##// END OF EJS Templates
Do not sanitize escaped text in NullFormatter....
Jean-Philippe Lang -
r9348:6d41de61a5e5
parent child
Show More
@@ -1,171 +1,171
1 1 # Redmine - project management software
2 2 # Copyright (C) 2006-2011 Jean-Philippe Lang
3 3 #
4 4 # This program is free software; you can redistribute it and/or
5 5 # modify it under the terms of the GNU General Public License
6 6 # as published by the Free Software Foundation; either version 2
7 7 # of the License, or (at your option) any later version.
8 8 #
9 9 # This program is distributed in the hope that it will be useful,
10 10 # but WITHOUT ANY WARRANTY; without even the implied warranty of
11 11 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
12 12 # GNU General Public License for more details.
13 13 #
14 14 # You should have received a copy of the GNU General Public License
15 15 # along with this program; if not, write to the Free Software
16 16 # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
17 17
18 18 module Redmine
19 19 module WikiFormatting
20 20 class StaleSectionError < Exception; end
21 21
22 22 @@formatters = {}
23 23
24 24 class << self
25 25 def map
26 26 yield self
27 27 end
28 28
29 29 def register(name, formatter, helper)
30 30 raise ArgumentError, "format name '#{name}' is already taken" if @@formatters[name.to_s]
31 31 @@formatters[name.to_s] = {:formatter => formatter, :helper => helper}
32 32 end
33 33
34 34 def formatter
35 35 formatter_for(Setting.text_formatting)
36 36 end
37 37
38 38 def formatter_for(name)
39 39 entry = @@formatters[name.to_s]
40 40 (entry && entry[:formatter]) || Redmine::WikiFormatting::NullFormatter::Formatter
41 41 end
42 42
43 43 def helper_for(name)
44 44 entry = @@formatters[name.to_s]
45 45 (entry && entry[:helper]) || Redmine::WikiFormatting::NullFormatter::Helper
46 46 end
47 47
48 48 def format_names
49 49 @@formatters.keys.map
50 50 end
51 51
52 52 def to_html(format, text, options = {})
53 53 text = if Setting.cache_formatted_text? && text.size > 2.kilobyte && cache_store && cache_key = cache_key_for(format, options[:object], options[:attribute])
54 54 # Text retrieved from the cache store may be frozen
55 55 # We need to dup it so we can do in-place substitutions with gsub!
56 56 cache_store.fetch cache_key do
57 57 formatter_for(format).new(text).to_html
58 58 end.dup
59 59 else
60 60 formatter_for(format).new(text).to_html
61 61 end
62 62 text
63 63 end
64 64
65 65 # Returns true if the text formatter supports single section edit
66 66 def supports_section_edit?
67 67 (formatter.instance_methods & ['update_section', :update_section]).any?
68 68 end
69 69
70 70 # Returns a cache key for the given text +format+, +object+ and +attribute+ or nil if no caching should be done
71 71 def cache_key_for(format, object, attribute)
72 72 if object && attribute && !object.new_record? && object.respond_to?(:updated_on) && !format.blank?
73 73 "formatted_text/#{format}/#{object.class.model_name.cache_key}/#{object.id}-#{attribute}-#{object.updated_on.to_s(:number)}"
74 74 end
75 75 end
76 76
77 77 # Returns the cache store used to cache HTML output
78 78 def cache_store
79 79 ActionController::Base.cache_store
80 80 end
81 81 end
82 82
83 83 module LinksHelper
84 84 AUTO_LINK_RE = %r{
85 85 ( # leading text
86 86 <\w+.*?>| # leading HTML tag, or
87 87 [^=<>!:'"/]| # leading punctuation, or
88 88 ^ # beginning of line
89 89 )
90 90 (
91 91 (?:https?://)| # protocol spec, or
92 92 (?:s?ftps?://)|
93 93 (?:www\.) # www.*
94 94 )
95 95 (
96 96 (\S+?) # url
97 97 (\/)? # slash
98 98 )
99 99 ((?:&gt;)?|[^\w\=\/;\(\)]*?) # post
100 100 (?=<|\s|$)
101 101 }x unless const_defined?(:AUTO_LINK_RE)
102 102
103 103 # Destructively remplaces urls into clickable links
104 104 def auto_link!(text)
105 105 text.gsub!(AUTO_LINK_RE) do
106 106 all, leading, proto, url, post = $&, $1, $2, $3, $6
107 107 if leading =~ /<a\s/i || leading =~ /![<>=]?/
108 108 # don't replace URL's that are already linked
109 109 # and URL's prefixed with ! !> !< != (textile images)
110 110 all
111 111 else
112 112 # Idea below : an URL with unbalanced parethesis and
113 113 # ending by ')' is put into external parenthesis
114 114 if ( url[-1]==?) and ((url.count("(") - url.count(")")) < 0 ) )
115 115 url=url[0..-2] # discard closing parenth from url
116 116 post = ")"+post # add closing parenth to post
117 117 end
118 118 content = proto + url
119 119 href = "#{proto=="www."?"http://www.":proto}#{url}"
120 120 %(#{leading}<a class="external" href="#{ERB::Util.html_escape href}">#{ERB::Util.html_escape content}</a>#{post}).html_safe
121 121 end
122 122 end
123 123 end
124 124
125 125 # Destructively remplaces email addresses into clickable links
126 126 def auto_mailto!(text)
127 127 text.gsub!(/([\w\.!#\$%\-+.]+@[A-Za-z0-9\-]+(\.[A-Za-z0-9\-]+)+)/) do
128 128 mail = $1
129 129 if text.match(/<a\b[^>]*>(.*)(#{Regexp.escape(mail)})(.*)<\/a>/)
130 130 mail
131 131 else
132 132 %(<a class="email" href="mailto:#{ERB::Util.html_escape mail}">#{ERB::Util.html_escape mail}</a>).html_safe
133 133 end
134 134 end
135 135 end
136 136 end
137 137
138 138 # Default formatter module
139 139 module NullFormatter
140 140 class Formatter
141 141 include ActionView::Helpers::TagHelper
142 142 include ActionView::Helpers::TextHelper
143 143 include ActionView::Helpers::UrlHelper
144 144 include Redmine::WikiFormatting::LinksHelper
145 145
146 146 def initialize(text)
147 147 @text = text
148 148 end
149 149
150 150 def to_html(*args)
151 151 t = CGI::escapeHTML(@text)
152 152 auto_link!(t)
153 153 auto_mailto!(t)
154 simple_format(t)
154 simple_format(t, {}, :sanitize => false)
155 155 end
156 156 end
157 157
158 158 module Helper
159 159 def wikitoolbar_for(field_id)
160 160 end
161 161
162 162 def heads_for_wiki_formatter
163 163 end
164 164
165 165 def initial_page_content(page)
166 166 page.pretty_title.to_s
167 167 end
168 168 end
169 169 end
170 170 end
171 171 end
General Comments 0
You need to be logged in to leave comments. Login now