jro_apps/redmine Commit - r8740:0ede069d2c79

Allows custom styles in textile formatting using a white list of styles (#2416)....

Jean-Philippe Lang -

r8740:0ede069d2c79

parent child

Context file:

r8740:0ede069d2c79

Collapse all files

lib/redcloth3.rb +14 -1

             #                                vim:ts=4:sw=4:
             # = RedCloth - Textile and Markdown Hybrid for Ruby
             #
             # Homepage::  http://whytheluckystiff.net/ruby/redcloth/
             # Author::    why the lucky stiff (http://whytheluckystiff.net/)
             # Copyright:: (cc) 2004 why the lucky stiff (and his puppet organizations.)
             # License::   BSD
             #
             # (see http://hobix.com/textile/ for a Textile Reference.)
             #
             # Based on (and also inspired by) both:
             #
             # PyTextile: http://diveintomark.org/projects/textile/textile.py.txt
             # Textism for PHP: http://www.textism.com/tools/textile/
             #
             #
             # = RedCloth
             #
             # RedCloth is a Ruby library for converting Textile and/or Markdown
             # into HTML.  You can use either format, intermingled or separately.
             # You can also extend RedCloth to honor your own custom text stylings.
             #
             # RedCloth users are encouraged to use Textile if they are generating
             # HTML and to use Markdown if others will be viewing the plain text.
             #
             # == What is Textile?
             #
             # Textile is a simple formatting style for text
             # documents, loosely based on some HTML conventions.
             #
             # == Sample Textile Text
             #
             #  h2. This is a title
             #
             #  h3. This is a subhead
             #
             #  This is a bit of paragraph.
             #
             #  bq. This is a blockquote.
             #
             # = Writing Textile
             #
             # A Textile document consists of paragraphs.  Paragraphs
             # can be specially formatted by adding a small instruction
             # to the beginning of the paragraph.
             #
             #  h[n].   Header of size [n].
             #  bq.     Blockquote.
             #  #       Numeric list.
             #  *       Bulleted list.
             #
             # == Quick Phrase Modifiers
             #
             # Quick phrase modifiers are also included, to allow formatting
             # of small portions of text within a paragraph.
             #
             #  \_emphasis\_
             #  \_\_italicized\_\_
             #  \*strong\*
             #  \*\*bold\*\*
             #  ??citation??
             #  -deleted text-
             #  +inserted text+
             #  ^superscript^
             #  ~subscript~
             #  @code@
             #  %(classname)span%
             #
             #  ==notextile== (leave text alone)
             #
             # == Links
             #
             # To make a hypertext link, put the link text in "quotation
             # marks" followed immediately by a colon and the URL of the link.
             #
             # Optional: text in (parentheses) following the link text,
             # but before the closing quotation mark, will become a Title
             # attribute for the link, visible as a tool tip when a cursor is above it.
             #
             # Example:
             #
             #  "This is a link (This is a title) ":http://www.textism.com
             #
             # Will become:
             #
             #  <a href="http://www.textism.com" title="This is a title">This is a link</a>
             #
             # == Images
             #
             # To insert an image, put the URL for the image inside exclamation marks.
             #
             # Optional: text that immediately follows the URL in (parentheses) will
             # be used as the Alt text for the image. Images on the web should always
             # have descriptive Alt text for the benefit of readers using non-graphical
             # browsers.
             #
             # Optional: place a colon followed by a URL immediately after the
             # closing ! to make the image into a link.
             #
             # Example:
             #
             #  !http://www.textism.com/common/textist.gif(Textist)!
             #
             # Will become:
             #
             #  <img src="http://www.textism.com/common/textist.gif" alt="Textist" />
             #
             # With a link:
             #
             #  !/common/textist.gif(Textist)!:http://textism.com
             #
             # Will become:
             #
             #  <a href="http://textism.com"><img src="/common/textist.gif" alt="Textist" /></a>
             #
             # == Defining Acronyms
             #
             # HTML allows authors to define acronyms via the tag. The definition appears as a
             # tool tip when a cursor hovers over the acronym. A crucial aid to clear writing,
             # this should be used at least once for each acronym in documents where they appear.
             #
             # To quickly define an acronym in Textile, place the full text in (parentheses)
             # immediately following the acronym.
             #
             # Example:
             #
             #  ACLU(American Civil Liberties Union)
             #
             # Will become:
             #
             #  <acronym title="American Civil Liberties Union">ACLU</acronym>
             #
             # == Adding Tables
             #
             # In Textile, simple tables can be added by seperating each column by
             # a pipe.
             #
             #     |a|simple|table|row|
             #     |And|Another|table|row|
             #
             # Attributes are defined by style definitions in parentheses.
             #
             #     table(border:1px solid black).
             #     (background:#ddd;color:red). |{}| | | |
             #
             # == Using RedCloth
             #
             # RedCloth is simply an extension of the String class, which can handle
             # Textile formatting.  Use it like a String and output HTML with its
             # RedCloth#to_html method.
             #
             #  doc = RedCloth.new "
             #
             #  h2. Test document
             #
             #  Just a simple test."
             #
             #  puts doc.to_html
             #
             # By default, RedCloth uses both Textile and Markdown formatting, with
             # Textile formatting taking precedence.  If you want to turn off Markdown
             # formatting, to boost speed and limit the processor:
             #
             #  class RedCloth::Textile.new( str )
             class RedCloth3 < String
                 VERSION = '3.0.4'
                 DEFAULT_RULES = [:textile, :markdown]
                 #
                 # Two accessor for setting security restrictions.
                 #
                 # This is a nice thing if you're using RedCloth for
                 # formatting in public places (e.g. Wikis) where you
                 # don't want users to abuse HTML for bad things.
                 #
                 # If +:filter_html+ is set, HTML which wasn't
                 # created by the Textile processor will be escaped.
                 #
                 # If +:filter_styles+ is set, it will also disable
                 # the style markup specifier. ('{color: red}')
                 #
                 attr_accessor :filter_html, :filter_styles
                 #
                 # Accessor for toggling hard breaks.
                 #
                 # If +:hard_breaks+ is set, single newlines will
                 # be converted to HTML break tags.  This is the
                 # default behavior for traditional RedCloth.
                 #
                 attr_accessor :hard_breaks
                 # Accessor for toggling lite mode.
                 #
                 # In lite mode, block-level rules are ignored.  This means
                 # that tables, paragraphs, lists, and such aren't available.
                 # Only the inline markup for bold, italics, entities and so on.
                 #
                 #   r = RedCloth.new( "And then? She *fell*!", [:lite_mode] )
                 #   r.to_html
                 #   #=> "And then? She <strong>fell</strong>!"
                 #
                 attr_accessor :lite_mode
                 #
                 # Accessor for toggling span caps.
                 #
                 # Textile places `span' tags around capitalized
                 # words by default, but this wreaks havoc on Wikis.
                 # If +:no_span_caps+ is set, this will be
                 # suppressed.
                 #
                 attr_accessor :no_span_caps
                 #
                 # Establishes the markup predence.  Available rules include:
                 #
                 # == Textile Rules
                 #
                 # The following textile rules can be set individually.  Or add the complete
                 # set of rules with the single :textile rule, which supplies the rule set in
                 # the following precedence:
                 #
                 # refs_textile::          Textile references (i.e. [hobix]http://hobix.com/)
                 # block_textile_table::   Textile table block structures
                 # block_textile_lists::   Textile list structures
                 # block_textile_prefix::  Textile blocks with prefixes (i.e. bq., h2., etc.)
                 # inline_textile_image::  Textile inline images
                 # inline_textile_link::   Textile inline links
                 # inline_textile_span::   Textile inline spans
                 # glyphs_textile:: Textile entities (such as em-dashes and smart quotes)
                 #
                 # == Markdown
                 #
                 # refs_markdown::         Markdown references (for example: [hobix]: http://hobix.com/)
                 # block_markdown_setext:: Markdown setext headers
                 # block_markdown_atx::    Markdown atx headers
                 # block_markdown_rule::   Markdown horizontal rules
                 # block_markdown_bq::     Markdown blockquotes
                 # block_markdown_lists::  Markdown lists
                 # inline_markdown_link::  Markdown links
                 attr_accessor :rules
                 # Returns a new RedCloth object, based on _string_ and
                 # enforcing all the included _restrictions_.
                 #
                 #   r = RedCloth.new( "h1. A <b>bold</b> man", [:filter_html] )
                 #   r.to_html
                 #     #=>"<h1>A &lt;b&gt;bold&lt;/b&gt; man</h1>"
                 #
                 def initialize( string, restrictions = [] )
                     restrictions.each { |r| method( "#{ r }=" ).call( true ) }
                     super( string )
                 end
                 #
                 # Generates HTML from the Textile contents.
                 #
                 #   r = RedCloth.new( "And then? She *fell*!" )
                 #   r.to_html( true )
                 #     #=>"And then? She <strong>fell</strong>!"
                 #
                 def to_html( *rules )
                     rules = DEFAULT_RULES if rules.empty?
                     # make our working copy
                     text = self.dup
                     @urlrefs = {}
                     @shelf = []
                     textile_rules = [:block_textile_table, :block_textile_lists,
                                      :block_textile_prefix, :inline_textile_image, :inline_textile_link,
                                      :inline_textile_code, :inline_textile_span, :glyphs_textile]
                     markdown_rules = [:refs_markdown, :block_markdown_setext, :block_markdown_atx, :block_markdown_rule,
                                       :block_markdown_bq, :block_markdown_lists,
                                       :inline_markdown_reflink, :inline_markdown_link]
                     @rules = rules.collect do |rule|
                         case rule
                         when :markdown
                             markdown_rules
                         when :textile
                             textile_rules
                         else
                             rule
                         end
                     end.flatten
                     # standard clean up
                     incoming_entities text
                     clean_white_space text
                     # start processor
                     @pre_list = []
                     rip_offtags text
                     no_textile text
                     escape_html_tags text
                     # need to do this before #hard_break and #blocks
                     block_textile_quotes text unless @lite_mode
                     hard_break text
                     unless @lite_mode
                         refs text
                         blocks text
                     end
                     inline text
                     smooth_offtags text
                     retrieve text
                     text.gsub!( /<\/?notextile>/, '' )
                     text.gsub!( /x%x%/, '&#38;' )
                     clean_html text if filter_html
                     text.strip!
                     text
                 end
                 #######
                 private
                 #######
                 #
                 # Mapping of 8-bit ASCII codes to HTML numerical entity equivalents.
                 # (from PyTextile)
                 #
                 TEXTILE_TAGS =
                     [[128, 8364], [129, 0], [130, 8218], [131, 402], [132, 8222], [133, 8230],
                      [134, 8224], [135, 8225], [136, 710], [137, 8240], [138, 352], [139, 8249],
                      [140, 338], [141, 0], [142, 0], [143, 0], [144, 0], [145, 8216], [146, 8217],
                      [147, 8220], [148, 8221], [149, 8226], [150, 8211], [151, 8212], [152, 732],
                      [153, 8482], [154, 353], [155, 8250], [156, 339], [157, 0], [158, 0], [159, 376]].
                     collect! do |a, b|
                         [a.chr, ( b.zero? and "" or "&#{ b };" )]
                     end
                 #
                 # Regular expressions to convert to HTML.
                 #
                 A_HLGN = /(?:(?:<>|<|>|\=|[()]+)+)/
                 A_VLGN = /[\-^~]/
                 C_CLAS = '(?:\([^)]+\))'
                 C_LNGE = '(?:\[[^\[\]]+\])'
                 C_STYL = '(?:\{[^}]+\})'
                 S_CSPN = '(?:\\\\\d+)'
                 S_RSPN = '(?:/\d+)'
                 A = "(?:#{A_HLGN}?#{A_VLGN}?|#{A_VLGN}?#{A_HLGN}?)"
                 S = "(?:#{S_CSPN}?#{S_RSPN}|#{S_RSPN}?#{S_CSPN}?)"
                 C = "(?:#{C_CLAS}?#{C_STYL}?#{C_LNGE}?|#{C_STYL}?#{C_LNGE}?#{C_CLAS}?|#{C_LNGE}?#{C_STYL}?#{C_CLAS}?)"
                 # PUNCT = Regexp::quote( '!"#$%&\'()*+,-./:;<=>?@[\\]^_`{|}~' )
                 PUNCT = Regexp::quote( '!"#$%&\'*+,-./:;=?@\\^_`|~' )
                 PUNCT_NOQ = Regexp::quote( '!"#$&\',./:;=?@\\`|' )
                 PUNCT_Q = Regexp::quote( '*-_+^~%' )
                 HYPERLINK = '(\S+?)([^\w\s/;=\?]*?)(?=\s|<|$)'
                 # Text markup tags, don't conflict with block tags
                 SIMPLE_HTML_TAGS = [
                     'tt', 'b', 'i', 'big', 'small', 'em', 'strong', 'dfn', 'code',
                     'samp', 'kbd', 'var', 'cite', 'abbr', 'acronym', 'a', 'img', 'br',
                     'br', 'map', 'q', 'sub', 'sup', 'span', 'bdo'
                 ]
                 QTAGS = [
                     ['**', 'b', :limit],
                     ['*', 'strong', :limit],
                     ['??', 'cite', :limit],
                     ['-', 'del', :limit],
                     ['__', 'i', :limit],
                     ['_', 'em', :limit],
                     ['%', 'span', :limit],
                     ['+', 'ins', :limit],
                     ['^', 'sup', :limit],
                     ['~', 'sub', :limit]
                 ]
                 QTAGS_JOIN = QTAGS.map {|rc, ht, rtype| Regexp::quote rc}.join('|')
                 QTAGS.collect! do |rc, ht, rtype|
                     rcq = Regexp::quote rc
                     re =
                         case rtype
                         when :limit
                             /(^|[>\s\(])          # sta
                             (?!\-\-)
                             (#{QTAGS_JOIN}|)      # oqs
                             (#{rcq})              # qtag
                             (\w|[^\s].*?[^\s])    # content
                             (?!\-\-)
                             #{rcq}
                             (#{QTAGS_JOIN}|)      # oqa
                             (?=[[:punct:]]|<|\s|\)|$)/x
                         else
                             /(#{rcq})
                             (#{C})
                             (?::(\S+))?
                             (\w|[^\s\-].*?[^\s\-])
                             #{rcq}/xm
                         end
                     [rc, ht, re, rtype]
                 end
                 # Elements to handle
                 GLYPHS = [
                 #   [ /([^\s\[{(>])?\'([dmst]\b|ll\b|ve\b|\s|:|$)/, '\1&#8217;\2' ], # single closing
                 #   [ /([^\s\[{(>#{PUNCT_Q}][#{PUNCT_Q}]*)\'/, '\1&#8217;' ], # single closing
                 #   [ /\'(?=[#{PUNCT_Q}]*(s\b|[\s#{PUNCT_NOQ}]))/, '&#8217;' ], # single closing
                 #   [ /\'/, '&#8216;' ], # single opening
                 #   [ /</, '&lt;' ], # less-than
                 #   [ />/, '&gt;' ], # greater-than
                 #   [ /([^\s\[{(])?"(\s|:|$)/, '\1&#8221;\2' ], # double closing
                 #   [ /([^\s\[{(>#{PUNCT_Q}][#{PUNCT_Q}]*)"/, '\1&#8221;' ], # double closing
                 #   [ /"(?=[#{PUNCT_Q}]*[\s#{PUNCT_NOQ}])/, '&#8221;' ], # double closing
                 #   [ /"/, '&#8220;' ], # double opening
                 #   [ /\b( )?\.{3}/, '\1&#8230;' ], # ellipsis
                 #   [ /\b([A-Z][A-Z0-9]{2,})\b(?:[(]([^)]*)[)])/, '<acronym title="\2">\1</acronym>' ], # 3+ uppercase acronym
                 #   [ /(^|[^"][>\s])([A-Z][A-Z0-9 ]+[A-Z0-9])([^<A-Za-z0-9]|$)/, '\1<span class="caps">\2</span>\3', :no_span_caps ], # 3+ uppercase caps
                 #   [ /(\.\s)?\s?--\s?/, '\1&#8212;' ], # em dash
                 #   [ /\s->\s/, ' &rarr; ' ], # right arrow
                 #   [ /\s-\s/, ' &#8211; ' ], # en dash
                 #   [ /(\d+) ?x ?(\d+)/, '\1&#215;\2' ], # dimension sign
                 #   [ /\b ?[(\[]TM[\])]/i, '&#8482;' ], # trademark
                 #   [ /\b ?[(\[]R[\])]/i, '&#174;' ], # registered
                 #   [ /\b ?[(\[]C[\])]/i, '&#169;' ] # copyright
                 ]
                 H_ALGN_VALS = {
                     '<' => 'left',
                     '=' => 'center',
                     '>' => 'right',
                     '<>' => 'justify'
                 }
                 V_ALGN_VALS = {
                     '^' => 'top',
                     '-' => 'middle',
                     '~' => 'bottom'
                 }
                 #
                 # Flexible HTML escaping
                 #
                 def htmlesc( str, mode=:Quotes )
                   if str
                     str.gsub!( '&', '&amp;' )
                     str.gsub!( '"', '&quot;' ) if mode != :NoQuotes
                     str.gsub!( "'", '&#039;' ) if mode == :Quotes
                     str.gsub!( '<', '&lt;')
                     str.gsub!( '>', '&gt;')
                   end
                   str
                 end
                 # Search and replace for Textile glyphs (quotes, dashes, other symbols)
                 def pgl( text )
                     #GLYPHS.each do |re, resub, tog|
                     #    next if tog and method( tog ).call
                     #    text.gsub! re, resub
                     #end
                     text.gsub!(/\b([A-Z][A-Z0-9]{1,})\b(?:[(]([^)]*)[)])/) do |m|
                       "<acronym title=\"#{htmlesc $2}\">#{$1}</acronym>"
                     end
                 end
                 # Parses Textile attribute lists and builds an HTML attribute string
                 def pba( text_in, element = "" )
                     return '' unless text_in
                     style = []
                     text = text_in.dup
                     if element == 'td'
                         colspan = $1 if text =~ /\\(\d+)/
                         rowspan = $1 if text =~ /\/(\d+)/
                         style << "vertical-align:#{ v_align( $& ) };" if text =~ A_VLGN
                     end
-                    style << "#{ htmlesc $1 };" if text.sub!( /\{([^}]*)\}/, '' ) && !filter_styles
+                    if text.sub!( /\{([^"}]*)\}/, '' ) && !filter_styles
+                      sanitized = sanitize_styles($1)
+                      style << "#{ sanitized };" unless sanitized.blank?
+                    end
                     lang = $1 if
                         text.sub!( /\[([^)]+?)\]/, '' )
                     cls = $1 if
                         text.sub!( /\(([^()]+?)\)/, '' )
                     style << "padding-left:#{ $1.length }em;" if
                         text.sub!( /([(]+)/, '' )
                     style << "padding-right:#{ $1.length }em;" if text.sub!( /([)]+)/, '' )
                     style << "text-align:#{ h_align( $& ) };" if text =~ A_HLGN
                     cls, id = $1, $2 if cls =~ /^(.*?)#(.*)$/
                     atts = ''
                     atts << " style=\"#{ style.join }\"" unless style.empty?
                     atts << " class=\"#{ cls }\"" unless cls.to_s.empty?
                     atts << " lang=\"#{ lang }\"" if lang
                     atts << " id=\"#{ id }\"" if id
                     atts << " colspan=\"#{ colspan }\"" if colspan
                     atts << " rowspan=\"#{ rowspan }\"" if rowspan
                     atts
                 end
+                STYLES_RE = /^(color|width|height|border|background|padding|margin|font|text)(-[a-z]+)*:\s*((\d+%?|\d+px|\d+(\.\d+)?em|#[0-9a-f]+|[a-z]+)\s*)+$/i
+                def sanitize_styles(str)
+                  styles = str.split(";").map(&:strip)
+                  styles.reject! do |style|
+                    !style.match(STYLES_RE)
+                  end
+                  styles.join(";")
+                end
                 TABLE_RE = /^(?:table(_?#{S}#{A}#{C})\. ?\n)?^(#{A}#{C}\.? ?\|.*?\|)(\n\n|\Z)/m
                 # Parses a Textile table block, building HTML from the result.
                 def block_textile_table( text )
                     text.gsub!( TABLE_RE ) do |matches|
                         tatts, fullrow = $~[1..2]
                         tatts = pba( tatts, 'table' )
                         tatts = shelve( tatts ) if tatts
                         rows = []
                         fullrow.each_line do |row|
                             ratts, row = pba( $1, 'tr' ), $2 if row =~ /^(#{A}#{C}\. )(.*)/m
                             cells = []
                             row.split( /(\|)(?![^\[\|]*\]\])/ )[1..-2].each do |cell|
                                 next if cell == '|'
                                 ctyp = 'd'
                                 ctyp = 'h' if cell =~ /^_/
                                 catts = ''
                                 catts, cell = pba( $1, 'td' ), $2 if cell =~ /^(_?#{S}#{A}#{C}\. ?)(.*)/
                                 catts = shelve( catts ) if catts
                                 cells << "\t\t\t<t#{ ctyp }#{ catts }>#{ cell }</t#{ ctyp }>"
                             end
                             ratts = shelve( ratts ) if ratts
                             rows << "\t\t<tr#{ ratts }>\n#{ cells.join( "\n" ) }\n\t\t</tr>"
                         end
                         "\t<table#{ tatts }>\n#{ rows.join( "\n" ) }\n\t</table>\n\n"
                     end
                 end
                 LISTS_RE = /^([#*]+?#{C} .*?)$(?![^#*])/m
                 LISTS_CONTENT_RE = /^([#*]+)(#{A}#{C}) (.*)$/m
                 # Parses Textile lists and generates HTML
                 def block_textile_lists( text )
                     text.gsub!( LISTS_RE ) do |match|
                         lines = match.split( /\n/ )
                         last_line = -1
                         depth = []
                         lines.each_with_index do |line, line_id|
                             if line =~ LISTS_CONTENT_RE
                                 tl,atts,content = $~[1..3]
                                 if depth.last
                                     if depth.last.length > tl.length
                                         (depth.length - 1).downto(0) do |i|
                                             break if depth[i].length == tl.length
                                             lines[line_id - 1] << "</li>\n\t</#{ lT( depth[i] ) }l>\n\t"
                                             depth.pop
                                         end
                                     end
                                     if depth.last and depth.last.length == tl.length
                                         lines[line_id - 1] << '</li>'
                                     end
                                 end
                                 unless depth.last == tl
                                     depth << tl
                                     atts = pba( atts )
                                     atts = shelve( atts ) if atts
                                     lines[line_id] = "\t<#{ lT(tl) }l#{ atts }>\n\t<li>#{ content }"
                                 else
                                     lines[line_id] = "\t\t<li>#{ content }"
                                 end
                                 last_line = line_id
                             else
                                 last_line = line_id
                             end
                             if line_id - last_line > 1 or line_id == lines.length - 1
                                 depth.delete_if do |v|
                                     lines[last_line] << "</li>\n\t</#{ lT( v ) }l>"
                                 end
                             end
                         end
                         lines.join( "\n" )
                     end
                 end
                 QUOTES_RE = /(^>+([^\n]*?)(\n|$))+/m
                 QUOTES_CONTENT_RE = /^([> ]+)(.*)$/m
                 def block_textile_quotes( text )
                   text.gsub!( QUOTES_RE ) do |match|
                     lines = match.split( /\n/ )
                     quotes = ''
                     indent = 0
                     lines.each do |line|
                       line =~ QUOTES_CONTENT_RE
                       bq,content = $1, $2
                       l = bq.count('>')
                       if l != indent
                         quotes << ("\n\n" + (l>indent ? '<blockquote>' * (l-indent) : '</blockquote>' * (indent-l)) + "\n\n")
                         indent = l
                       end
                       quotes << (content + "\n")
                     end
                     quotes << ("\n" + '</blockquote>' * indent + "\n\n")
                     quotes
                   end
                 end
                 CODE_RE = /(\W)
                     @
                     (?:\|(\w+?)\|)?
                     (.+?)
                     @
                     (?=\W)/x
                 def inline_textile_code( text )
                     text.gsub!( CODE_RE ) do |m|
                         before,lang,code,after = $~[1..4]
                         lang = " lang=\"#{ lang }\"" if lang
                         rip_offtags( "#{ before }<code#{ lang }>#{ code }</code>#{ after }", false )
                     end
                 end
                 def lT( text )
                     text =~ /\#$/ ? 'o' : 'u'
                 end
                 def hard_break( text )
                     text.gsub!( /(.)\n(?!\Z| *([#*=]+(\s|$)|[{|]))/, "\\1<br />" ) if hard_breaks
                 end
                 BLOCKS_GROUP_RE = /\n{2,}(?! )/m
                 def blocks( text, deep_code = false )
                     text.replace( text.split( BLOCKS_GROUP_RE ).collect do |blk|
                         plain = blk !~ /\A[#*> ]/
                         # skip blocks that are complex HTML
                         if blk =~ /^<\/?(\w+).*>/ and not SIMPLE_HTML_TAGS.include? $1
                             blk
                         else
                             # search for indentation levels
                             blk.strip!
                             if blk.empty?
                                 blk
                             else
                                 code_blk = nil
                                 blk.gsub!( /((?:\n(?:\n^ +[^\n]*)+)+)/m ) do |iblk|
                                     flush_left iblk
                                     blocks iblk, plain
                                     iblk.gsub( /^(\S)/, "\t\\1" )
                                     if plain
                                         code_blk = iblk; ""
                                     else
                                         iblk
                                     end
                                 end
                                 block_applied = 0
                                 @rules.each do |rule_name|
                                     block_applied += 1 if ( rule_name.to_s.match /^block_/ and method( rule_name ).call( blk ) )
                                 end
                                 if block_applied.zero?
                                     if deep_code
                                         blk = "\t<pre><code>#{ blk }</code></pre>"
                                     else
                                         blk = "\t<p>#{ blk }</p>"
                                     end
                                 end
                                 # hard_break blk
                                 blk + "\n#{ code_blk }"
                             end
                         end
                     end.join( "\n\n" ) )
                 end
                 def textile_bq( tag, atts, cite, content )
                     cite, cite_title = check_refs( cite )
                     cite = " cite=\"#{ cite }\"" if cite
                     atts = shelve( atts ) if atts
                     "\t<blockquote#{ cite }>\n\t\t<p#{ atts }>#{ content }</p>\n\t</blockquote>"
                 end
                 def textile_p( tag, atts, cite, content )
                     atts = shelve( atts ) if atts
                     "\t<#{ tag }#{ atts }>#{ content }</#{ tag }>"
                 end
                 alias textile_h1 textile_p
                 alias textile_h2 textile_p
                 alias textile_h3 textile_p
                 alias textile_h4 textile_p
                 alias textile_h5 textile_p
                 alias textile_h6 textile_p
                 def textile_fn_( tag, num, atts, cite, content )
                     atts << " id=\"fn#{ num }\" class=\"footnote\""
                     content = "<sup>#{ num }</sup> #{ content }"
                     atts = shelve( atts ) if atts
                     "\t<p#{ atts }>#{ content }</p>"
                 end
                 BLOCK_RE = /^(([a-z]+)(\d*))(#{A}#{C})\.(?::(\S+))? (.*)$/m
                 def block_textile_prefix( text )
                     if text =~ BLOCK_RE
                         tag,tagpre,num,atts,cite,content = $~[1..6]
                         atts = pba( atts )
                         # pass to prefix handler
                         replacement = nil
                         if respond_to? "textile_#{ tag }", true
                           replacement = method( "textile_#{ tag }" ).call( tag, atts, cite, content )
                         elsif respond_to? "textile_#{ tagpre }_", true
                           replacement = method( "textile_#{ tagpre }_" ).call( tagpre, num, atts, cite, content )
                         end
                         text.gsub!( $& ) { replacement } if replacement
                     end
                 end
                 SETEXT_RE = /\A(.+?)\n([=-])[=-]* *$/m
                 def block_markdown_setext( text )
                     if text =~ SETEXT_RE
                         tag = if $2 == "="; "h1"; else; "h2"; end
                         blk, cont = "<#{ tag }>#{ $1 }</#{ tag }>", $'
                         blocks cont
                         text.replace( blk + cont )
                     end
                 end
                 ATX_RE = /\A(\#{1,6})  # $1 = string of #'s
                           [ ]*
                           (.+?)       # $2 = Header text
                           [ ]*
                           \#*         # optional closing #'s (not counted)
                           $/x
                 def block_markdown_atx( text )
                     if text =~ ATX_RE
                         tag = "h#{ $1.length }"
                         blk, cont = "<#{ tag }>#{ $2 }</#{ tag }>\n\n", $'
                         blocks cont
                         text.replace( blk + cont )
                     end
                 end
                 MARKDOWN_BQ_RE = /\A(^ *> ?.+$(.+\n)*\n*)+/m
                 def block_markdown_bq( text )
                     text.gsub!( MARKDOWN_BQ_RE ) do |blk|
                         blk.gsub!( /^ *> ?/, '' )
                         flush_left blk
                         blocks blk
                         blk.gsub!( /^(\S)/, "\t\\1" )
                         "<blockquote>\n#{ blk }\n</blockquote>\n\n"
                     end
                 end
                 MARKDOWN_RULE_RE = /^(#{
                     ['*', '-', '_'].collect { |ch| ' ?(' + Regexp::quote( ch ) + ' ?){3,}' }.join( '|' )
                 })$/
                 def block_markdown_rule( text )
                     text.gsub!( MARKDOWN_RULE_RE ) do |blk|
                         "<hr />"
                     end
                 end
                 # XXX TODO XXX
                 def block_markdown_lists( text )
                 end
                 def inline_textile_span( text )
                     QTAGS.each do |qtag_rc, ht, qtag_re, rtype|
                         text.gsub!( qtag_re ) do |m|
                             case rtype
                             when :limit
                                 sta,oqs,qtag,content,oqa = $~[1..6]
                                 atts = nil
                                 if content =~ /^(#{C})(.+)$/
                                   atts, content = $~[1..2]
                                 end
                             else
                                 qtag,atts,cite,content = $~[1..4]
                                 sta = ''
                             end
                             atts = pba( atts )
                             atts = shelve( atts ) if atts
                             "#{ sta }#{ oqs }<#{ ht }#{ atts }>#{ content }</#{ ht }>#{ oqa }"
                         end
                     end
                 end
                 LINK_RE = /
                         (
                         ([\s\[{(]|[#{PUNCT}])?     # $pre
                         "                          # start
                         (#{C})                     # $atts
                         ([^"\n]+?)                 # $text
                         \s?
                         (?:\(([^)]+?)\)(?="))?     # $title
                         ":
                         (                          # $url
                         (\/|[a-zA-Z]+:\/\/|www\.|mailto:)  # $proto
                         [\w\/]\S+?
                         )
                         (\/)?                      # $slash
                         ([^\w\=\/;\(\)]*?)         # $post
                         )
                         (?=<|\s|$)
                     /x
             #"
                 def inline_textile_link( text )
                     text.gsub!( LINK_RE ) do |m|
                       all,pre,atts,text,title,url,proto,slash,post = $~[1..9]
                       if text.include?('<br />')
                         all
                       else
                         url, url_title = check_refs( url )
                         title ||= url_title
                         # Idea below : an URL with unbalanced parethesis and
                         # ending by ')' is put into external parenthesis
                         if ( url[-1]==?) and ((url.count("(") - url.count(")")) < 0 ) )
                           url=url[0..-2] # discard closing parenth from url
                           post = ")"+post # add closing parenth to post
                         end
                         atts = pba( atts )
                         atts = " href=\"#{ htmlesc url }#{ slash }\"#{ atts }"
                         atts << " title=\"#{ htmlesc title }\"" if title
                         atts = shelve( atts ) if atts
                         external = (url =~ /^https?:\/\//) ? ' class="external"' : ''
                         "#{ pre }<a#{ atts }#{ external }>#{ text }</a>#{ post }"
                       end
                     end
                 end
                 MARKDOWN_REFLINK_RE = /
                         \[([^\[\]]+)\]      # $text
                         [ ]?                # opt. space
                         (?:\n[ ]*)?         # one optional newline followed by spaces
                         \[(.*?)\]           # $id
                     /x
                 def inline_markdown_reflink( text )
                     text.gsub!( MARKDOWN_REFLINK_RE ) do |m|
                         text, id = $~[1..2]
                         if id.empty?
                             url, title = check_refs( text )
                         else
                             url, title = check_refs( id )
                         end
                         atts = " href=\"#{ url }\""
                         atts << " title=\"#{ title }\"" if title
                         atts = shelve( atts )
                         "<a#{ atts }>#{ text }</a>"
                     end
                 end
                 MARKDOWN_LINK_RE = /
                         \[([^\[\]]+)\]      # $text
                         \(                  # open paren
                         [ \t]*              # opt space
                         <?(.+?)>?           # $href
                         [ \t]*              # opt space
                         (?:                 # whole title
                         (['"])              # $quote
                         (.*?)               # $title
                         \3                  # matching quote
                         )?                  # title is optional
                         \)
                     /x
                 def inline_markdown_link( text )
                     text.gsub!( MARKDOWN_LINK_RE ) do |m|
                         text, url, quote, title = $~[1..4]
                         atts = " href=\"#{ url }\""
                         atts << " title=\"#{ title }\"" if title
                         atts = shelve( atts )
                         "<a#{ atts }>#{ text }</a>"
                     end
                 end
                 TEXTILE_REFS_RE =  /(^ *)\[([^\[\n]+?)\](#{HYPERLINK})(?=\s|$)/
                 MARKDOWN_REFS_RE = /(^ *)\[([^\n]+?)\]:\s+<?(#{HYPERLINK})>?(?:\s+"((?:[^"]|\\")+)")?(?=\s|$)/m
                 def refs( text )
                     @rules.each do |rule_name|
                         method( rule_name ).call( text ) if rule_name.to_s.match /^refs_/
                     end
                 end
                 def refs_textile( text )
                     text.gsub!( TEXTILE_REFS_RE ) do |m|
                         flag, url = $~[2..3]
                         @urlrefs[flag.downcase] = [url, nil]
                         nil
                     end
                 end
                 def refs_markdown( text )
                     text.gsub!( MARKDOWN_REFS_RE ) do |m|
                         flag, url = $~[2..3]
                         title = $~[6]
                         @urlrefs[flag.downcase] = [url, title]
                         nil
                     end
                 end
                 def check_refs( text )
                     ret = @urlrefs[text.downcase] if text
                     ret || [text, nil]
                 end
                 IMAGE_RE = /
                         (>|\s|^)           # start of line?
                         \!                   # opening
                         (\<|\=|\>)?          # optional alignment atts
                         (#{C})               # optional style,class atts
                         (?:\. )?             # optional dot-space
                         ([^\s(!]+?)          # presume this is the src
                         \s?                  # optional space
                         (?:\(((?:[^\(\)]|\([^\)]+\))+?)\))?   # optional title
                         \!                   # closing
                         (?::#{ HYPERLINK })? # optional href
                     /x
                 def inline_textile_image( text )
                     text.gsub!( IMAGE_RE )  do |m|
                         stln,algn,atts,url,title,href,href_a1,href_a2 = $~[1..8]
                         htmlesc title
                         atts = pba( atts )
                         atts = " src=\"#{ htmlesc url.dup }\"#{ atts }"
                         atts << " title=\"#{ title }\"" if title
                         atts << " alt=\"#{ title }\""
                         # size = @getimagesize($url);
                         # if($size) $atts.= " $size[3]";
                         href, alt_title = check_refs( href ) if href
                         url, url_title = check_refs( url )
                         out = ''
                         out << "<a#{ shelve( " href=\"#{ href }\"" ) }>" if href
                         out << "<img#{ shelve( atts ) } />"
                         out << "</a>#{ href_a1 }#{ href_a2 }" if href
                         if algn
                             algn = h_align( algn )
                             if stln == "<p>"
                                 out = "<p style=\"float:#{ algn }\">#{ out }"
                             else
                                 out = "#{ stln }<div style=\"float:#{ algn }\">#{ out }</div>"
                             end
                         else
                             out = stln + out
                         end
                         out
                     end
                 end
                 def shelve( val )
                     @shelf << val
                     " :redsh##{ @shelf.length }:"
                 end
                 def retrieve( text )
                     @shelf.each_with_index do |r, i|
                         text.gsub!( " :redsh##{ i + 1 }:", r )
                     end
                 end
                 def incoming_entities( text )
                     ## turn any incoming ampersands into a dummy character for now.
                     ## This uses a negative lookahead for alphanumerics followed by a semicolon,
                     ## implying an incoming html entity, to be skipped
                     text.gsub!( /&(?![#a-z0-9]+;)/i, "x%x%" )
                 end
                 def no_textile( text )
                     text.gsub!( /(^|\s)==([^=]+.*?)==(\s|$)?/,
                         '\1<notextile>\2</notextile>\3' )
                     text.gsub!( /^ *==([^=]+.*?)==/m,
                         '\1<notextile>\2</notextile>\3' )
                 end
                 def clean_white_space( text )
                     # normalize line breaks
                     text.gsub!( /\r\n/, "\n" )
                     text.gsub!( /\r/, "\n" )
                     text.gsub!( /\t/, '    ' )
                     text.gsub!( /^ +$/, '' )
                     text.gsub!( /\n{3,}/, "\n\n" )
                     text.gsub!( /"$/, "\" " )
                     # if entire document is indented, flush
                     # to the left side
                     flush_left text
                 end
                 def flush_left( text )
                     indt = 0
                     if text =~ /^ /
                         while text !~ /^ {#{indt}}\S/
                             indt += 1
                         end unless text.empty?
                         if indt.nonzero?
                             text.gsub!( /^ {#{indt}}/, '' )
                         end
                     end
                 end
                 def footnote_ref( text )
                     text.gsub!( /\b\[([0-9]+?)\](\s)?/,
                         '<sup><a href="#fn\1">\1</a></sup>\2' )
                 end
                 OFFTAGS = /(code|pre|kbd|notextile)/
                 OFFTAG_MATCH = /(?:(<\/#{ OFFTAGS }>)|(<#{ OFFTAGS }[^>]*>))(.*?)(?=<\/?#{ OFFTAGS }\W|\Z)/mi
                 OFFTAG_OPEN = /<#{ OFFTAGS }/
                 OFFTAG_CLOSE = /<\/?#{ OFFTAGS }/
                 HASTAG_MATCH = /(<\/?\w[^\n]*?>)/m
                 ALLTAG_MATCH = /(<\/?\w[^\n]*?>)|.*?(?=<\/?\w[^\n]*?>|$)/m
                 def glyphs_textile( text, level = 0 )
                     if text !~ HASTAG_MATCH
                         pgl text
                         footnote_ref text
                     else
                         codepre = 0
                         text.gsub!( ALLTAG_MATCH ) do |line|
                             ## matches are off if we're between <code>, <pre> etc.
                             if $1
                                 if line =~ OFFTAG_OPEN
                                     codepre += 1
                                 elsif line =~ OFFTAG_CLOSE
                                     codepre -= 1
                                     codepre = 0 if codepre < 0
                                 end
                             elsif codepre.zero?
                                 glyphs_textile( line, level + 1 )
                             else
                                 htmlesc( line, :NoQuotes )
                             end
                             # p [level, codepre, line]
                             line
                         end
                     end
                 end
                 def rip_offtags( text, escape_aftertag=true, escape_line=true )
                     if text =~ /<.*>/
                         ## strip and encode <pre> content
                         codepre, used_offtags = 0, {}
                         text.gsub!( OFFTAG_MATCH ) do |line|
                             if $3
                                 first, offtag, aftertag = $3, $4, $5
                                 codepre += 1
                                 used_offtags[offtag] = true
                                 if codepre - used_offtags.length > 0
                                     htmlesc( line, :NoQuotes ) if escape_line
                                     @pre_list.last << line
                                     line = ""
                                 else
                                     ### htmlesc is disabled between CODE tags which will be parsed with highlighter
                                     ### Regexp in formatter.rb is : /<code\s+class="(\w+)">\s?(.+)/m
                                     ### NB: some changes were made not to use $N variables, because we use "match"
                                     ###   and it breaks following lines
                                     htmlesc( aftertag, :NoQuotes ) if aftertag && escape_aftertag && !first.match(/<code\s+class="(\w+)">/)
                                     line = "<redpre##{ @pre_list.length }>"
                                     first.match(/<#{ OFFTAGS }([^>]*)>/)
                                     tag = $1
                                     $2.to_s.match(/(class\=("[^"]+"|'[^']+'))/i)
                                     tag << " #{$1}" if $1
                                     @pre_list << "<#{ tag }>#{ aftertag }"
                                 end
                             elsif $1 and codepre > 0
                                 if codepre - used_offtags.length > 0
                                     htmlesc( line, :NoQuotes ) if escape_line
                                     @pre_list.last << line
                                     line = ""
                                 end
                                 codepre -= 1 unless codepre.zero?
                                 used_offtags = {} if codepre.zero?
                             end
                             line
                         end
                     end
                     text
                 end
                 def smooth_offtags( text )
                     unless @pre_list.empty?
                         ## replace <pre> content
                         text.gsub!( /<redpre#(\d+)>/ ) { @pre_list[$1.to_i] }
                     end
                 end
                 def inline( text )
                     [/^inline_/, /^glyphs_/].each do |meth_re|
                         @rules.each do |rule_name|
                             method( rule_name ).call( text ) if rule_name.to_s.match( meth_re )
                         end
                     end
                 end
                 def h_align( text )
                     H_ALGN_VALS[text]
                 end
                 def v_align( text )
                     V_ALGN_VALS[text]
                 end
                 def textile_popup_help( name, windowW, windowH )
                     ' <a target="_blank" href="http://hobix.com/textile/#' + helpvar + '" onclick="window.open(this.href, \'popupwindow\', \'width=' + windowW + ',height=' + windowH + ',scrollbars,resizable\'); return false;">' + name + '</a><br />'
                 end
                 # HTML cleansing stuff
                 BASIC_TAGS = {
                     'a' => ['href', 'title'],
                     'img' => ['src', 'alt', 'title'],
                     'br' => [],
                     'i' => nil,
                     'u' => nil,
                     'b' => nil,
                     'pre' => nil,
                     'kbd' => nil,
                     'code' => ['lang'],
                     'cite' => nil,
                     'strong' => nil,
                     'em' => nil,
                     'ins' => nil,
                     'sup' => nil,
                     'sub' => nil,
                     'del' => nil,
                     'table' => nil,
                     'tr' => nil,
                     'td' => ['colspan', 'rowspan'],
                     'th' => nil,
                     'ol' => nil,
                     'ul' => nil,
                     'li' => nil,
                     'p' => nil,
                     'h1' => nil,
                     'h2' => nil,
                     'h3' => nil,
                     'h4' => nil,
                     'h5' => nil,
                     'h6' => nil,
                     'blockquote' => ['cite']
                 }
                 def clean_html( text, tags = BASIC_TAGS )
                     text.gsub!( /<!\[CDATA\[/, '' )
                     text.gsub!( /<(\/*)(\w+)([^>]*)>/ ) do
                         raw = $~
                         tag = raw[2].downcase
                         if tags.has_key? tag
                             pcs = [tag]
                             tags[tag].each do |prop|
                                 ['"', "'", ''].each do |q|
                                     q2 = ( q != '' ? q : '\s' )
                                     if raw[3] =~ /#{prop}\s*=\s*#{q}([^#{q2}]+)#{q}/i
                                         attrv = $1
                                         next if prop == 'src' and attrv =~ %r{^(?!http)\w+:}
                                         pcs << "#{prop}=\"#{$1.gsub('"', '\\"')}\""
                                         break
                                     end
                                 end
                             end if tags[tag]
                             "<#{raw[1]}#{pcs.join " "}>"
                         else
                             " "
                         end
                     end
                 end
                 ALLOWED_TAGS = %w(redpre pre code notextile)
                 def escape_html_tags(text)
                   text.gsub!(%r{<(\/?([!\w]+)[^<>\n]*)(>?)}) {|m| ALLOWED_TAGS.include?($2) ? "<#{$1}#{$3}" : "&lt;#{$1}#{'&gt;' unless $3.blank?}" }
                 end
             end

lib/redmine/wiki_formatting/textile/formatter.rb +1 -1

             # Redmine - project management software
             # Copyright (C) 2006-2011  Jean-Philippe Lang
             #
             # This program is free software; you can redistribute it and/or
             # modify it under the terms of the GNU General Public License
             # as published by the Free Software Foundation; either version 2
             # of the License, or (at your option) any later version.
             #
             # This program is distributed in the hope that it will be useful,
             # but WITHOUT ANY WARRANTY; without even the implied warranty of
             # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
             # GNU General Public License for more details.
             #
             # You should have received a copy of the GNU General Public License
             # along with this program; if not, write to the Free Software
             # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
             require 'redcloth3'
             require 'digest/md5'
             module Redmine
               module WikiFormatting
                 module Textile
                   class Formatter < RedCloth3
                     include ActionView::Helpers::TagHelper
                     # auto_link rule after textile rules so that it doesn't break !image_url! tags
                     RULES = [:textile, :block_markdown_rule, :inline_auto_link, :inline_auto_mailto]
                     def initialize(*args)
                       super
                       self.hard_breaks=true
                       self.no_span_caps=true
-                      self.filter_styles=true
+                      self.filter_styles=false
                     end
                     def to_html(*rules)
                       @toc = []
                       super(*RULES).to_s
                     end
                     def get_section(index)
                       section = extract_sections(index)[1]
                       hash = Digest::MD5.hexdigest(section)
                       return section, hash
                     end
                     def update_section(index, update, hash=nil)
                       t = extract_sections(index)
                       if hash.present? && hash != Digest::MD5.hexdigest(t[1])
                         raise Redmine::WikiFormatting::StaleSectionError
                       end
                       t[1] = update unless t[1].blank?
                       t.reject(&:blank?).join "\n\n"
                     end
                     def extract_sections(index)
                       @pre_list = []
                       text = self.dup
                       rip_offtags text, false, false
                       before = ''
                       s = ''
                       after = ''
                       i = 0
                       l = 1
                       started = false
                       ended = false
                       text.scan(/(((?:.*?)(\A|\r?\n\r?\n))(h(\d+)(#{A}#{C})\.(?::(\S+))? (.*?)$)|.*)/m).each do |all, content, lf, heading, level|
                         if heading.nil?
                           if ended
                             after << all
                           elsif started
                             s << all
                           else
                             before << all
                           end
                           break
                         end
                         i += 1
                         if ended
                           after << all
                         elsif i == index
                           l = level.to_i
                           before << content
                           s << heading
                           started = true
                         elsif i > index
                           s << content
                           if level.to_i > l
                             s << heading
                           else
                             after << heading
                             ended = true
                           end
                         else
                           before << all
                         end
                       end
                       sections = [before.strip, s.strip, after.strip]
                       sections.each {|section| smooth_offtags_without_code_highlighting section}
                       sections
                     end
                   private
                     # Patch for RedCloth.  Fixed in RedCloth r128 but _why hasn't released it yet.
                     # <a href="http://code.whytheluckystiff.net/redcloth/changeset/128">http://code.whytheluckystiff.net/redcloth/changeset/128</a>
                     def hard_break( text )
                       text.gsub!( /(.)\n(?!\n|\Z| *([#*=]+(\s|$)|[{|]))/, "\\1<br />" ) if hard_breaks
                     end
                     alias :smooth_offtags_without_code_highlighting :smooth_offtags
                     # Patch to add code highlighting support to RedCloth
                     def smooth_offtags( text )
                       unless @pre_list.empty?
                         ## replace <pre> content
                         text.gsub!(/<redpre#(\d+)>/) do
                           content = @pre_list[$1.to_i]
                           if content.match(/<code\s+class="(\w+)">\s?(.+)/m)
                             content = "<code class=\"#{$1} syntaxhl\">" +
                               Redmine::SyntaxHighlighting.highlight_by_language($2, $1)
                           end
                           content
                         end
                       end
                     end
                     AUTO_LINK_RE = %r{
                                     (                          # leading text
                                       <\w+.*?>|                # leading HTML tag, or
                                       [^=<>!:'"/]|             # leading punctuation, or
                                       ^                        # beginning of line
                                     )
                                     (
                                       (?:https?://)|           # protocol spec, or
                                       (?:s?ftps?://)|
                                       (?:www\.)                # www.*
                                     )
                                     (
                                       (\S+?)                   # url
                                       (\/)?                    # slash
                                     )
                                     ((?:&gt;)?|[^\w\=\/;\(\)]*?)               # post
                                     (?=<|\s|$)
                                    }x unless const_defined?(:AUTO_LINK_RE)
                     # Turns all urls into clickable links (code from Rails).
                     def inline_auto_link(text)
                       text.gsub!(AUTO_LINK_RE) do
                         all, leading, proto, url, post = $&, $1, $2, $3, $6
                         if leading =~ /<a\s/i || leading =~ /![<>=]?/
                           # don't replace URL's that are already linked
                           # and URL's prefixed with ! !> !< != (textile images)
                           all
                         else
                           # Idea below : an URL with unbalanced parethesis and
                           # ending by ')' is put into external parenthesis
                           if ( url[-1]==?) and ((url.count("(") - url.count(")")) < 0 ) )
                             url=url[0..-2] # discard closing parenth from url
                             post = ")"+post # add closing parenth to post
                           end
                           tag = content_tag('a', proto + url, :href => "#{proto=="www."?"http://www.":proto}#{url}", :class => 'external')
                           %(#{leading}#{tag}#{post})
                         end
                       end
                     end
                     # Turns all email addresses into clickable links (code from Rails).
                     def inline_auto_mailto(text)
                       text.gsub!(/([\w\.!#\$%\-+.]+@[A-Za-z0-9\-]+(\.[A-Za-z0-9\-]+)+)/) do
                         mail = $1
                         if text.match(/<a\b[^>]*>(.*)(#{Regexp.escape(mail)})(.*)<\/a>/)
                           mail
                         else
                           content_tag('a', mail, :href => "mailto:#{mail}", :class => "email")
                         end
                       end
                     end
                   end
                 end
               end
             end

test/unit/lib/redmine/wiki_formatting/textile_formatter_test.rb +44 0

             # Redmine - project management software
             # Copyright (C) 2006-2011  Jean-Philippe Lang
             #
             # This program is free software; you can redistribute it and/or
             # modify it under the terms of the GNU General Public License
             # as published by the Free Software Foundation; either version 2
             # of the License, or (at your option) any later version.
             #
             # This program is distributed in the hope that it will be useful,
             # but WITHOUT ANY WARRANTY; without even the implied warranty of
             # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
             # GNU General Public License for more details.
             #
             # You should have received a copy of the GNU General Public License
             # along with this program; if not, write to the Free Software
             # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
             require File.expand_path('../../../../../test_helper', __FILE__)
             require 'digest/md5'
             class Redmine::WikiFormatting::TextileFormatterTest < ActionView::TestCase
               def setup
                 @formatter = Redmine::WikiFormatting::Textile::Formatter
               end
               MODIFIERS = {
                 "*" => 'strong', # bold
                 "_" => 'em',     # italic
                 "+" => 'ins',    # underline
                 "-" => 'del',    # deleted
                 "^" => 'sup',    # superscript
                 "~" => 'sub'     # subscript
               }
               def test_modifiers
                 assert_html_output(
                   '*bold*'                => '<strong>bold</strong>',
                   'before *bold*'         => 'before <strong>bold</strong>',
                   '*bold* after'          => '<strong>bold</strong> after',
                   '*two words*'           => '<strong>two words</strong>',
                   '*two*words*'           => '<strong>two*words</strong>',
                   '*two * words*'         => '<strong>two * words</strong>',
                   '*two* *words*'         => '<strong>two</strong> <strong>words</strong>',
                   '*(two)* *(words)*'     => '<strong>(two)</strong> <strong>(words)</strong>',
                   # with class
                   '*(foo)two words*'      => '<strong class="foo">two words</strong>'
                 )
               end
               def test_modifiers_combination
                 MODIFIERS.each do |m1, tag1|
                   MODIFIERS.each do |m2, tag2|
                     next if m1 == m2
                     text = "#{m2}#{m1}Phrase modifiers#{m1}#{m2}"
                     html = "<#{tag2}><#{tag1}>Phrase modifiers</#{tag1}></#{tag2}>"
                     assert_html_output text => html
                   end
                 end
               end
+              def test_styles
+                # single style
+                assert_html_output({
+                  'p{color:red}. text'           => '<p style="color:red;">text</p>',
+                  'p{color:red;}. text'          => '<p style="color:red;">text</p>',
+                  'p{color: red}. text'          => '<p style="color: red;">text</p>',
+                  'p{color:#f00}. text'          => '<p style="color:#f00;">text</p>',
+                  'p{color:#ff0000}. text'       => '<p style="color:#ff0000;">text</p>',
+                  'p{border:10px}. text'         => '<p style="border:10px;">text</p>',
+                  'p{border:10}. text'           => '<p style="border:10;">text</p>',
+                  'p{border:10%}. text'          => '<p style="border:10%;">text</p>',
+                  'p{border:10em}. text'         => '<p style="border:10em;">text</p>',
+                  'p{border:1.5em}. text'        => '<p style="border:1.5em;">text</p>',
+                  'p{border-left:1px}. text'     => '<p style="border-left:1px;">text</p>',
+                  'p{border-right:1px}. text'    => '<p style="border-right:1px;">text</p>',
+                  'p{border-top:1px}. text'      => '<p style="border-top:1px;">text</p>',
+                  'p{border-bottom:1px}. text'   => '<p style="border-bottom:1px;">text</p>',
+                  }, false)
+                # multiple styles
+                assert_html_output({
+                  'p{color:red; border-top:1px}. text'   => '<p style="color:red;border-top:1px;">text</p>',
+                  'p{color:red ; border-top:1px}. text'  => '<p style="color:red;border-top:1px;">text</p>',
+                  'p{color:red;border-top:1px}. text'    => '<p style="color:red;border-top:1px;">text</p>',
+                  }, false)
+                # styles with multiple values
+                assert_html_output({
+                  'p{border:1px solid red;}. text'             => '<p style="border:1px solid red;">text</p>',
+                  'p{border-top-left-radius: 10px 5px;}. text' => '<p style="border-top-left-radius: 10px 5px;">text</p>',
+                  }, false)
+              end
+              def test_invalid_styles_should_be_filtered
+                assert_html_output({
+                  'p{invalid}. text'                     => '<p>text</p>',
+                  'p{invalid:red}. text'                 => '<p>text</p>',
+                  'p{color:(red)}. text'                 => '<p>text</p>',
+                  'p{color:red;invalid:blue}. text'      => '<p style="color:red;">text</p>',
+                  'p{invalid:blue;color:red}. text'      => '<p style="color:red;">text</p>',
+                  'p{color:"}. text'                     => '<p>text</p>',
+                  }, false)
+              end
               def test_inline_code
                 assert_html_output(
                   'this is @some code@'      => 'this is <code>some code</code>',
                   '@<Location /redmine>@'    => '<code>&lt;Location /redmine&gt;</code>'
                 )
               end
               def test_escaping
                 assert_html_output(
                   'this is a <script>'      => 'this is a &lt;script&gt;'
                 )
               end
               def test_use_of_backslashes_followed_by_numbers_in_headers
                 assert_html_output({
                   'h1. 2009\02\09'      => '<h1>2009\02\09</h1>'
                 }, false)
               end
               def test_double_dashes_should_not_strikethrough
                 assert_html_output(
                   'double -- dashes -- test'  => 'double -- dashes -- test',
                   'double -- *dashes* -- test'  => 'double -- <strong>dashes</strong> -- test'
                 )
               end
               def test_acronyms
                 assert_html_output(
                   'this is an acronym: GPL(General Public License)' => 'this is an acronym: <acronym title="General Public License">GPL</acronym>',
                   '2 letters JP(Jean-Philippe) acronym' => '2 letters <acronym title="Jean-Philippe">JP</acronym> acronym',
                   'GPL(This is a double-quoted "title")' => '<acronym title="This is a double-quoted &quot;title&quot;">GPL</acronym>'
                 )
               end
               def test_blockquote
                 # orig raw text
                 raw = <<-RAW
             John said:
             > Lorem ipsum dolor sit amet, consectetuer adipiscing elit. Maecenas sed libero.
             > Nullam commodo metus accumsan nulla. Curabitur lobortis dui id dolor.
             > * Donec odio lorem,
             > * sagittis ac,
             > * malesuada in,
             > * adipiscing eu, dolor.
             >
             > >Nulla varius pulvinar diam. Proin id arcu id lorem scelerisque condimentum. Proin vehicula turpis vitae lacus.
             > Proin a tellus. Nam vel neque.
             He's right.
             RAW
                 # expected html
                 expected = <<-EXPECTED
             <p>John said:</p>
             <blockquote>
             Lorem ipsum dolor sit amet, consectetuer adipiscing elit. Maecenas sed libero.<br />
             Nullam commodo metus accumsan nulla. Curabitur lobortis dui id dolor.
             <ul>
               <li>Donec odio lorem,</li>
               <li>sagittis ac,</li>
               <li>malesuada in,</li>
               <li>adipiscing eu, dolor.</li>
             </ul>
             <blockquote>
             <p>Nulla varius pulvinar diam. Proin id arcu id lorem scelerisque condimentum. Proin vehicula turpis vitae lacus.</p>
             </blockquote>
             <p>Proin a tellus. Nam vel neque.</p>
             </blockquote>
             <p>He's right.</p>
             EXPECTED
                 assert_equal expected.gsub(%r{\s+}, ''), to_html(raw).gsub(%r{\s+}, '')
               end
               def test_table
                 raw = <<-RAW
             This is a table with empty cells:
             |cell11|cell12||
             |cell21||cell23|
             |cell31|cell32|cell33|
             RAW
                 expected = <<-EXPECTED
             <p>This is a table with empty cells:</p>
             <table>
               <tr><td>cell11</td><td>cell12</td><td></td></tr>
               <tr><td>cell21</td><td></td><td>cell23</td></tr>
               <tr><td>cell31</td><td>cell32</td><td>cell33</td></tr>
             </table>
             EXPECTED
                 assert_equal expected.gsub(%r{\s+}, ''), to_html(raw).gsub(%r{\s+}, '')
               end
               def test_table_with_line_breaks
                 raw = <<-RAW
             This is a table with line breaks:
             |cell11
             continued|cell12||
             |-cell21-||cell23
             cell23 line2
             cell23 *line3*|
             |cell31|cell32
             cell32 line2|cell33|
             RAW
                 expected = <<-EXPECTED
             <p>This is a table with line breaks:</p>
             <table>
               <tr>
                 <td>cell11<br />continued</td>
                 <td>cell12</td>
                 <td></td>
               </tr>
               <tr>
                 <td><del>cell21</del></td>
                 <td></td>
                 <td>cell23<br/>cell23 line2<br/>cell23 <strong>line3</strong></td>
               </tr>
               <tr>
                 <td>cell31</td>
                 <td>cell32<br/>cell32 line2</td>
                 <td>cell33</td>
               </tr>
             </table>
             EXPECTED
                 assert_equal expected.gsub(%r{\s+}, ''), to_html(raw).gsub(%r{\s+}, '')
               end
               def test_textile_should_not_mangle_brackets
                 assert_equal '<p>[msg1][msg2]</p>', to_html('[msg1][msg2]')
               end
               def test_textile_should_escape_image_urls
                 # this is onclick="alert('XSS');" in encoded form
                 raw = '!/images/comment.png"onclick=&#x61;&#x6c;&#x65;&#x72;&#x74;&#x28;&#x27;&#x58;&#x53;&#x53;&#x27;&#x29;;&#x22;!'
                 expected = '<p><img src="/images/comment.png&quot;onclick=&amp;#x61;&amp;#x6c;&amp;#x65;&amp;#x72;&amp;#x74;&amp;#x28;&amp;#x27;&amp;#x58;&amp;#x53;&amp;#x53;&amp;#x27;&amp;#x29;;&amp;#x22;" alt="" /></p>'
                 assert_equal expected.gsub(%r{\s+}, ''), to_html(raw).gsub(%r{\s+}, '')
               end
               STR_WITHOUT_PRE = [
               # 0
             "h1. Title
             Lorem ipsum dolor sit amet, consectetuer adipiscing elit. Maecenas sed libero.",
               # 1
             "h2. Heading 2
             Maecenas sed elit sit amet mi accumsan vestibulum non nec velit. Proin porta tincidunt lorem, consequat rhoncus dolor fermentum in.
             Cras ipsum felis, ultrices at porttitor vel, faucibus eu nunc.",
               # 2
             "h2. Heading 2
             Morbi facilisis accumsan orci non pharetra.
             h3. Heading 3
             Nulla nunc nisi, egestas in ornare vel, posuere ac libero.",
               # 3
             "h3. Heading 3
             Praesent eget turpis nibh, a lacinia nulla.",
               # 4
             "h2. Heading 2
             Ut rhoncus elementum adipiscing."]
               TEXT_WITHOUT_PRE = STR_WITHOUT_PRE.join("\n\n").freeze
               def test_get_section_should_return_the_requested_section_and_its_hash
                 assert_section_with_hash STR_WITHOUT_PRE[1], TEXT_WITHOUT_PRE, 2
                 assert_section_with_hash STR_WITHOUT_PRE[2..3].join("\n\n"), TEXT_WITHOUT_PRE, 3
                 assert_section_with_hash STR_WITHOUT_PRE[3], TEXT_WITHOUT_PRE, 5
                 assert_section_with_hash STR_WITHOUT_PRE[4], TEXT_WITHOUT_PRE, 6
                 assert_section_with_hash '', TEXT_WITHOUT_PRE, 0
                 assert_section_with_hash '', TEXT_WITHOUT_PRE, 10
               end
               def test_update_section_should_update_the_requested_section
                 replacement = "New text"
                 assert_equal [STR_WITHOUT_PRE[0], replacement, STR_WITHOUT_PRE[2..4]].flatten.join("\n\n"), @formatter.new(TEXT_WITHOUT_PRE).update_section(2, replacement)
                 assert_equal [STR_WITHOUT_PRE[0..1], replacement, STR_WITHOUT_PRE[4]].flatten.join("\n\n"), @formatter.new(TEXT_WITHOUT_PRE).update_section(3, replacement)
                 assert_equal [STR_WITHOUT_PRE[0..2], replacement, STR_WITHOUT_PRE[4]].flatten.join("\n\n"), @formatter.new(TEXT_WITHOUT_PRE).update_section(5, replacement)
                 assert_equal [STR_WITHOUT_PRE[0..3], replacement].flatten.join("\n\n"), @formatter.new(TEXT_WITHOUT_PRE).update_section(6, replacement)
                 assert_equal TEXT_WITHOUT_PRE, @formatter.new(TEXT_WITHOUT_PRE).update_section(0, replacement)
                 assert_equal TEXT_WITHOUT_PRE, @formatter.new(TEXT_WITHOUT_PRE).update_section(10, replacement)
               end
               def test_update_section_with_hash_should_update_the_requested_section
                 replacement = "New text"
                 assert_equal [STR_WITHOUT_PRE[0], replacement, STR_WITHOUT_PRE[2..4]].flatten.join("\n\n"),
                   @formatter.new(TEXT_WITHOUT_PRE).update_section(2, replacement, Digest::MD5.hexdigest(STR_WITHOUT_PRE[1]))
               end
               def test_update_section_with_wrong_hash_should_raise_an_error
                 assert_raise Redmine::WikiFormatting::StaleSectionError do
                   @formatter.new(TEXT_WITHOUT_PRE).update_section(2, "New text", Digest::MD5.hexdigest("Old text"))
                 end
               end
               STR_WITH_PRE = [
               # 0
             "h1. Title
             Lorem ipsum dolor sit amet, consectetuer adipiscing elit. Maecenas sed libero.",
               # 1
             "h2. Heading 2
             <pre><code class=\"ruby\">
               def foo
               end
             </code></pre>
             <pre><code><pre><code class=\"ruby\">
               Place your code here.
             </code></pre>
             </code></pre>
             Morbi facilisis accumsan orci non pharetra.
             <pre>
             Pre Content:
             h2. Inside pre
             <tag> inside pre block
             Morbi facilisis accumsan orci non pharetra.
             </pre>",
               # 2
             "h3. Heading 3
             Nulla nunc nisi, egestas in ornare vel, posuere ac libero."]
               def test_get_section_should_ignore_pre_content
                 text = STR_WITH_PRE.join("\n\n")
                 assert_section_with_hash STR_WITH_PRE[1..2].join("\n\n"), text, 2
                 assert_section_with_hash STR_WITH_PRE[2], text, 3
               end
               def test_update_section_should_not_escape_pre_content_outside_section
                 text = STR_WITH_PRE.join("\n\n")
                 replacement = "New text"
                 assert_equal [STR_WITH_PRE[0..1], "New text"].flatten.join("\n\n"),
                   @formatter.new(text).update_section(3, replacement)
               end
               private
               def assert_html_output(to_test, expect_paragraph = true)
                 to_test.each do |text, expected|
                   assert_equal(( expect_paragraph ? "<p>#{expected}</p>" : expected ), @formatter.new(text).to_html, "Formatting the following text failed:\n===\n#{text}\n===\n")
                 end
               end
               def to_html(text)
                 @formatter.new(text).to_html
               end
               def assert_section_with_hash(expected, text, index)
                 result = @formatter.new(text).get_section(index)
                 assert_kind_of Array, result
                 assert_equal 2, result.size
                 assert_equal expected, result.first, "section content did not match"
                 assert_equal Digest::MD5.hexdigest(expected), result.last, "section hash did not match"
               end
             end

General Comments 0

Write
Preview

You need to be logged in to leave comments. Login now

No TODOs yet

	Site-wide shortcuts
/	Use quick search box
g h	Goto home page
g g	Goto my private gists page
g G	Goto my public gists page
g 0-9	Goto bookmarked items from 0-9
n r	New repository page
n g	New gist page

	Repositories
g s	Goto summary page
g c	Goto changelog page
g f	Goto files page
g F	Goto files page with file search activated
g p	Goto pull requests page
g o	Goto repository settings
g O	Goto repository access permissions settings
t s	Toggle sidebar on some pages