From 9b31e0e1b9f7695b2c56d8d6d75239aaeb78959c Mon Sep 17 00:00:00 2001 From: LI JIAHAO Date: Thu, 15 Jun 2017 13:01:00 +0800 Subject: [PATCH] add purifier --- app/Http/Controllers/AdminController.php | 3 +- app/Http/Controllers/GoodController.php | 5 +- composer.json | 3 +- composer.lock | 159 +++++++++++++++++++---- config/app.php | 2 + config/purifier.php | 105 +++++++++++++++ 6 files changed, 248 insertions(+), 29 deletions(-) create mode 100644 config/purifier.php diff --git a/app/Http/Controllers/AdminController.php b/app/Http/Controllers/AdminController.php index 95efd8d..1ef9c76 100644 --- a/app/Http/Controllers/AdminController.php +++ b/app/Http/Controllers/AdminController.php @@ -11,6 +11,7 @@ use App\User; use App\Announcement; use App\Http\Controllers\Controller; use App\Ticket; +use Mews\Purifier\Purifier; class AdminController extends Controller { @@ -130,7 +131,7 @@ class AdminController extends Controller $input = $request->all(); $announcement = new Announcement; $announcement->title = $input['title']; - $announcement->content = $input['content']; + $announcement->content = clean($input['content']); $announcement->save(); return Redirect::to('/admin'); } diff --git a/app/Http/Controllers/GoodController.php b/app/Http/Controllers/GoodController.php index 476f546..6e7c19e 100644 --- a/app/Http/Controllers/GoodController.php +++ b/app/Http/Controllers/GoodController.php @@ -23,6 +23,7 @@ use Storage; use Image; use App\Http\Requests\AddGoodRequest; use App\Http\Requests\EditGoodRequest; +use Mews\Purifier\Purifier; class GoodController extends Controller { @@ -180,7 +181,7 @@ class GoodController extends Controller $good = new GoodInfo; $good->good_name = $input['good_name']; $good->cat_id = $input['cat_id']; - $good->description = $input['description']; + $good->description = clean($input['description']); $good->price = $input['price']; $good->type = $input['type']; $good->count = $input['count']; @@ -245,7 +246,7 @@ class GoodController extends Controller return Redirect::to('/good/'.$good_id); $good->good_name=$input['good_name']; $good->cat_id=$input['cat_id']; - $good->description=$input['description']; + $good->description= clean($input['description']); $good->price=$input['price']; $good->type=$input['type']; $good->count=$input['count']; diff --git a/composer.json b/composer.json index 2a3240d..6464b42 100644 --- a/composer.json +++ b/composer.json @@ -10,7 +10,8 @@ "intervention/image": "^2.3", "laravel/browser-kit-testing": "^1.0", "satooshi/php-coveralls": "^1.0", - "jasig/phpcas": "^1.3" + "jasig/phpcas": "^1.3", + "mews/purifier": "^2.0" }, "require-dev": { "fzaninotto/faker": "~1.4", diff --git a/composer.lock b/composer.lock index be923d2..8a2ae20 100644 --- a/composer.lock +++ b/composer.lock @@ -4,7 +4,7 @@ "Read more about it at https://getcomposer.org/doc/01-basic-usage.md#composer-lock-the-lock-file", "This file is @generated automatically" ], - "content-hash": "ba8ffb9ee316786406c6e5e5594b771f", + "content-hash": "532bb9f36654d490014eddaf16a312c8", "packages": [ { "name": "doctrine/inflector", @@ -115,6 +115,50 @@ ], "time": "2017-03-29T16:04:15+00:00" }, + { + "name": "ezyang/htmlpurifier", + "version": "v4.8.0", + "source": { + "type": "git", + "url": "https://github.com/ezyang/htmlpurifier.git", + "reference": "d0c392f77d2f2a3dcf7fcb79e2a1e2b8804e75b2" + }, + "dist": { + "type": "zip", + "url": "https://api.github.com/repos/ezyang/htmlpurifier/zipball/d0c392f77d2f2a3dcf7fcb79e2a1e2b8804e75b2", + "reference": "d0c392f77d2f2a3dcf7fcb79e2a1e2b8804e75b2", + "shasum": "" + }, + "require": { + "php": ">=5.2" + }, + "type": "library", + "autoload": { + "psr-0": { + "HTMLPurifier": "library/" + }, + "files": [ + "library/HTMLPurifier.composer.php" + ] + }, + "notification-url": "https://packagist.org/downloads/", + "license": [ + "LGPL" + ], + "authors": [ + { + "name": "Edward Z. Yang", + "email": "admin@htmlpurifier.org", + "homepage": "http://ezyang.com" + } + ], + "description": "Standards compliant HTML filter written in PHP", + "homepage": "http://htmlpurifier.org/", + "keywords": [ + "html" + ], + "time": "2016-07-16T12:58:58+00:00" + }, { "name": "guzzle/guzzle", "version": "v3.9.3", @@ -649,6 +693,71 @@ ], "time": "2017-04-28T10:15:08+00:00" }, + { + "name": "mews/purifier", + "version": "v2.0.7", + "source": { + "type": "git", + "url": "https://github.com/mewebstudio/Purifier.git", + "reference": "e7cb532acbb9f5aaed4d62fe21fe387c8abf18db" + }, + "dist": { + "type": "zip", + "url": "https://api.github.com/repos/mewebstudio/Purifier/zipball/e7cb532acbb9f5aaed4d62fe21fe387c8abf18db", + "reference": "e7cb532acbb9f5aaed4d62fe21fe387c8abf18db", + "shasum": "" + }, + "require": { + "ezyang/htmlpurifier": "4.8.*", + "illuminate/config": "5.1.*|5.2.*|5.3.*|5.4.*", + "illuminate/filesystem": "5.1.*|5.2.*|5.3.*|5.4.*", + "illuminate/support": "5.1.*|5.2.*|5.3.*|5.4.*", + "php": ">=5.5.9" + }, + "require-dev": { + "graham-campbell/testbench": "^3.2", + "mockery/mockery": "0.9.*", + "phpunit/phpunit": "^4.8|^5.0", + "scrutinizer/ocular": "^1.3" + }, + "suggest": { + "laravel/framework": "To test the Laravel bindings", + "laravel/lumen-framework": "To test the Lumen bindings" + }, + "type": "package", + "autoload": { + "psr-4": { + "Mews\\Purifier\\": "src/" + }, + "files": [ + "src/helpers.php" + ] + }, + "notification-url": "https://packagist.org/downloads/", + "license": [ + "MIT" + ], + "authors": [ + { + "name": "Muharrem ERİN", + "email": "me@mewebstudio.com", + "homepage": "https://github.com/mewebstudio", + "role": "Developer" + } + ], + "description": "Laravel 5 HtmlPurifier Package", + "homepage": "https://github.com/mewebstudio/purifier", + "keywords": [ + "Purifier", + "htmlpurifier", + "laravel5 HtmlPurifier", + "laravel5 Purifier", + "laravel5 Security", + "security", + "xss" + ], + "time": "2017-04-16T12:23:45+00:00" + }, { "name": "monolog/monolog", "version": "1.22.1", @@ -2284,7 +2393,7 @@ }, "dist": { "type": "zip", - "url": "https://packagist.phpcomposer.com/files/fzaninotto/Faker/44f9a286a04b80c76a4e5fb7aad8bb539b920123.zip", + "url": "https://api.github.com/repos/fzaninotto/Faker/zipball/44f9a286a04b80c76a4e5fb7aad8bb539b920123", "reference": "44f9a286a04b80c76a4e5fb7aad8bb539b920123", "shasum": "" }, @@ -2377,7 +2486,7 @@ }, "dist": { "type": "zip", - "url": "https://files.phpcomposer.com/files/padraic/mockery/6fdb61243844dc924071d3404bb23994ea0b6856.zip", + "url": "https://api.github.com/repos/mockery/mockery/zipball/6fdb61243844dc924071d3404bb23994ea0b6856", "reference": "6fdb61243844dc924071d3404bb23994ea0b6856", "shasum": "" }, @@ -2442,7 +2551,7 @@ }, "dist": { "type": "zip", - "url": "https://files.phpcomposer.com/files/myclabs/DeepCopy/8e6e04167378abf1ddb4d3522d8755c5fd90d102.zip", + "url": "https://api.github.com/repos/myclabs/DeepCopy/zipball/8e6e04167378abf1ddb4d3522d8755c5fd90d102", "reference": "8e6e04167378abf1ddb4d3522d8755c5fd90d102", "shasum": "" }, @@ -2484,7 +2593,7 @@ }, "dist": { "type": "zip", - "url": "https://packagist.phpcomposer.com/files/phpDocumentor/ReflectionCommon/144c307535e82c8fdcaacbcfc1d6d8eeb896687c.zip", + "url": "https://api.github.com/repos/phpDocumentor/ReflectionCommon/zipball/144c307535e82c8fdcaacbcfc1d6d8eeb896687c", "reference": "144c307535e82c8fdcaacbcfc1d6d8eeb896687c", "shasum": "" }, @@ -2538,7 +2647,7 @@ }, "dist": { "type": "zip", - "url": "https://packagist.phpcomposer.com/files/phpDocumentor/ReflectionDocBlock/8331b5efe816ae05461b7ca1e721c01b46bafb3e.zip", + "url": "https://api.github.com/repos/phpDocumentor/ReflectionDocBlock/zipball/8331b5efe816ae05461b7ca1e721c01b46bafb3e", "reference": "8331b5efe816ae05461b7ca1e721c01b46bafb3e", "shasum": "" }, @@ -2583,7 +2692,7 @@ }, "dist": { "type": "zip", - "url": "https://packagist.phpcomposer.com/files/phpDocumentor/TypeResolver/e224fb2ea2fba6d3ad6fdaef91cd09a172155ccb.zip", + "url": "https://api.github.com/repos/phpDocumentor/TypeResolver/zipball/e224fb2ea2fba6d3ad6fdaef91cd09a172155ccb", "reference": "e224fb2ea2fba6d3ad6fdaef91cd09a172155ccb", "shasum": "" }, @@ -2630,7 +2739,7 @@ }, "dist": { "type": "zip", - "url": "https://files.phpcomposer.com/files/phpspec/prophecy/93d39f1f7f9326d746203c7c056f300f7f126073.zip", + "url": "https://api.github.com/repos/phpspec/prophecy/zipball/93d39f1f7f9326d746203c7c056f300f7f126073", "reference": "93d39f1f7f9326d746203c7c056f300f7f126073", "shasum": "" }, @@ -2693,7 +2802,7 @@ }, "dist": { "type": "zip", - "url": "https://files.phpcomposer.com/files/sebastianbergmann/php-code-coverage/ef7b2f56815df854e66ceaee8ebe9393ae36a40d.zip", + "url": "https://api.github.com/repos/sebastianbergmann/php-code-coverage/zipball/ef7b2f56815df854e66ceaee8ebe9393ae36a40d", "reference": "ef7b2f56815df854e66ceaee8ebe9393ae36a40d", "shasum": "" }, @@ -2756,7 +2865,7 @@ }, "dist": { "type": "zip", - "url": "https://packagist.phpcomposer.com/files/sebastianbergmann/php-file-iterator/3cc8f69b3028d0f96a9078e6295d86e9bf019be5.zip", + "url": "https://api.github.com/repos/sebastianbergmann/php-file-iterator/zipball/3cc8f69b3028d0f96a9078e6295d86e9bf019be5", "reference": "3cc8f69b3028d0f96a9078e6295d86e9bf019be5", "shasum": "" }, @@ -2844,7 +2953,7 @@ }, "dist": { "type": "zip", - "url": "https://files.phpcomposer.com/files/sebastianbergmann/php-timer/3dcf38ca72b158baf0bc245e9184d3fdffa9c46f.zip", + "url": "https://api.github.com/repos/sebastianbergmann/php-timer/zipball/3dcf38ca72b158baf0bc245e9184d3fdffa9c46f", "reference": "3dcf38ca72b158baf0bc245e9184d3fdffa9c46f", "shasum": "" }, @@ -2893,7 +3002,7 @@ }, "dist": { "type": "zip", - "url": "https://files.phpcomposer.com/files/sebastianbergmann/php-token-stream/e03f8f67534427a787e21a385a67ec3ca6978ea7.zip", + "url": "https://api.github.com/repos/sebastianbergmann/php-token-stream/zipball/e03f8f67534427a787e21a385a67ec3ca6978ea7", "reference": "e03f8f67534427a787e21a385a67ec3ca6978ea7", "shasum": "" }, @@ -2942,7 +3051,7 @@ }, "dist": { "type": "zip", - "url": "https://files.phpcomposer.com/files/sebastianbergmann/phpunit/3cb94a5f8c07a03c8b7527ed7468a2926203f58b.zip", + "url": "https://api.github.com/repos/sebastianbergmann/phpunit/zipball/3cb94a5f8c07a03c8b7527ed7468a2926203f58b", "reference": "3cb94a5f8c07a03c8b7527ed7468a2926203f58b", "shasum": "" }, @@ -3024,7 +3133,7 @@ }, "dist": { "type": "zip", - "url": "https://files.phpcomposer.com/files/sebastianbergmann/phpunit-mock-objects/3ab72b65b39b491e0c011e2e09bb2206c2aa8e24.zip", + "url": "https://api.github.com/repos/sebastianbergmann/phpunit-mock-objects/zipball/3ab72b65b39b491e0c011e2e09bb2206c2aa8e24", "reference": "3ab72b65b39b491e0c011e2e09bb2206c2aa8e24", "shasum": "" }, @@ -3083,7 +3192,7 @@ }, "dist": { "type": "zip", - "url": "https://files.phpcomposer.com/files/sebastianbergmann/code-unit-reverse-lookup/4419fcdb5eabb9caa61a27c7a1db532a6b55dd18.zip", + "url": "https://api.github.com/repos/sebastianbergmann/code-unit-reverse-lookup/zipball/4419fcdb5eabb9caa61a27c7a1db532a6b55dd18", "reference": "4419fcdb5eabb9caa61a27c7a1db532a6b55dd18", "shasum": "" }, @@ -3128,7 +3237,7 @@ }, "dist": { "type": "zip", - "url": "https://packagist.phpcomposer.com/files/sebastianbergmann/comparator/2b7424b55f5047b47ac6e5ccb20b2aea4011d9be.zip", + "url": "https://api.github.com/repos/sebastianbergmann/comparator/zipball/2b7424b55f5047b47ac6e5ccb20b2aea4011d9be", "reference": "2b7424b55f5047b47ac6e5ccb20b2aea4011d9be", "shasum": "" }, @@ -3192,7 +3301,7 @@ }, "dist": { "type": "zip", - "url": "https://files.phpcomposer.com/files/sebastianbergmann/diff/7f066a26a962dbe58ddea9f72a4e82874a3975a4.zip", + "url": "https://api.github.com/repos/sebastianbergmann/diff/zipball/7f066a26a962dbe58ddea9f72a4e82874a3975a4", "reference": "7f066a26a962dbe58ddea9f72a4e82874a3975a4", "shasum": "" }, @@ -3244,7 +3353,7 @@ }, "dist": { "type": "zip", - "url": "https://files.phpcomposer.com/files/sebastianbergmann/environment/5795ffe5dc5b02460c3e34222fee8cbe245d8fac.zip", + "url": "https://api.github.com/repos/sebastianbergmann/environment/zipball/5795ffe5dc5b02460c3e34222fee8cbe245d8fac", "reference": "5795ffe5dc5b02460c3e34222fee8cbe245d8fac", "shasum": "" }, @@ -3294,7 +3403,7 @@ }, "dist": { "type": "zip", - "url": "https://files.phpcomposer.com/files/sebastianbergmann/exporter/ce474bdd1a34744d7ac5d6aad3a46d48d9bac4c4.zip", + "url": "https://api.github.com/repos/sebastianbergmann/exporter/zipball/ce474bdd1a34744d7ac5d6aad3a46d48d9bac4c4", "reference": "ce474bdd1a34744d7ac5d6aad3a46d48d9bac4c4", "shasum": "" }, @@ -3412,7 +3521,7 @@ }, "dist": { "type": "zip", - "url": "https://files.phpcomposer.com/files/sebastianbergmann/object-enumerator/1311872ac850040a79c3c058bea3e22d0f09cbb7.zip", + "url": "https://api.github.com/repos/sebastianbergmann/object-enumerator/zipball/1311872ac850040a79c3c058bea3e22d0f09cbb7", "reference": "1311872ac850040a79c3c058bea3e22d0f09cbb7", "shasum": "" }, @@ -3458,7 +3567,7 @@ }, "dist": { "type": "zip", - "url": "https://files.phpcomposer.com/files/sebastianbergmann/recursion-context/2c3ba150cbec723aa057506e73a8d33bdb286c9a.zip", + "url": "https://api.github.com/repos/sebastianbergmann/recursion-context/zipball/2c3ba150cbec723aa057506e73a8d33bdb286c9a", "reference": "2c3ba150cbec723aa057506e73a8d33bdb286c9a", "shasum": "" }, @@ -3511,7 +3620,7 @@ }, "dist": { "type": "zip", - "url": "https://files.phpcomposer.com/files/sebastianbergmann/resource-operations/ce990bb21759f94aeafd30209e8cfcdfa8bc3f52.zip", + "url": "https://api.github.com/repos/sebastianbergmann/resource-operations/zipball/ce990bb21759f94aeafd30209e8cfcdfa8bc3f52", "reference": "ce990bb21759f94aeafd30209e8cfcdfa8bc3f52", "shasum": "" }, @@ -3553,7 +3662,7 @@ }, "dist": { "type": "zip", - "url": "https://files.phpcomposer.com/files/sebastianbergmann/version/99732be0ddb3361e16ad77b68ba41efc8e979019.zip", + "url": "https://api.github.com/repos/sebastianbergmann/version/zipball/99732be0ddb3361e16ad77b68ba41efc8e979019", "reference": "99732be0ddb3361e16ad77b68ba41efc8e979019", "shasum": "" }, @@ -3596,7 +3705,7 @@ }, "dist": { "type": "zip", - "url": "https://packagist.phpcomposer.com/files/symfony/dom-crawler/dff8fecf1f56990d88058e3a1885c2a5f1b8e970.zip", + "url": "https://api.github.com/repos/symfony/dom-crawler/zipball/dff8fecf1f56990d88058e3a1885c2a5f1b8e970", "reference": "dff8fecf1f56990d88058e3a1885c2a5f1b8e970", "shasum": "" }, @@ -3652,7 +3761,7 @@ }, "dist": { "type": "zip", - "url": "https://packagist.phpcomposer.com/files/webmozart/assert/2db61e59ff05fe5126d152bd0655c9ea113e550f.zip", + "url": "https://api.github.com/repos/webmozart/assert/zipball/2db61e59ff05fe5126d152bd0655c9ea113e550f", "reference": "2db61e59ff05fe5126d152bd0655c9ea113e550f", "shasum": "" }, diff --git a/config/app.php b/config/app.php index 99db242..d96951e 100644 --- a/config/app.php +++ b/config/app.php @@ -158,6 +158,7 @@ return [ App\Providers\RouteServiceProvider::class, Intervention\Image\ImageServiceProvider::class, + Mews\Purifier\PurifierServiceProvider::class, ], /* @@ -204,6 +205,7 @@ return [ 'Validator' => Illuminate\Support\Facades\Validator::class, 'View' => Illuminate\Support\Facades\View::class, 'Image' => Intervention\Image\Facades\Image::class, + 'Purifier' => Mews\Purifier\Facades\Purifier::class, ], diff --git a/config/purifier.php b/config/purifier.php new file mode 100644 index 0000000..7e2ba89 --- /dev/null +++ b/config/purifier.php @@ -0,0 +1,105 @@ +set('Core.Encoding', $this->config->get('purifier.encoding')); + * $config->set('Cache.SerializerPath', $this->config->get('purifier.cachePath')); + * if ( ! $this->config->get('purifier.finalize')) { + * $config->autoFinalize = false; + * } + * $config->loadArray($this->getConfig()); + * + * You must NOT delete the default settings + * anything in settings should be compacted with params that needed to instance HTMLPurifier_Config. + * + * @link http://htmlpurifier.org/live/configdoc/plain.html + */ + +return [ + 'encoding' => 'UTF-8', + 'finalize' => true, + 'cachePath' => storage_path('app/purifier'), + 'cacheFileMode' => 0755, + 'settings' => [ + 'default' => [ + 'HTML.Doctype' => 'HTML 4.01 Transitional', + 'HTML.Allowed' => 'div,b,strong,i,em,u,a[href|title],ul,ol,li,p[style],br,span[style],img[width|height|alt|src]', + 'CSS.AllowedProperties' => 'font,font-size,font-weight,font-style,font-family,text-decoration,padding-left,color,background-color,text-align', + 'AutoFormat.AutoParagraph' => true, + 'AutoFormat.RemoveEmpty' => true, + ], + 'test' => [ + 'Attr.EnableID' => 'true', + ], + "youtube" => [ + "HTML.SafeIframe" => 'true', + "URI.SafeIframeRegexp" => "%^(http://|https://|//)(www.youtube.com/embed/|player.vimeo.com/video/)%", + ], + 'custom_definition' => [ + 'id' => 'html5-definitions', + 'rev' => 1, + 'debug' => false, + 'elements' => [ + // http://developers.whatwg.org/sections.html + ['section', 'Block', 'Flow', 'Common'], + ['nav', 'Block', 'Flow', 'Common'], + ['article', 'Block', 'Flow', 'Common'], + ['aside', 'Block', 'Flow', 'Common'], + ['header', 'Block', 'Flow', 'Common'], + ['footer', 'Block', 'Flow', 'Common'], + + // Content model actually excludes several tags, not modelled here + ['address', 'Block', 'Flow', 'Common'], + ['hgroup', 'Block', 'Required: h1 | h2 | h3 | h4 | h5 | h6', 'Common'], + + // http://developers.whatwg.org/grouping-content.html + ['figure', 'Block', 'Optional: (figcaption, Flow) | (Flow, figcaption) | Flow', 'Common'], + ['figcaption', 'Inline', 'Flow', 'Common'], + + // http://developers.whatwg.org/the-video-element.html#the-video-element + ['video', 'Block', 'Optional: (source, Flow) | (Flow, source) | Flow', 'Common', [ + 'src' => 'URI', + 'type' => 'Text', + 'width' => 'Length', + 'height' => 'Length', + 'poster' => 'URI', + 'preload' => 'Enum#auto,metadata,none', + 'controls' => 'Bool', + ]], + ['source', 'Block', 'Flow', 'Common', [ + 'src' => 'URI', + 'type' => 'Text', + ]], + + // http://developers.whatwg.org/text-level-semantics.html + ['s', 'Inline', 'Inline', 'Common'], + ['var', 'Inline', 'Inline', 'Common'], + ['sub', 'Inline', 'Inline', 'Common'], + ['sup', 'Inline', 'Inline', 'Common'], + ['mark', 'Inline', 'Inline', 'Common'], + ['wbr', 'Inline', 'Empty', 'Core'], + + // http://developers.whatwg.org/edits.html + ['ins', 'Block', 'Flow', 'Common', ['cite' => 'URI', 'datetime' => 'CDATA']], + ['del', 'Block', 'Flow', 'Common', ['cite' => 'URI', 'datetime' => 'CDATA']], + ], + 'attributes' => [ + ['iframe', 'allowfullscreen', 'Bool'], + ['table', 'height', 'Text'], + ['td', 'border', 'Text'], + ['th', 'border', 'Text'], + ['tr', 'width', 'Text'], + ['tr', 'height', 'Text'], + ['tr', 'border', 'Text'], + ], + ], + 'custom_attributes' => [ + ['a', 'target', 'Enum#_blank,_self,_target,_top'], + ], + 'custom_elements' => [ + ['u', 'Inline', 'Inline', 'Common'], + ], + ], + +];