- ' . $s_file . '
Sorry, page \'' . htmlspecialchars($rule_page) . + return '
Sorry, page \'' . htmlsc($rule_page) . '\' unavailable.
'; } else { return convert_html(get_source($rule_page)); @@ -631,7 +631,7 @@ if (isset($script_directory_index)) { if (! file_exists($script_directory_index)) die_message('Directory index file not found: ' . - htmlspecialchars($script_directory_index)); + htmlsc($script_directory_index)); $matches = array(); if (preg_match('#^(.+/)' . preg_quote($script_directory_index, '#') . '$#', $script, $matches)) $script = $matches[1]; @@ -700,6 +700,13 @@ } return join($glue, $arr); } + +// Sugar with default settings +function htmlsc($string = '', $flags = ENT_COMPAT, $charset = CONTENT_CHARSET) +{ + return htmlspecialchars($string, $flags, $charset); // htmlsc() +} + //// Compat //// diff -ur pukiwiki-1.4.7_notb_utf8/lib/html.php pukiwiki-1_5_0_utf8/lib/html.php --- pukiwiki-1.4.7_notb_utf8/lib/html.php Sun Oct 22 05:41:10 2006 +++ pukiwiki-1_5_0_utf8/lib/html.php Sun Jul 13 13:03:57 2014 @@ -1,6 +1,6 @@ ' . $_msg_word . htmlspecialchars($vars['word']) . + $body = '' . $_msg_word . htmlsc($vars['word']) .
'
' . $hr . "\n" . $body;
// BugTrack2/106: Only variables can be passed by reference from PHP 5.0.5
@@ -132,7 +132,7 @@
$keys = get_search_words(array_keys($keys), TRUE);
$id = 0;
foreach ($keys as $key=>$pattern) {
- $s_key = htmlspecialchars($key);
+ $s_key = htmlsc($key);
$pattern = '/' .
'' . "\n" . ' @@ -147,12 +147,12 @@ if ($align == 'clear') return ''; // 改行挿入 if ($align != 'left') $align = 'right'; // 配置決定 - $asin_all = htmlspecialchars($aryargs[0]); // for XSS + $asin_all = htmlsc($aryargs[0]); // for XSS if (is_asin() == FALSE && $align != 'clear') return FALSE; if ($aryargs[2] != '') { // タイトル指定 - $title = $alt = htmlspecialchars($aryargs[2]); // for XSS + $title = $alt = htmlsc($aryargs[2]); // for XSS if ($alt == 'image') { $alt = plugin_amazon_get_asin_title(); if ($alt == '') return FALSE; @@ -195,7 +195,7 @@ $s_page = isset($vars['refer']) ? $vars['refer'] : ''; $asin_all = isset($vars['asin']) ? - htmlspecialchars(rawurlencode(strip_bracket($vars['asin']))) : ''; + htmlsc(rawurlencode(strip_bracket($vars['asin']))) : ''; if (! is_asin()) { $retvars['msg'] = 'ブックレビュー編集'; @@ -236,7 +236,7 @@ list($asin_all) = func_get_args(); - $asin_all = htmlspecialchars($asin_all); // for XSS + $asin_all = htmlsc($asin_all); // for XSS if (! is_asin()) return FALSE; $title = plugin_amazon_get_asin_title(); diff -ur pukiwiki-1.4.7_notb_utf8/plugin/aname.inc.php pukiwiki-1_5_0_utf8/plugin/aname.inc.php --- pukiwiki-1.4.7_notb_utf8/plugin/aname.inc.php Sun Oct 22 05:41:10 2006 +++ pukiwiki-1_5_0_utf8/plugin/aname.inc.php Sun Jul 13 13:03:57 2014 @@ -1,6 +1,6 @@ @@ -93,9 +93,9 @@ $body = $_msg_collided . "\n"; - $s_refer = htmlspecialchars($post['refer']); - $s_digest = htmlspecialchars($post['digest']); - $s_postdata = htmlspecialchars($postdata_input); + $s_refer = htmlsc($post['refer']); + $s_digest = htmlsc($post['digest']); + $s_postdata = htmlsc($postdata_input); $body .= <<
@@ -152,9 +152,9 @@
$article_no = $numbers[$vars['page']]++;
- $s_page = htmlspecialchars($vars['page']);
- $s_digest = htmlspecialchars($digest);
- $name_cols = PLUGIN_ARTICLE_NAME_COLS;
+ $s_page = htmlsc($vars['page']);
+ $s_digest = htmlsc($digest);
+ $name_cols = PLUGIN_ARTICLE_NAME_COLS;
$subject_cols = PLUGIN_ARTICLE_SUBJECT_COLS;
$article_rows = PLUGIN_ARTICLE_ROWS;
$article_cols = PLUGIN_ARTICLE_COLS;
diff -ur pukiwiki-1.4.7_notb_utf8/plugin/attach.inc.php pukiwiki-1_5_0_utf8/plugin/attach.inc.php
--- pukiwiki-1.4.7_notb_utf8/plugin/attach.inc.php Sun Oct 22 05:41:10 2006
+++ pukiwiki-1_5_0_utf8/plugin/attach.inc.php Sun Jul 13 13:03:57 2014
@@ -1,6 +1,6 @@
http://home.arino.jp/
@@ -389,7 +389,7 @@
global $script, $vars, $_attach_messages;
$r_page = rawurlencode($page);
- $s_page = htmlspecialchars($page);
+ $s_page = htmlsc($page);
$navi = <<
[{$_attach_messages['msg_list']}]
@@ -502,7 +502,7 @@
$param = '&file=' . rawurlencode($this->file) . '&refer=' . rawurlencode($this->page) .
($this->age ? '&age=' . $this->age : '');
$title = $this->time_str . ' ' . $this->size_str;
- $label = ($showicon ? PLUGIN_ATTACH_FILE_ICON : '') . htmlspecialchars($this->file);
+ $label = ($showicon ? PLUGIN_ATTACH_FILE_ICON : '') . htmlsc($this->file);
if ($this->age) {
$label .= ' (backup No.' . $this->age . ')';
}
@@ -522,8 +522,8 @@
global $script, $_attach_messages;
$r_page = rawurlencode($this->page);
- $s_page = htmlspecialchars($this->page);
- $s_file = htmlspecialchars($this->file);
+ $s_page = htmlsc($this->page);
+ $s_file = htmlsc($this->file);
$s_err = ($err == '') ? '' : '
' . $_attach_messages[$err] . '
'; $msg_rename = ''; @@ -564,7 +564,7 @@ } $info = $this->toString(TRUE, FALSE); - $retval = array('msg'=>sprintf($_attach_messages['msg_info'], htmlspecialchars($this->file))); + $retval = array('msg'=>sprintf($_attach_messages['msg_info'], htmlsc($this->file))); $retval['body'] = <<< EOD[{$_attach_messages['msg_list']}] @@ -711,13 +711,13 @@ break; } } - $filename = htmlspecialchars($filename); + $utf8filename = mb_convert_encoding($filename, 'UTF-8', 'auto'); ini_set('default_charset', ''); mb_http_output('pass'); pkwk_common_headers(); - header('Content-Disposition: inline; filename="' . $filename . '"'); + header('Content-Disposition: inline; filename="' . $filename . '"; filename*=utf-8\'\'' . rawurlencode($utf8filename)); header('Content-Length: ' . $this->size); header('Content-Type: ' . $this->type); @@ -763,7 +763,7 @@ $_files[$age] = $this->files[$file][$age]->toString(FALSE, TRUE); } if (! isset($_files[0])) { - $_files[0] = htmlspecialchars($file); + $_files[0] = htmlsc($file); } ksort($_files); $_file = $_files[0]; diff -ur pukiwiki-1.4.7_notb_utf8/plugin/back.inc.php pukiwiki-1_5_0_utf8/plugin/back.inc.php --- pukiwiki-1.4.7_notb_utf8/plugin/back.inc.php Sun Oct 22 05:41:10 2006 +++ pukiwiki-1_5_0_utf8/plugin/back.inc.php Sun Jul 13 13:03:57 2014 @@ -1,5 +1,5 @@ @@ -23,7 +23,7 @@ list($word, $align, $hr, $href) = array_pad(func_get_args(), 4, ''); $word = trim($word); - $word = ($word == '') ? $_msg_back_word : htmlspecialchars($word); + $word = ($word == '') ? $_msg_back_word : htmlsc($word); $align = strtolower(trim($align)); switch($align){ diff -ur pukiwiki-1.4.7_notb_utf8/plugin/backup.inc.php pukiwiki-1_5_0_utf8/plugin/backup.inc.php --- pukiwiki-1.4.7_notb_utf8/plugin/backup.inc.php Sun Oct 22 05:41:11 2006 +++ pukiwiki-1_5_0_utf8/plugin/backup.inc.php Sun Jul 13 13:03:57 2014 @@ -1,6 +1,6 @@ $_title_backuplist, 'body'=>plugin_backup_get_list_all()); check_readable($page, true, true); - $s_page = htmlspecialchars($page); + $s_page = htmlsc($page); $r_page = rawurlencode($page); $action = isset($vars['action']) ? $vars['action'] : ''; @@ -33,7 +33,7 @@ $s_action = $r_action = ''; if ($action != '') { - $s_action = htmlspecialchars($action); + $s_action = htmlsc($action); $r_action = rawurlencode($action); } @@ -107,7 +107,7 @@ $body .= plugin_backup_diff(do_diff($old, $cur)); } else if ($s_action == 'source') { $title = & $_title_backupsource; - $body .= '
' . htmlspecialchars(join('', $backups[$s_age]['data'])) .
+ $body .= '' . htmlsc(join('', $backups[$s_age]['data'])) .
'' . "\n";
} else {
if (PLUGIN_BACKUP_DISABLE_BACKUP_RENDERING) {
@@ -145,7 +145,7 @@
}
$script = get_script_uri();
- $s_page = htmlspecialchars($page);
+ $s_page = htmlsc($page);
$body .= <<$_msg_backup_adminpass