Merge pull request #491 from ArthurHoaro/markdown-escape2

Markdown: don't escape content + sanitize sensible tags

diff --git a/application/LinkDB.php b/application/LinkDB.php
index 9f4d3e3cc7b4fabb23750fda02427ad23612b14d..9488ac4582532f770da99072c52f0f02b12bea0a 100644 (file)
--- a/application/LinkDB.php
+++ b/application/LinkDB.php
@@ -32,6 +32,9 @@ class LinkDB implements Iterator, Countable, ArrayAccess
     // Links are stored as a PHP serialized string
     private $_datastore;
 
+    // Link date storage format
+    const LINK_DATE_FORMAT = 'Ymd_His';
+
     // Datastore PHP prefix
     protected static $phpPrefix = '<?php /* ';
 

diff --git a/application/Utils.php b/application/Utils.php
index 868946df756d98c1a726350cd524556e48b4a667..3d819716316e78f1a884cb662723668a1529560d 100644 (file)
--- a/application/Utils.php
+++ b/application/Utils.php
@@ -229,3 +229,28 @@ function space2nbsp($text)
 function format_description($description, $redirector) {
     return nl2br(space2nbsp(text2clickable($description, $redirector)));
 }
+
+/**
+ * Sniff browser language to set the locale automatically.
+ * Note that is may not work on your server if the corresponding locale is not installed.
+ *
+ * @param string $headerLocale Locale send in HTTP headers (e.g. "fr,fr-fr;q=0.8,en;q=0.5,en-us;q=0.3").
+ **/
+function autoLocale($headerLocale)
+{
+    // Default if browser does not send HTTP_ACCEPT_LANGUAGE
+    $attempts = array('en_US');
+    if (isset($headerLocale)) {
+        // (It's a bit crude, but it works very well. Preferred language is always presented first.)
+        if (preg_match('/([a-z]{2})-?([a-z]{2})?/i', $headerLocale, $matches)) {
+            $loc = $matches[1] . (!empty($matches[2]) ? '_' . strtoupper($matches[2]) : '');
+            $attempts = array(
+                $loc.'.UTF-8', $loc, str_replace('_', '-', $loc).'.UTF-8', str_replace('_', '-', $loc),
+                $loc . '_' . strtoupper($loc).'.UTF-8', $loc . '_' . strtoupper($loc),
+                $loc . '_' . $loc.'.UTF-8', $loc . '_' . $loc, $loc . '-' . strtoupper($loc).'.UTF-8',
+                $loc . '-' . strtoupper($loc), $loc . '-' . $loc.'.UTF-8', $loc . '-' . $loc
+            );
+        }
+    }
+    setlocale(LC_ALL, $attempts);
+}
\ No newline at end of file

diff --git a/inc/shaarli.css b/inc/shaarli.css
index 8a7409b23df05dc4160eefb559d0cd9b5a9db31c..1be4d752b0c3b5f173cfe8b6c12593daf51de462 100644 (file)
--- a/inc/shaarli.css
+++ b/inc/shaarli.css
@@ -1147,6 +1147,10 @@ ul.errors {
     margin: 10px 0;
 }
 
+#pluginsadmin label {
+    cursor: pointer;
+}
+
 #pluginsadmin .plugin_parameter {
     padding: 5px 0;
     border-width: 1px 0;

diff --git a/index.php b/index.php
index 3a63319c63027fd3873896f9b1a3f12d9a5bd26a..a9264cbb9f7d99db16477fc4d4cf14afad4dbff0 100644 (file)
--- a/index.php
+++ b/index.php
@@ -268,7 +268,7 @@ $GLOBALS['redirector'] = !empty($GLOBALS['redirector']) ? escape($GLOBALS['redir
 // a token depending of deployment salt, user password, and the current ip
 define('STAY_SIGNED_IN_TOKEN', sha1($GLOBALS['hash'].$_SERVER["REMOTE_ADDR"].$GLOBALS['salt']));
 
-autoLocale(); // Sniff browser language and set date format accordingly.
+autoLocale($_SERVER['HTTP_ACCEPT_LANGUAGE']); // Sniff browser language and set date format accordingly.
 header('Content-Type: text/html; charset=utf-8'); // We use UTF-8 for proper international characters handling.
 
 //==================================================================================================
@@ -315,26 +315,6 @@ function setup_login_state() {
 }
 $userIsLoggedIn = setup_login_state();
 
-
-// ------------------------------------------------------------------------------------------
-// Sniff browser language to display dates in the right format automatically.
-// (Note that is may not work on your server if the corresponding local is not installed.)
-function autoLocale()
-{
-    $attempts = array('en_US'); // Default if browser does not send HTTP_ACCEPT_LANGUAGE
-    if (isset($_SERVER['HTTP_ACCEPT_LANGUAGE'])) // e.g. "fr,fr-fr;q=0.8,en;q=0.5,en-us;q=0.3"
-    {   // (It's a bit crude, but it works very well. Preferred language is always presented first.)
-        if (preg_match('/([a-z]{2})-?([a-z]{2})?/i',$_SERVER['HTTP_ACCEPT_LANGUAGE'],$matches)) {
-            $loc = $matches[1] . (!empty($matches[2]) ? '_' . strtoupper($matches[2]) : '');
-            $attempts = array($loc.'.UTF-8', $loc, str_replace('_', '-', $loc).'.UTF-8', str_replace('_', '-', $loc),
-                $loc . '_' . strtoupper($loc).'.UTF-8', $loc . '_' . strtoupper($loc),
-                $loc . '_' . $loc.'.UTF-8', $loc . '_' . $loc, $loc . '-' . strtoupper($loc).'.UTF-8',
-                $loc . '-' . strtoupper($loc), $loc . '-' . $loc.'.UTF-8', $loc . '-' . $loc);
-        }
-    }
-    setlocale(LC_TIME, $attempts);  // LC_TIME = Set local for date/time format only.
-}
-
 // ------------------------------------------------------------------------------------------
 // PubSubHubbub protocol support (if enabled)  [UNTESTED]
 // (Source: http://aldarone.fr/les-flux-rss-shaarli-et-pubsubhubbub/ )
@@ -551,33 +531,6 @@ function getMaxFileSize()
     return $maxsize;
 }
 
-/*  Converts a linkdate time (YYYYMMDD_HHMMSS) of an article to a timestamp (Unix epoch)
-    (used to build the ADD_DATE attribute in Netscape-bookmarks file)
-    PS: I could have used strptime(), but it does not exist on Windows. I'm too kind. */
-function linkdate2timestamp($linkdate)
-{
-    if(strcmp($linkdate, '_000000') !== 0 || !$linkdate){
-        $Y=$M=$D=$h=$m=$s=0;
-        $r = sscanf($linkdate,'%4d%2d%2d_%2d%2d%2d',$Y,$M,$D,$h,$m,$s);
-        return mktime($h,$m,$s,$M,$D,$Y);
-    }
-    return time();
-}
-
-/*  Converts a linkdate time (YYYYMMDD_HHMMSS) of an article to a RFC822 date.
-    (used to build the pubDate attribute in RSS feed.)  */
-function linkdate2rfc822($linkdate)
-{
-    return date('r',linkdate2timestamp($linkdate)); // 'r' is for RFC822 date format.
-}
-
-/*  Converts a linkdate time (YYYYMMDD_HHMMSS) of an article to a ISO 8601 date.
-    (used to build the updated tags in ATOM feed.)  */
-function linkdate2iso8601($linkdate)
-{
-    return date('c',linkdate2timestamp($linkdate)); // 'c' is for ISO 8601 date format.
-}
-
 // ------------------------------------------------------------------------------------------
 // Token management for XSRF protection
 // Token should be used in any form which acts on data (create,update,delete,import...).
@@ -769,14 +722,16 @@ function showRSS()
     {
         $link = $linksToDisplay[$keys[$i]];
         $guid = $pageaddr.'?'.smallHash($link['linkdate']);
-        $rfc822date = linkdate2rfc822($link['linkdate']);
+        $date = DateTime::createFromFormat(LinkDB::LINK_DATE_FORMAT, $link['linkdate']);
         $absurl = $link['url'];
         if (startsWith($absurl,'?')) $absurl=$pageaddr.$absurl;  // make permalink URL absolute
         if ($usepermalinks===true)
             echo '<item><title>'.$link['title'].'</title><guid isPermaLink="true">'.$guid.'</guid><link>'.$guid.'</link>';
         else
             echo '<item><title>'.$link['title'].'</title><guid isPermaLink="false">'.$guid.'</guid><link>'.$absurl.'</link>';
-        if (!$GLOBALS['config']['HIDE_TIMESTAMPS'] || isLoggedIn()) echo '<pubDate>'.escape($rfc822date)."</pubDate>\n";
+        if (!$GLOBALS['config']['HIDE_TIMESTAMPS'] || isLoggedIn()) {
+            echo '<pubDate>'.escape($date->format(DateTime::RSS))."</pubDate>\n";
+        }
         if ($link['tags']!='') // Adding tags to each RSS entry (as mentioned in RSS specification)
         {
             foreach(explode(' ',$link['tags']) as $tag) { echo '<category domain="'.$pageaddr.'">'.$tag.'</category>'."\n"; }
@@ -857,8 +812,9 @@ function showATOM()
     {
         $link = $linksToDisplay[$keys[$i]];
         $guid = $pageaddr.'?'.smallHash($link['linkdate']);
-        $iso8601date = linkdate2iso8601($link['linkdate']);
-        $latestDate = max($latestDate,$iso8601date);
+        $date = DateTime::createFromFormat(LinkDB::LINK_DATE_FORMAT, $link['linkdate']);
+        $iso8601date = $date->format(DateTime::ISO8601);
+        $latestDate = max($latestDate, $iso8601date);
         $absurl = $link['url'];
         if (startsWith($absurl,'?')) $absurl=$pageaddr.$absurl;  // make permalink URL absolute
         $entries.='<entry><title>'.$link['title'].'</title>';
@@ -866,7 +822,10 @@ function showATOM()
             $entries.='<link href="'.$guid.'" /><id>'.$guid.'</id>';
         else
             $entries.='<link href="'.$absurl.'" /><id>'.$guid.'</id>';
-        if (!$GLOBALS['config']['HIDE_TIMESTAMPS'] || isLoggedIn()) $entries.='<updated>'.escape($iso8601date).'</updated>';
+
+        if (!$GLOBALS['config']['HIDE_TIMESTAMPS'] || isLoggedIn()) {
+            $entries.='<updated>'.escape($iso8601date).'</updated>';
+        }
 
         // Add permalink in description
         $descriptionlink = '(<a href="'.$guid.'">Permalink</a>)';
@@ -972,8 +931,7 @@ function showDailyRSS() {
 
     // For each day.
     foreach ($days as $day => $linkdates) {
-        $daydate = linkdate2timestamp($day.'_000000'); // Full text date
-        $rfc822date = linkdate2rfc822($day.'_000000');
+        $dayDate = DateTime::createFromFormat(LinkDB::LINK_DATE_FORMAT, $day.'_000000');
         $absurl = escape(index_url($_SERVER).'?do=daily&day='.$day);  // Absolute URL of the corresponding "Daily" page.
 
         // Build the HTML body of this RSS entry.
@@ -986,7 +944,8 @@ function showDailyRSS() {
             $l = $LINKSDB[$linkdate];
             $l['formatedDescription'] = format_description($l['description'], $GLOBALS['redirector']);
             $l['thumbnail'] = thumbnail($l['url']);
-            $l['timestamp'] = linkdate2timestamp($l['linkdate']);
+            $l_date = DateTime::createFromFormat(LinkDB::LINK_DATE_FORMAT, $l['linkdate']);
+            $l['timestamp'] = $l_date->getTimestamp();
             if (startsWith($l['url'], '?')) {
                 $l['url'] = index_url($_SERVER) . $l['url'];  // make permalink URL absolute
             }
@@ -996,10 +955,10 @@ function showDailyRSS() {
         // Then build the HTML for this day:
         $tpl = new RainTPL;
         $tpl->assign('title', $GLOBALS['title']);
-        $tpl->assign('daydate', $daydate);
+        $tpl->assign('daydate', $dayDate->getTimestamp());
         $tpl->assign('absurl', $absurl);
         $tpl->assign('links', $links);
-        $tpl->assign('rfc822date', escape($rfc822date));
+        $tpl->assign('rssdate', escape($dayDate->format(DateTime::RSS)));
         $html = $tpl->draw('dailyrss', $return_string=true);
 
         echo $html . PHP_EOL;
@@ -1055,7 +1014,8 @@ function showDaily($pageBuilder)
         $linksToDisplay[$key]['taglist']=$taglist;
         $linksToDisplay[$key]['formatedDescription'] = format_description($link['description'], $GLOBALS['redirector']);
         $linksToDisplay[$key]['thumbnail'] = thumbnail($link['url']);
-        $linksToDisplay[$key]['timestamp'] = linkdate2timestamp($link['linkdate']);
+        $date = DateTime::createFromFormat(LinkDB::LINK_DATE_FORMAT, $link['linkdate']);
+        $linksToDisplay[$key]['timestamp'] = $date->getTimestamp();
     }
 
     /* We need to spread the articles on 3 columns.
@@ -1080,11 +1040,12 @@ function showDaily($pageBuilder)
         $fill[$index]+=$length;
     }
 
+    $dayDate = DateTime::createFromFormat(LinkDB::LINK_DATE_FORMAT, $day.'_000000');
     $data = array(
         'linksToDisplay' => $linksToDisplay,
         'linkcount' => count($LINKSDB),
         'cols' => $columns,
-        'day' => linkdate2timestamp($day.'_000000'),
+        'day' => $dayDate->getTimestamp(),
         'previousday' => $previousday,
         'nextday' => $nextday,
     );
@@ -1238,11 +1199,12 @@ function renderPage()
         uksort($tags, function($a, $b) {
             // Collator is part of PHP intl.
             if (class_exists('Collator')) {
-                $c = new Collator(setlocale(LC_ALL, 0));
-                return $c->compare($a, $b);
-            } else {
-                return strcasecmp($a, $b);
+                $c = new Collator(setlocale(LC_COLLATE, 0));
+                if (!intl_is_failure(intl_get_error_code())) {
+                    return $c->compare($a, $b);
+                }
             }
+            return strcasecmp($a, $b);
         });
 
         $tagList=array();
@@ -1588,7 +1550,7 @@ function renderPage()
         $link = array(
             'title' => trim($_POST['lf_title']),
             'url' => $url,
-            'description' => trim($_POST['lf_description']),
+            'description' => $_POST['lf_description'],
             'private' => (isset($_POST['lf_private']) ? 1 : 0),
             'linkdate' => $linkdate,
             'tags' => str_replace(',', ' ', $tags)
@@ -1799,7 +1761,8 @@ HTML;
                ($exportWhat=='private' && $link['private']!=0) ||
                ($exportWhat=='public' && $link['private']==0))
             {
-                echo '<DT><A HREF="'.$link['url'].'" ADD_DATE="'.linkdate2timestamp($link['linkdate']).'" PRIVATE="'.$link['private'].'"';
+                $date = DateTime::createFromFormat(LinkDB::LINK_DATE_FORMAT, $link['linkdate']);
+                echo '<DT><A HREF="'.$link['url'].'" ADD_DATE="'.$date->getTimestamp().'" PRIVATE="'.$link['private'].'"';
                 if ($link['tags']!='') echo ' TAGS="'.str_replace(' ',',',$link['tags']).'"';
                 echo '>'.$link['title']."</A>\n";
                 if ($link['description']!='') echo '<DD>'.$link['description']."\n";
@@ -2042,7 +2005,8 @@ function buildLinkList($PAGE,$LINKSDB)
         $link['description'] = format_description($link['description'], $GLOBALS['redirector']);
         $classLi =  ($i % 2) != 0 ? '' : 'publicLinkHightLight';
         $link['class'] = $link['private'] == 0 ? $classLi : 'private';
-        $link['timestamp'] = linkdate2timestamp($link['linkdate']);
+        $date = DateTime::createFromFormat(LinkDB::LINK_DATE_FORMAT, $link['linkdate']);
+        $link['timestamp'] = $date->getTimestamp();
         $taglist = explode(' ', $link['tags']);
         uasort($taglist, 'strcasecmp');
         $link['taglist'] = $taglist;

diff --git a/plugins/markdown/markdown.css b/plugins/markdown/markdown.css
index 6d666dcf35ce696d58ab518c07ce8d9ad9f24860..3c1b2aeb2bd90a414addb9dde31c3f63b88a8a69 100644 (file)
--- a/plugins/markdown/markdown.css
+++ b/plugins/markdown/markdown.css
@@ -114,6 +114,35 @@
     margin-bottom: 0;
 }
 
+.markdown pre {
+    background-color: #eee;
+    padding: 4px 9px;
+    -webkit-border-radius: 5px;
+    -moz-border-radius: 5px;
+    border-radius: 5px;
+    overflow: auto;
+    box-shadow: 0 -1px 0 #e5e5e5,0 0 1px rgba(0,0,0,0.12),0 1px 2px rgba(0,0,0,0.24);
+}
+
+.markdown pre code {
+    color: black;
+    font-family: 'Consolas', 'Monaco', 'Andale Mono', monospace;
+    direction: ltr;
+    text-align: left;
+    white-space: pre;
+    word-spacing: normal;
+    word-break: normal;
+    line-height: 1.7;
+    font-size: 11.5px;
+    -moz-tab-size: 4;
+    -o-tab-size: 4;
+    tab-size: 4;
+    -webkit-hyphens: none;
+    -moz-hyphens: none;
+    -ms-hyphens: none;
+    hyphens: none;  
+}
+
 .md_help {
     color: white;
 }

diff --git a/tpl/dailyrss.html b/tpl/dailyrss.html
index d959d6be89e1626d9d72aa7a99d8e25f420e95b0..4133ca3e44dc637d5d603abfe7da7f3e64c0abac 100644 (file)
--- a/tpl/dailyrss.html
+++ b/tpl/dailyrss.html
@@ -2,7 +2,7 @@
     <title>{$title} - {function="strftime('%A %e %B %Y', $daydate)"}</title>
     <guid>{$absurl}</guid>
     <link>{$absurl}</link>
-    <pubDate>{$rfc822date}</pubDate>
+    <pubDate>{$rssdate}</pubDate>
     <description><![CDATA[
         {loop="links"}
                <h3><a href="{$value.url}">{$value.title}</a></h3>
@@ -13,4 +13,4 @@
                <br><br><hr>
         {/loop}
     ]]></description>
-</item>
\ No newline at end of file
+</item>

diff --git a/tpl/pluginsadmin.html b/tpl/pluginsadmin.html
index 4f7d091e206961708813c0be63ac32fbfbb63c2c..5ddcf0612cc6bb12d37a9c94b5bf9657598582ea 100644 (file)
--- a/tpl/pluginsadmin.html
+++ b/tpl/pluginsadmin.html
@@ -36,7 +36,7 @@
             <tbody>
             {loop="$enabledPlugins"}
               <tr data-line="{$key}" data-order="{$counter}">
-                <td class="center"><input type="checkbox" name="{$key}" checked="checked"></td>
+                <td class="center"><input type="checkbox" name="{$key}" id="{$key}" checked="checked"></td>
                 <td class="center">
                   <a href="#"
                      onclick="return orderUp(this.parentNode.parentNode.getAttribute('data-order'));">
@@ -48,8 +48,8 @@
                   </a>
                   <input type="hidden" name="order_{$key}" value="{$counter}">
                 </td>
-                <td>{$key}</td>
-                <td>{$value.description}</td>
+                <td><label for="{$key}">{function="str_replace('_', ' ', $key)"}</label></td>
+                <td><label for="{$key}">{$value.description}</label></td>
               </tr>
             {/loop}
             </tbody>
@@ -73,9 +73,9 @@
             </tr>
             {loop="$disabledPlugins"}
               <tr>
-                <td class="center"><input type="checkbox" name="{$key}"></td>
-                <td>{$key}</td>
-                <td>{$value.description}</td>
+                <td class="center"><input type="checkbox" name="{$key}" id="{$key}"></td>
+                <td><label for="{$key}">{function="str_replace('_', ' ', $key)"}</label></td>
+                <td><label for="{$key}">{$value.description}</label></td>
               </tr>
             {/loop}
           </table>
@@ -99,7 +99,7 @@
           {loop="$enabledPlugins"}
             {if="count($value.parameters) > 0"}
               <div class="plugin_parameters">
-                <h2>{$key}</h2>
+                <h2>{function="str_replace('_', ' ', $key)"}</h2>
                 {loop="$value.parameters"}
                   <div class="plugin_parameter">
                     <div class="float_label">
@@ -128,4 +128,4 @@
 
 <script src="inc/plugin_admin.js#"></script>
 </body>
-</html>
\ No newline at end of file
+</html>