Fix XSS via unescaped lang attribute and tighten lang/id parsing

The lang token value was captured with trim() instead of the regex
capture group, allowing extra characters after the language code t

Fix XSS via unescaped lang attribute and tighten lang/id parsing

The lang token value was captured with trim() instead of the regex
capture group, allowing extra characters after the language code to
survive, and it was written into the lang/xml:lang attributes without
hsc() escaping. A page editor could inject arbitrary HTML attributes,
e.g. <wrap :en"onmouseover="...>.

The patch uses the regex capture group for both lang and id, so only
well-formed tokens match. hsc() on the lang output is added as safety
guard. Both, id and lang patterns are also achored to the start of the
string for stricter parsing ("foo:en" is no longer matched as a language
setting).

Note: the patch has been kept deliberatly simple. Further refactoring to
use buildAttributes() when creating the HTML could simplify the output
escape mechanisms.

The vulnerability was originally reported by "TrackerUser" via email.

show more ...

Merge pull request #250 from saschaleib/saschaleib-patch-language-dir

Improvements to the language and writing direction detection

Fix PHP warning in helper.php on line 398.

Fixed issue #267: PHP warnings about margins in helper.php.

Workaround for framebox overlap (ODT)

Update helper.php

PHP8 Warning on ODT export fix

Fix "Empty regular expression" PHP8 Warning

Improvements to the language and writing direction detection

This code changes the way `:lang` attributes are handled, allowing more flexibility, including a possible Script specification, as specif

Improvements to the language and writing direction detection

This code changes the way `:lang` attributes are handled, allowing more flexibility, including a possible Script specification, as specified in BCP 47.

The direction specification (è.g. `dir="rtl"`) now uses the language code as a default, but allows the script specification to override this when needed.

A side effect of this change is that the additional config file is no longer needed.

show more ...

escape seems not needed in this regexp

static column_count not used. It was used as attribute

And static not needed because the helper is already an instance that is
reused

cleanup requires and defines

isset($var=false)=true. Should be initialized to null.

Set default values in attr array.

Change PHP keywords to comply with PSR2

Signed-off-by: CodeLingoBot <bot@codelingo.io>

Deprecate emulated headlines

Introduce new config option 'emulatedHeadlines', set to false by default,
to deprecate emulated headlines.
The plan is to remove them altogether after two years.

Simplify `getAttributes()` param to ignore noPrefix

Refactor to make the change in only one line earlier in the function.
Remove double negative by renaming parameter.

Fixed broken ODT export for columns if 'group' is not in 'noPrefix'

Added optional parameter '$ignoreNoPrefix' to function 'getAttributes()'.
In this way the ODT helper can query all wrap classes wi

Fixed broken ODT export for columns if 'group' is not in 'noPrefix'

Added optional parameter '$ignoreNoPrefix' to function 'getAttributes()'.
In this way the ODT helper can query all wrap classes with prefix independent
of the config setting 'noPrefix'. If the parameter is omitted, the function
will behave like before this commit.

show more ...

use logical XOR (exclusive OR) operator for class name restriction

allow wildcards (?,*) to specify restrictedClasses

allow wildcards (?,*) to specify noPrefix classes

implement simple converter as anonymous function that builds regular
expression from class name list (csv). use preg_match() instead of
in_array()

allow wildcards (?,*) to specify noPrefix classes

implement simple converter as anonymous function that builds regular
expression from class name list (csv). use preg_match() instead of
in_array() to see if "wrap_" prefix is required.

show more ...

add more modern width units (rem, ch, vw, vh)

ODT export: fixed indented columns

On export to ODT give a table including columns 100% width and ignore the
width imported from the CSS classes (e.g. class 'third').

Implemented simple floating for boxes/containers.

This means floating works well if there are just one or two frames on the same y position/height.
What does not work well is the case that there are

Implemented simple floating for boxes/containers.

This means floating works well if there are just one or two frames on the same y position/height.
What does not work well is the case that there are too much frames and they do not fit in on the
same 'line' so that some would need to be wrapped below the other frames. In that case frames will overlap.

This makes the wrap example page look quite ugly regarding frames.
But it works well if you have got just a text paragraph and e.g. one frame to include a picture
or table which shall be surrounded by the text of the paragraph.

show more ...

Adjustment for ODT redesign branch and minor improvements:
- support for text direction (ltr or rtl)
- render boxes as tables (so we lose round corners but get formating inside of the boxes)
- Paragr

Adjustment for ODT redesign branch and minor improvements:
- support for text direction (ltr or rtl)
- render boxes as tables (so we lose round corners but get formating inside of the boxes)
- Paragraph and Span styles will be editable in LibreOffice after export

show more ...

Re-factored ODT export:
- Moved specific code from div.php and span.php to helper.php
- Reworked code, now using getAttributes() function instead of buildAttributes()

Conflicts:
syntax/div.php
syn

Re-factored ODT export:
- Moved specific code from div.php and span.php to helper.php
- Reworked code, now using getAttributes() function instead of buildAttributes()

Conflicts:
syntax/div.php
syntax/span.php

show more ...