Browse files

BUGFIX Escaping base URLs for anchor links rewritten by SSViewer::pro…

…cess() with the 'rewriteHashlinks' option enabled (which is a framework default, and necessary because of the use of a <base> tag). Also added escaping for base URLs rendered through the 'php' variation of 'rewriteHashlinks'
  • Loading branch information...
1 parent 2ce1882 commit e2bf21ba1a1c1e353abc3fa028f6d858f8fc3a0a @chillu chillu committed Oct 18, 2011
Showing with 74 additions and 4 deletions.
  1. +70 −0 tests/view/SSViewerTest.php
  2. +1 −1 view/SSTemplateParser.php
  3. +1 −1 view/SSTemplateParser.php.inc
  4. +2 −2 view/SSViewer.php
View
70 tests/view/SSViewerTest.php
@@ -513,6 +513,76 @@ function testThemeRetrieval() {
// Remove all the test themes we created
Filesystem::removeFolder($testThemeBaseDir);
}
+
+ function testRewriteHashlinks() {
+ $oldRewriteHashLinks = SSViewer::getOption('rewriteHashlinks');
+ SSViewer::setOption('rewriteHashlinks', true);
+
+ // Emulate SSViewer::process()
+ $base = Convert::raw2att($_SERVER['REQUEST_URI']);
+
+ $tmplFile = TEMP_FOLDER . '/SSViewerTest_testRewriteHashlinks_' . sha1(rand()) . '.ss';
+
+ // Note: SSViewer_FromString doesn't rewrite hash links.
+ file_put_contents($tmplFile, '<!DOCTYPE html>
+ <html>
+ <head><% base_tag %></head>
+ <body>
+ <a class="inline" href="#anchor">InlineLink</a>
+ $InsertedLink
+ <body>
+ </html>');
+ $tmpl = new SSViewer($tmplFile);
+ $obj = new ViewableData();
+ $obj->InsertedLink = '<a class="inserted" href="#anchor">InsertedLink</a>';
+ $result = $tmpl->process($obj);
+ $this->assertContains(
+ '<a class="inserted" href="' . $base . '#anchor">InsertedLink</a>',
+ $result
+ );
+ $this->assertContains(
+ '<a class="inline" href="' . $base . '#anchor">InlineLink</a>',
+ $result
+ );
+
+ unlink($tmplFile);
+
+ SSViewer::setOption('rewriteHashlinks', $oldRewriteHashLinks);
+ }
+
+ function testRewriteHashlinksInPhpMode() {
+ $oldRewriteHashLinks = SSViewer::getOption('rewriteHashlinks');
+ SSViewer::setOption('rewriteHashlinks', 'php');
+
+ $tmplFile = TEMP_FOLDER . '/SSViewerTest_testRewriteHashlinksInPhpMode_' . sha1(rand()) . '.ss';
+
+ // Note: SSViewer_FromString doesn't rewrite hash links.
+ file_put_contents($tmplFile, '<!DOCTYPE html>
+ <html>
+ <head><% base_tag %></head>
+ <body>
+ <a class="inline" href="#anchor">InlineLink</a>
+ $InsertedLink
+ <body>
+ </html>');
+ $tmpl = new SSViewer($tmplFile);
+ $obj = new ViewableData();
+ $obj->InsertedLink = '<a class="inserted" href="#anchor">InsertedLink</a>';
+ $result = $tmpl->process($obj);
+ $this->assertContains(
+ '<a class="inserted" href="<?php echo strip_tags(',
+ $result
+ );
+ // TODO Fix inline links in PHP mode
+ // $this->assertContains(
+ // '<a class="inline" href="<?php echo str_replace(',
+ // $result
+ // );
+
+ unlink($tmplFile);
+
+ SSViewer::setOption('rewriteHashlinks', $oldRewriteHashLinks);
+ }
}
View
2 view/SSTemplateParser.php
@@ -3882,7 +3882,7 @@ function Text__finalise(&$res) {
// TODO: This is pretty ugly & gets applied on all files not just html. I wonder if we can make this non-dynamically calculated
$text = preg_replace(
'/href\s*\=\s*\"\#/',
- 'href="\' . (SSViewer::$options[\'rewriteHashlinks\'] ? Convert::raw2att( $_SERVER[\'REQUEST_URI\'] ) : "") . \'#',
+ 'href="\' . (SSViewer::$options[\'rewriteHashlinks\'] ? strip_tags( $_SERVER[\'REQUEST_URI\'] ) : "") . \'#',
$text
);
View
2 view/SSTemplateParser.php.inc
@@ -870,7 +870,7 @@ class SSTemplateParser extends Parser {
// TODO: This is pretty ugly & gets applied on all files not just html. I wonder if we can make this non-dynamically calculated
$text = preg_replace(
'/href\s*\=\s*\"\#/',
- 'href="\' . (SSViewer::$options[\'rewriteHashlinks\'] ? Convert::raw2att( $_SERVER[\'REQUEST_URI\'] ) : "") . \'#',
+ 'href="\' . (SSViewer::$options[\'rewriteHashlinks\'] ? strip_tags( $_SERVER[\'REQUEST_URI\'] ) : "") . \'#',
$text
);
View
4 view/SSViewer.php
@@ -503,9 +503,9 @@ public function process($item, $cache = null) {
if($this->rewriteHashlinks && self::$options['rewriteHashlinks']) {
if(strpos($output, '<base') !== false) {
if(SSViewer::$options['rewriteHashlinks'] === 'php') {
- $thisURLRelativeToBase = "<?php echo \$_SERVER['REQUEST_URI']; ?>";
+ $thisURLRelativeToBase = "<?php echo strip_tags(\$_SERVER['REQUEST_URI']); ?>";
} else {
- $thisURLRelativeToBase = Director::makeRelative(Director::absoluteURL($_SERVER['REQUEST_URI']));
+ $thisURLRelativeToBase = strip_tags($_SERVER['REQUEST_URI']);
}
$output = preg_replace('/(<a[^>]+href *= *)"#/i', '\\1"' . $thisURLRelativeToBase . '#', $output);
}

0 comments on commit e2bf21b

Please sign in to comment.