diff --git modules/filter/filter.module modules/filter/filter.module index c03b084..ecae662 100644 --- modules/filter/filter.module +++ modules/filter/filter.module @@ -1298,46 +1298,202 @@ function _filter_url_settings($form, &$form_state, $filter, $format, $defaults) } /** - * URL filter. Automatically converts text web addresses (URLs, e-mail addresses, - * ftp links, etc.) into hyperlinks. + * URL filter. Automatically converts text into hyperlinks. + * + * This filter identifies and makes clickable three types of "links". + * - URLs like http://example.com. + * - E-mail addresses like name@example.com. + * - Web addresses without the "http://" protocol defined, like www.example.com. + * Each type must be processed separately, as there is no one regular + * expression that could possibly match all of the cases in one pass. */ function _filter_url($text, $filter) { - // Pass length to regexp callback + // Tags to skip and not recurse into. + $ignore_tags = 'a|script|style|code|pre'; + + // Pass length to regexp callback. _filter_url_trim(NULL, $filter->settings['filter_url_length']); - $text = ' ' . $text . ' '; + // Create an array which contains the regexps for each type of link. + // The key to the regexp is the name of a function that is used as + // callback function to process matches of the regexp. The callback function + // is to return the replacement for the match. The array is used and + // matching/replacement done below inside some loops. + $tasks = array(); + + // Prepare protocols pattern for absolute URLs. + // check_url() will replace any bad protocols with HTTP, so we need to support + // the identical list. While '//' is technically optional for MAILTO only, + // we cannot cleanly differ between protocols here without hard-coding MAILTO, + // so '//' is optional for all protocols. + // @see filter_xss_bad_protocol() + $protocols = variable_get('filter_allowed_protocols', array('http', 'https', 'ftp', 'news', 'nntp', 'telnet', 'mailto', 'irc', 'ssh', 'sftp', 'webcal', 'rtsp')); + $protocols = implode(':(?://)?|', $protocols) . ':(?://)?'; + + // Prepare domain name pattern. + // The ICANN seems to be on track towards accepting more diverse top level + // domains, so this pattern has been "future-proofed" to allow for TLDs + // of length 2-64. + $domain = '(?:[A-Za-z0-9._+-]+\.)?[A-Za-z]{2,64}\b'; + $ip = '(?:[0-9]{1,3}\.){3}[0-9]{1,3}'; + $auth = '[a-zA-Z0-9:%_+*~#?&=.,/;-]+@'; + $trail = '[a-zA-Z0-9:%_+*~#&\[\]=/;?\.,-]*[a-zA-Z0-9:%_+*~#&\[\]=/;-]'; + + // Prepare pattern for optional trailing punctuation. + // Even these characters could have a valid meaning for the URL, such usage is + // rare compared to using a URL at the end of or within a sentence, so these + // trailing characters are optionally excluded. + $punctuation = '[\.,?!]*?'; // Match absolute URLs. - $text = preg_replace_callback("`(

|

  • ||[ \n\r\t\(])((http://|https://|ftp://|mailto:|smb://|afp://|file://|gopher://|news://|ssl://|sslv2://|sslv3://|tls://|tcp://|udp://)([a-zA-Z0-9@:%_+*~#?&=.,/;-]*[a-zA-Z0-9@:%_+*~#&=/;-]))([.,?!]*?)(?=(

    |
    • ||[ \n\r\t\)]))`i", '_filter_url_parse_full_links', $text); + $url_pattern = "(?:$auth)?(?:$domain|$ip)/?(?:$trail)?"; + $pattern = "`((?:$protocols)(?:$url_pattern))($punctuation)`"; + $tasks['_filter_url_parse_full_links'] = $pattern; // Match e-mail addresses. - $text = preg_replace("`(

    |

  • ||[ \n\r\t\(])([A-Za-z0-9._-]+@[A-Za-z0-9._+-]+\.[A-Za-z]{2,4})([.,?!]*?)(?=(

    |
    • ||[ \n\r\t\)]))`i", '\1\2\3', $text); + $url_pattern = "[A-Za-z0-9._-]+@(?:$domain)"; + $pattern = "`($url_pattern)`"; + $tasks['_filter_url_parse_email_links'] = $pattern; + + // Match www domains. + $url_pattern = "www\.(?:$domain)/?(?:$trail)?"; + $pattern = "`($url_pattern)($punctuation)`"; + $tasks['_filter_url_parse_partial_links'] = $pattern; + + // Each type of URL needs to be processed separately. The text is joined and + // re-split after each task, since all injected HTML tags must be correctly + // protected before the next task. + foreach ($tasks as $task => $pattern) { + // HTML comments need to be handled separately, as they may contain HTML + // markup, especially a '>'. Therefore, remove all comment contents and add + // them back later. + _filter_url_escape_comments('', TRUE); + $text = preg_replace_callback('``s', '_filter_url_escape_comments', $text); + + // Split at all tags; ensures that no tags or attributes are processed. + $chunks = preg_split('/(<.+?>)/is', $text, -1, PREG_SPLIT_DELIM_CAPTURE); + // PHP ensures that the array consists of alternating delimiters and + // literals, and begins and ends with a literal (inserting NULL as + // required). Therefore, the first chunk is always text: + $chunk_type = 'text'; + // If a tag of $ignore_tags is found, it is stored in $open_tag and only + // removed when the closing tag is found. Until the closing tag is found, + // no replacements are made. + $open_tag = ''; + + for ($i = 0; $i < count($chunks); $i++) { + if ($chunk_type == 'text') { + // Only process this text if there are no unclosed $ignore_tags. + if ($open_tag == '') { + // If there is a match, inject a link into this chunk via the callback + // function contained in $task. + $chunks[$i] = preg_replace_callback($pattern, $task, $chunks[$i]); + } + // Text chunk is done, so next chunk must be a tag. + $chunk_type = 'tag'; + } + else { + // Only process this tag if there are no unclosed $ignore_tags. + if ($open_tag == '') { + // Check whether this tag is contained in $ignore_tags. + if (preg_match("`<($ignore_tags)(?:\s|>)`i", $chunks[$i], $matches)) { + $open_tag = $matches[1]; + } + } + // Otherwise, check whether this is the closing tag for $open_tag. + else { + if (preg_match("`<\/$open_tag>`i", $chunks[$i], $matches)) { + $open_tag = ''; + } + } + // Tag chunk is done, so next chunk must be text. + $chunk_type = 'text'; + } + } - // Match www domains/addresses. - $text = preg_replace_callback("`(

    |

  • |[ \n\r\t\(])(www\.[a-zA-Z0-9@:%_+*~#?&=.,/;-]*[a-zA-Z0-9@:%_+~#\&=/;-])([.,?!]*?)(?=(

    |
    • ||[ \n\r\t\)]))`i", '_filter_url_parse_partial_links', $text); - $text = substr($text, 1, -1); + $text = implode($chunks); + // Revert back to the original comment contents + _filter_url_escape_comments('', FALSE); + $text = preg_replace_callback('``', '_filter_url_escape_comments', $text); + } return $text; } /** - * Make links out of absolute URLs. + * preg_replace callback to make links out of absolute URLs. */ function _filter_url_parse_full_links($match) { - $match[2] = decode_entities($match[2]); - $caption = check_plain(_filter_url_trim($match[2])); - $match[2] = check_url($match[2]); - return $match[1] . '' . $caption . '' . $match[5]; + // The $i:th parenthesis in the regexp contains the URL. + $i = 1; + + $match[$i] = decode_entities($match[$i]); + $caption = check_plain(_filter_url_trim($match[$i])); + $match[$i] = check_plain($match[$i]); + return '' . $caption . '' . $match[$i + 1]; +} + +/** + * preg_replace callback to make links out of e-mail addresses. + */ +function _filter_url_parse_email_links($match) { + // The $i:th parenthesis in the regexp contains the URL. + $i = 0; + + $match[$i] = decode_entities($match[$i]); + $caption = check_plain(_filter_url_trim($match[$i])); + $match[$i] = check_plain($match[$i]); + return '' . $caption . ''; } /** - * Make links out of domain names starting with "www." + * preg_replace callback to make links out of domain names starting with "www." */ function _filter_url_parse_partial_links($match) { - $match[2] = decode_entities($match[2]); - $caption = check_plain(_filter_url_trim($match[2])); - $match[2] = check_plain($match[2]); - return $match[1] . '' . $caption . '' . $match[3]; + // The $i:th parenthesis in the regexp contains the URL. + $i = 1; + + $match[$i] = decode_entities($match[$i]); + $caption = check_plain(_filter_url_trim($match[$i])); + $match[$i] = check_plain($match[$i]); + return '' . $caption . '' . $match[$i + 1]; +} + +/** + * preg_replace callback to escape contents of HTML comments + * + * @param $match + * An array containing matches to replace from preg_replace_callback(), + * whereas $match[1] is expected to contain the content to be filtered. + * @param $escape + * (optional) Boolean whether to escape (TRUE) or unescape comments (FALSE). + * Defaults to neither. If TRUE, statically cached $comments are reset. + */ +function _filter_url_escape_comments($match, $escape = NULL) { + static $mode, $comments = array(); + + if (isset($escape)) { + $mode = $escape; + if ($escape){ + $comments = array(); + } + return; + } + + // Replace all HTML coments with a '' placeholder. + if ($mode) { + $content = $match[1]; + $hash = md5($content); + $comments[$hash] = $content; + return ""; + } + // Or replace placeholders with actual comment contents. + else { + $hash = $match[1]; + $hash = trim($hash); + $content = $comments[$hash]; + return ""; + } } /** @@ -1350,7 +1506,7 @@ function _filter_url_trim($text, $length = NULL) { } // Use +3 for '...' string length. - if (strlen($text) > $_length + 3) { + if ($_length && strlen($text) > $_length + 3) { $text = substr($text, 0, $_length) . '...'; } diff --git modules/filter/filter.test modules/filter/filter.test deleted file mode 100644 index af96960..0000000 --- modules/filter/filter.test +++ /dev/null @@ -1,1373 +0,0 @@ - 'Filter CRUD operations', - 'description' => 'Test creation, loading, updating, deleting of text formats and filters.', - 'group' => 'Filter', - ); - } - - function setUp() { - parent::setUp('filter_test'); - } - - /** - * Test CRUD operations for text formats and filters. - */ - function testTextFormatCRUD() { - // Add a text format with minimum data only. - $format = new stdClass(); - $format->name = 'Empty format'; - filter_format_save($format); - $this->verifyTextFormat($format); - $this->verifyFilters($format); - - // Add another text format specifying all possible properties. - $format = new stdClass(); - $format->name = 'Custom format'; - $format->filters = array( - 'filter_url' => array( - 'status' => 1, - 'settings' => array( - 'filter_url_length' => 30, - ), - ), - ); - filter_format_save($format); - $this->verifyTextFormat($format); - $this->verifyFilters($format); - - // Alter some text format properties and save again. - $format->name = 'Altered format'; - $format->filters['filter_url']['status'] = 0; - $format->filters['filter_autop']['status'] = 1; - filter_format_save($format); - $this->verifyTextFormat($format); - $this->verifyFilters($format); - - // Add a uncacheable filter and save again. - $format->filters['filter_test_uncacheable']['status'] = 1; - filter_format_save($format); - $this->verifyTextFormat($format); - $this->verifyFilters($format); - - // Delete the text format. - filter_format_delete($format); - $db_format = db_query("SELECT * FROM {filter_format} WHERE format = :format", array(':format' => $format->format))->fetchObject(); - $this->assertFalse($db_format, t('Database: Deleted text format no longer exists.')); - $db_filters = db_query("SELECT * FROM {filter} WHERE format = :format", array(':format' => $format->format))->fetchObject(); - $this->assertFalse($db_filters, t('Database: Filters for deleted text format no longer exist.')); - $formats = filter_formats(); - $this->assertTrue(!isset($formats[$format->format]), t('filter_formats: Deleted text format no longer exists.')); - } - - /** - * Verify that a text format is properly stored. - */ - function verifyTextFormat($format) { - $t_args = array('%format' => $format->name); - // Verify text format database record. - $db_format = db_select('filter_format', 'ff') - ->fields('ff') - ->condition('format', $format->format) - ->execute() - ->fetchObject(); - $this->assertEqual($db_format->format, $format->format, t('Database: Proper format id for text format %format.', $t_args)); - $this->assertEqual($db_format->name, $format->name, t('Database: Proper title for text format %format.', $t_args)); - $this->assertEqual($db_format->cache, $format->cache, t('Database: Proper cache indicator for text format %format.', $t_args)); - $this->assertEqual($db_format->weight, $format->weight, t('Database: Proper weight for text format %format.', $t_args)); - - // Verify filter_format_load(). - $filter_format = filter_format_load($format->format); - $this->assertEqual($filter_format->format, $format->format, t('filter_format_load: Proper format id for text format %format.', $t_args)); - $this->assertEqual($filter_format->name, $format->name, t('filter_format_load: Proper title for text format %format.', $t_args)); - $this->assertEqual($filter_format->cache, $format->cache, t('filter_format_load: Proper cache indicator for text format %format.', $t_args)); - $this->assertEqual($filter_format->weight, $format->weight, t('filter_format_load: Proper weight for text format %format.', $t_args)); - - // Verify the 'cache' text format property according to enabled filters. - $filter_info = filter_get_filters(); - $filters = filter_list_format($filter_format->format); - $cacheable = TRUE; - foreach ($filters as $name => $filter) { - // If this filter is not cacheable, update $cacheable accordingly, so we - // can verify $format->cache after iterating over all filters. - if ($filter->status && isset($filter_info[$name]['cache']) && !$filter_info[$name]['cache']) { - $cacheable = FALSE; - break; - } - } - $this->assertEqual($filter_format->cache, $cacheable, t('Text format contains proper cache property.')); - } - - /** - * Verify that filters are properly stored for a text format. - */ - function verifyFilters($format) { - // Verify filter database records. - $filters = db_query("SELECT * FROM {filter} WHERE format = :format", array(':format' => $format->format))->fetchAllAssoc('name'); - $format_filters = $format->filters; - foreach ($filters as $name => $filter) { - $t_args = array('%format' => $format->name, '%filter' => $name); - - // Verify that filter status is properly stored. - $this->assertEqual($filter->status, $format_filters[$name]['status'], t('Database: Proper status for %filter in text format %format.', $t_args)); - - // Verify that filter settings were properly stored. - $this->assertEqual(unserialize($filter->settings), isset($format_filters[$name]['settings']) ? $format_filters[$name]['settings'] : array(), t('Database: Proper filter settings for %filter in text format %format.', $t_args)); - - // Verify that each filter has a module name assigned. - $this->assertTrue(!empty($filter->module), t('Database: Proper module name for %filter in text format %format.', $t_args)); - - // Remove the filter from the copy of saved $format to check whether all - // filters have been processed later. - unset($format_filters[$name]); - } - // Verify that all filters have been processed. - $this->assertTrue(empty($format_filters), t('Database contains values for all filters in the saved format.')); - - // Verify filter_list_format(). - $filters = filter_list_format($format->format); - $format_filters = $format->filters; - foreach ($filters as $name => $filter) { - $t_args = array('%format' => $format->name, '%filter' => $name); - - // Verify that filter status is properly stored. - $this->assertEqual($filter->status, $format_filters[$name]['status'], t('filter_list_format: Proper status for %filter in text format %format.', $t_args)); - - // Verify that filter settings were properly stored. - $this->assertEqual($filter->settings, isset($format_filters[$name]['settings']) ? $format_filters[$name]['settings'] : array(), t('filter_list_format: Proper filter settings for %filter in text format %format.', $t_args)); - - // Verify that each filter has a module name assigned. - $this->assertTrue(!empty($filter->module), t('filter_list_format: Proper module name for %filter in text format %format.', $t_args)); - - // Remove the filter from the copy of saved $format to check whether all - // filters have been processed later. - unset($format_filters[$name]); - } - // Verify that all filters have been processed. - $this->assertTrue(empty($format_filters), t('filter_list_format: Loaded filters contain values for all filters in the saved format.')); - } -} - -class FilterAdminTestCase extends DrupalWebTestCase { - public static function getInfo() { - return array( - 'name' => 'Filter administration functionality', - 'description' => 'Thoroughly test the administrative interface of the filter module.', - 'group' => 'Filter', - ); - } - - function setUp() { - parent::setUp(); - - // Create users. - $filtered_html_format = db_query_range('SELECT * FROM {filter_format} WHERE name = :name', 0, 1, array(':name' => 'Filtered HTML'))->fetchObject(); - $full_html_format = db_query_range('SELECT * FROM {filter_format} WHERE name = :name', 0, 1, array(':name' => 'Full HTML'))->fetchObject(); - $this->admin_user = $this->drupalCreateUser(array( - 'administer filters', - filter_permission_name($filtered_html_format), - filter_permission_name($full_html_format), - )); - - $this->web_user = $this->drupalCreateUser(array('create page content', 'edit own page content')); - $this->drupalLogin($this->admin_user); - } - - function testFormatAdmin() { - // Add text format. - $this->drupalGet('admin/config/content/formats'); - $this->clickLink('Add text format'); - $edit = array( - 'name' => $this->randomName(), - ); - $this->drupalPost(NULL, $edit, t('Save configuration')); - - // Edit text format. - $format = $this->getFormat($edit['name']); - $this->drupalGet('admin/config/content/formats'); - $this->assertRaw('admin/config/content/formats/' . $format->format); - $this->drupalGet('admin/config/content/formats/' . $format->format); - $this->drupalPost(NULL, array(), t('Save configuration')); - - // Delete text format. - $this->drupalGet('admin/config/content/formats'); - $this->assertRaw('admin/config/content/formats/' . $format->format . '/delete'); - $this->drupalGet('admin/config/content/formats/' . $format->format . '/delete'); - $this->drupalPost(NULL, array(), t('Delete')); - - // Verify that deleted text format no longer exists. - $this->drupalGet('admin/config/content/formats/' . $format->format); - $this->assertResponse(404, t('Deleted text format no longer exists.')); - } - - /** - * Test filter administration functionality. - */ - function testFilterAdmin() { - // URL filter. - $first_filter = 'filter_url'; - // Line filter. - $second_filter = 'filter_autop'; - - list($filtered, $full, $plain) = $this->checkFilterFormats(); - - // Check that the fallback format exists and cannot be deleted. - $this->assertTrue(!empty($plain) && $plain == filter_fallback_format(), t('The fallback format is set to plain text.')); - $this->drupalGet('admin/config/content/formats'); - $this->assertNoRaw('admin/config/content/formats/' . $plain . '/delete', t('Delete link for the fallback format not found.')); - $this->drupalGet('admin/config/content/formats/' . $plain . '/delete'); - $this->assertResponse(403, t('The fallback format cannot be deleted.')); - - // Verify access permissions to Full HTML format. - $this->assertTrue(filter_access(filter_format_load($full), $this->admin_user), t('Admin user may use Full HTML.')); - $this->assertFalse(filter_access(filter_format_load($full), $this->web_user), t('Web user may not use Full HTML.')); - - // Add an additional tag. - $edit = array(); - $edit['filters[filter_html][settings][allowed_html]'] = '