mirror of
https://github.com/ezyang/htmlpurifier.git
synced 2025-01-03 05:11:52 +00:00
Officially transition from 1.7 -> 2.0, mass substitution. Also, wrote WHATSNEW. We are in feature-freeze!
git-svn-id: http://htmlpurifier.org/svnroot/htmlpurifier/trunk@1172 48356398-32a2-884e-a903-53898d9a118a
This commit is contained in:
parent
da2ea348fd
commit
cf7a50163c
12
TODO
12
TODO
@ -7,7 +7,7 @@ TODO List
|
|||||||
? Maybe I'll Do It
|
? Maybe I'll Do It
|
||||||
==========================
|
==========================
|
||||||
|
|
||||||
1.8 release [Refactor, refactor!]
|
2.1 release [Refactor, refactor!]
|
||||||
# URI validation routines tighter (see docs/dev-code-quality.html) (COMPLEX)
|
# URI validation routines tighter (see docs/dev-code-quality.html) (COMPLEX)
|
||||||
# Advanced URI filtering schemes (see docs/proposal-new-directives.txt)
|
# Advanced URI filtering schemes (see docs/proposal-new-directives.txt)
|
||||||
- Configuration profiles: predefined directives set with one func call
|
- Configuration profiles: predefined directives set with one func call
|
||||||
@ -16,13 +16,13 @@ TODO List
|
|||||||
- Allow non-ASCII characters in font names
|
- Allow non-ASCII characters in font names
|
||||||
- Genericize special cases in RemoveForeignElements
|
- Genericize special cases in RemoveForeignElements
|
||||||
|
|
||||||
1.9 release [Error'ed]
|
2.2 release [Error'ed]
|
||||||
# Error logging for filtering/cleanup procedures
|
# Error logging for filtering/cleanup procedures
|
||||||
- Requires I18N facilities to be created first (COMPLEX)
|
- Requires I18N facilities to be created first (COMPLEX)
|
||||||
- XSS-attempt detection
|
- XSS-attempt detection
|
||||||
- More fine-grained control over escaping behavior
|
- More fine-grained control over escaping behavior
|
||||||
|
|
||||||
1.10 release [Do What I Mean, Not What I Say]
|
2.3 release [Do What I Mean, Not What I Say]
|
||||||
# Additional support for poorly written HTML
|
# Additional support for poorly written HTML
|
||||||
- Microsoft Word HTML cleaning (i.e. MsoNormal, but research essential!)
|
- Microsoft Word HTML cleaning (i.e. MsoNormal, but research essential!)
|
||||||
- Friendly strict handling of <address> (block -> <br>)
|
- Friendly strict handling of <address> (block -> <br>)
|
||||||
@ -37,10 +37,10 @@ TODO List
|
|||||||
- Append something to duplicate IDs so they're still usable (impl. note: the
|
- Append something to duplicate IDs so they're still usable (impl. note: the
|
||||||
dupe detector would also need to detect the suffix as well)
|
dupe detector would also need to detect the suffix as well)
|
||||||
|
|
||||||
1.11 release [It's All About Trust] (floating)
|
2.4 release [It's All About Trust] (floating)
|
||||||
# Implement untrusted, dangerous elements/attributes
|
# Implement untrusted, dangerous elements/attributes
|
||||||
|
|
||||||
2.0 release [Beyond HTML]
|
3.0 release [Beyond HTML]
|
||||||
# Legit token based CSS parsing (will require revamping almost every
|
# Legit token based CSS parsing (will require revamping almost every
|
||||||
AttrDef class)
|
AttrDef class)
|
||||||
# More control over allowed CSS properties (maybe modularize it in the
|
# More control over allowed CSS properties (maybe modularize it in the
|
||||||
@ -59,7 +59,7 @@ TODO List
|
|||||||
- Convert RTL/LTR override characters to <bdo> tags, or vice versa on demand.
|
- Convert RTL/LTR override characters to <bdo> tags, or vice versa on demand.
|
||||||
Also, enable disabling of directionality
|
Also, enable disabling of directionality
|
||||||
|
|
||||||
3.0 release [To XML and Beyond]
|
4.0 release [To XML and Beyond]
|
||||||
- Extended HTML capabilities based on namespacing and tag transforms (COMPLEX)
|
- Extended HTML capabilities based on namespacing and tag transforms (COMPLEX)
|
||||||
- Hooks for adding custom processors to custom namespaced tags and
|
- Hooks for adding custom processors to custom namespaced tags and
|
||||||
attributes, offer default implementation
|
attributes, offer default implementation
|
||||||
|
14
WHATSNEW
14
WHATSNEW
@ -1,7 +1,7 @@
|
|||||||
The 1.6.1 release, code-named 'Ach! We missed something! Run!', completes
|
HTML Purifier 2.0 is the culmination of two major architectural changes.
|
||||||
HTML Purifier's roster of attribute transformations. It also implements
|
The first is Tidy, which enables HTML Purifier to both natively support
|
||||||
a number of minor features (such as better font transformations, smarter
|
deprecated elements and also convert them to standards-compliant
|
||||||
HTML parsing, the CSS property 'white-space' and XHTML 1.1), a few bug
|
alternatives. The second is the Advanced API, which enables users to
|
||||||
fixes (most notably fixed __autoload compatibility issues) and a ton
|
create new elements and attributes with ease. Keeping in line with a
|
||||||
of refactoring. 1.6 was for things that absolutely could not wait: this
|
commitment to high quality, there are also four esoteric bug-fixes and a
|
||||||
release, developed in a more leisurely pace, fills in the gaps.
|
plethora of subtle improvements that enhance the library.
|
||||||
|
@ -58,14 +58,14 @@ HTMLPurifier_ConfigSchema::define(
|
|||||||
ISO 639 language code for localizable things in HTML Purifier to use,
|
ISO 639 language code for localizable things in HTML Purifier to use,
|
||||||
which is mainly error reporting. There is currently only an English (en)
|
which is mainly error reporting. There is currently only an English (en)
|
||||||
translation, so this directive is currently useless.
|
translation, so this directive is currently useless.
|
||||||
This directive has been available since 1.7.0.
|
This directive has been available since 2.0.0.
|
||||||
');
|
');
|
||||||
|
|
||||||
HTMLPurifier_ConfigSchema::define(
|
HTMLPurifier_ConfigSchema::define(
|
||||||
'Core', 'CollectErrors', false, 'bool', '
|
'Core', 'CollectErrors', false, 'bool', '
|
||||||
Whether or not to collect errors found while filtering the document. This
|
Whether or not to collect errors found while filtering the document. This
|
||||||
is a useful way to give feedback to your users. CURRENTLY NOT IMPLEMENTED.
|
is a useful way to give feedback to your users. CURRENTLY NOT IMPLEMENTED.
|
||||||
This directive has been available since 1.7.0.
|
This directive has been available since 2.0.0.
|
||||||
');
|
');
|
||||||
|
|
||||||
/**
|
/**
|
||||||
|
@ -24,7 +24,7 @@ HTMLPurifier_ConfigSchema::define(
|
|||||||
), 'hash', '
|
), 'hash', '
|
||||||
Lookup array of color names to six digit hexadecimal number corresponding
|
Lookup array of color names to six digit hexadecimal number corresponding
|
||||||
to color, with preceding hash mark. Used when parsing colors.
|
to color, with preceding hash mark. Used when parsing colors.
|
||||||
This directive has been available since 1.7.0.
|
This directive has been available since 2.0.0.
|
||||||
');
|
');
|
||||||
|
|
||||||
/**
|
/**
|
||||||
|
@ -22,7 +22,7 @@ HTMLPurifier_ConfigSchema::define(
|
|||||||
<p>
|
<p>
|
||||||
Revision identifier for your custom definition. See
|
Revision identifier for your custom definition. See
|
||||||
%HTML.DefinitionRev for details. This directive has been available
|
%HTML.DefinitionRev for details. This directive has been available
|
||||||
since 1.7.0.
|
since 2.0.0.
|
||||||
</p>
|
</p>
|
||||||
');
|
');
|
||||||
|
|
||||||
|
@ -9,7 +9,7 @@ HTMLPurifier_ConfigSchema::define(
|
|||||||
Default is within the
|
Default is within the
|
||||||
HTML Purifier library inside DefinitionCache/Serializer. This
|
HTML Purifier library inside DefinitionCache/Serializer. This
|
||||||
path must be writable by the webserver. This directive has been
|
path must be writable by the webserver. This directive has been
|
||||||
available since 1.7.0.
|
available since 2.0.0.
|
||||||
</p>
|
</p>
|
||||||
');
|
');
|
||||||
|
|
||||||
|
@ -7,7 +7,7 @@ HTMLPurifier_ConfigSchema::define(
|
|||||||
This directive defines which method to use when caching definitions,
|
This directive defines which method to use when caching definitions,
|
||||||
the complex data-type that makes HTML Purifier tick. Set to null
|
the complex data-type that makes HTML Purifier tick. Set to null
|
||||||
to disable caching (not recommended, as you will see a definite
|
to disable caching (not recommended, as you will see a definite
|
||||||
performance degradation). This directive has been available since 1.7.0.
|
performance degradation). This directive has been available since 2.0.0.
|
||||||
');
|
');
|
||||||
|
|
||||||
HTMLPurifier_ConfigSchema::defineAllowedValues(
|
HTMLPurifier_ConfigSchema::defineAllowedValues(
|
||||||
|
@ -31,7 +31,7 @@ $def->addAttribute(\'a\', \'tabindex\', \'Number\');
|
|||||||
an extra directive attached to it.
|
an extra directive attached to it.
|
||||||
</p>
|
</p>
|
||||||
<p>
|
<p>
|
||||||
This directive has been available since 1.7.0, and in that version or
|
This directive has been available since 2.0.0, and in that version or
|
||||||
later you <em>must</em> specify a value to this directive to use the
|
later you <em>must</em> specify a value to this directive to use the
|
||||||
advanced API features.
|
advanced API features.
|
||||||
</p>
|
</p>
|
||||||
@ -46,7 +46,7 @@ HTMLPurifier_ConfigSchema::define(
|
|||||||
context: revision 3 is more up-to-date then revision 2. Thus, when
|
context: revision 3 is more up-to-date then revision 2. Thus, when
|
||||||
this gets incremented, the cache handling is smart enough to clean
|
this gets incremented, the cache handling is smart enough to clean
|
||||||
up any older revisions of your definition as well as flush the
|
up any older revisions of your definition as well as flush the
|
||||||
cache. This directive has been available since 1.7.0.
|
cache. This directive has been available since 2.0.0.
|
||||||
</p>
|
</p>
|
||||||
');
|
');
|
||||||
|
|
||||||
@ -124,7 +124,7 @@ HTMLPurifier_ConfigSchema::define(
|
|||||||
whitelist: directly copy-pasting it here will probably result in
|
whitelist: directly copy-pasting it here will probably result in
|
||||||
broken whitelists. If %HTML.AllowedElements or %HTML.AllowedAttributes
|
broken whitelists. If %HTML.AllowedElements or %HTML.AllowedAttributes
|
||||||
are set, this directive has no effect.
|
are set, this directive has no effect.
|
||||||
This directive has been available since 1.7.0.
|
This directive has been available since 2.0.0.
|
||||||
</p>
|
</p>
|
||||||
');
|
');
|
||||||
|
|
||||||
|
@ -18,7 +18,7 @@ There are four allowed values:</p>
|
|||||||
<dd>Transform all deprecated elements and attributes to standards
|
<dd>Transform all deprecated elements and attributes to standards
|
||||||
compliant equivalents</dd>
|
compliant equivalents</dd>
|
||||||
</dl>
|
</dl>
|
||||||
<p>This directive has been available since 1.7.0</p>
|
<p>This directive has been available since 2.0.0</p>
|
||||||
' );
|
' );
|
||||||
HTMLPurifier_ConfigSchema::defineAllowedValues(
|
HTMLPurifier_ConfigSchema::defineAllowedValues(
|
||||||
'HTML', 'TidyLevel', array('none', 'light', 'medium', 'heavy')
|
'HTML', 'TidyLevel', array('none', 'light', 'medium', 'heavy')
|
||||||
@ -27,13 +27,13 @@ HTMLPurifier_ConfigSchema::defineAllowedValues(
|
|||||||
HTMLPurifier_ConfigSchema::define(
|
HTMLPurifier_ConfigSchema::define(
|
||||||
'HTML', 'TidyAdd', array(), 'lookup', '
|
'HTML', 'TidyAdd', array(), 'lookup', '
|
||||||
Fixes to add to the default set of Tidy fixes as per your level. This
|
Fixes to add to the default set of Tidy fixes as per your level. This
|
||||||
directive has been available since 1.7.0.
|
directive has been available since 2.0.0.
|
||||||
' );
|
' );
|
||||||
|
|
||||||
HTMLPurifier_ConfigSchema::define(
|
HTMLPurifier_ConfigSchema::define(
|
||||||
'HTML', 'TidyRemove', array(), 'lookup', '
|
'HTML', 'TidyRemove', array(), 'lookup', '
|
||||||
Fixes to remove from the default set of Tidy fixes as per your level. This
|
Fixes to remove from the default set of Tidy fixes as per your level. This
|
||||||
directive has been available since 1.7.0.
|
directive has been available since 2.0.0.
|
||||||
' );
|
' );
|
||||||
|
|
||||||
/**
|
/**
|
||||||
|
@ -50,7 +50,7 @@ HTMLPurifier_ConfigSchema::define(
|
|||||||
'HTML', 'Trusted', false, 'bool',
|
'HTML', 'Trusted', false, 'bool',
|
||||||
'Indicates whether or not the user input is trusted or not. If the '.
|
'Indicates whether or not the user input is trusted or not. If the '.
|
||||||
'input is trusted, a more expansive set of allowed tags and attributes '.
|
'input is trusted, a more expansive set of allowed tags and attributes '.
|
||||||
'will be used. This directive has been available since 1.7.0.'
|
'will be used. This directive has been available since 2.0.0.'
|
||||||
);
|
);
|
||||||
|
|
||||||
HTMLPurifier_ConfigSchema::define(
|
HTMLPurifier_ConfigSchema::define(
|
||||||
@ -66,7 +66,7 @@ HTMLPurifier_ConfigSchema::define(
|
|||||||
If you specify a module that does not exist, the manager will silently
|
If you specify a module that does not exist, the manager will silently
|
||||||
fail to use it, so be careful! User-defined modules are not affected
|
fail to use it, so be careful! User-defined modules are not affected
|
||||||
by this directive. Modules defined in %HTML.CoreModules are not
|
by this directive. Modules defined in %HTML.CoreModules are not
|
||||||
affected by this directive. This directive has been available since 1.7.0.
|
affected by this directive. This directive has been available since 2.0.0.
|
||||||
</p>
|
</p>
|
||||||
');
|
');
|
||||||
|
|
||||||
@ -86,7 +86,7 @@ HTMLPurifier_ConfigSchema::define(
|
|||||||
type: put those modules here. By default, XHTML\'s core modules
|
type: put those modules here. By default, XHTML\'s core modules
|
||||||
are used. You can set this to a blank array to disable core module
|
are used. You can set this to a blank array to disable core module
|
||||||
protection, but this is not recommended. This directive has been
|
protection, but this is not recommended. This directive has been
|
||||||
available since 1.7.0.
|
available since 2.0.0.
|
||||||
</p>
|
</p>
|
||||||
');
|
');
|
||||||
|
|
||||||
|
@ -48,7 +48,7 @@ HTMLPurifier_ConfigSchema::define(
|
|||||||
</dd>
|
</dd>
|
||||||
</dl>
|
</dl>
|
||||||
<p>
|
<p>
|
||||||
This directive has been available since 1.7.0.
|
This directive has been available since 2.0.0.
|
||||||
</p>
|
</p>
|
||||||
'
|
'
|
||||||
);
|
);
|
||||||
@ -61,7 +61,7 @@ HTMLPurifier_ConfigSchema::define(
|
|||||||
significant performance degradation and should not be used when
|
significant performance degradation and should not be used when
|
||||||
unnecessary. This directive must be used with the DirectLex lexer,
|
unnecessary. This directive must be used with the DirectLex lexer,
|
||||||
as the DOMLex lexer does not (yet) support this functionality. This directive
|
as the DOMLex lexer does not (yet) support this functionality. This directive
|
||||||
has been available since 1.7.0.
|
has been available since 2.0.0.
|
||||||
</p>
|
</p>
|
||||||
');
|
');
|
||||||
|
|
||||||
|
@ -12,7 +12,7 @@ HTMLPurifier_ConfigSchema::define(
|
|||||||
performance, and this is only strictly necessary if the counting
|
performance, and this is only strictly necessary if the counting
|
||||||
algorithm is buggy (in which case you should report it as a bug).
|
algorithm is buggy (in which case you should report it as a bug).
|
||||||
This has no effect when %Core.MaintainLineNumbers is disabled or DirectLex is
|
This has no effect when %Core.MaintainLineNumbers is disabled or DirectLex is
|
||||||
not being used. This directive has been available since 1.7.0.
|
not being used. This directive has been available since 2.0.0.
|
||||||
</p>
|
</p>
|
||||||
');
|
');
|
||||||
|
|
||||||
|
@ -16,8 +16,8 @@ HTMLPurifier_ConfigSchema::define(
|
|||||||
HTMLPurifier_ConfigSchema::define(
|
HTMLPurifier_ConfigSchema::define(
|
||||||
'Core', 'RemoveScriptContents', true, 'bool', '
|
'Core', 'RemoveScriptContents', true, 'bool', '
|
||||||
This directive enables HTML Purifier to remove not only script tags
|
This directive enables HTML Purifier to remove not only script tags
|
||||||
but all of their contents. This directive has been available since 1.7.0,
|
but all of their contents. This directive has been available since 2.0.0,
|
||||||
revert to pre-1.7.0 behavior by setting to false.
|
revert to pre-2.0.0 behavior by setting to false.
|
||||||
'
|
'
|
||||||
);
|
);
|
||||||
|
|
||||||
|
Loading…
Reference in New Issue
Block a user