• last updated 23 hours ago
Constraints
Constraints: committers
 
Constraints: files
Constraints: dates
Fixed regression test and make more use of "aa_test_start" and "aa_test_end"

This change reduces the errors in the log file a lets run the

regression test (on my site) without reported errors as reported by

acs_kernel__server_startup_ok.

  1. … 3 more files in changeset.
Complete the URL earlier, so that protocol-relative URLs can be correctly determined as external or not

Rework URL validation in ad_dom_sanitize_html

We now prefer higher level api to determine:

- if a URL is external

- what protocol should be assumed for a URL when this is relative or protocol-relative

made test for valid protocols case invariant

In the end we do phase out the util_expand_entities* procs for being too lame

Good riddance

  1. … 1 more file in changeset.
Reimplement util_expand_entities_ie_style

This proc turned out to be long broken. We could consider phasing it out, but as it is a public interface used in a few places we prefer to keep it around and try to fix it.

The intended behavior has been reconstructed from the documentation. The new approach uses a single regexp to extract entities, which does not risk to loop indefinitely as before.

fixed broken indentation and broken nesting

    • -1149
    • +1148
    ./text-html-procs.tcl
fix incorrect nesting in switch statements

improved spelling

  1. … 5 more files in changeset.
Untangle if logics

Reject URLs displaying multiple protocols

Strenghten validation against smarter attempts to disguise the javascript: protocol

Manually replace the ":" entity to prevent attempts at disguising "javascript:" links

When using ad_dom_sanitize_html to validate markup, treat failure to parse as a normal validation failure, rather than an error

reduce verbosity

Use a better regexp to reimplement ad_looks_like_html_p, use the improved api to port downstream feature: an ad_form datatype validator that won't allow to insert markup

Many thanks to Günter Ernst

  1. … 1 more file in changeset.
Deprecate trivial wrappers for ad_html_text_convert

  1. … 2 more files in changeset.
improve robustness

  1. … 1 more file in changeset.
make parsing more robust

fix typo

reduce verbosity

  1. … 2 more files in changeset.
Small improvements:

- use "string is space" instead of trimming the string and checking if empty, at least 2x faster on development, wherever we don't need the trimmed value

- modernize leftover foreach trick with lassign

  1. … 6 more files in changeset.
if truncate_len is provided we have to call util_close_html_tags for truncating the string

Rename proc according to convention enforced in acs-tcl: naming__proc_naming

comment tags, which are NOT supported by HTML5, allow "abbr" in enhanced text

Reduce verbosity

Fix typo

implemented ad_html_security_check based on ns_parsehtml

Use "ns_parsehtml" for speed and correctness when available

The new NaviServer built-in command "ns_parsehtml" is used on

several occasions in the code when available, namely in

- util_close_html_tags

- escaping disallowed HTML tags in ad_text_to_html

- util_close_html_tags

The command "util_close_html_tags" has a long history of troubles,

since it was implemented originally based on regular expressions. It

was reported in Jan 2009, that the function took on certain forums

entries 6 to 9 hours (e.g. /forums/message-view?message_id=357753) to

finish. Therefore, at this time a quick version based on tdom was

introduced, which reduced at that time the performance to 7.3

seconds. However, the tdom-based version tend to fail on invalid HTML,

so it could cover only a few cases. The new "ns_parsehtml" is more

robust and works very stable on openacs.org with the know problem

cases. Furthermore, this version is also significantly faster than the

tdom version.

  1. … 1 more file in changeset.
Deprecate ad_parameter_all_values_as_list: it does not provide much value and was also often use improperly

  1. … 4 more files in changeset.