| Index: trunk/phase3/includes/Sanitizer.php |
| — | — | @@ -335,11 +335,11 @@ |
| 336 | 336 | * Cleans up HTML, removes dangerous tags and attributes, and |
| 337 | 337 | * removes HTML comments |
| 338 | 338 | * @private |
| 339 | | - * @param string $text |
| 340 | | - * @param callback $processCallback to do any variable or parameter replacements in HTML attribute values |
| 341 | | - * @param array $args for the processing callback |
| 342 | | - * @param array $extratags for any extra tags to include |
| 343 | | - * @param array $removetags for any tags (default or extra) to exclude |
| | 339 | + * @param $text String |
| | 340 | + * @param $processCallback Callback to do any variable or parameter replacements in HTML attribute values |
| | 341 | + * @param $args Array for the processing callback |
| | 342 | + * @param $extratags Array for any extra tags to include |
| | 343 | + * @param $removetags Array for any tags (default or extra) to exclude |
| 344 | 344 | * @return string |
| 345 | 345 | */ |
| 346 | 346 | static function removeHTMLtags( $text, $processCallback = null, $args = array(), $extratags = array(), $removetags = array() ) { |
| — | — | @@ -530,7 +530,7 @@ |
| 531 | 531 | * trailing spaces and one of the newlines. |
| 532 | 532 | * |
| 533 | 533 | * @private |
| 534 | | - * @param string $text |
| | 534 | + * @param $text String |
| 535 | 535 | * @return string |
| 536 | 536 | */ |
| 537 | 537 | static function removeHTMLcomments( $text ) { |
| — | — | @@ -576,9 +576,9 @@ |
| 577 | 577 | * - Unsafe style attributes are discarded |
| 578 | 578 | * - Invalid id attributes are reencoded |
| 579 | 579 | * |
| 580 | | - * @param array $attribs |
| 581 | | - * @param string $element |
| 582 | | - * @return array |
| | 580 | + * @param $attribs Array |
| | 581 | + * @param $element String |
| | 582 | + * @return Array |
| 583 | 583 | * |
| 584 | 584 | * @todo Check for legal values where the DTD limits things. |
| 585 | 585 | * @todo Check for unique id attribute :P |
| — | — | @@ -596,9 +596,9 @@ |
| 597 | 597 | * - Unsafe style attributes are discarded |
| 598 | 598 | * - Invalid id attributes are reencoded |
| 599 | 599 | * |
| 600 | | - * @param array $attribs |
| 601 | | - * @param array $whitelist list of allowed attribute names |
| 602 | | - * @return array |
| | 600 | + * @param $attribs Array |
| | 601 | + * @param $whitelist Array: list of allowed attribute names |
| | 602 | + * @return Array |
| 603 | 603 | * |
| 604 | 604 | * @todo Check for legal values where the DTD limits things. |
| 605 | 605 | * @todo Check for unique id attribute :P |
| — | — | @@ -639,8 +639,8 @@ |
| 640 | 640 | * will be combined (if they're both strings). |
| 641 | 641 | * |
| 642 | 642 | * @todo implement merging for other attributes such as style |
| 643 | | - * @param array $a |
| 644 | | - * @param array $b |
| | 643 | + * @param $a Array |
| | 644 | + * @param $b Array |
| 645 | 645 | * @return array |
| 646 | 646 | */ |
| 647 | 647 | static function mergeAttributes( $a, $b ) { |
| — | — | @@ -661,8 +661,8 @@ |
| 662 | 662 | * |
| 663 | 663 | * Currently URL references, 'expression', 'tps' are forbidden. |
| 664 | 664 | * |
| 665 | | - * @param string $value |
| 666 | | - * @return mixed |
| | 665 | + * @param $value String |
| | 666 | + * @return Mixed |
| 667 | 667 | */ |
| 668 | 668 | static function checkCss( $value ) { |
| 669 | 669 | $stripped = Sanitizer::decodeCharReferences( $value ); |
| — | — | @@ -700,9 +700,9 @@ |
| 701 | 701 | * - Unsafe style attributes are discarded |
| 702 | 702 | * - Prepends space if there are attributes. |
| 703 | 703 | * |
| 704 | | - * @param string $text |
| 705 | | - * @param string $element |
| 706 | | - * @return string |
| | 704 | + * @param $text String |
| | 705 | + * @param $element String |
| | 706 | + * @return String |
| 707 | 707 | */ |
| 708 | 708 | static function fixTagAttributes( $text, $element ) { |
| 709 | 709 | if( trim( $text ) == '' ) { |
| — | — | @@ -724,7 +724,7 @@ |
| 725 | 725 | |
| 726 | 726 | /** |
| 727 | 727 | * Encode an attribute value for HTML output. |
| 728 | | - * @param $text |
| | 728 | + * @param $text String |
| 729 | 729 | * @return HTML-encoded text fragment |
| 730 | 730 | */ |
| 731 | 731 | static function encodeAttribute( $text ) { |
| — | — | @@ -745,7 +745,7 @@ |
| 746 | 746 | /** |
| 747 | 747 | * Encode an attribute value for HTML tags, with extra armoring |
| 748 | 748 | * against further wiki processing. |
| 749 | | - * @param $text |
| | 749 | + * @param $text String |
| 750 | 750 | * @return HTML-encoded text fragment |
| 751 | 751 | */ |
| 752 | 752 | static function safeEncodeAttribute( $text ) { |
| — | — | @@ -784,8 +784,8 @@ |
| 785 | 785 | * name attributes |
| 786 | 786 | * @see http://www.w3.org/TR/html401/struct/links.html#h-12.2.3 Anchors with the id attribute |
| 787 | 787 | * |
| 788 | | - * @param string $id Id to validate |
| 789 | | - * @param mixed $options String or array of strings (default is array()): |
| | 788 | + * @param $id String: id to validate |
| | 789 | + * @param $options Mixed: string or array of strings (default is array()): |
| 790 | 790 | * 'noninitial': This is a non-initial fragment of an id, not a full id, |
| 791 | 791 | * so don't pay attention if the first character isn't valid at the |
| 792 | 792 | * beginning of an id. |
| — | — | @@ -794,7 +794,7 @@ |
| 795 | 795 | * Therefore, it also completely changes the type of escaping: instead |
| 796 | 796 | * of weird dot-encoding, runs of invalid characters (mostly |
| 797 | 797 | * whitespace) are just compressed into a single underscore. |
| 798 | | - * @return string |
| | 798 | + * @return String |
| 799 | 799 | */ |
| 800 | 800 | static function escapeId( $id, $options = array() ) { |
| 801 | 801 | $options = (array)$options; |
| — | — | @@ -844,8 +844,8 @@ |
| 845 | 845 | * |
| 846 | 846 | * @see http://www.w3.org/TR/CSS21/syndata.html Valid characters/format |
| 847 | 847 | * |
| 848 | | - * @param string $class |
| 849 | | - * @return string |
| | 848 | + * @param $class String |
| | 849 | + * @return String |
| 850 | 850 | */ |
| 851 | 851 | static function escapeClass( $class ) { |
| 852 | 852 | // Convert ugly stuff to underscores and kill underscores in ugly places |
| — | — | @@ -859,8 +859,8 @@ |
| 860 | 860 | * Given HTML input, escape with htmlspecialchars but un-escape entites. |
| 861 | 861 | * This allows (generally harmless) entities like to survive. |
| 862 | 862 | * |
| 863 | | - * @param string $html String to escape |
| 864 | | - * @return string Escaped input |
| | 863 | + * @param $html String to escape |
| | 864 | + * @return String: escaped input |
| 865 | 865 | */ |
| 866 | 866 | static function escapeHtmlAllowEntities( $html ) { |
| 867 | 867 | # It seems wise to escape ' as well as ", as a matter of course. Can't |
| — | — | @@ -873,9 +873,8 @@ |
| 874 | 874 | |
| 875 | 875 | /** |
| 876 | 876 | * Regex replace callback for armoring links against further processing. |
| 877 | | - * @param array $matches |
| | 877 | + * @param $matches Array |
| 878 | 878 | * @return string |
| 879 | | - * @private |
| 880 | 879 | */ |
| 881 | 880 | private static function armorLinksCallback( $matches ) { |
| 882 | 881 | return str_replace( ':', ':', $matches[1] ); |
| — | — | @@ -886,8 +885,8 @@ |
| 887 | 886 | * a partial tag string. Attribute names are forces to lowercase, |
| 888 | 887 | * character references are decoded to UTF-8 text. |
| 889 | 888 | * |
| 890 | | - * @param string |
| 891 | | - * @return array |
| | 889 | + * @param $text String |
| | 890 | + * @return Array |
| 892 | 891 | */ |
| 893 | 892 | public static function decodeTagAttributes( $text ) { |
| 894 | 893 | $attribs = array(); |
| — | — | @@ -923,9 +922,8 @@ |
| 924 | 923 | * Pick the appropriate attribute value from a match set from the |
| 925 | 924 | * MW_ATTRIBS_REGEX matches. |
| 926 | 925 | * |
| 927 | | - * @param array $set |
| 928 | | - * @return string |
| 929 | | - * @private |
| | 926 | + * @param $set Array |
| | 927 | + * @return String |
| 930 | 928 | */ |
| 931 | 929 | private static function getTagAttributeCallback( $set ) { |
| 932 | 930 | if( isset( $set[6] ) ) { |
| — | — | @@ -957,9 +955,8 @@ |
| 958 | 956 | * but note that we're not returning the value, but are returning |
| 959 | 957 | * XML source fragments that will be slapped into output. |
| 960 | 958 | * |
| 961 | | - * @param string $text |
| 962 | | - * @return string |
| 963 | | - * @private |
| | 959 | + * @param $text String |
| | 960 | + * @return String |
| 964 | 961 | */ |
| 965 | 962 | private static function normalizeAttributeValue( $text ) { |
| 966 | 963 | return str_replace( '"', '"', |
| — | — | @@ -984,8 +981,8 @@ |
| 985 | 982 | * c. use &#x, not &#X |
| 986 | 983 | * d. fix or reject non-valid attributes |
| 987 | 984 | * |
| 988 | | - * @param string $text |
| 989 | | - * @return string |
| | 985 | + * @param $text String |
| | 986 | + * @return String |
| 990 | 987 | * @private |
| 991 | 988 | */ |
| 992 | 989 | static function normalizeCharReferences( $text ) { |
| — | — | @@ -995,8 +992,8 @@ |
| 996 | 993 | $text ); |
| 997 | 994 | } |
| 998 | 995 | /** |
| 999 | | - * @param string $matches |
| 1000 | | - * @return string |
| | 996 | + * @param $matches String |
| | 997 | + * @return String |
| 1001 | 998 | */ |
| 1002 | 999 | static function normalizeCharReferencesCallback( $matches ) { |
| 1003 | 1000 | $ret = null; |
| — | — | @@ -1022,9 +1019,8 @@ |
| 1023 | 1020 | * MediaWiki-specific alias, returns the HTML equivalent. Otherwise, |
| 1024 | 1021 | * returns HTML-escaped text of pseudo-entity source (eg &foo;) |
| 1025 | 1022 | * |
| 1026 | | - * @param string $name |
| 1027 | | - * @return string |
| 1028 | | - * @static |
| | 1023 | + * @param $name String |
| | 1024 | + * @return String |
| 1029 | 1025 | */ |
| 1030 | 1026 | static function normalizeEntity( $name ) { |
| 1031 | 1027 | global $wgHtmlEntities, $wgHtmlEntityAliases; |
| — | — | @@ -1057,8 +1053,8 @@ |
| 1058 | 1054 | |
| 1059 | 1055 | /** |
| 1060 | 1056 | * Returns true if a given Unicode codepoint is a valid character in XML. |
| 1061 | | - * @param int $codepoint |
| 1062 | | - * @return bool |
| | 1057 | + * @param $codepoint Integer |
| | 1058 | + * @return Boolean |
| 1063 | 1059 | */ |
| 1064 | 1060 | private static function validateCodepoint( $codepoint ) { |
| 1065 | 1061 | return ($codepoint == 0x09) |
| — | — | @@ -1073,10 +1069,8 @@ |
| 1074 | 1070 | * Decode any character references, numeric or named entities, |
| 1075 | 1071 | * in the text and return a UTF-8 string. |
| 1076 | 1072 | * |
| 1077 | | - * @param string $text |
| 1078 | | - * @return string |
| 1079 | | - * @public |
| 1080 | | - * @static |
| | 1073 | + * @param $text String |
| | 1074 | + * @return String |
| 1081 | 1075 | */ |
| 1082 | 1076 | public static function decodeCharReferences( $text ) { |
| 1083 | 1077 | return preg_replace_callback( |
| — | — | @@ -1086,8 +1080,8 @@ |
| 1087 | 1081 | } |
| 1088 | 1082 | |
| 1089 | 1083 | /** |
| 1090 | | - * @param string $matches |
| 1091 | | - * @return string |
| | 1084 | + * @param $matches String |
| | 1085 | + * @return String |
| 1092 | 1086 | */ |
| 1093 | 1087 | static function decodeCharReferencesCallback( $matches ) { |
| 1094 | 1088 | if( $matches[1] != '' ) { |
| — | — | @@ -1106,8 +1100,8 @@ |
| 1107 | 1101 | /** |
| 1108 | 1102 | * Return UTF-8 string for a codepoint if that is a valid |
| 1109 | 1103 | * character reference, otherwise U+FFFD REPLACEMENT CHARACTER. |
| 1110 | | - * @param int $codepoint |
| 1111 | | - * @return string |
| | 1104 | + * @param $codepoint Integer |
| | 1105 | + * @return String |
| 1112 | 1106 | * @private |
| 1113 | 1107 | */ |
| 1114 | 1108 | static function decodeChar( $codepoint ) { |
| — | — | @@ -1123,8 +1117,8 @@ |
| 1124 | 1118 | * return the UTF-8 encoding of that character. Otherwise, returns |
| 1125 | 1119 | * pseudo-entity source (eg &foo;) |
| 1126 | 1120 | * |
| 1127 | | - * @param string $name |
| 1128 | | - * @return string |
| | 1121 | + * @param $name Strings |
| | 1122 | + * @return String |
| 1129 | 1123 | */ |
| 1130 | 1124 | static function decodeEntity( $name ) { |
| 1131 | 1125 | global $wgHtmlEntities, $wgHtmlEntityAliases; |
| — | — | @@ -1139,11 +1133,10 @@ |
| 1140 | 1134 | } |
| 1141 | 1135 | |
| 1142 | 1136 | /** |
| 1143 | | - * Fetch the whitelist of acceptable attributes for a given |
| 1144 | | - * element name. |
| | 1137 | + * Fetch the whitelist of acceptable attributes for a given element name. |
| 1145 | 1138 | * |
| 1146 | | - * @param string $element |
| 1147 | | - * @return array |
| | 1139 | + * @param $element String |
| | 1140 | + * @return Array |
| 1148 | 1141 | */ |
| 1149 | 1142 | static function attributeWhitelist( $element ) { |
| 1150 | 1143 | static $list; |
| — | — | @@ -1158,7 +1151,7 @@ |
| 1159 | 1152 | /** |
| 1160 | 1153 | * Foreach array key (an allowed HTML element), return an array |
| 1161 | 1154 | * of allowed attributes |
| 1162 | | - * @return array |
| | 1155 | + * @return Array |
| 1163 | 1156 | */ |
| 1164 | 1157 | static function setupAttributeWhitelist() { |
| 1165 | 1158 | $common = array( 'id', 'class', 'lang', 'dir', 'title', 'style' ); |
| — | — | @@ -1313,8 +1306,8 @@ |
| 1314 | 1307 | * Warning: this return value must be further escaped for literal |
| 1315 | 1308 | * inclusion in HTML output as of 1.10! |
| 1316 | 1309 | * |
| 1317 | | - * @param string $text HTML fragment |
| 1318 | | - * @return string |
| | 1310 | + * @param $text String: HTML fragment |
| | 1311 | + * @return String |
| 1319 | 1312 | */ |
| 1320 | 1313 | static function stripAllTags( $text ) { |
| 1321 | 1314 | # Actual <tags> |
| — | — | @@ -1334,8 +1327,7 @@ |
| 1335 | 1328 | * |
| 1336 | 1329 | * Use for passing XHTML fragments to PHP's XML parsing functions |
| 1337 | 1330 | * |
| 1338 | | - * @return string |
| 1339 | | - * @static |
| | 1331 | + * @return String |
| 1340 | 1332 | */ |
| 1341 | 1333 | static function hackDocType() { |
| 1342 | 1334 | global $wgHtmlEntities; |