Remove some references to skins/common/ in comments

[lhc/web/wiklou.git] / includes / Sanitizer.php

diff --git a/includes/Sanitizer.php b/includes/Sanitizer.php
index 75812f2..2cdbe15 100644 (file)
--- a/includes/Sanitizer.php
+++ b/includes/Sanitizer.php
@@ -328,6 +328,7 @@ class Sanitizer {
         * Regular expression to match HTML/XML attribute pairs within a tag.
         * Allows some... latitude.
         * Used in Sanitizer::fixTagAttributes and Sanitizer::decodeTagAttributes
+        * @return string
         */
        static function getAttribsRegex() {
                if ( self::$attribsRegex === null ) {
@@ -383,7 +384,7 @@ class Sanitizer {
                                'h2', 'h3', 'h4', 'h5', 'h6', 'cite', 'code', 'em', 's',
                                'strike', 'strong', 'tt', 'var', 'div', 'center',
                                'blockquote', 'ol', 'ul', 'dl', 'table', 'caption', 'pre',
-                               'ruby', 'rt', 'rb', 'rp', 'p', 'span', 'abbr', 'dfn',
+                               'ruby', 'rb', 'rp', 'rt', 'rtc', 'p', 'span', 'abbr', 'dfn',
                                'kbd', 'samp', 'data', 'time', 'mark'
                        );
                        $htmlsingle = array(
@@ -715,7 +716,7 @@ class Sanitizer {
         * - Invalid id attributes are re-encoded
         *
         * @param array $attribs
-        * @param array $whitelist list of allowed attribute names
+        * @param array $whitelist List of allowed attribute names
         * @return array
         *
         * @todo Check for legal values where the DTD limits things.
@@ -849,8 +850,6 @@ class Sanitizer {
         * @return string
         */
        static function checkCss( $value ) {
-               global $wgDisallowedCss;
-
                // Decode character references like {
                $value = Sanitizer::decodeCharReferences( $value );
 
@@ -939,12 +938,18 @@ class Sanitizer {
                // Reject problematic keywords and control characters
                if ( preg_match( '/[\000-\010\013\016-\037\177]/', $value ) ) {
                        return '/* invalid control char */';
-               } else {
-                       if ( $wgDisallowedCss ) {
-                               if ( preg_match( $wgDisallowedCss, $value ) ) {
-                                       return '/* insecure input */';
-                               }
-                       }
+               } elseif ( preg_match(
+                       '! expression
+                               | filter\s*:
+                               | accelerator\s*:
+                               | -o-link\s*:
+                               | -o-link-source\s*:
+                               | -o-replace\s*:
+                               | url\s*\(
+                               | image\s*\(
+                               | image-set\s*\(
+                       !ix', $value ) ) {
+                       return '/* insecure input */';
                }
                return $value;
        }
@@ -1077,7 +1082,7 @@ class Sanitizer {
         * @see http://www.whatwg.org/html/elements.html#the-id-attribute
         *   HTML5 definition of id attribute
         *
-        * @param string $id id to escape
+        * @param string $id Id to escape
         * @param string|array $options String or array of strings (default is array()):
         *   'noninitial': This is a non-initial fragment of an id, not a full id,
         *       so don't pay attention if the first character isn't valid at the
@@ -1224,7 +1229,7 @@ class Sanitizer {
         * attribs regex matches.
         *
         * @param array $set
-        * @throws MWException when tag conditions are not met.
+        * @throws MWException When tag conditions are not met.
         * @return string
         */
        private static function getTagAttributeCallback( $set ) {
@@ -1681,10 +1686,10 @@ class Sanitizer {
                        # http://www.whatwg.org/html/text-level-semantics.html#the-ruby-element
                        'ruby'       => $common,
                        # rbc
-                       # rtc
                        'rb'         => $common,
-                       'rt'         => $common, #array_merge( $common, array( 'rbspan' ) ),
                        'rp'         => $common,
+                       'rt'         => $common, #array_merge( $common, array( 'rbspan' ) ),
+                       'rtc'         => $common,
 
                        # MathML root element, where used for extensions
                        # 'title' may not be 100% valid here; it's XHTML