mirrors/htmlpurifier
0
0
Fork 0
mirror of https://github.com/ezyang/htmlpurifier.git synced 2024-12-22 16:31:53 +00:00
Code Releases Activity

[3.1.1] Update Munge docs.

Browse Source 
git-svn-id: http://htmlpurifier.org/svnroot/htmlpurifier/trunk@1804 48356398-32a2-884e-a903-53898d9a118a
This commit is contained in:
Edward Z. Yang 2008-06-19 19:06:55 +00:00
parent 463aa3a0fa
commit 511dfe2d4a
5 changed files with 16 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
NEWS
View File

@ -10,6 +10,8 @@ NEWS ( CHANGELOG and HISTORY ) HTMLPurifier
========================== ==========================
3.1.1, unknown release date 3.1.1, unknown release date
# %URI.Munge now, by default, does not munge resources (for example, <img src="">)
In order to enable this again, please set %URI.MungeResources to true.
! More robust imagecrash protection with height/width CSS with %CSS.MaxImgLength, ! More robust imagecrash protection with height/width CSS with %CSS.MaxImgLength,
and height/width HTML with %HTML.MaxImgLength. and height/width HTML with %HTML.MaxImgLength.
! %URI.SecureMunge for secure URI munging (as opposed to %URI.Munge). Thanks Chris ! %URI.SecureMunge for secure URI munging (as opposed to %URI.Munge). Thanks Chris

3
TODO
View File

@ -13,9 +13,7 @@ afraid to cast your vote for the next feature to be implemented!
- Investigate how early internal structures can be accessed; this would - Investigate how early internal structures can be accessed; this would
prevent structures from being parsed and serialized multiple times. prevent structures from being parsed and serialized multiple times.
- Figure out how to simultaneously set %CSS.Trusted and %HTML.Trusted (?)
- Built-in support for target="_blank" on all external links - Built-in support for target="_blank" on all external links
- Implement SecureMunge for resources too
- Gitify the repository - Gitify the repository
FUTURE VERSIONS FUTURE VERSIONS
@ -28,6 +26,7 @@ FUTURE VERSIONS
IDREFs to non-existent IDs) IDREFs to non-existent IDs)
# Frameset XHTML 1.0 and HTML 4.01 doctypes # Frameset XHTML 1.0 and HTML 4.01 doctypes
- Implement <area> - Implement <area>
- Figure out how to simultaneously set %CSS.Trusted and %HTML.Trusted (?)
3.3 release [Error'ed] 3.3 release [Error'ed]
# Error logging for filtering/cleanup procedures # Error logging for filtering/cleanup procedures

2
configdoc/styles/plain.xsl
View File

@ -19,7 +19,7 @@
<xsl:variable name="usageLookup" select="document('../usage.xml')/usage" /> <xsl:variable name="usageLookup" select="document('../usage.xml')/usage" />
<!-- Twiddle this variable to get the columns as even as possible --> <!-- Twiddle this variable to get the columns as even as possible -->
<xsl:variable name="maxNumberAdjust" select="1" /> <xsl:variable name="maxNumberAdjust" select="2" />
<xsl:template match="/"> <xsl:template match="/">
<html lang="en" xml:lang="en"> <html lang="en" xml:lang="en">

6
library/HTMLPurifier/ConfigSchema/schema/URI.Munge.txt
View File

@ -27,6 +27,12 @@ DEFAULT: NULL
in corporate environments. in corporate environments.
</li> </li>
</ul> </ul>
<p>
Prior to HTML Purifier 3.1.1, this directive also enabled the munging
of browsable external resources, which could break things if your redirection
script was a splash page or used <code>meta</code> tags. To revert to
previous behavior, please use %URI.MungeResources.
</p>
<p> <p>
You may want to also use %URI.MungeSecretKey along with this directive You may want to also use %URI.MungeSecretKey along with this directive
in order to enforce what URIs your redirector script allows. Open in order to enforce what URIs your redirector script allows. Open

8
library/HTMLPurifier/ConfigSchema/schema/URI.MungeResources.txt
View File

@ -4,9 +4,13 @@ VERSION: 3.1.1
DEFAULT: false DEFAULT: false
--DESCRIPTION-- --DESCRIPTION--
<p> <p>
If true, any URI munging directives like %URI.Munge or %URI.SecureMunge If true, any URI munging directives like %URI.Munge
will also apply to embedded resources, such as <code>&lt;img src=""&gt;</code>. will also apply to embedded resources, such as <code>&lt;img src=""&gt;</code>.
Be careful enabling this directive if you have a redirector script Be careful enabling this directive if you have a redirector script
that does not use the <code>Location</code> HTTP header; all of your images that does not use the <code>Location</code> HTTP header; all of your images
and other embedded resources will break. and other embedded resources will break.
</ul> </p>
<p>
<strong>Warning:</strong> It is strongly advised you use this in conjunction
%URI.MungeSecretKey to mitigate the security risk of an open redirector.
</p>