:4:"ordf";s:2:"ª";s:5:"laquo";s:2:"«";s:3:"not";s:2:"¬";s:3:"shy";s:2:"­";s:3:"reg";s:2:"®";s:4:"macr";s:2:"¯";s:3:"deg";s:2:"°";s:6:"plusmn";s:2:"±";s:4:"sup2";s:2:"²";s:4:"sup3";s:2:"³";s:5:"acute";s:2:"´";s:5:"micro";s:2:"µ";s:4:"para";s:2:"¶";s:6:"middot";s:2:"·";s:5:"cedil";s:2:"¸";s:4:"sup1";s:2:"¹";s:4:"ordm";s:2:"º";s:5:"raquo";s:2:"»";s:6:"frac14";s:2:"¼";s:6:"frac12";s:2:"½";s:6:"frac34";s:2:"¾";s:6:"iquest";s:2:"¿";s:6:"Agrave";s:2:"À";s:6:"Aacute";s:2:"Á";s:5:"Acirc";s:2:"Â";s:6:"Atilde";s:2:"Ã";s:4:"Auml";s:2:"Ä";s:5:"Aring";s:2:"Å";s:5:"AElig";s:2:"Æ";s:6:"Ccedil";s:2:"Ç";s:6:"Egrave";s:2:"È";s:6:"Eacute";s:2:"É";s:5:"Ecirc";s:2:"Ê";s:4:"Euml";s:2:"Ë";s:6:"Igrave";s:2:"Ì";s:6:"Iacute";s:2:"Í";s:5:"Icirc";s:2:"Î";s:4:"Iuml";s:2:"Ï";s:3:"ETH";s:2:"Ð";s:6:"Ntilde";s:2:"Ñ";s:6:"Ograve";s:2:"Ò";s:6:"Oacute";s:2:"Ó";s:5:"Ocirc";s:2:"Ô";s:6:"Otilde";s:2:"Õ";s:4:"Ouml";s:2:"Ö";s:5:"times";s:2:"×";s:6:"Oslash";s:2:"Ø";s:6:"Ugrave";s:2:"Ù";s:6:"Uacute";s:2:"Ú";s:5:"Ucirc";s:2:"Û";s:4:"Uuml";s:2:"Ü";s:6:"Yacute";s:2:"Ý";s:5:"THORN";s:2:"Þ";s:5:"szlig";s:2:"ß";s:6:"agrave";s:2:"à";s:6:"aacute";s:2:"á";s:5:"acirc";s:2:"â";s:6:"atilde";s:2:"ã";s:4:"auml";s:2:"ä";s:5:"aring";s:2:"å";s:5:"aelig";s:2:"æ";s:6:"ccedil";s:2:"ç";s:6:"egrave";s:2:"è";s:6:"eacute";s:2:"é";s:5:"ecirc";s:2:"ê";s:4:"euml";s:2:"ë";s:6:"igrave";s:2:"ì";s:6:"iacute";s:2:"í";s:5:"icirc";s:2:"î";s:4:"iuml";s:2:"ï";s:3:"eth";s:2:"ð";s:6:"ntilde";s:2:"ñ";s:6:"ograve";s:2:"ò";s:6:"oacute";s:2:"ó";s:5:"ocirc";s:2:"ô";s:6:"otilde";s:2:"õ";s:4:"ouml";s:2:"ö";s:6:"divide";s:2:"÷";s:6:"oslash";s:2:"ø";s:6:"ugrave";s:2:"ù";s:6:"uacute";s:2:"ú";s:5:"ucirc";s:2:"û";s:4:"uuml";s:2:"ü";s:6:"yacute";s:2:"ý";s:5:"thorn";s:2:"þ";s:4:"yuml";s:2:"ÿ";} \ No newline at end of file diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/EntityParser.php b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/EntityParser.php new file mode 100644 index 0000000..8c38447 --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/EntityParser.php @@ -0,0 +1,144 @@ + '"', + 38 => '&', + 39 => "'", + 60 => '<', + 62 => '>' + ); + + /** + * Stripped entity names to decimal conversion table for special entities. + */ + protected $_special_ent2dec = + array( + 'quot' => 34, + 'amp' => 38, + 'lt' => 60, + 'gt' => 62 + ); + + /** + * Substitutes non-special entities with their parsed equivalents. Since + * running this whenever you have parsed character is t3h 5uck, we run + * it before everything else. + * + * @param $string String to have non-special entities parsed. + * @returns Parsed string. + */ + public function substituteNonSpecialEntities($string) { + // it will try to detect missing semicolons, but don't rely on it + return preg_replace_callback( + $this->_substituteEntitiesRegex, + array($this, 'nonSpecialEntityCallback'), + $string + ); + } + + /** + * Callback function for substituteNonSpecialEntities() that does the work. + * + * @param $matches PCRE matches array, with 0 the entire match, and + * either index 1, 2 or 3 set with a hex value, dec value, + * or string (respectively). + * @returns Replacement string. + */ + + protected function nonSpecialEntityCallback($matches) { + // replaces all but big five + $entity = $matches[0]; + $is_num = (@$matches[0][1] === '#'); + if ($is_num) { + $is_hex = (@$entity[2] === 'x'); + $code = $is_hex ? hexdec($matches[1]) : (int) $matches[2]; + + // abort for special characters + if (isset($this->_special_dec2str[$code])) return $entity; + + return HTMLPurifier_Encoder::unichr($code); + } else { + if (isset($this->_special_ent2dec[$matches[3]])) return $entity; + if (!$this->_entity_lookup) { + $this->_entity_lookup = HTMLPurifier_EntityLookup::instance(); + } + if (isset($this->_entity_lookup->table[$matches[3]])) { + return $this->_entity_lookup->table[$matches[3]]; + } else { + return $entity; + } + } + } + + /** + * Substitutes only special entities with their parsed equivalents. + * + * @notice We try to avoid calling this function because otherwise, it + * would have to be called a lot (for every parsed section). + * + * @param $string String to have non-special entities parsed. + * @returns Parsed string. + */ + public function substituteSpecialEntities($string) { + return preg_replace_callback( + $this->_substituteEntitiesRegex, + array($this, 'specialEntityCallback'), + $string); + } + + /** + * Callback function for substituteSpecialEntities() that does the work. + * + * This callback has same syntax as nonSpecialEntityCallback(). + * + * @param $matches PCRE-style matches array, with 0 the entire match, and + * either index 1, 2 or 3 set with a hex value, dec value, + * or string (respectively). + * @returns Replacement string. + */ + protected function specialEntityCallback($matches) { + $entity = $matches[0]; + $is_num = (@$matches[0][1] === '#'); + if ($is_num) { + $is_hex = (@$entity[2] === 'x'); + $int = $is_hex ? hexdec($matches[1]) : (int) $matches[2]; + return isset($this->_special_dec2str[$int]) ? + $this->_special_dec2str[$int] : + $entity; + } else { + return isset($this->_special_ent2dec[$matches[3]]) ? + $this->_special_ent2dec[$matches[3]] : + $entity; + } + } + +} + +// vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ErrorCollector.php b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ErrorCollector.php new file mode 100644 index 0000000..6713eaf --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ErrorCollector.php @@ -0,0 +1,209 @@ +locale =& $context->get('Locale'); + $this->context = $context; + $this->_current =& $this->_stacks[0]; + $this->errors =& $this->_stacks[0]; + } + + /** + * Sends an error message to the collector for later use + * @param $severity int Error severity, PHP error style (don't use E_USER_) + * @param $msg string Error message text + * @param $subst1 string First substitution for $msg + * @param $subst2 string ... + */ + public function send($severity, $msg) { + + $args = array(); + if (func_num_args() > 2) { + $args = func_get_args(); + array_shift($args); + unset($args[0]); + } + + $token = $this->context->get('CurrentToken', true); + $line = $token ? $token->line : $this->context->get('CurrentLine', true); + $col = $token ? $token->col : $this->context->get('CurrentCol', true); + $attr = $this->context->get('CurrentAttr', true); + + // perform special substitutions, also add custom parameters + $subst = array(); + if (!is_null($token)) { + $args['CurrentToken'] = $token; + } + if (!is_null($attr)) { + $subst['$CurrentAttr.Name'] = $attr; + if (isset($token->attr[$attr])) $subst['$CurrentAttr.Value'] = $token->attr[$attr]; + } + + if (empty($args)) { + $msg = $this->locale->getMessage($msg); + } else { + $msg = $this->locale->formatMessage($msg, $args); + } + + if (!empty($subst)) $msg = strtr($msg, $subst); + + // (numerically indexed) + $error = array( + self::LINENO => $line, + self::SEVERITY => $severity, + self::MESSAGE => $msg, + self::CHILDREN => array() + ); + $this->_current[] = $error; + + + // NEW CODE BELOW ... + + $struct = null; + // Top-level errors are either: + // TOKEN type, if $value is set appropriately, or + // "syntax" type, if $value is null + $new_struct = new HTMLPurifier_ErrorStruct(); + $new_struct->type = HTMLPurifier_ErrorStruct::TOKEN; + if ($token) $new_struct->value = clone $token; + if (is_int($line) && is_int($col)) { + if (isset($this->lines[$line][$col])) { + $struct = $this->lines[$line][$col]; + } else { + $struct = $this->lines[$line][$col] = $new_struct; + } + // These ksorts may present a performance problem + ksort($this->lines[$line], SORT_NUMERIC); + } else { + if (isset($this->lines[-1])) { + $struct = $this->lines[-1]; + } else { + $struct = $this->lines[-1] = $new_struct; + } + } + ksort($this->lines, SORT_NUMERIC); + + // Now, check if we need to operate on a lower structure + if (!empty($attr)) { + $struct = $struct->getChild(HTMLPurifier_ErrorStruct::ATTR, $attr); + if (!$struct->value) { + $struct->value = array($attr, 'PUT VALUE HERE'); + } + } + if (!empty($cssprop)) { + $struct = $struct->getChild(HTMLPurifier_ErrorStruct::CSSPROP, $cssprop); + if (!$struct->value) { + // if we tokenize CSS this might be a little more difficult to do + $struct->value = array($cssprop, 'PUT VALUE HERE'); + } + } + + // Ok, structs are all setup, now time to register the error + $struct->addError($severity, $msg); + } + + /** + * Retrieves raw error data for custom formatter to use + * @param List of arrays in format of array(line of error, + * error severity, error message, + * recursive sub-errors array) + */ + public function getRaw() { + return $this->errors; + } + + /** + * Default HTML formatting implementation for error messages + * @param $config Configuration array, vital for HTML output nature + * @param $errors Errors array to display; used for recursion. + */ + public function getHTMLFormatted($config, $errors = null) { + $ret = array(); + + $this->generator = new HTMLPurifier_Generator($config, $this->context); + if ($errors === null) $errors = $this->errors; + + // 'At line' message needs to be removed + + // generation code for new structure goes here. It needs to be recursive. + foreach ($this->lines as $line => $col_array) { + if ($line == -1) continue; + foreach ($col_array as $col => $struct) { + $this->_renderStruct($ret, $struct, $line, $col); + } + } + if (isset($this->lines[-1])) { + $this->_renderStruct($ret, $this->lines[-1]); + } + + if (empty($errors)) { + return '

' . $this->locale->getMessage('ErrorCollector: No errors') . '

'; + } else { + return '
  • ' . implode('
  • ', $ret) . '
'; + } + + } + + private function _renderStruct(&$ret, $struct, $line = null, $col = null) { + $stack = array($struct); + $context_stack = array(array()); + while ($current = array_pop($stack)) { + $context = array_pop($context_stack); + foreach ($current->errors as $error) { + list($severity, $msg) = $error; + $string = ''; + $string .= '
'; + // W3C uses an icon to indicate the severity of the error. + $error = $this->locale->getErrorName($severity); + $string .= "$error "; + if (!is_null($line) && !is_null($col)) { + $string .= "Line $line, Column $col: "; + } else { + $string .= 'End of Document: '; + } + $string .= '' . $this->generator->escape($msg) . ' '; + $string .= '
'; + // Here, have a marker for the character on the column appropriate. + // Be sure to clip extremely long lines. + //$string .= '
';
+                //$string .= '';
+                //$string .= '
'; + $ret[] = $string; + } + foreach ($current->children as $type => $array) { + $context[] = $current; + $stack = array_merge($stack, array_reverse($array, true)); + for ($i = count($array); $i > 0; $i--) { + $context_stack[] = $context; + } + } + } + } + +} + +// vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ErrorStruct.php b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ErrorStruct.php new file mode 100644 index 0000000..9bc8996 --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/ErrorStruct.php @@ -0,0 +1,60 @@ +children[$type][$id])) { + $this->children[$type][$id] = new HTMLPurifier_ErrorStruct(); + $this->children[$type][$id]->type = $type; + } + return $this->children[$type][$id]; + } + + public function addError($severity, $message) { + $this->errors[] = array($severity, $message); + } + +} + +// vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/Exception.php b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/Exception.php new file mode 100644 index 0000000..be85b4c --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/Exception.php @@ -0,0 +1,12 @@ +preFilter, + * 2->preFilter, 3->preFilter, purify, 3->postFilter, 2->postFilter, + * 1->postFilter. + * + * @note Methods are not declared abstract as it is perfectly legitimate + * for an implementation not to want anything to happen on a step + */ + +class HTMLPurifier_Filter +{ + + /** + * Name of the filter for identification purposes + */ + public $name; + + /** + * Pre-processor function, handles HTML before HTML Purifier + */ + public function preFilter($html, $config, $context) { + return $html; + } + + /** + * Post-processor function, handles HTML after HTML Purifier + */ + public function postFilter($html, $config, $context) { + return $html; + } + +} + +// vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/Filter/ExtractStyleBlocks.php b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/Filter/ExtractStyleBlocks.php new file mode 100644 index 0000000..bbf78a6 --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/Filter/ExtractStyleBlocks.php @@ -0,0 +1,135 @@ + blocks from input HTML, cleans them up + * using CSSTidy, and then places them in $purifier->context->get('StyleBlocks') + * so they can be used elsewhere in the document. + * + * @note + * See tests/HTMLPurifier/Filter/ExtractStyleBlocksTest.php for + * sample usage. + * + * @note + * This filter can also be used on stylesheets not included in the + * document--something purists would probably prefer. Just directly + * call HTMLPurifier_Filter_ExtractStyleBlocks->cleanCSS() + */ +class HTMLPurifier_Filter_ExtractStyleBlocks extends HTMLPurifier_Filter +{ + + public $name = 'ExtractStyleBlocks'; + private $_styleMatches = array(); + private $_tidy; + + public function __construct() { + $this->_tidy = new csstidy(); + } + + /** + * Save the contents of CSS blocks to style matches + * @param $matches preg_replace style $matches array + */ + protected function styleCallback($matches) { + $this->_styleMatches[] = $matches[1]; + } + + /** + * Removes inline #isU', array($this, 'styleCallback'), $html); + $style_blocks = $this->_styleMatches; + $this->_styleMatches = array(); // reset + $context->register('StyleBlocks', $style_blocks); // $context must not be reused + if ($this->_tidy) { + foreach ($style_blocks as &$style) { + $style = $this->cleanCSS($style, $config, $context); + } + } + return $html; + } + + /** + * Takes CSS (the stuff found in in a font-family prop). + if ($config->get('Filter.ExtractStyleBlocks.Escaping')) { + $css = str_replace( + array('<', '>', '&'), + array('\3C ', '\3E ', '\26 '), + $css + ); + } + return $css; + } + +} + +// vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/Filter/YouTube.php b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/Filter/YouTube.php new file mode 100644 index 0000000..23df221 --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/Filter/YouTube.php @@ -0,0 +1,39 @@ +]+>.+?'. + 'http://www.youtube.com/((?:v|cp)/[A-Za-z0-9\-_=]+).+?#s'; + $pre_replace = '\1'; + return preg_replace($pre_regex, $pre_replace, $html); + } + + public function postFilter($html, $config, $context) { + $post_regex = '#((?:v|cp)/[A-Za-z0-9\-_=]+)#'; + return preg_replace_callback($post_regex, array($this, 'postFilterCallback'), $html); + } + + protected function armorUrl($url) { + return str_replace('--', '--', $url); + } + + protected function postFilterCallback($matches) { + $url = $this->armorUrl($matches[1]); + return ''. + ''. + ''. + ''; + + } +} + +// vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/Generator.php b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/Generator.php new file mode 100644 index 0000000..fee1a5f --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/Generator.php @@ -0,0 +1,254 @@ + tags + */ + private $_scriptFix = false; + + /** + * Cache of HTMLDefinition during HTML output to determine whether or + * not attributes should be minimized. + */ + private $_def; + + /** + * Cache of %Output.SortAttr + */ + private $_sortAttr; + + /** + * Cache of %Output.FlashCompat + */ + private $_flashCompat; + + /** + * Cache of %Output.FixInnerHTML + */ + private $_innerHTMLFix; + + /** + * Stack for keeping track of object information when outputting IE + * compatibility code. + */ + private $_flashStack = array(); + + /** + * Configuration for the generator + */ + protected $config; + + /** + * @param $config Instance of HTMLPurifier_Config + * @param $context Instance of HTMLPurifier_Context + */ + public function __construct($config, $context) { + $this->config = $config; + $this->_scriptFix = $config->get('Output.CommentScriptContents'); + $this->_innerHTMLFix = $config->get('Output.FixInnerHTML'); + $this->_sortAttr = $config->get('Output.SortAttr'); + $this->_flashCompat = $config->get('Output.FlashCompat'); + $this->_def = $config->getHTMLDefinition(); + $this->_xhtml = $this->_def->doctype->xml; + } + + /** + * Generates HTML from an array of tokens. + * @param $tokens Array of HTMLPurifier_Token + * @param $config HTMLPurifier_Config object + * @return Generated HTML + */ + public function generateFromTokens($tokens) { + if (!$tokens) return ''; + + // Basic algorithm + $html = ''; + for ($i = 0, $size = count($tokens); $i < $size; $i++) { + if ($this->_scriptFix && $tokens[$i]->name === 'script' + && $i + 2 < $size && $tokens[$i+2] instanceof HTMLPurifier_Token_End) { + // script special case + // the contents of the script block must be ONE token + // for this to work. + $html .= $this->generateFromToken($tokens[$i++]); + $html .= $this->generateScriptFromToken($tokens[$i++]); + } + $html .= $this->generateFromToken($tokens[$i]); + } + + // Tidy cleanup + if (extension_loaded('tidy') && $this->config->get('Output.TidyFormat')) { + $tidy = new Tidy; + $tidy->parseString($html, array( + 'indent'=> true, + 'output-xhtml' => $this->_xhtml, + 'show-body-only' => true, + 'indent-spaces' => 2, + 'wrap' => 68, + ), 'utf8'); + $tidy->cleanRepair(); + $html = (string) $tidy; // explicit cast necessary + } + + // Normalize newlines to system defined value + if ($this->config->get('Core.NormalizeNewlines')) { + $nl = $this->config->get('Output.Newline'); + if ($nl === null) $nl = PHP_EOL; + if ($nl !== "\n") $html = str_replace("\n", $nl, $html); + } + return $html; + } + + /** + * Generates HTML from a single token. + * @param $token HTMLPurifier_Token object. + * @return Generated HTML + */ + public function generateFromToken($token) { + if (!$token instanceof HTMLPurifier_Token) { + trigger_error('Cannot generate HTML from non-HTMLPurifier_Token object', E_USER_WARNING); + return ''; + + } elseif ($token instanceof HTMLPurifier_Token_Start) { + $attr = $this->generateAttributes($token->attr, $token->name); + if ($this->_flashCompat) { + if ($token->name == "object") { + $flash = new stdclass(); + $flash->attr = $token->attr; + $flash->param = array(); + $this->_flashStack[] = $flash; + } + } + return '<' . $token->name . ($attr ? ' ' : '') . $attr . '>'; + + } elseif ($token instanceof HTMLPurifier_Token_End) { + $_extra = ''; + if ($this->_flashCompat) { + if ($token->name == "object" && !empty($this->_flashStack)) { + // doesn't do anything for now + } + } + return $_extra . 'name . '>'; + + } elseif ($token instanceof HTMLPurifier_Token_Empty) { + if ($this->_flashCompat && $token->name == "param" && !empty($this->_flashStack)) { + $this->_flashStack[count($this->_flashStack)-1]->param[$token->attr['name']] = $token->attr['value']; + } + $attr = $this->generateAttributes($token->attr, $token->name); + return '<' . $token->name . ($attr ? ' ' : '') . $attr . + ( $this->_xhtml ? ' /': '' ) //
v.
+ . '>'; + + } elseif ($token instanceof HTMLPurifier_Token_Text) { + return $this->escape($token->data, ENT_NOQUOTES); + + } elseif ($token instanceof HTMLPurifier_Token_Comment) { + return ''; + } else { + return ''; + + } + } + + /** + * Special case processor for the contents of script tags + * @warning This runs into problems if there's already a literal + * --> somewhere inside the script contents. + */ + public function generateScriptFromToken($token) { + if (!$token instanceof HTMLPurifier_Token_Text) return $this->generateFromToken($token); + // Thanks + $data = preg_replace('#//\s*$#', '', $token->data); + return ''; + } + + /** + * Generates attribute declarations from attribute array. + * @note This does not include the leading or trailing space. + * @param $assoc_array_of_attributes Attribute array + * @param $element Name of element attributes are for, used to check + * attribute minimization. + * @return Generate HTML fragment for insertion. + */ + public function generateAttributes($assoc_array_of_attributes, $element = false) { + $html = ''; + if ($this->_sortAttr) ksort($assoc_array_of_attributes); + foreach ($assoc_array_of_attributes as $key => $value) { + if (!$this->_xhtml) { + // Remove namespaced attributes + if (strpos($key, ':') !== false) continue; + // Check if we should minimize the attribute: val="val" -> val + if ($element && !empty($this->_def->info[$element]->attr[$key]->minimized)) { + $html .= $key . ' '; + continue; + } + } + // Workaround for Internet Explorer innerHTML bug. + // Essentially, Internet Explorer, when calculating + // innerHTML, omits quotes if there are no instances of + // angled brackets, quotes or spaces. However, when parsing + // HTML (for example, when you assign to innerHTML), it + // treats backticks as quotes. Thus, + // `` + // becomes + // `` + // becomes + // + // Fortunately, all we need to do is trigger an appropriate + // quoting style, which we do by adding an extra space. + // This also is consistent with the W3C spec, which states + // that user agents may ignore leading or trailing + // whitespace (in fact, most don't, at least for attributes + // like alt, but an extra space at the end is barely + // noticeable). Still, we have a configuration knob for + // this, since this transformation is not necesary if you + // don't process user input with innerHTML or you don't plan + // on supporting Internet Explorer. + if ($this->_innerHTMLFix) { + if (strpos($value, '`') !== false) { + // check if correct quoting style would not already be + // triggered + if (strcspn($value, '"\' <>') === strlen($value)) { + // protect! + $value .= ' '; + } + } + } + $html .= $key.'="'.$this->escape($value).'" '; + } + return rtrim($html); + } + + /** + * Escapes raw text data. + * @todo This really ought to be protected, but until we have a facility + * for properly generating HTML here w/o using tokens, it stays + * public. + * @param $string String data to escape for HTML. + * @param $quote Quoting style, like htmlspecialchars. ENT_NOQUOTES is + * permissible for non-attribute output. + * @return String escaped data. + */ + public function escape($string, $quote = null) { + // Workaround for APC bug on Mac Leopard reported by sidepodcast + // http://htmlpurifier.org/phorum/read.php?3,4823,4846 + if ($quote === null) $quote = ENT_COMPAT; + return htmlspecialchars($string, $quote, 'UTF-8'); + } + +} + +// vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/HTMLDefinition.php b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/HTMLDefinition.php new file mode 100644 index 0000000..33bb38a --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/HTMLDefinition.php @@ -0,0 +1,425 @@ +getAnonymousModule(); + if (!isset($module->info[$element_name])) { + $element = $module->addBlankElement($element_name); + } else { + $element = $module->info[$element_name]; + } + $element->attr[$attr_name] = $def; + } + + /** + * Adds a custom element to your HTML definition + * @note See HTMLPurifier_HTMLModule::addElement for detailed + * parameter and return value descriptions. + */ + public function addElement($element_name, $type, $contents, $attr_collections, $attributes = array()) { + $module = $this->getAnonymousModule(); + // assume that if the user is calling this, the element + // is safe. This may not be a good idea + $element = $module->addElement($element_name, $type, $contents, $attr_collections, $attributes); + return $element; + } + + /** + * Adds a blank element to your HTML definition, for overriding + * existing behavior + * @note See HTMLPurifier_HTMLModule::addBlankElement for detailed + * parameter and return value descriptions. + */ + public function addBlankElement($element_name) { + $module = $this->getAnonymousModule(); + $element = $module->addBlankElement($element_name); + return $element; + } + + /** + * Retrieves a reference to the anonymous module, so you can + * bust out advanced features without having to make your own + * module. + */ + public function getAnonymousModule() { + if (!$this->_anonModule) { + $this->_anonModule = new HTMLPurifier_HTMLModule(); + $this->_anonModule->name = 'Anonymous'; + } + return $this->_anonModule; + } + + private $_anonModule; + + + // PUBLIC BUT INTERNAL VARIABLES -------------------------------------- + + public $type = 'HTML'; + public $manager; /**< Instance of HTMLPurifier_HTMLModuleManager */ + + /** + * Performs low-cost, preliminary initialization. + */ + public function __construct() { + $this->manager = new HTMLPurifier_HTMLModuleManager(); + } + + protected function doSetup($config) { + $this->processModules($config); + $this->setupConfigStuff($config); + unset($this->manager); + + // cleanup some of the element definitions + foreach ($this->info as $k => $v) { + unset($this->info[$k]->content_model); + unset($this->info[$k]->content_model_type); + } + } + + /** + * Extract out the information from the manager + */ + protected function processModules($config) { + + if ($this->_anonModule) { + // for user specific changes + // this is late-loaded so we don't have to deal with PHP4 + // reference wonky-ness + $this->manager->addModule($this->_anonModule); + unset($this->_anonModule); + } + + $this->manager->setup($config); + $this->doctype = $this->manager->doctype; + + foreach ($this->manager->modules as $module) { + foreach($module->info_tag_transform as $k => $v) { + if ($v === false) unset($this->info_tag_transform[$k]); + else $this->info_tag_transform[$k] = $v; + } + foreach($module->info_attr_transform_pre as $k => $v) { + if ($v === false) unset($this->info_attr_transform_pre[$k]); + else $this->info_attr_transform_pre[$k] = $v; + } + foreach($module->info_attr_transform_post as $k => $v) { + if ($v === false) unset($this->info_attr_transform_post[$k]); + else $this->info_attr_transform_post[$k] = $v; + } + foreach ($module->info_injector as $k => $v) { + if ($v === false) unset($this->info_injector[$k]); + else $this->info_injector[$k] = $v; + } + } + + $this->info = $this->manager->getElements(); + $this->info_content_sets = $this->manager->contentSets->lookup; + + } + + /** + * Sets up stuff based on config. We need a better way of doing this. + */ + protected function setupConfigStuff($config) { + + $block_wrapper = $config->get('HTML.BlockWrapper'); + if (isset($this->info_content_sets['Block'][$block_wrapper])) { + $this->info_block_wrapper = $block_wrapper; + } else { + trigger_error('Cannot use non-block element as block wrapper', + E_USER_ERROR); + } + + $parent = $config->get('HTML.Parent'); + $def = $this->manager->getElement($parent, true); + if ($def) { + $this->info_parent = $parent; + $this->info_parent_def = $def; + } else { + trigger_error('Cannot use unrecognized element as parent', + E_USER_ERROR); + $this->info_parent_def = $this->manager->getElement($this->info_parent, true); + } + + // support template text + $support = "(for information on implementing this, see the ". + "support forums) "; + + // setup allowed elements ----------------------------------------- + + $allowed_elements = $config->get('HTML.AllowedElements'); + $allowed_attributes = $config->get('HTML.AllowedAttributes'); // retrieve early + + if (!is_array($allowed_elements) && !is_array($allowed_attributes)) { + $allowed = $config->get('HTML.Allowed'); + if (is_string($allowed)) { + list($allowed_elements, $allowed_attributes) = $this->parseTinyMCEAllowedList($allowed); + } + } + + if (is_array($allowed_elements)) { + foreach ($this->info as $name => $d) { + if(!isset($allowed_elements[$name])) unset($this->info[$name]); + unset($allowed_elements[$name]); + } + // emit errors + foreach ($allowed_elements as $element => $d) { + $element = htmlspecialchars($element); // PHP doesn't escape errors, be careful! + trigger_error("Element '$element' is not supported $support", E_USER_WARNING); + } + } + + // setup allowed attributes --------------------------------------- + + $allowed_attributes_mutable = $allowed_attributes; // by copy! + if (is_array($allowed_attributes)) { + + // This actually doesn't do anything, since we went away from + // global attributes. It's possible that userland code uses + // it, but HTMLModuleManager doesn't! + foreach ($this->info_global_attr as $attr => $x) { + $keys = array($attr, "*@$attr", "*.$attr"); + $delete = true; + foreach ($keys as $key) { + if ($delete && isset($allowed_attributes[$key])) { + $delete = false; + } + if (isset($allowed_attributes_mutable[$key])) { + unset($allowed_attributes_mutable[$key]); + } + } + if ($delete) unset($this->info_global_attr[$attr]); + } + + foreach ($this->info as $tag => $info) { + foreach ($info->attr as $attr => $x) { + $keys = array("$tag@$attr", $attr, "*@$attr", "$tag.$attr", "*.$attr"); + $delete = true; + foreach ($keys as $key) { + if ($delete && isset($allowed_attributes[$key])) { + $delete = false; + } + if (isset($allowed_attributes_mutable[$key])) { + unset($allowed_attributes_mutable[$key]); + } + } + if ($delete) { + if ($this->info[$tag]->attr[$attr]->required) { + trigger_error("Required attribute '$attr' in element '$tag' was not allowed, which means '$tag' will not be allowed either", E_USER_WARNING); + } + unset($this->info[$tag]->attr[$attr]); + } + } + } + // emit errors + foreach ($allowed_attributes_mutable as $elattr => $d) { + $bits = preg_split('/[.@]/', $elattr, 2); + $c = count($bits); + switch ($c) { + case 2: + if ($bits[0] !== '*') { + $element = htmlspecialchars($bits[0]); + $attribute = htmlspecialchars($bits[1]); + if (!isset($this->info[$element])) { + trigger_error("Cannot allow attribute '$attribute' if element '$element' is not allowed/supported $support"); + } else { + trigger_error("Attribute '$attribute' in element '$element' not supported $support", + E_USER_WARNING); + } + break; + } + // otherwise fall through + case 1: + $attribute = htmlspecialchars($bits[0]); + trigger_error("Global attribute '$attribute' is not ". + "supported in any elements $support", + E_USER_WARNING); + break; + } + } + + } + + // setup forbidden elements --------------------------------------- + + $forbidden_elements = $config->get('HTML.ForbiddenElements'); + $forbidden_attributes = $config->get('HTML.ForbiddenAttributes'); + + foreach ($this->info as $tag => $info) { + if (isset($forbidden_elements[$tag])) { + unset($this->info[$tag]); + continue; + } + foreach ($info->attr as $attr => $x) { + if ( + isset($forbidden_attributes["$tag@$attr"]) || + isset($forbidden_attributes["*@$attr"]) || + isset($forbidden_attributes[$attr]) + ) { + unset($this->info[$tag]->attr[$attr]); + continue; + } // this segment might get removed eventually + elseif (isset($forbidden_attributes["$tag.$attr"])) { + // $tag.$attr are not user supplied, so no worries! + trigger_error("Error with $tag.$attr: tag.attr syntax not supported for HTML.ForbiddenAttributes; use tag@attr instead", E_USER_WARNING); + } + } + } + foreach ($forbidden_attributes as $key => $v) { + if (strlen($key) < 2) continue; + if ($key[0] != '*') continue; + if ($key[1] == '.') { + trigger_error("Error with $key: *.attr syntax not supported for HTML.ForbiddenAttributes; use attr instead", E_USER_WARNING); + } + } + + // setup injectors ----------------------------------------------------- + foreach ($this->info_injector as $i => $injector) { + if ($injector->checkNeeded($config) !== false) { + // remove injector that does not have it's required + // elements/attributes present, and is thus not needed. + unset($this->info_injector[$i]); + } + } + } + + /** + * Parses a TinyMCE-flavored Allowed Elements and Attributes list into + * separate lists for processing. Format is element[attr1|attr2],element2... + * @warning Although it's largely drawn from TinyMCE's implementation, + * it is different, and you'll probably have to modify your lists + * @param $list String list to parse + * @param array($allowed_elements, $allowed_attributes) + * @todo Give this its own class, probably static interface + */ + public function parseTinyMCEAllowedList($list) { + + $list = str_replace(array(' ', "\t"), '', $list); + + $elements = array(); + $attributes = array(); + + $chunks = preg_split('/(,|[\n\r]+)/', $list); + foreach ($chunks as $chunk) { + if (empty($chunk)) continue; + // remove TinyMCE element control characters + if (!strpos($chunk, '[')) { + $element = $chunk; + $attr = false; + } else { + list($element, $attr) = explode('[', $chunk); + } + if ($element !== '*') $elements[$element] = true; + if (!$attr) continue; + $attr = substr($attr, 0, strlen($attr) - 1); // remove trailing ] + $attr = explode('|', $attr); + foreach ($attr as $key) { + $attributes["$element.$key"] = true; + } + } + + return array($elements, $attributes); + + } + + +} + +// vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/HTMLModule.php b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/HTMLModule.php new file mode 100644 index 0000000..072cf68 --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/HTMLModule.php @@ -0,0 +1,244 @@ +info, since the object's data is only info, + * with extra behavior associated with it. + */ + public $attr_collections = array(); + + /** + * Associative array of deprecated tag name to HTMLPurifier_TagTransform + */ + public $info_tag_transform = array(); + + /** + * List of HTMLPurifier_AttrTransform to be performed before validation. + */ + public $info_attr_transform_pre = array(); + + /** + * List of HTMLPurifier_AttrTransform to be performed after validation. + */ + public $info_attr_transform_post = array(); + + /** + * List of HTMLPurifier_Injector to be performed during well-formedness fixing. + * An injector will only be invoked if all of it's pre-requisites are met; + * if an injector fails setup, there will be no error; it will simply be + * silently disabled. + */ + public $info_injector = array(); + + /** + * Boolean flag that indicates whether or not getChildDef is implemented. + * For optimization reasons: may save a call to a function. Be sure + * to set it if you do implement getChildDef(), otherwise it will have + * no effect! + */ + public $defines_child_def = false; + + /** + * Boolean flag whether or not this module is safe. If it is not safe, all + * of its members are unsafe. Modules are safe by default (this might be + * slightly dangerous, but it doesn't make much sense to force HTML Purifier, + * which is based off of safe HTML, to explicitly say, "This is safe," even + * though there are modules which are "unsafe") + * + * @note Previously, safety could be applied at an element level granularity. + * We've removed this ability, so in order to add "unsafe" elements + * or attributes, a dedicated module with this property set to false + * must be used. + */ + public $safe = true; + + /** + * Retrieves a proper HTMLPurifier_ChildDef subclass based on + * content_model and content_model_type member variables of + * the HTMLPurifier_ElementDef class. There is a similar function + * in HTMLPurifier_HTMLDefinition. + * @param $def HTMLPurifier_ElementDef instance + * @return HTMLPurifier_ChildDef subclass + */ + public function getChildDef($def) {return false;} + + // -- Convenience ----------------------------------------------------- + + /** + * Convenience function that sets up a new element + * @param $element Name of element to add + * @param $type What content set should element be registered to? + * Set as false to skip this step. + * @param $contents Allowed children in form of: + * "$content_model_type: $content_model" + * @param $attr_includes What attribute collections to register to + * element? + * @param $attr What unique attributes does the element define? + * @note See ElementDef for in-depth descriptions of these parameters. + * @return Created element definition object, so you + * can set advanced parameters + */ + public function addElement($element, $type, $contents, $attr_includes = array(), $attr = array()) { + $this->elements[] = $element; + // parse content_model + list($content_model_type, $content_model) = $this->parseContents($contents); + // merge in attribute inclusions + $this->mergeInAttrIncludes($attr, $attr_includes); + // add element to content sets + if ($type) $this->addElementToContentSet($element, $type); + // create element + $this->info[$element] = HTMLPurifier_ElementDef::create( + $content_model, $content_model_type, $attr + ); + // literal object $contents means direct child manipulation + if (!is_string($contents)) $this->info[$element]->child = $contents; + return $this->info[$element]; + } + + /** + * Convenience function that creates a totally blank, non-standalone + * element. + * @param $element Name of element to create + * @return Created element + */ + public function addBlankElement($element) { + if (!isset($this->info[$element])) { + $this->elements[] = $element; + $this->info[$element] = new HTMLPurifier_ElementDef(); + $this->info[$element]->standalone = false; + } else { + trigger_error("Definition for $element already exists in module, cannot redefine"); + } + return $this->info[$element]; + } + + /** + * Convenience function that registers an element to a content set + * @param Element to register + * @param Name content set (warning: case sensitive, usually upper-case + * first letter) + */ + public function addElementToContentSet($element, $type) { + if (!isset($this->content_sets[$type])) $this->content_sets[$type] = ''; + else $this->content_sets[$type] .= ' | '; + $this->content_sets[$type] .= $element; + } + + /** + * Convenience function that transforms single-string contents + * into separate content model and content model type + * @param $contents Allowed children in form of: + * "$content_model_type: $content_model" + * @note If contents is an object, an array of two nulls will be + * returned, and the callee needs to take the original $contents + * and use it directly. + */ + public function parseContents($contents) { + if (!is_string($contents)) return array(null, null); // defer + switch ($contents) { + // check for shorthand content model forms + case 'Empty': + return array('empty', ''); + case 'Inline': + return array('optional', 'Inline | #PCDATA'); + case 'Flow': + return array('optional', 'Flow | #PCDATA'); + } + list($content_model_type, $content_model) = explode(':', $contents); + $content_model_type = strtolower(trim($content_model_type)); + $content_model = trim($content_model); + return array($content_model_type, $content_model); + } + + /** + * Convenience function that merges a list of attribute includes into + * an attribute array. + * @param $attr Reference to attr array to modify + * @param $attr_includes Array of includes / string include to merge in + */ + public function mergeInAttrIncludes(&$attr, $attr_includes) { + if (!is_array($attr_includes)) { + if (empty($attr_includes)) $attr_includes = array(); + else $attr_includes = array($attr_includes); + } + $attr[0] = $attr_includes; + } + + /** + * Convenience function that generates a lookup table with boolean + * true as value. + * @param $list List of values to turn into a lookup + * @note You can also pass an arbitrary number of arguments in + * place of the regular argument + * @return Lookup array equivalent of list + */ + public function makeLookup($list) { + if (is_string($list)) $list = func_get_args(); + $ret = array(); + foreach ($list as $value) { + if (is_null($value)) continue; + $ret[$value] = true; + } + return $ret; + } + + /** + * Lazy load construction of the module after determining whether + * or not it's needed, and also when a finalized configuration object + * is available. + * @param $config Instance of HTMLPurifier_Config + */ + public function setup($config) {} + +} + +// vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/HTMLModule/Bdo.php b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/HTMLModule/Bdo.php new file mode 100644 index 0000000..3d66f1b --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/HTMLModule/Bdo.php @@ -0,0 +1,31 @@ + array('dir' => false) + ); + + public function setup($config) { + $bdo = $this->addElement( + 'bdo', 'Inline', 'Inline', array('Core', 'Lang'), + array( + 'dir' => 'Enum#ltr,rtl', // required + // The Abstract Module specification has the attribute + // inclusions wrong for bdo: bdo allows Lang + ) + ); + $bdo->attr_transform_post['required-dir'] = new HTMLPurifier_AttrTransform_BdoDir(); + + $this->attr_collections['I18N']['dir'] = 'Enum#ltr,rtl'; + } + +} + +// vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/HTMLModule/CommonAttributes.php b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/HTMLModule/CommonAttributes.php new file mode 100644 index 0000000..7c15da8 --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/HTMLModule/CommonAttributes.php @@ -0,0 +1,26 @@ + array( + 0 => array('Style'), + // 'xml:space' => false, + 'class' => 'Class', + 'id' => 'ID', + 'title' => 'CDATA', + ), + 'Lang' => array(), + 'I18N' => array( + 0 => array('Lang'), // proprietary, for xml:lang/lang + ), + 'Common' => array( + 0 => array('Core', 'I18N') + ) + ); + +} + +// vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/HTMLModule/Edit.php b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/HTMLModule/Edit.php new file mode 100644 index 0000000..ff93690 --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/HTMLModule/Edit.php @@ -0,0 +1,38 @@ + 'URI', + // 'datetime' => 'Datetime', // not implemented + ); + $this->addElement('del', 'Inline', $contents, 'Common', $attr); + $this->addElement('ins', 'Inline', $contents, 'Common', $attr); + } + + // HTML 4.01 specifies that ins/del must not contain block + // elements when used in an inline context, chameleon is + // a complicated workaround to acheive this effect + + // Inline context ! Block context (exclamation mark is + // separator, see getChildDef for parsing) + + public $defines_child_def = true; + public function getChildDef($def) { + if ($def->content_model_type != 'chameleon') return false; + $value = explode('!', $def->content_model); + return new HTMLPurifier_ChildDef_Chameleon($value[0], $value[1]); + } + +} + +// vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/HTMLModule/Forms.php b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/HTMLModule/Forms.php new file mode 100644 index 0000000..44c22f6 --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/HTMLModule/Forms.php @@ -0,0 +1,118 @@ + 'Form', + 'Inline' => 'Formctrl', + ); + + public function setup($config) { + $form = $this->addElement('form', 'Form', + 'Required: Heading | List | Block | fieldset', 'Common', array( + 'accept' => 'ContentTypes', + 'accept-charset' => 'Charsets', + 'action*' => 'URI', + 'method' => 'Enum#get,post', + // really ContentType, but these two are the only ones used today + 'enctype' => 'Enum#application/x-www-form-urlencoded,multipart/form-data', + )); + $form->excludes = array('form' => true); + + $input = $this->addElement('input', 'Formctrl', 'Empty', 'Common', array( + 'accept' => 'ContentTypes', + 'accesskey' => 'Character', + 'alt' => 'Text', + 'checked' => 'Bool#checked', + 'disabled' => 'Bool#disabled', + 'maxlength' => 'Number', + 'name' => 'CDATA', + 'readonly' => 'Bool#readonly', + 'size' => 'Number', + 'src' => 'URI#embeds', + 'tabindex' => 'Number', + 'type' => 'Enum#text,password,checkbox,button,radio,submit,reset,file,hidden,image', + 'value' => 'CDATA', + )); + $input->attr_transform_post[] = new HTMLPurifier_AttrTransform_Input(); + + $this->addElement('select', 'Formctrl', 'Required: optgroup | option', 'Common', array( + 'disabled' => 'Bool#disabled', + 'multiple' => 'Bool#multiple', + 'name' => 'CDATA', + 'size' => 'Number', + 'tabindex' => 'Number', + )); + + $this->addElement('option', false, 'Optional: #PCDATA', 'Common', array( + 'disabled' => 'Bool#disabled', + 'label' => 'Text', + 'selected' => 'Bool#selected', + 'value' => 'CDATA', + )); + // It's illegal for there to be more than one selected, but not + // be multiple. Also, no selected means undefined behavior. This might + // be difficult to implement; perhaps an injector, or a context variable. + + $textarea = $this->addElement('textarea', 'Formctrl', 'Optional: #PCDATA', 'Common', array( + 'accesskey' => 'Character', + 'cols*' => 'Number', + 'disabled' => 'Bool#disabled', + 'name' => 'CDATA', + 'readonly' => 'Bool#readonly', + 'rows*' => 'Number', + 'tabindex' => 'Number', + )); + $textarea->attr_transform_pre[] = new HTMLPurifier_AttrTransform_Textarea(); + + $button = $this->addElement('button', 'Formctrl', 'Optional: #PCDATA | Heading | List | Block | Inline', 'Common', array( + 'accesskey' => 'Character', + 'disabled' => 'Bool#disabled', + 'name' => 'CDATA', + 'tabindex' => 'Number', + 'type' => 'Enum#button,submit,reset', + 'value' => 'CDATA', + )); + + // For exclusions, ideally we'd specify content sets, not literal elements + $button->excludes = $this->makeLookup( + 'form', 'fieldset', // Form + 'input', 'select', 'textarea', 'label', 'button', // Formctrl + 'a' // as per HTML 4.01 spec, this is omitted by modularization + ); + + // Extra exclusion: img usemap="" is not permitted within this element. + // We'll omit this for now, since we don't have any good way of + // indicating it yet. + + // This is HIGHLY user-unfriendly; we need a custom child-def for this + $this->addElement('fieldset', 'Form', 'Custom: (#WS?,legend,(Flow|#PCDATA)*)', 'Common'); + + $label = $this->addElement('label', 'Formctrl', 'Optional: #PCDATA | Inline', 'Common', array( + 'accesskey' => 'Character', + // 'for' => 'IDREF', // IDREF not implemented, cannot allow + )); + $label->excludes = array('label' => true); + + $this->addElement('legend', false, 'Optional: #PCDATA | Inline', 'Common', array( + 'accesskey' => 'Character', + )); + + $this->addElement('optgroup', false, 'Required: option', 'Common', array( + 'disabled' => 'Bool#disabled', + 'label*' => 'Text', + )); + + // Don't forget an injector for . This one's a little complex + // because it maps to multiple elements. + + } +} + +// vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/HTMLModule/Hypertext.php b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/HTMLModule/Hypertext.php new file mode 100644 index 0000000..d7e9bdd --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/HTMLModule/Hypertext.php @@ -0,0 +1,31 @@ +addElement( + 'a', 'Inline', 'Inline', 'Common', + array( + // 'accesskey' => 'Character', + // 'charset' => 'Charset', + 'href' => 'URI', + // 'hreflang' => 'LanguageCode', + 'rel' => new HTMLPurifier_AttrDef_HTML_LinkTypes('rel'), + 'rev' => new HTMLPurifier_AttrDef_HTML_LinkTypes('rev'), + // 'tabindex' => 'Number', + // 'type' => 'ContentType', + ) + ); + $a->formatting = true; + $a->excludes = array('a' => true); + } + +} + +// vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/HTMLModule/Image.php b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/HTMLModule/Image.php new file mode 100644 index 0000000..948d435 --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/HTMLModule/Image.php @@ -0,0 +1,40 @@ +get('HTML.MaxImgLength'); + $img = $this->addElement( + 'img', 'Inline', 'Empty', 'Common', + array( + 'alt*' => 'Text', + // According to the spec, it's Length, but percents can + // be abused, so we allow only Pixels. + 'height' => 'Pixels#' . $max, + 'width' => 'Pixels#' . $max, + 'longdesc' => 'URI', + 'src*' => new HTMLPurifier_AttrDef_URI(true), // embedded + ) + ); + if ($max === null || $config->get('HTML.Trusted')) { + $img->attr['height'] = + $img->attr['width'] = 'Length'; + } + + // kind of strange, but splitting things up would be inefficient + $img->attr_transform_pre[] = + $img->attr_transform_post[] = + new HTMLPurifier_AttrTransform_ImgRequired(); + } + +} + +// vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/HTMLModule/Legacy.php b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/HTMLModule/Legacy.php new file mode 100644 index 0000000..df33927 --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/HTMLModule/Legacy.php @@ -0,0 +1,143 @@ +addElement('basefont', 'Inline', 'Empty', false, array( + 'color' => 'Color', + 'face' => 'Text', // extremely broad, we should + 'size' => 'Text', // tighten it + 'id' => 'ID' + )); + $this->addElement('center', 'Block', 'Flow', 'Common'); + $this->addElement('dir', 'Block', 'Required: li', 'Common', array( + 'compact' => 'Bool#compact' + )); + $this->addElement('font', 'Inline', 'Inline', array('Core', 'I18N'), array( + 'color' => 'Color', + 'face' => 'Text', // extremely broad, we should + 'size' => 'Text', // tighten it + )); + $this->addElement('menu', 'Block', 'Required: li', 'Common', array( + 'compact' => 'Bool#compact' + )); + + $s = $this->addElement('s', 'Inline', 'Inline', 'Common'); + $s->formatting = true; + + $strike = $this->addElement('strike', 'Inline', 'Inline', 'Common'); + $strike->formatting = true; + + $u = $this->addElement('u', 'Inline', 'Inline', 'Common'); + $u->formatting = true; + + // setup modifications to old elements + + $align = 'Enum#left,right,center,justify'; + + $address = $this->addBlankElement('address'); + $address->content_model = 'Inline | #PCDATA | p'; + $address->content_model_type = 'optional'; + $address->child = false; + + $blockquote = $this->addBlankElement('blockquote'); + $blockquote->content_model = 'Flow | #PCDATA'; + $blockquote->content_model_type = 'optional'; + $blockquote->child = false; + + $br = $this->addBlankElement('br'); + $br->attr['clear'] = 'Enum#left,all,right,none'; + + $caption = $this->addBlankElement('caption'); + $caption->attr['align'] = 'Enum#top,bottom,left,right'; + + $div = $this->addBlankElement('div'); + $div->attr['align'] = $align; + + $dl = $this->addBlankElement('dl'); + $dl->attr['compact'] = 'Bool#compact'; + + for ($i = 1; $i <= 6; $i++) { + $h = $this->addBlankElement("h$i"); + $h->attr['align'] = $align; + } + + $hr = $this->addBlankElement('hr'); + $hr->attr['align'] = $align; + $hr->attr['noshade'] = 'Bool#noshade'; + $hr->attr['size'] = 'Pixels'; + $hr->attr['width'] = 'Length'; + + $img = $this->addBlankElement('img'); + $img->attr['align'] = 'Enum#top,middle,bottom,left,right'; + $img->attr['border'] = 'Pixels'; + $img->attr['hspace'] = 'Pixels'; + $img->attr['vspace'] = 'Pixels'; + + // figure out this integer business + + $li = $this->addBlankElement('li'); + $li->attr['value'] = new HTMLPurifier_AttrDef_Integer(); + $li->attr['type'] = 'Enum#s:1,i,I,a,A,disc,square,circle'; + + $ol = $this->addBlankElement('ol'); + $ol->attr['compact'] = 'Bool#compact'; + $ol->attr['start'] = new HTMLPurifier_AttrDef_Integer(); + $ol->attr['type'] = 'Enum#s:1,i,I,a,A'; + + $p = $this->addBlankElement('p'); + $p->attr['align'] = $align; + + $pre = $this->addBlankElement('pre'); + $pre->attr['width'] = 'Number'; + + // script omitted + + $table = $this->addBlankElement('table'); + $table->attr['align'] = 'Enum#left,center,right'; + $table->attr['bgcolor'] = 'Color'; + + $tr = $this->addBlankElement('tr'); + $tr->attr['bgcolor'] = 'Color'; + + $th = $this->addBlankElement('th'); + $th->attr['bgcolor'] = 'Color'; + $th->attr['height'] = 'Length'; + $th->attr['nowrap'] = 'Bool#nowrap'; + $th->attr['width'] = 'Length'; + + $td = $this->addBlankElement('td'); + $td->attr['bgcolor'] = 'Color'; + $td->attr['height'] = 'Length'; + $td->attr['nowrap'] = 'Bool#nowrap'; + $td->attr['width'] = 'Length'; + + $ul = $this->addBlankElement('ul'); + $ul->attr['compact'] = 'Bool#compact'; + $ul->attr['type'] = 'Enum#square,disc,circle'; + + } + +} + +// vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/HTMLModule/List.php b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/HTMLModule/List.php new file mode 100644 index 0000000..74d4522 --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/HTMLModule/List.php @@ -0,0 +1,37 @@ + 'List'); + + public function setup($config) { + $ol = $this->addElement('ol', 'List', 'Required: li', 'Common'); + $ol->wrap = "li"; + $ul = $this->addElement('ul', 'List', 'Required: li', 'Common'); + $ul->wrap = "li"; + $this->addElement('dl', 'List', 'Required: dt | dd', 'Common'); + + $this->addElement('li', false, 'Flow', 'Common'); + + $this->addElement('dd', false, 'Flow', 'Common'); + $this->addElement('dt', false, 'Inline', 'Common'); + } + +} + +// vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/HTMLModule/Name.php b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/HTMLModule/Name.php new file mode 100644 index 0000000..05694b4 --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/HTMLModule/Name.php @@ -0,0 +1,21 @@ +addBlankElement($name); + $element->attr['name'] = 'CDATA'; + if (!$config->get('HTML.Attr.Name.UseCDATA')) { + $element->attr_transform_post['NameSync'] = new HTMLPurifier_AttrTransform_NameSync(); + } + } + } + +} + +// vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/HTMLModule/Nofollow.php b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/HTMLModule/Nofollow.php new file mode 100644 index 0000000..3aa6654 --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/HTMLModule/Nofollow.php @@ -0,0 +1,19 @@ +addBlankElement('a'); + $a->attr_transform_post[] = new HTMLPurifier_AttrTransform_Nofollow(); + } + +} + +// vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/HTMLModule/NonXMLCommonAttributes.php b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/HTMLModule/NonXMLCommonAttributes.php new file mode 100644 index 0000000..5f1b14a --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/HTMLModule/NonXMLCommonAttributes.php @@ -0,0 +1,14 @@ + array( + 'lang' => 'LanguageCode', + ) + ); +} + +// vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/HTMLModule/Object.php b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/HTMLModule/Object.php new file mode 100644 index 0000000..193c101 --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/HTMLModule/Object.php @@ -0,0 +1,47 @@ + to cater to legacy browsers: this + * module does not allow this sort of behavior + */ +class HTMLPurifier_HTMLModule_Object extends HTMLPurifier_HTMLModule +{ + + public $name = 'Object'; + public $safe = false; + + public function setup($config) { + + $this->addElement('object', 'Inline', 'Optional: #PCDATA | Flow | param', 'Common', + array( + 'archive' => 'URI', + 'classid' => 'URI', + 'codebase' => 'URI', + 'codetype' => 'Text', + 'data' => 'URI', + 'declare' => 'Bool#declare', + 'height' => 'Length', + 'name' => 'CDATA', + 'standby' => 'Text', + 'tabindex' => 'Number', + 'type' => 'ContentType', + 'width' => 'Length' + ) + ); + + $this->addElement('param', false, 'Empty', false, + array( + 'id' => 'ID', + 'name*' => 'Text', + 'type' => 'Text', + 'value' => 'Text', + 'valuetype' => 'Enum#data,ref,object' + ) + ); + + } + +} + +// vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/HTMLModule/Presentation.php b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/HTMLModule/Presentation.php new file mode 100644 index 0000000..8ff0b5e --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/HTMLModule/Presentation.php @@ -0,0 +1,36 @@ +addElement('hr', 'Block', 'Empty', 'Common'); + $this->addElement('sub', 'Inline', 'Inline', 'Common'); + $this->addElement('sup', 'Inline', 'Inline', 'Common'); + $b = $this->addElement('b', 'Inline', 'Inline', 'Common'); + $b->formatting = true; + $big = $this->addElement('big', 'Inline', 'Inline', 'Common'); + $big->formatting = true; + $i = $this->addElement('i', 'Inline', 'Inline', 'Common'); + $i->formatting = true; + $small = $this->addElement('small', 'Inline', 'Inline', 'Common'); + $small->formatting = true; + $tt = $this->addElement('tt', 'Inline', 'Inline', 'Common'); + $tt->formatting = true; + } + +} + +// vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/HTMLModule/Proprietary.php b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/HTMLModule/Proprietary.php new file mode 100644 index 0000000..dd36a3d --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/HTMLModule/Proprietary.php @@ -0,0 +1,33 @@ +addElement('marquee', 'Inline', 'Flow', 'Common', + array( + 'direction' => 'Enum#left,right,up,down', + 'behavior' => 'Enum#alternate', + 'width' => 'Length', + 'height' => 'Length', + 'scrolldelay' => 'Number', + 'scrollamount' => 'Number', + 'loop' => 'Number', + 'bgcolor' => 'Color', + 'hspace' => 'Pixels', + 'vspace' => 'Pixels', + ) + ); + + } + +} + +// vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/HTMLModule/Ruby.php b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/HTMLModule/Ruby.php new file mode 100644 index 0000000..b26a0a3 --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/HTMLModule/Ruby.php @@ -0,0 +1,27 @@ +addElement('ruby', 'Inline', + 'Custom: ((rb, (rt | (rp, rt, rp))) | (rbc, rtc, rtc?))', + 'Common'); + $this->addElement('rbc', false, 'Required: rb', 'Common'); + $this->addElement('rtc', false, 'Required: rt', 'Common'); + $rb = $this->addElement('rb', false, 'Inline', 'Common'); + $rb->excludes = array('ruby' => true); + $rt = $this->addElement('rt', false, 'Inline', 'Common', array('rbspan' => 'Number')); + $rt->excludes = array('ruby' => true); + $this->addElement('rp', false, 'Optional: #PCDATA', 'Common'); + } + +} + +// vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/HTMLModule/SafeEmbed.php b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/HTMLModule/SafeEmbed.php new file mode 100644 index 0000000..9f3758a --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/HTMLModule/SafeEmbed.php @@ -0,0 +1,34 @@ +get('HTML.MaxImgLength'); + $embed = $this->addElement( + 'embed', 'Inline', 'Empty', 'Common', + array( + 'src*' => 'URI#embedded', + 'type' => 'Enum#application/x-shockwave-flash', + 'width' => 'Pixels#' . $max, + 'height' => 'Pixels#' . $max, + 'allowscriptaccess' => 'Enum#never', + 'allownetworking' => 'Enum#internal', + 'flashvars' => 'Text', + 'wmode' => 'Enum#window,transparent,opaque', + 'name' => 'ID', + ) + ); + $embed->attr_transform_post[] = new HTMLPurifier_AttrTransform_SafeEmbed(); + + } + +} + +// vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/HTMLModule/SafeObject.php b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/HTMLModule/SafeObject.php new file mode 100644 index 0000000..00da342 --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/HTMLModule/SafeObject.php @@ -0,0 +1,52 @@ +get('HTML.MaxImgLength'); + $object = $this->addElement( + 'object', + 'Inline', + 'Optional: param | Flow | #PCDATA', + 'Common', + array( + // While technically not required by the spec, we're forcing + // it to this value. + 'type' => 'Enum#application/x-shockwave-flash', + 'width' => 'Pixels#' . $max, + 'height' => 'Pixels#' . $max, + 'data' => 'URI#embedded', + 'codebase' => new HTMLPurifier_AttrDef_Enum(array( + 'http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=6,0,40,0')), + ) + ); + $object->attr_transform_post[] = new HTMLPurifier_AttrTransform_SafeObject(); + + $param = $this->addElement('param', false, 'Empty', false, + array( + 'id' => 'ID', + 'name*' => 'Text', + 'value' => 'Text' + ) + ); + $param->attr_transform_post[] = new HTMLPurifier_AttrTransform_SafeParam(); + $this->info_injector[] = 'SafeObject'; + + } + +} + +// vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/HTMLModule/Scripting.php b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/HTMLModule/Scripting.php new file mode 100644 index 0000000..cecdea6 --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/HTMLModule/Scripting.php @@ -0,0 +1,54 @@ + 'script | noscript', 'Inline' => 'script | noscript'); + public $safe = false; + + public function setup($config) { + // TODO: create custom child-definition for noscript that + // auto-wraps stray #PCDATA in a similar manner to + // blockquote's custom definition (we would use it but + // blockquote's contents are optional while noscript's contents + // are required) + + // TODO: convert this to new syntax, main problem is getting + // both content sets working + + // In theory, this could be safe, but I don't see any reason to + // allow it. + $this->info['noscript'] = new HTMLPurifier_ElementDef(); + $this->info['noscript']->attr = array( 0 => array('Common') ); + $this->info['noscript']->content_model = 'Heading | List | Block'; + $this->info['noscript']->content_model_type = 'required'; + + $this->info['script'] = new HTMLPurifier_ElementDef(); + $this->info['script']->attr = array( + 'defer' => new HTMLPurifier_AttrDef_Enum(array('defer')), + 'src' => new HTMLPurifier_AttrDef_URI(true), + 'type' => new HTMLPurifier_AttrDef_Enum(array('text/javascript')) + ); + $this->info['script']->content_model = '#PCDATA'; + $this->info['script']->content_model_type = 'optional'; + $this->info['script']->attr_transform_pre['type'] = + $this->info['script']->attr_transform_post['type'] = + new HTMLPurifier_AttrTransform_ScriptRequired(); + } +} + +// vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/HTMLModule/StyleAttribute.php b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/HTMLModule/StyleAttribute.php new file mode 100644 index 0000000..eb78464 --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/HTMLModule/StyleAttribute.php @@ -0,0 +1,24 @@ + array('style' => false), // see constructor + 'Core' => array(0 => array('Style')) + ); + + public function setup($config) { + $this->attr_collections['Style']['style'] = new HTMLPurifier_AttrDef_CSS(); + } + +} + +// vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/HTMLModule/Tables.php b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/HTMLModule/Tables.php new file mode 100644 index 0000000..f314ced --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/HTMLModule/Tables.php @@ -0,0 +1,66 @@ +addElement('caption', false, 'Inline', 'Common'); + + $this->addElement('table', 'Block', + new HTMLPurifier_ChildDef_Table(), 'Common', + array( + 'border' => 'Pixels', + 'cellpadding' => 'Length', + 'cellspacing' => 'Length', + 'frame' => 'Enum#void,above,below,hsides,lhs,rhs,vsides,box,border', + 'rules' => 'Enum#none,groups,rows,cols,all', + 'summary' => 'Text', + 'width' => 'Length' + ) + ); + + // common attributes + $cell_align = array( + 'align' => 'Enum#left,center,right,justify,char', + 'charoff' => 'Length', + 'valign' => 'Enum#top,middle,bottom,baseline', + ); + + $cell_t = array_merge( + array( + 'abbr' => 'Text', + 'colspan' => 'Number', + 'rowspan' => 'Number', + ), + $cell_align + ); + $this->addElement('td', false, 'Flow', 'Common', $cell_t); + $this->addElement('th', false, 'Flow', 'Common', $cell_t); + + $this->addElement('tr', false, 'Required: td | th', 'Common', $cell_align); + + $cell_col = array_merge( + array( + 'span' => 'Number', + 'width' => 'MultiLength', + ), + $cell_align + ); + $this->addElement('col', false, 'Empty', 'Common', $cell_col); + $this->addElement('colgroup', false, 'Optional: col', 'Common', $cell_col); + + $this->addElement('tbody', false, 'Required: tr', 'Common', $cell_align); + $this->addElement('thead', false, 'Required: tr', 'Common', $cell_align); + $this->addElement('tfoot', false, 'Required: tr', 'Common', $cell_align); + + } + +} + +// vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/HTMLModule/Target.php b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/HTMLModule/Target.php new file mode 100644 index 0000000..2b844ec --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/HTMLModule/Target.php @@ -0,0 +1,23 @@ +addBlankElement($name); + $e->attr = array( + 'target' => new HTMLPurifier_AttrDef_HTML_FrameTarget() + ); + } + } + +} + +// vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/HTMLModule/Text.php b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/HTMLModule/Text.php new file mode 100644 index 0000000..ae77c71 --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/HTMLModule/Text.php @@ -0,0 +1,71 @@ + 'Heading | Block | Inline' + ); + + public function setup($config) { + + // Inline Phrasal ------------------------------------------------- + $this->addElement('abbr', 'Inline', 'Inline', 'Common'); + $this->addElement('acronym', 'Inline', 'Inline', 'Common'); + $this->addElement('cite', 'Inline', 'Inline', 'Common'); + $this->addElement('dfn', 'Inline', 'Inline', 'Common'); + $this->addElement('kbd', 'Inline', 'Inline', 'Common'); + $this->addElement('q', 'Inline', 'Inline', 'Common', array('cite' => 'URI')); + $this->addElement('samp', 'Inline', 'Inline', 'Common'); + $this->addElement('var', 'Inline', 'Inline', 'Common'); + + $em = $this->addElement('em', 'Inline', 'Inline', 'Common'); + $em->formatting = true; + + $strong = $this->addElement('strong', 'Inline', 'Inline', 'Common'); + $strong->formatting = true; + + $code = $this->addElement('code', 'Inline', 'Inline', 'Common'); + $code->formatting = true; + + // Inline Structural ---------------------------------------------- + $this->addElement('span', 'Inline', 'Inline', 'Common'); + $this->addElement('br', 'Inline', 'Empty', 'Core'); + + // Block Phrasal -------------------------------------------------- + $this->addElement('address', 'Block', 'Inline', 'Common'); + $this->addElement('blockquote', 'Block', 'Optional: Heading | Block | List', 'Common', array('cite' => 'URI') ); + $pre = $this->addElement('pre', 'Block', 'Inline', 'Common'); + $pre->excludes = $this->makeLookup( + 'img', 'big', 'small', 'object', 'applet', 'font', 'basefont' ); + $this->addElement('h1', 'Heading', 'Inline', 'Common'); + $this->addElement('h2', 'Heading', 'Inline', 'Common'); + $this->addElement('h3', 'Heading', 'Inline', 'Common'); + $this->addElement('h4', 'Heading', 'Inline', 'Common'); + $this->addElement('h5', 'Heading', 'Inline', 'Common'); + $this->addElement('h6', 'Heading', 'Inline', 'Common'); + + // Block Structural ----------------------------------------------- + $p = $this->addElement('p', 'Block', 'Inline', 'Common'); + $p->autoclose = array_flip(array("address", "blockquote", "center", "dir", "div", "dl", "fieldset", "ol", "p", "ul")); + + $this->addElement('div', 'Block', 'Flow', 'Common'); + + } + +} + +// vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/HTMLModule/Tidy.php b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/HTMLModule/Tidy.php new file mode 100644 index 0000000..21783f1 --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/HTMLModule/Tidy.php @@ -0,0 +1,207 @@ + 'none', 'light', 'medium', 'heavy'); + + /** + * Default level to place all fixes in. Disabled by default + */ + public $defaultLevel = null; + + /** + * Lists of fixes used by getFixesForLevel(). Format is: + * HTMLModule_Tidy->fixesForLevel[$level] = array('fix-1', 'fix-2'); + */ + public $fixesForLevel = array( + 'light' => array(), + 'medium' => array(), + 'heavy' => array() + ); + + /** + * Lazy load constructs the module by determining the necessary + * fixes to create and then delegating to the populate() function. + * @todo Wildcard matching and error reporting when an added or + * subtracted fix has no effect. + */ + public function setup($config) { + + // create fixes, initialize fixesForLevel + $fixes = $this->makeFixes(); + $this->makeFixesForLevel($fixes); + + // figure out which fixes to use + $level = $config->get('HTML.TidyLevel'); + $fixes_lookup = $this->getFixesForLevel($level); + + // get custom fix declarations: these need namespace processing + $add_fixes = $config->get('HTML.TidyAdd'); + $remove_fixes = $config->get('HTML.TidyRemove'); + + foreach ($fixes as $name => $fix) { + // needs to be refactored a little to implement globbing + if ( + isset($remove_fixes[$name]) || + (!isset($add_fixes[$name]) && !isset($fixes_lookup[$name])) + ) { + unset($fixes[$name]); + } + } + + // populate this module with necessary fixes + $this->populate($fixes); + + } + + /** + * Retrieves all fixes per a level, returning fixes for that specific + * level as well as all levels below it. + * @param $level String level identifier, see $levels for valid values + * @return Lookup up table of fixes + */ + public function getFixesForLevel($level) { + if ($level == $this->levels[0]) { + return array(); + } + $activated_levels = array(); + for ($i = 1, $c = count($this->levels); $i < $c; $i++) { + $activated_levels[] = $this->levels[$i]; + if ($this->levels[$i] == $level) break; + } + if ($i == $c) { + trigger_error( + 'Tidy level ' . htmlspecialchars($level) . ' not recognized', + E_USER_WARNING + ); + return array(); + } + $ret = array(); + foreach ($activated_levels as $level) { + foreach ($this->fixesForLevel[$level] as $fix) { + $ret[$fix] = true; + } + } + return $ret; + } + + /** + * Dynamically populates the $fixesForLevel member variable using + * the fixes array. It may be custom overloaded, used in conjunction + * with $defaultLevel, or not used at all. + */ + public function makeFixesForLevel($fixes) { + if (!isset($this->defaultLevel)) return; + if (!isset($this->fixesForLevel[$this->defaultLevel])) { + trigger_error( + 'Default level ' . $this->defaultLevel . ' does not exist', + E_USER_ERROR + ); + return; + } + $this->fixesForLevel[$this->defaultLevel] = array_keys($fixes); + } + + /** + * Populates the module with transforms and other special-case code + * based on a list of fixes passed to it + * @param $lookup Lookup table of fixes to activate + */ + public function populate($fixes) { + foreach ($fixes as $name => $fix) { + // determine what the fix is for + list($type, $params) = $this->getFixType($name); + switch ($type) { + case 'attr_transform_pre': + case 'attr_transform_post': + $attr = $params['attr']; + if (isset($params['element'])) { + $element = $params['element']; + if (empty($this->info[$element])) { + $e = $this->addBlankElement($element); + } else { + $e = $this->info[$element]; + } + } else { + $type = "info_$type"; + $e = $this; + } + // PHP does some weird parsing when I do + // $e->$type[$attr], so I have to assign a ref. + $f =& $e->$type; + $f[$attr] = $fix; + break; + case 'tag_transform': + $this->info_tag_transform[$params['element']] = $fix; + break; + case 'child': + case 'content_model_type': + $element = $params['element']; + if (empty($this->info[$element])) { + $e = $this->addBlankElement($element); + } else { + $e = $this->info[$element]; + } + $e->$type = $fix; + break; + default: + trigger_error("Fix type $type not supported", E_USER_ERROR); + break; + } + } + } + + /** + * Parses a fix name and determines what kind of fix it is, as well + * as other information defined by the fix + * @param $name String name of fix + * @return array(string $fix_type, array $fix_parameters) + * @note $fix_parameters is type dependant, see populate() for usage + * of these parameters + */ + public function getFixType($name) { + // parse it + $property = $attr = null; + if (strpos($name, '#') !== false) list($name, $property) = explode('#', $name); + if (strpos($name, '@') !== false) list($name, $attr) = explode('@', $name); + + // figure out the parameters + $params = array(); + if ($name !== '') $params['element'] = $name; + if (!is_null($attr)) $params['attr'] = $attr; + + // special case: attribute transform + if (!is_null($attr)) { + if (is_null($property)) $property = 'pre'; + $type = 'attr_transform_' . $property; + return array($type, $params); + } + + // special case: tag transform + if (is_null($property)) { + return array('tag_transform', $params); + } + + return array($property, $params); + + } + + /** + * Defines all fixes the module will perform in a compact + * associative array of fix name to fix implementation. + */ + public function makeFixes() {} + +} + +// vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/HTMLModule/Tidy/Name.php b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/HTMLModule/Tidy/Name.php new file mode 100644 index 0000000..61ff85c --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/HTMLModule/Tidy/Name.php @@ -0,0 +1,24 @@ +content_model_type != 'strictblockquote') return parent::getChildDef($def); + return new HTMLPurifier_ChildDef_StrictBlockquote($def->content_model); + } +} + +// vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/HTMLModule/Tidy/Transitional.php b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/HTMLModule/Tidy/Transitional.php new file mode 100644 index 0000000..9960b1d --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/HTMLModule/Tidy/Transitional.php @@ -0,0 +1,9 @@ + 'text-align:left;', + 'right' => 'text-align:right;', + 'top' => 'caption-side:top;', + 'bottom' => 'caption-side:bottom;' // not supported by IE + )); + + // @align for img ------------------------------------------------- + $r['img@align'] = + new HTMLPurifier_AttrTransform_EnumToCSS('align', array( + 'left' => 'float:left;', + 'right' => 'float:right;', + 'top' => 'vertical-align:top;', + 'middle' => 'vertical-align:middle;', + 'bottom' => 'vertical-align:baseline;', + )); + + // @align for table ----------------------------------------------- + $r['table@align'] = + new HTMLPurifier_AttrTransform_EnumToCSS('align', array( + 'left' => 'float:left;', + 'center' => 'margin-left:auto;margin-right:auto;', + 'right' => 'float:right;' + )); + + // @align for hr ----------------------------------------------- + $r['hr@align'] = + new HTMLPurifier_AttrTransform_EnumToCSS('align', array( + // we use both text-align and margin because these work + // for different browsers (IE and Firefox, respectively) + // and the melange makes for a pretty cross-compatible + // solution + 'left' => 'margin-left:0;margin-right:auto;text-align:left;', + 'center' => 'margin-left:auto;margin-right:auto;text-align:center;', + 'right' => 'margin-left:auto;margin-right:0;text-align:right;' + )); + + // @align for h1, h2, h3, h4, h5, h6, p, div ---------------------- + // {{{ + $align_lookup = array(); + $align_values = array('left', 'right', 'center', 'justify'); + foreach ($align_values as $v) $align_lookup[$v] = "text-align:$v;"; + // }}} + $r['h1@align'] = + $r['h2@align'] = + $r['h3@align'] = + $r['h4@align'] = + $r['h5@align'] = + $r['h6@align'] = + $r['p@align'] = + $r['div@align'] = + new HTMLPurifier_AttrTransform_EnumToCSS('align', $align_lookup); + + // @bgcolor for table, tr, td, th --------------------------------- + $r['table@bgcolor'] = + $r['td@bgcolor'] = + $r['th@bgcolor'] = + new HTMLPurifier_AttrTransform_BgColor(); + + // @border for img ------------------------------------------------ + $r['img@border'] = new HTMLPurifier_AttrTransform_Border(); + + // @clear for br -------------------------------------------------- + $r['br@clear'] = + new HTMLPurifier_AttrTransform_EnumToCSS('clear', array( + 'left' => 'clear:left;', + 'right' => 'clear:right;', + 'all' => 'clear:both;', + 'none' => 'clear:none;', + )); + + // @height for td, th --------------------------------------------- + $r['td@height'] = + $r['th@height'] = + new HTMLPurifier_AttrTransform_Length('height'); + + // @hspace for img ------------------------------------------------ + $r['img@hspace'] = new HTMLPurifier_AttrTransform_ImgSpace('hspace'); + + // @noshade for hr ------------------------------------------------ + // this transformation is not precise but often good enough. + // different browsers use different styles to designate noshade + $r['hr@noshade'] = + new HTMLPurifier_AttrTransform_BoolToCSS( + 'noshade', + 'color:#808080;background-color:#808080;border:0;' + ); + + // @nowrap for td, th --------------------------------------------- + $r['td@nowrap'] = + $r['th@nowrap'] = + new HTMLPurifier_AttrTransform_BoolToCSS( + 'nowrap', + 'white-space:nowrap;' + ); + + // @size for hr -------------------------------------------------- + $r['hr@size'] = new HTMLPurifier_AttrTransform_Length('size', 'height'); + + // @type for li, ol, ul ------------------------------------------- + // {{{ + $ul_types = array( + 'disc' => 'list-style-type:disc;', + 'square' => 'list-style-type:square;', + 'circle' => 'list-style-type:circle;' + ); + $ol_types = array( + '1' => 'list-style-type:decimal;', + 'i' => 'list-style-type:lower-roman;', + 'I' => 'list-style-type:upper-roman;', + 'a' => 'list-style-type:lower-alpha;', + 'A' => 'list-style-type:upper-alpha;' + ); + $li_types = $ul_types + $ol_types; + // }}} + + $r['ul@type'] = new HTMLPurifier_AttrTransform_EnumToCSS('type', $ul_types); + $r['ol@type'] = new HTMLPurifier_AttrTransform_EnumToCSS('type', $ol_types, true); + $r['li@type'] = new HTMLPurifier_AttrTransform_EnumToCSS('type', $li_types, true); + + // @vspace for img ------------------------------------------------ + $r['img@vspace'] = new HTMLPurifier_AttrTransform_ImgSpace('vspace'); + + // @width for hr, td, th ------------------------------------------ + $r['td@width'] = + $r['th@width'] = + $r['hr@width'] = new HTMLPurifier_AttrTransform_Length('width'); + + return $r; + + } + +} + +// vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/HTMLModule/XMLCommonAttributes.php b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/HTMLModule/XMLCommonAttributes.php new file mode 100644 index 0000000..9c0e031 --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/HTMLModule/XMLCommonAttributes.php @@ -0,0 +1,14 @@ + array( + 'xml:lang' => 'LanguageCode', + ) + ); +} + +// vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/HTMLModuleManager.php b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/HTMLModuleManager.php new file mode 100644 index 0000000..362e3b7 --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/HTMLModuleManager.php @@ -0,0 +1,403 @@ +attrTypes = new HTMLPurifier_AttrTypes(); + $this->doctypes = new HTMLPurifier_DoctypeRegistry(); + + // setup basic modules + $common = array( + 'CommonAttributes', 'Text', 'Hypertext', 'List', + 'Presentation', 'Edit', 'Bdo', 'Tables', 'Image', + 'StyleAttribute', + // Unsafe: + 'Scripting', 'Object', 'Forms', + // Sorta legacy, but present in strict: + 'Name', + ); + $transitional = array('Legacy', 'Target'); + $xml = array('XMLCommonAttributes'); + $non_xml = array('NonXMLCommonAttributes'); + + // setup basic doctypes + $this->doctypes->register( + 'HTML 4.01 Transitional', false, + array_merge($common, $transitional, $non_xml), + array('Tidy_Transitional', 'Tidy_Proprietary'), + array(), + '-//W3C//DTD HTML 4.01 Transitional//EN', + 'http://www.w3.org/TR/html4/loose.dtd' + ); + + $this->doctypes->register( + 'HTML 4.01 Strict', false, + array_merge($common, $non_xml), + array('Tidy_Strict', 'Tidy_Proprietary', 'Tidy_Name'), + array(), + '-//W3C//DTD HTML 4.01//EN', + 'http://www.w3.org/TR/html4/strict.dtd' + ); + + $this->doctypes->register( + 'XHTML 1.0 Transitional', true, + array_merge($common, $transitional, $xml, $non_xml), + array('Tidy_Transitional', 'Tidy_XHTML', 'Tidy_Proprietary', 'Tidy_Name'), + array(), + '-//W3C//DTD XHTML 1.0 Transitional//EN', + 'http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd' + ); + + $this->doctypes->register( + 'XHTML 1.0 Strict', true, + array_merge($common, $xml, $non_xml), + array('Tidy_Strict', 'Tidy_XHTML', 'Tidy_Strict', 'Tidy_Proprietary', 'Tidy_Name'), + array(), + '-//W3C//DTD XHTML 1.0 Strict//EN', + 'http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd' + ); + + $this->doctypes->register( + 'XHTML 1.1', true, + array_merge($common, $xml, array('Ruby')), + array('Tidy_Strict', 'Tidy_XHTML', 'Tidy_Proprietary', 'Tidy_Strict', 'Tidy_Name'), // Tidy_XHTML1_1 + array(), + '-//W3C//DTD XHTML 1.1//EN', + 'http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd' + ); + + } + + /** + * Registers a module to the recognized module list, useful for + * overloading pre-existing modules. + * @param $module Mixed: string module name, with or without + * HTMLPurifier_HTMLModule prefix, or instance of + * subclass of HTMLPurifier_HTMLModule. + * @param $overload Boolean whether or not to overload previous modules. + * If this is not set, and you do overload a module, + * HTML Purifier will complain with a warning. + * @note This function will not call autoload, you must instantiate + * (and thus invoke) autoload outside the method. + * @note If a string is passed as a module name, different variants + * will be tested in this order: + * - Check for HTMLPurifier_HTMLModule_$name + * - Check all prefixes with $name in order they were added + * - Check for literal object name + * - Throw fatal error + * If your object name collides with an internal class, specify + * your module manually. All modules must have been included + * externally: registerModule will not perform inclusions for you! + */ + public function registerModule($module, $overload = false) { + if (is_string($module)) { + // attempt to load the module + $original_module = $module; + $ok = false; + foreach ($this->prefixes as $prefix) { + $module = $prefix . $original_module; + if (class_exists($module)) { + $ok = true; + break; + } + } + if (!$ok) { + $module = $original_module; + if (!class_exists($module)) { + trigger_error($original_module . ' module does not exist', + E_USER_ERROR); + return; + } + } + $module = new $module(); + } + if (empty($module->name)) { + trigger_error('Module instance of ' . get_class($module) . ' must have name'); + return; + } + if (!$overload && isset($this->registeredModules[$module->name])) { + trigger_error('Overloading ' . $module->name . ' without explicit overload parameter', E_USER_WARNING); + } + $this->registeredModules[$module->name] = $module; + } + + /** + * Adds a module to the current doctype by first registering it, + * and then tacking it on to the active doctype + */ + public function addModule($module) { + $this->registerModule($module); + if (is_object($module)) $module = $module->name; + $this->userModules[] = $module; + } + + /** + * Adds a class prefix that registerModule() will use to resolve a + * string name to a concrete class + */ + public function addPrefix($prefix) { + $this->prefixes[] = $prefix; + } + + /** + * Performs processing on modules, after being called you may + * use getElement() and getElements() + * @param $config Instance of HTMLPurifier_Config + */ + public function setup($config) { + + $this->trusted = $config->get('HTML.Trusted'); + + // generate + $this->doctype = $this->doctypes->make($config); + $modules = $this->doctype->modules; + + // take out the default modules that aren't allowed + $lookup = $config->get('HTML.AllowedModules'); + $special_cases = $config->get('HTML.CoreModules'); + + if (is_array($lookup)) { + foreach ($modules as $k => $m) { + if (isset($special_cases[$m])) continue; + if (!isset($lookup[$m])) unset($modules[$k]); + } + } + + // custom modules + if ($config->get('HTML.Proprietary')) { + $modules[] = 'Proprietary'; + } + if ($config->get('HTML.SafeObject')) { + $modules[] = 'SafeObject'; + } + if ($config->get('HTML.SafeEmbed')) { + $modules[] = 'SafeEmbed'; + } + if ($config->get('HTML.Nofollow')) { + $modules[] = 'Nofollow'; + } + + // merge in custom modules + $modules = array_merge($modules, $this->userModules); + + foreach ($modules as $module) { + $this->processModule($module); + $this->modules[$module]->setup($config); + } + + foreach ($this->doctype->tidyModules as $module) { + $this->processModule($module); + $this->modules[$module]->setup($config); + } + + // prepare any injectors + foreach ($this->modules as $module) { + $n = array(); + foreach ($module->info_injector as $i => $injector) { + if (!is_object($injector)) { + $class = "HTMLPurifier_Injector_$injector"; + $injector = new $class; + } + $n[$injector->name] = $injector; + } + $module->info_injector = $n; + } + + // setup lookup table based on all valid modules + foreach ($this->modules as $module) { + foreach ($module->info as $name => $def) { + if (!isset($this->elementLookup[$name])) { + $this->elementLookup[$name] = array(); + } + $this->elementLookup[$name][] = $module->name; + } + } + + // note the different choice + $this->contentSets = new HTMLPurifier_ContentSets( + // content set assembly deals with all possible modules, + // not just ones deemed to be "safe" + $this->modules + ); + $this->attrCollections = new HTMLPurifier_AttrCollections( + $this->attrTypes, + // there is no way to directly disable a global attribute, + // but using AllowedAttributes or simply not including + // the module in your custom doctype should be sufficient + $this->modules + ); + } + + /** + * Takes a module and adds it to the active module collection, + * registering it if necessary. + */ + public function processModule($module) { + if (!isset($this->registeredModules[$module]) || is_object($module)) { + $this->registerModule($module); + } + $this->modules[$module] = $this->registeredModules[$module]; + } + + /** + * Retrieves merged element definitions. + * @return Array of HTMLPurifier_ElementDef + */ + public function getElements() { + + $elements = array(); + foreach ($this->modules as $module) { + if (!$this->trusted && !$module->safe) continue; + foreach ($module->info as $name => $v) { + if (isset($elements[$name])) continue; + $elements[$name] = $this->getElement($name); + } + } + + // remove dud elements, this happens when an element that + // appeared to be safe actually wasn't + foreach ($elements as $n => $v) { + if ($v === false) unset($elements[$n]); + } + + return $elements; + + } + + /** + * Retrieves a single merged element definition + * @param $name Name of element + * @param $trusted Boolean trusted overriding parameter: set to true + * if you want the full version of an element + * @return Merged HTMLPurifier_ElementDef + * @note You may notice that modules are getting iterated over twice (once + * in getElements() and once here). This + * is because + */ + public function getElement($name, $trusted = null) { + + if (!isset($this->elementLookup[$name])) { + return false; + } + + // setup global state variables + $def = false; + if ($trusted === null) $trusted = $this->trusted; + + // iterate through each module that has registered itself to this + // element + foreach($this->elementLookup[$name] as $module_name) { + + $module = $this->modules[$module_name]; + + // refuse to create/merge from a module that is deemed unsafe-- + // pretend the module doesn't exist--when trusted mode is not on. + if (!$trusted && !$module->safe) { + continue; + } + + // clone is used because, ideally speaking, the original + // definition should not be modified. Usually, this will + // make no difference, but for consistency's sake + $new_def = clone $module->info[$name]; + + if (!$def && $new_def->standalone) { + $def = $new_def; + } elseif ($def) { + // This will occur even if $new_def is standalone. In practice, + // this will usually result in a full replacement. + $def->mergeIn($new_def); + } else { + // :TODO: + // non-standalone definitions that don't have a standalone + // to merge into could be deferred to the end + continue; + } + + // attribute value expansions + $this->attrCollections->performInclusions($def->attr); + $this->attrCollections->expandIdentifiers($def->attr, $this->attrTypes); + + // descendants_are_inline, for ChildDef_Chameleon + if (is_string($def->content_model) && + strpos($def->content_model, 'Inline') !== false) { + if ($name != 'del' && $name != 'ins') { + // this is for you, ins/del + $def->descendants_are_inline = true; + } + } + + $this->contentSets->generateChildDef($def, $module); + } + + // This can occur if there is a blank definition, but no base to + // mix it in with + if (!$def) return false; + + // add information on required attributes + foreach ($def->attr as $attr_name => $attr_def) { + if ($attr_def->required) { + $def->required_attr[] = $attr_name; + } + } + + return $def; + + } + +} + +// vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/IDAccumulator.php b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/IDAccumulator.php new file mode 100644 index 0000000..7321529 --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/IDAccumulator.php @@ -0,0 +1,53 @@ +load($config->get('Attr.IDBlacklist')); + return $id_accumulator; + } + + /** + * Add an ID to the lookup table. + * @param $id ID to be added. + * @return Bool status, true if success, false if there's a dupe + */ + public function add($id) { + if (isset($this->ids[$id])) return false; + return $this->ids[$id] = true; + } + + /** + * Load a list of IDs into the lookup table + * @param $array_of_ids Array of IDs to load + * @note This function doesn't care about duplicates + */ + public function load($array_of_ids) { + foreach ($array_of_ids as $id) { + $this->ids[$id] = true; + } + } + +} + +// vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/Injector.php b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/Injector.php new file mode 100644 index 0000000..5922f81 --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/Injector.php @@ -0,0 +1,239 @@ +processToken() + * documentation. + * + * @todo Allow injectors to request a re-run on their output. This + * would help if an operation is recursive. + */ +abstract class HTMLPurifier_Injector +{ + + /** + * Advisory name of injector, this is for friendly error messages + */ + public $name; + + /** + * Instance of HTMLPurifier_HTMLDefinition + */ + protected $htmlDefinition; + + /** + * Reference to CurrentNesting variable in Context. This is an array + * list of tokens that we are currently "inside" + */ + protected $currentNesting; + + /** + * Reference to InputTokens variable in Context. This is an array + * list of the input tokens that are being processed. + */ + protected $inputTokens; + + /** + * Reference to InputIndex variable in Context. This is an integer + * array index for $this->inputTokens that indicates what token + * is currently being processed. + */ + protected $inputIndex; + + /** + * Array of elements and attributes this injector creates and therefore + * need to be allowed by the definition. Takes form of + * array('element' => array('attr', 'attr2'), 'element2') + */ + public $needed = array(); + + /** + * Index of inputTokens to rewind to. + */ + protected $rewind = false; + + /** + * Rewind to a spot to re-perform processing. This is useful if you + * deleted a node, and now need to see if this change affected any + * earlier nodes. Rewinding does not affect other injectors, and can + * result in infinite loops if not used carefully. + * @warning HTML Purifier will prevent you from fast-forwarding with this + * function. + */ + public function rewind($index) { + $this->rewind = $index; + } + + /** + * Retrieves rewind, and then unsets it. + */ + public function getRewind() { + $r = $this->rewind; + $this->rewind = false; + return $r; + } + + /** + * Prepares the injector by giving it the config and context objects: + * this allows references to important variables to be made within + * the injector. This function also checks if the HTML environment + * will work with the Injector (see checkNeeded()). + * @param $config Instance of HTMLPurifier_Config + * @param $context Instance of HTMLPurifier_Context + * @return Boolean false if success, string of missing needed element/attribute if failure + */ + public function prepare($config, $context) { + $this->htmlDefinition = $config->getHTMLDefinition(); + // Even though this might fail, some unit tests ignore this and + // still test checkNeeded, so be careful. Maybe get rid of that + // dependency. + $result = $this->checkNeeded($config); + if ($result !== false) return $result; + $this->currentNesting =& $context->get('CurrentNesting'); + $this->inputTokens =& $context->get('InputTokens'); + $this->inputIndex =& $context->get('InputIndex'); + return false; + } + + /** + * This function checks if the HTML environment + * will work with the Injector: if p tags are not allowed, the + * Auto-Paragraphing injector should not be enabled. + * @param $config Instance of HTMLPurifier_Config + * @param $context Instance of HTMLPurifier_Context + * @return Boolean false if success, string of missing needed element/attribute if failure + */ + public function checkNeeded($config) { + $def = $config->getHTMLDefinition(); + foreach ($this->needed as $element => $attributes) { + if (is_int($element)) $element = $attributes; + if (!isset($def->info[$element])) return $element; + if (!is_array($attributes)) continue; + foreach ($attributes as $name) { + if (!isset($def->info[$element]->attr[$name])) return "$element.$name"; + } + } + return false; + } + + /** + * Tests if the context node allows a certain element + * @param $name Name of element to test for + * @return True if element is allowed, false if it is not + */ + public function allowsElement($name) { + if (!empty($this->currentNesting)) { + $parent_token = array_pop($this->currentNesting); + $this->currentNesting[] = $parent_token; + $parent = $this->htmlDefinition->info[$parent_token->name]; + } else { + $parent = $this->htmlDefinition->info_parent_def; + } + if (!isset($parent->child->elements[$name]) || isset($parent->excludes[$name])) { + return false; + } + // check for exclusion + for ($i = count($this->currentNesting) - 2; $i >= 0; $i--) { + $node = $this->currentNesting[$i]; + $def = $this->htmlDefinition->info[$node->name]; + if (isset($def->excludes[$name])) return false; + } + return true; + } + + /** + * Iterator function, which starts with the next token and continues until + * you reach the end of the input tokens. + * @warning Please prevent previous references from interfering with this + * functions by setting $i = null beforehand! + * @param &$i Current integer index variable for inputTokens + * @param &$current Current token variable. Do NOT use $token, as that variable is also a reference + */ + protected function forward(&$i, &$current) { + if ($i === null) $i = $this->inputIndex + 1; + else $i++; + if (!isset($this->inputTokens[$i])) return false; + $current = $this->inputTokens[$i]; + return true; + } + + /** + * Similar to _forward, but accepts a third parameter $nesting (which + * should be initialized at 0) and stops when we hit the end tag + * for the node $this->inputIndex starts in. + */ + protected function forwardUntilEndToken(&$i, &$current, &$nesting) { + $result = $this->forward($i, $current); + if (!$result) return false; + if ($nesting === null) $nesting = 0; + if ($current instanceof HTMLPurifier_Token_Start) $nesting++; + elseif ($current instanceof HTMLPurifier_Token_End) { + if ($nesting <= 0) return false; + $nesting--; + } + return true; + } + + /** + * Iterator function, starts with the previous token and continues until + * you reach the beginning of input tokens. + * @warning Please prevent previous references from interfering with this + * functions by setting $i = null beforehand! + * @param &$i Current integer index variable for inputTokens + * @param &$current Current token variable. Do NOT use $token, as that variable is also a reference + */ + protected function backward(&$i, &$current) { + if ($i === null) $i = $this->inputIndex - 1; + else $i--; + if ($i < 0) return false; + $current = $this->inputTokens[$i]; + return true; + } + + /** + * Initializes the iterator at the current position. Use in a do {} while; + * loop to force the _forward and _backward functions to start at the + * current location. + * @warning Please prevent previous references from interfering with this + * functions by setting $i = null beforehand! + * @param &$i Current integer index variable for inputTokens + * @param &$current Current token variable. Do NOT use $token, as that variable is also a reference + */ + protected function current(&$i, &$current) { + if ($i === null) $i = $this->inputIndex; + $current = $this->inputTokens[$i]; + } + + /** + * Handler that is called when a text token is processed + */ + public function handleText(&$token) {} + + /** + * Handler that is called when a start or empty token is processed + */ + public function handleElement(&$token) {} + + /** + * Handler that is called when an end token is processed + */ + public function handleEnd(&$token) { + $this->notifyEnd($token); + } + + /** + * Notifier that is called when an end token is processed + * @note This differs from handlers in that the token is read-only + * @deprecated + */ + public function notifyEnd($token) {} + + +} + +// vim: et sw=4 sts=4 diff --git a/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/Injector/AutoParagraph.php b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/Injector/AutoParagraph.php new file mode 100644 index 0000000..afa7608 --- /dev/null +++ b/libraries/plugins/IDS/vendors/htmlpurifier/HTMLPurifier/Injector/AutoParagraph.php @@ -0,0 +1,345 @@ +armor['MakeWellFormed_TagClosedError'] = true; + return $par; + } + + public function handleText(&$token) { + $text = $token->data; + // Does the current parent allow

tags? + if ($this->allowsElement('p')) { + if (empty($this->currentNesting) || strpos($text, "\n\n") !== false) { + // Note that we have differing behavior when dealing with text + // in the anonymous root node, or a node inside the document. + // If the text as a double-newline, the treatment is the same; + // if it doesn't, see the next if-block if you're in the document. + + $i = $nesting = null; + if (!$this->forwardUntilEndToken($i, $current, $nesting) && $token->is_whitespace) { + // State 1.1: ... ^ (whitespace, then document end) + // ---- + // This is a degenerate case + } else { + if (!$token->is_whitespace || $this->_isInline($current)) { + // State 1.2: PAR1 + // ---- + + // State 1.3: PAR1\n\nPAR2 + // ------------ + + // State 1.4:

PAR1\n\nPAR2 (see State 2) + // ------------ + $token = array($this->_pStart()); + $this->_splitText($text, $token); + } else { + // State 1.5: \n
+ // -- + } + } + } else { + // State 2:
PAR1... (similar to 1.4) + // ---- + + // We're in an element that allows paragraph tags, but we're not + // sure if we're going to need them. + if ($this->_pLookAhead()) { + // State 2.1:
PAR1PAR1\n\nPAR2 + // ---- + // Note: This will always be the first child, since any + // previous inline element would have triggered this very + // same routine, and found the double newline. One possible + // exception would be a comment. + $token = array($this->_pStart(), $token); + } else { + // State 2.2.1:
PAR1
+ // ---- + + // State 2.2.2:
PAR1PAR1
+ // ---- + } + } + // Is the current parent a

tag? + } elseif ( + !empty($this->currentNesting) && + $this->currentNesting[count($this->currentNesting)-1]->name == 'p' + ) { + // State 3.1: ...

PAR1 + // ---- + + // State 3.2: ...

PAR1\n\nPAR2 + // ------------ + $token = array(); + $this->_splitText($text, $token); + // Abort! + } else { + // State 4.1: ...PAR1 + // ---- + + // State 4.2: ...PAR1\n\nPAR2 + // ------------ + } + } + + public function handleElement(&$token) { + // We don't have to check if we're already in a

tag for block + // tokens, because the tag would have been autoclosed by MakeWellFormed. + if ($this->allowsElement('p')) { + if (!empty($this->currentNesting)) { + if ($this->_isInline($token)) { + // State 1:

... + // --- + + // Check if this token is adjacent to the parent token + // (seek backwards until token isn't whitespace) + $i = null; + $this->backward($i, $prev); + + if (!$prev instanceof HTMLPurifier_Token_Start) { + // Token wasn't adjacent + + if ( + $prev instanceof HTMLPurifier_Token_Text && + substr($prev->data, -2) === "\n\n" + ) { + // State 1.1.4:

PAR1

\n\n + // --- + + // Quite frankly, this should be handled by splitText + $token = array($this->_pStart(), $token); + } else { + // State 1.1.1:

PAR1

+ // --- + + // State 1.1.2:

+ // --- + + // State 1.1.3:
PAR + // --- + } + + } else { + // State 1.2.1:
+ // --- + + // Lookahead to see if

is needed. + if ($this->_pLookAhead()) { + // State 1.3.1:

PAR1\n\nPAR2 + // --- + $token = array($this->_pStart(), $token); + } else { + // State 1.3.2:
PAR1
+ // --- + + // State 1.3.3:
PAR1
\n\n
+ // --- + } + } + } else { + // State 2.3: ...
+ // ----- + } + } else { + if ($this->_isInline($token)) { + // State 3.1: + // --- + // This is where the {p} tag is inserted, not reflected in + // inputTokens yet, however. + $token = array($this->_pStart(), $token); + } else { + // State 3.2:
+ // ----- + } + + $i = null; + if ($this->backward($i, $prev)) { + if ( + !$prev instanceof HTMLPurifier_Token_Text + ) { + // State 3.1.1: ...

{p} + // --- + + // State 3.2.1: ...

+ // ----- + + if (!is_array($token)) $token = array($token); + array_unshift($token, new HTMLPurifier_Token_Text("\n\n")); + } else { + // State 3.1.2: ...

\n\n{p} + // --- + + // State 3.2.2: ...

\n\n
+ // ----- + + // Note: PAR cannot occur because PAR would have been + // wrapped in

tags. + } + } + } + } else { + // State 2.2: