? help-blocks-1.patch ? standalone-html-escape-1.patch ? standalone-html-escape.patch ? includes/password.inc ? includes/passwordhash.inc ? sites/default/files ? sites/default/settings.php Index: modules/filter/filter.admin.inc =================================================================== RCS file: /cvs/drupal/drupal/modules/filter/filter.admin.inc,v retrieving revision 1.10 diff -u -p -r1.10 filter.admin.inc --- modules/filter/filter.admin.inc 19 Feb 2008 14:07:21 -0000 1.10 +++ modules/filter/filter.admin.inc 1 Apr 2008 04:34:43 -0000 @@ -144,7 +144,7 @@ function filter_admin_format_form(&$form $form['filters'] = array('#type' => 'fieldset', '#title' => t('Filters'), - '#description' => t('Choose the filters that will be used in this filter format.'), + '#description' => t('Select the filters to be enabled in this input format.'), '#tree' => TRUE, ); foreach ($all as $id => $filter) { @@ -164,7 +164,7 @@ function filter_admin_format_form(&$form if (!$tiplist) { $tiplist = '
'. t('No guidelines available.') .'
'; } - $group = ''. t('These are the guidelines that users will see for posting in this input format. They are automatically generated from the filter settings.') .'
'; + $group = ''. t('The following automatically-generated guidelines will be available to users posting in this input format.') .'
'; $group .= $tiplist; $form['tips'] = array('#value' => ''. t('Since input formats, if available, are presented in the same order as the list below, it may be helpful to arrange the formats in descending order of your preference for their use. To change the order of an input format, grab a drag-and-drop handle under the Name column and drag to a new location in the list. (Grab a handle by clicking and holding the mouse while hovering over a handle icon.) Remember that your changes will not be saved until you click the Save changes button at the bottom of the page.') .'
'; return $output; case 'admin/settings/filters/%': - return ''. t('Every filter performs one particular change on the user input, for example stripping out malicious HTML or making URLs clickable. Choose which filters you want to apply to text in this input format. If you notice some filters are causing conflicts in the output, you can rearrange them.', array('@rearrange' => url('admin/settings/filters/'. $arg[3] .'/order'))) .'
'; + return ''. t('Use the page below to select the filters to be applied as part of this input format. Each enabled filter performs a specific operation, generally either adding, removing or transforming elements within user-entered text. One filter may strip potentially malicious HTML from user input, for instance, while another transforms URLs into clickable links. Filters are executed in a specific order and may be rearranged to prevent conflicts in processing.', array('@rearrange' => url('admin/settings/filters/'. $arg[3] .'/order'))) .'
'; case 'admin/settings/filters/%/configure': - return ''. t('If you cannot find the settings for a certain filter, make sure you have enabled it on the view tab first.', array('@url' => url('admin/settings/filters/'. $arg[3]))) .'
'; + return ''. t('If the settings for a specific filter are not displayed, ensure the filter is enabled on the edit page.', array('@url' => url('admin/settings/filters/'. $arg[3]))) .'
'; case 'admin/settings/filters/%/order': $output = ''. t('Because of the flexible filtering system, you might encounter a situation where one filter prevents another from doing its job. For example: a word in an URL gets converted into a glossary term, before the URL can be converted to a clickable link. When this happens, rearrange the order of the filters.') .'
'; $output .= ''. t("Filters are executed from top-to-bottom. To change the order of the filters, modify the values in the Weight column or grab a drag-and-drop handle under the Name column and drag filters to new locations in the list. (Grab a handle by clicking and holding the mouse while hovering over a handle icon.) Remember that your changes will not be saved until you click the Save configuration button at the bottom of the page.") .'
'; @@ -171,100 +171,95 @@ function filter_filter_tips($delta, $for global $base_url; switch ($delta) { case 0: - if (variable_get("filter_html_$format", FILTER_HTML_STRIP) == FILTER_HTML_STRIP) { - if ($allowed_html = variable_get("allowed_html_$format", ' -
-
- ')) {
- switch ($long) {
- case 0:
- return t('Allowed HTML tags: @tags', array('@tags' => $allowed_html));
- case 1:
- $output = '
'. t('Allowed HTML tags: @tags', array('@tags' => $allowed_html)) .'
';
- if (!variable_get("filter_html_help_$format", 1)) {
- return $output;
- }
+ if ($allowed_html = variable_get("allowed_html_$format", ' -
-
- ')) {
+ switch ($long) {
+ case 0:
+ return t('Allowed HTML tags: @tags', array('@tags' => $allowed_html));
+ case 1:
+ $output = '
'. t('Allowed HTML tags: @tags', array('@tags' => $allowed_html)) .'
';
+ if (!variable_get("filter_html_help_$format", 1)) {
+ return $output;
+ }
- $output .= ''. t('This site allows HTML content. While learning all of HTML may feel intimidating, learning how to use a very small number of the most basic HTML "tags" is very easy. This table provides examples for each tag that is enabled on this site.') .'
';
- $output .= ''. t('For more information see W3C\'s HTML Specifications or use your favorite search engine to find other sites that explain HTML.', array('@html-specifications' => 'http://www.w3.org/TR/html/')) .'
';
- $tips = array(
- 'a' => array( t('Anchors are used to make links to other pages.'), ''. variable_get('site_name', 'Drupal') .''),
- 'br' => array( t('By default line break tags are automatically added, so use this tag to add additional ones. Use of this tag is different because it is not used with an open/close pair like all the others. Use the extra " /" inside the tag to maintain XHTML 1.0 compatibility'), t('Text with
line break')),
- 'p' => array( t('By default paragraph tags are automatically added, so use this tag to add additional ones.'), ''. t('Paragraph one.') .'
'. t('Paragraph two.') .'
'),
- 'strong' => array( t('Strong'), ''. t('Strong') .''),
- 'em' => array( t('Emphasized'), ''. t('Emphasized') .''),
- 'cite' => array( t('Cited'), ''. t('Cited') .''),
- 'code' => array( t('Coded text used to show programming source code'), ''. t('Coded') .''),
- 'b' => array( t('Bolded'), ''. t('Bolded') .''),
- 'u' => array( t('Underlined'), ''. t('Underlined') .''),
- 'i' => array( t('Italicized'), ''. t('Italicized') .''),
- 'sup' => array( t('Superscripted'), t('Superscripted')),
- 'sub' => array( t('Subscripted'), t('Subscripted')),
- 'pre' => array( t('Preformatted'), ''. t('Preformatted') .''),
- 'abbr' => array( t('Abbreviation'), t('Abbrev.')),
- 'acronym' => array( t('Acronym'), t('TLA')),
- 'blockquote' => array( t('Block quoted'), ''. t('Block quoted') .'
'),
- 'q' => array( t('Quoted inline'), ''. t('Quoted inline') .'
'),
- // Assumes and describes tr, td, th.
- 'table' => array( t('Table'), ' '. t('Table header') .' '. t('Table cell') .'
'),
- 'tr' => NULL, 'td' => NULL, 'th' => NULL,
- 'del' => array( t('Deleted'), ''. t('Deleted') .''),
- 'ins' => array( t('Inserted'), ''. t('Inserted') .''),
- // Assumes and describes li.
- 'ol' => array( t('Ordered list - use the <li> to begin each list item'), ' - '. t('First item') .'
- '. t('Second item') .'
'),
- 'ul' => array( t('Unordered list - use the <li> to begin each list item'), ' - '. t('First item') .'
- '. t('Second item') .'
'),
- 'li' => NULL,
- // Assumes and describes dt and dd.
- 'dl' => array( t('Definition lists are similar to other HTML lists. <dl> begins the definition list, <dt> begins the definition term and <dd> begins the definition description.'), ' - '. t('First term') .'
- '. t('First definition') .'
- '. t('Second term') .'
- '. t('Second definition') .'
'),
- 'dt' => NULL, 'dd' => NULL,
- 'h1' => array( t('Header'), ''. t('Title') .'
'),
- 'h2' => array( t('Header'), ''. t('Subtitle') .'
'),
- 'h3' => array( t('Header'), ''. t('Subtitle three') .'
'),
- 'h4' => array( t('Header'), ''. t('Subtitle four') .'
'),
- 'h5' => array( t('Header'), ''. t('Subtitle five') .'
'),
- 'h6' => array( t('Header'), ''. t('Subtitle six') .'
')
- );
- $header = array(t('Tag Description'), t('You Type'), t('You Get'));
- preg_match_all('/<([a-z0-9]+)[^a-z0-9]/i', $allowed_html, $out);
- foreach ($out[1] as $tag) {
- if (array_key_exists($tag, $tips)) {
- if ($tips[$tag]) {
- $rows[] = array(
- array('data' => $tips[$tag][0], 'class' => 'description'),
- array('data' => ''. check_plain($tips[$tag][1]) .'', 'class' => 'type'),
- array('data' => $tips[$tag][1], 'class' => 'get')
- );
- }
- }
- else {
+ $output .= ''. t('This site allows HTML content. While learning all of HTML may feel intimidating, learning how to use a very small number of the most basic HTML "tags" is very easy. This table provides examples for each tag that is enabled on this site.') .'
';
+ $output .= ''. t('For more information see W3C\'s HTML Specifications or use your favorite search engine to find other sites that explain HTML.', array('@html-specifications' => 'http://www.w3.org/TR/html/')) .'
';
+ $tips = array(
+ 'a' => array( t('Anchors are used to make links to other pages.'), ''. variable_get('site_name', 'Drupal') .''),
+ 'br' => array( t('By default line break tags are automatically added, so use this tag to add additional ones. Use of this tag is different because it is not used with an open/close pair like all the others. Use the extra " /" inside the tag to maintain XHTML 1.0 compatibility'), t('Text with
line break')),
+ 'p' => array( t('By default paragraph tags are automatically added, so use this tag to add additional ones.'), ''. t('Paragraph one.') .'
'. t('Paragraph two.') .'
'),
+ 'strong' => array( t('Strong'), ''. t('Strong') .''),
+ 'em' => array( t('Emphasized'), ''. t('Emphasized') .''),
+ 'cite' => array( t('Cited'), ''. t('Cited') .''),
+ 'code' => array( t('Coded text used to show programming source code'), ''. t('Coded') .''),
+ 'b' => array( t('Bolded'), ''. t('Bolded') .''),
+ 'u' => array( t('Underlined'), ''. t('Underlined') .''),
+ 'i' => array( t('Italicized'), ''. t('Italicized') .''),
+ 'sup' => array( t('Superscripted'), t('Superscripted')),
+ 'sub' => array( t('Subscripted'), t('Subscripted')),
+ 'pre' => array( t('Preformatted'), ''. t('Preformatted') .''),
+ 'abbr' => array( t('Abbreviation'), t('Abbrev.')),
+ 'acronym' => array( t('Acronym'), t('TLA')),
+ 'blockquote' => array( t('Block quoted'), ''. t('Block quoted') .'
'),
+ 'q' => array( t('Quoted inline'), ''. t('Quoted inline') .'
'),
+ // Assumes and describes tr, td, th.
+ 'table' => array( t('Table'), ' '. t('Table header') .' '. t('Table cell') .'
'),
+ 'tr' => NULL, 'td' => NULL, 'th' => NULL,
+ 'del' => array( t('Deleted'), ''. t('Deleted') .''),
+ 'ins' => array( t('Inserted'), ''. t('Inserted') .''),
+ // Assumes and describes li.
+ 'ol' => array( t('Ordered list - use the <li> to begin each list item'), ' - '. t('First item') .'
- '. t('Second item') .'
'),
+ 'ul' => array( t('Unordered list - use the <li> to begin each list item'), ' - '. t('First item') .'
- '. t('Second item') .'
'),
+ 'li' => NULL,
+ // Assumes and describes dt and dd.
+ 'dl' => array( t('Definition lists are similar to other HTML lists. <dl> begins the definition list, <dt> begins the definition term and <dd> begins the definition description.'), ' - '. t('First term') .'
- '. t('First definition') .'
- '. t('Second term') .'
- '. t('Second definition') .'
'),
+ 'dt' => NULL, 'dd' => NULL,
+ 'h1' => array( t('Header'), ''. t('Title') .'
'),
+ 'h2' => array( t('Header'), ''. t('Subtitle') .'
'),
+ 'h3' => array( t('Header'), ''. t('Subtitle three') .'
'),
+ 'h4' => array( t('Header'), ''. t('Subtitle four') .'
'),
+ 'h5' => array( t('Header'), ''. t('Subtitle five') .'
'),
+ 'h6' => array( t('Header'), ''. t('Subtitle six') .'
')
+ );
+ $header = array(t('Tag Description'), t('You Type'), t('You Get'));
+ preg_match_all('/<([a-z0-9]+)[^a-z0-9]/i', $allowed_html, $out);
+ foreach ($out[1] as $tag) {
+ if (array_key_exists($tag, $tips)) {
+ if ($tips[$tag]) {
$rows[] = array(
- array('data' => t('No help provided for tag %tag.', array('%tag' => $tag)), 'class' => 'description', 'colspan' => 3),
+ array('data' => $tips[$tag][0], 'class' => 'description'),
+ array('data' => ''. check_plain($tips[$tag][1]) .'', 'class' => 'type'),
+ array('data' => $tips[$tag][1], 'class' => 'get')
);
}
}
- $output .= theme('table', $header, $rows);
-
- $output .= ''. t('Most unusual characters can be directly entered without any problems.') .'
';
- $output .= ''. t('If you do encounter problems, try using HTML character entities. A common example looks like & for an ampersand & character. For a full list of entities see HTML\'s entities page. Some of the available characters include:', array('@html-entities' => 'http://www.w3.org/TR/html4/sgml/entities.html')) .'
';
-
- $entities = array(
- array( t('Ampersand'), '&'),
- array( t('Greater than'), '>'),
- array( t('Less than'), '<'),
- array( t('Quotation mark'), '"'),
- );
- $header = array(t('Character Description'), t('You Type'), t('You Get'));
- unset($rows);
- foreach ($entities as $entity) {
+ else {
$rows[] = array(
- array('data' => $entity[0], 'class' => 'description'),
- array('data' => ''. check_plain($entity[1]) .'', 'class' => 'type'),
- array('data' => $entity[1], 'class' => 'get')
+ array('data' => t('No help provided for tag %tag.', array('%tag' => $tag)), 'class' => 'description', 'colspan' => 3),
);
}
- $output .= theme('table', $header, $rows);
- return $output;
- }
- }
- else {
- return t('No HTML tags allowed');
+ }
+ $output .= theme('table', $header, $rows);
+
+ $output .= ''. t('Most unusual characters can be directly entered without any problems.') .'
';
+ $output .= ''. t('If you do encounter problems, try using HTML character entities. A common example looks like & for an ampersand & character. For a full list of entities see HTML\'s entities page. Some of the available characters include:', array('@html-entities' => 'http://www.w3.org/TR/html4/sgml/entities.html')) .'
';
+
+ $entities = array(
+ array( t('Ampersand'), '&'),
+ array( t('Greater than'), '>'),
+ array( t('Less than'), '<'),
+ array( t('Quotation mark'), '"'),
+ );
+ $header = array(t('Character Description'), t('You Type'), t('You Get'));
+ unset($rows);
+ foreach ($entities as $entity) {
+ $rows[] = array(
+ array('data' => $entity[0], 'class' => 'description'),
+ array('data' => ''. check_plain($entity[1]) .'', 'class' => 'type'),
+ array('data' => $entity[1], 'class' => 'get')
+ );
+ }
+ $output .= theme('table', $header, $rows);
+ return $output;
}
}
break;
@@ -277,8 +272,15 @@ function filter_filter_tips($delta, $for
return t('Lines and paragraphs are automatically recognized. The <br /> line break, <p> paragraph and </p> close paragraph tags are inserted automatically. If paragraphs are not recognized simply add a couple blank lines.');
}
break;
+
case 2:
return t('Web page addresses and e-mail addresses turn into links automatically.');
+ break;
+
+ case 4:
+ return t('No HTML tags allowed');
+ break;
+
}
}
@@ -602,18 +604,20 @@ function theme_filter_tips_more_info() {
function filter_filter($op, $delta = 0, $format = -1, $text = '') {
switch ($op) {
case 'list':
- return array(0 => t('HTML filter'), 1 => t('Line break converter'), 2 => t('URL filter'), 3 => t('HTML corrector'));
+ return array(0 => t('Limit allowed HTML tags'), 1 => t('Convert line breaks'), 2 => t('Convert URLs into links'), 3 => t('Correct broken HTML'), 4 => t('Escape all HTML'));
case 'description':
switch ($delta) {
case 0:
- return t('Allows you to restrict whether users can post HTML and which tags to filter out. It will also remove harmful content such as JavaScript events, JavaScript URLs and CSS styles from those tags that are not removed.');
+ return t('Limit HTML tags allowed within text (and remove potentially harmful JavaScript events, JavaScript URLs and CSS styles from all tags).');
case 1:
- return t('Converts line breaks into HTML (i.e. <br> and <p> tags).');
+ return t('Convert line breaks into HTML tags (i.e. <br> and <p>).');
case 2:
- return t('Turns web and e-mail addresses into clickable links.');
+ return t('Automatically transform web and e-mail addresses into clickable links.');
case 3:
- return t('Corrects faulty and chopped off HTML in postings.');
+ return t('Correct misformed or truncated HTML in content.');
+ case 4:
+ return t('Convert all HTML tags within text into display-only equivalents.');
default:
return;
}
@@ -628,6 +632,8 @@ function filter_filter($op, $delta = 0,
return _filter_url($text, $format);
case 3:
return _filter_htmlcorrector($text);
+ case 4:
+ return trim(check_plain($text));
default:
return $text;
}
@@ -656,32 +662,25 @@ function _filter_html_settings($format)
'#title' => t('HTML filter'),
'#collapsible' => TRUE,
);
- $form['filter_html']["filter_html_$format"] = array(
- '#type' => 'radios',
- '#title' => t('Filter HTML tags'),
- '#default_value' => variable_get("filter_html_$format", FILTER_HTML_STRIP),
- '#options' => array(FILTER_HTML_STRIP => t('Strip disallowed tags'), FILTER_HTML_ESCAPE => t('Escape all tags')),
- '#description' => t('How to deal with HTML tags in user-contributed content. If set to "Strip disallowed tags", dangerous tags are removed (see below). If set to "Escape tags", all HTML is escaped and presented as it was typed.'),
- );
$form['filter_html']["allowed_html_$format"] = array(
'#type' => 'textfield',
'#title' => t('Allowed HTML tags'),
'#default_value' => variable_get("allowed_html_$format", ' -
-
- '),
'#size' => 64,
'#maxlength' => 255,
- '#description' => t('If "Strip disallowed tags" is selected, optionally specify tags which should not be stripped. JavaScript event attributes are always stripped.'),
+ '#description' => t('If Limit allowed HTML tags is selected, optionally specify tags which should not be stripped. JavaScript event attributes are always stripped from all tags.'),
);
$form['filter_html']["filter_html_help_$format"] = array(
'#type' => 'checkbox',
'#title' => t('Display HTML help'),
'#default_value' => variable_get("filter_html_help_$format", 1),
- '#description' => t('If enabled, Drupal will display some basic HTML help in the long filter tips.'),
+ '#description' => t('If enabled, basic HTML help will be included on the Compose tips page.', array('@filter-tips' => url('filter/tips'))),
);
$form['filter_html']["filter_html_nofollow_$format"] = array(
'#type' => 'checkbox',
'#title' => t('Spam link deterrent'),
'#default_value' => variable_get("filter_html_nofollow_$format", FALSE),
- '#description' => t('If enabled, Drupal will add rel="nofollow" to all links, as a measure to reduce the effectiveness of spam links. Note: this will also prevent valid links from being followed by search engines, therefore it is likely most effective when enabled for anonymous users.'),
+ '#description' => t('If enabled, a rel="nofollow" will be added to all links, to reduce the effectiveness of link spam. Since enabling this option also prevent valid links from being followed by compliant search engines, you may wish to use it only with content entered by anonymous users.'),
);
return $form;
}
@@ -690,15 +689,8 @@ function _filter_html_settings($format)
* HTML filter. Provides filtering of input into accepted HTML.
*/
function _filter_html($text, $format) {
- if (variable_get("filter_html_$format", FILTER_HTML_STRIP) == FILTER_HTML_STRIP) {
- $allowed_tags = preg_split('/\s+|<|>/', variable_get("allowed_html_$format", '
-
-
- '), -1, PREG_SPLIT_NO_EMPTY);
- $text = filter_xss($text, $allowed_tags);
- }
-
- if (variable_get("filter_html_$format", FILTER_HTML_STRIP) == FILTER_HTML_ESCAPE) {
- // Escape HTML
- $text = check_plain($text);
- }
+ $allowed_tags = preg_split('/\s+|<|>/', variable_get("allowed_html_$format", '
-
-
- '), -1, PREG_SPLIT_NO_EMPTY);
+ $text = filter_xss($text, $allowed_tags);
if (variable_get("filter_html_nofollow_$format", FALSE)) {
$text = preg_replace('/]+)>/i', '', $text);
@@ -721,7 +713,7 @@ function _filter_url_settings($format) {
'#title' => t('Maximum link text length'),
'#default_value' => variable_get('filter_url_length_'. $format, 72),
'#maxlength' => 4,
- '#description' => t('URLs longer than this number of characters will be truncated to prevent long strings that break formatting. The link itself will be retained; just the text portion of the link will be truncated.'),
+ '#description' => t('To prevent long strings from interfering with page formatting, URLs longer than this number of characters will be truncated. The link itself is retained; only the text portion of the link is shortened.'),
);
return $form;
}