how can I restrict users to upload files that are Pure HTML Only.
I'm currently creating an online editor in PHP that would produce a web page which can be printed to PDF. As such, I have some HTML files that need to be dynamically included in the web page. This is because manually adding them through the online editor would take a long time as they include a lot of content, plus they contain static data which need not be changed. Think of them as presets.
Now the problem occurs when I let the users upload their own presets. As far as I know, any file with the .html extension can hold PHP code. How can I make sure that no PHP code lies within the uploaded file? Is it even possible to escape PHP tags using PHP?
Code example:
//User fills the PDF editor form and submits it.
is_logged(); // Login check and setting user info variables, redirects if not logged in.
if ( !isset( $_POST['gen-page'] ) {
custom_redirect( MAIN_PATH );
}
$content .= "<html>";
$content .= "<head>";
$content .= "<meta charset='utf-8'>";
$content .= "<meta name=viewport' content='width=device-width, initial-scale=1'>";
$content .= "<title>"$user_name"</title>";
$content .= file_get_contents( MAIN_PATH . '/uploads/' . $user_id . '/' . $user_style . '.html' ); // Contains style details.
$content .= "</head>";
$content .= "<body>";
for ($inputs as $input) { // Inputs is an array that was posted by the user.
$content .= "<p>" . $input . "</p>";
}
$content .= file_get_contents( MAIN_PATH . '/uploads/' . $user_id . '/' . $user_file . '.html' ); // The preset that the user has uploaded.
$content .= '</body>';
$filename = MAIN_PATH.'viewable/view-' . $user_id . '.html';
file_put_contents( $filename, $content );
custom_redirect( MAIN_PATH.'viewable/view-' . $user_id . '.html' );
$sitemap .= " " . '<orders>' . "\n" .
"\t" . '<idKlant>' . $id. '</idKlant>' .
"\n\t" . '<emptyfield></emptyfield>' .
"\n\t" . '<date>' . $verzenddatum . '</date>' . //remaining to get
"\n " . '</orders>' . "\n";
For generating XMl, I am using below code
$xmlobj = new SimpleXMLElement($sitemap);
$xmlobj->asXML("orders.xml");
Output of orders.xml
<orders>
<idKlant>12</idKlant>
<emptyfield/>
<date>30-12-2012</date>
</orders>
What i want is: for Empty xml field there should be Opening and Closing tag as well
<orders>
<idKlant>12</idKlant>
<emptyfield></emptyfield>
<date>30-12-2012</date>
</orders>
Is it possible? OR should i add black space?
As Rolando Isidoro said you can't do it with SimpleXML. But you can always switch to the DOM. Both extension use the same underlying library and representation, so there is very little overhead.
DOMDocument::saveXML can take libxml options as the second parameter and there is LIBXML_NOEMPTYTAG which does exactly what you want.
e.g.
<?php
$o = new SimpleXMLELement(data());
$docRoot = dom_import_simplexml($o);
echo $docRoot->ownerDocument->savexml($docRoot,LIBXML_NOEMPTYTAG);
function data() {
return '<orders>
<idKlant>12</idKlant>
<emptyfield/>
<date>30-12-2012</date>
</orders>';
}
prints
<orders>
<idKlant>12</idKlant>
<emptyfield></emptyfield>
<date>30-12-2012</date>
</orders>
Background: Working with MediaWiki 1.19.1, Graphviz 2.28.0, Extension:GraphViz 0.9 on WAMP stack (Server 2008, Apache 2.4.2, MySQL 5.5.27, PHP 5.4.5). Everything is working great and as expected for the basic functionality of rendering a clickable image from a Graphviz diagram using the GraphViz extension in MediaWiki.
Problem: The links in the image map are not added to the MediaWiki pagelinks table. I get why they aren't added but it becomes an issue if there is no way to follow the links back with the 'What links here' functionality.
Desired solution: During the processing of the diagram in the GraphViz extension, I would like to use the generated .map file to then create a list of wikilinks to add on the page to get picked up by MediaWiki and added to the pagelinks table.
Details:
This GraphViz extension code:
<graphviz border='frame' format='png'>
digraph example1 {
// define nodes
nodeHello [
label="I say Hello",
URL="Hello"
]
nodeWorld [
label="You say World!",
URL="World"
]
// link nodes
nodeHello -> nodeWorld!
}
</graphviz>
Generates this image:
And this image map code in a corresponding .map file on the server:
<map id="example1" name="example1">
<area shape="poly" id="node1" href="Hello" title="I say Hello" alt="" coords="164,29,161,22,151,15,137,10,118,7,97,5,77,7,58,10,43,15,34,22,31,29,34,37,43,43,58,49,77,52,97,53,118,52,137,49,151,43,161,37"/>
<area shape="poly" id="node2" href="World" title="You say World!" alt="" coords="190,125,186,118,172,111,152,106,126,103,97,101,69,103,43,106,22,111,9,118,5,125,9,133,22,139,43,145,69,148,97,149,126,148,152,145,172,139,186,133"/>
</map>
From that image map file, I would like to be able to extract the href and title to build wikilinks like so:
[[Hello|I say Hello]]
[[World|You say World!]]
I'm guessing that since that .map file is essentially XML that I could just use XPATH to query the file, but that is just a guess. PHP is not my strongest area and I don't know the best approach to going about the XML/XPATH option or if that is even the best approach to pull that info from the file.
Once I got that collection/array of wikilinks from the .map file, I'm sure I can hack up the GraphViz.php extension file to add it to the contents of the page to get it added to the pagelinks table.
Progress: I had a bit of an Rubber Duck Problem Solving moment right as I submitted the question. I realized that since I had well formed data in the image map, that XPATH was probably the way to go. It was fairly trivial to be able to pull the data I needed, especially since I found that the map file contents was stilled stored in a local string variable.
$xml = new SimpleXMLElement( $map );
foreach($xml->area as $item) {
$links .= "[[" . $item->attributes()->href . "|" . $item->attributes()->title . "]]";
}
Final Solution: See my accepted answer below.
Thanks for taking a look. I appreciate any assistance or direction you can offer.
I finally worked through all of the issues and now have a fairly decent solution to render the graph nicely, provide a list of links, and register the links with wiki. My solution doesn't fully support all of the capabilities of the current GraphViz extension as it is written as there is functionality we do not need and I do not want to support. Here are the assumptions / limitations of this solution:
Does not support MscGen: We only have a need for Graphviz.
Does not support imageAtrributes: We wanted to control the format and presentation and it seemed like there were inconsistencies in the imageAttributes implementation that would then cause further support issues.
Does not support wikilinks: While it would be nice to provide consistent link usage through wiki and the Graphviz extension, the reality is that Graphviz is a completely different markup environment. While the current extension 'supports' wikilinks, the implementation is a little weak and leaves areas for confusion. Example: Wikilinks support giving the link an optional description but Graphviz already uses the node label for the description. So then you end up ignoring the wikilink description and telling users that 'Yes, we support wikilinks but don't use the description part' So since we aren't really using wikilinks correctly, just implement a regular link implementation and try to avoid the confusion entirely.
Here is what the output looks like:
Here are the changes that were made
Comment out this line:
// We don't want to support wikilinks so don't replace them
//$timelinesrc = rewriteWikiUrls( $timelinesrc ); // if we use wiki-links we transform them to real urls
Replace this block of code:
// clean up map-name
$map = preg_replace( '#<ma(.*)>#', ' ', $map );
$map = str_replace( '</map>', '', $map );
if ( $renderer == 'mscgen' ) {
$mapbefore = $map;
$map = preg_replace( '/(\w+)\s([_:%#/\w]+)\s(\d+,\d+)\s(\d+,\d+)/',
'<area shape="$1" href="$2" title="$2" alt="$2" coords="$3,$4" />',
$map );
}
/* Procduce html
*/
if ( $wgGraphVizSettings->imageFormatting )
{
$txt = imageAtrributes( $args, $storagename, $map, $outputType, $wgUploadPath ); // if we want borders/position/...
} else {
$txt = '<map name="' . $storagename . '">' . $map . '</map>' .
'<img src="' . $wgUploadPath . '/graphviz/' . $storagename . '.' . $outputType . '"' .
' usemap="#' . $storagename . '" />';
}
With this code:
$intHtml = '';
$extHtml = '';
$badHtml = '';
// Wrap the map/area info with top level nodes and load into xml object
$xmlObj = new SimpleXMLElement( $map );
// What does map look like before we start working with it?
wfDebugLog( 'graphviz', 'map before: ' . $map . "\n" );
// loop through each of the <area> nodes
foreach($xmlObj->area as $areaNode) {
wfDebugLog( 'graphviz', "areaNode: " . $areaNode->asXML() . "\n" );
// Get the data from the XML attributes
$hrefValue = (string)$areaNode->attributes()->href;
$textValue = (string)$areaNode->attributes()->title;
wfDebugLog( 'graphviz', '$hrefValue before: ' . $hrefValue . "\n" );
wfDebugLog( 'graphviz', '$textValue before: ' . $textValue . "\n" );
// For the text fields, multiple spaces (" ") in the Graphviz source (label)
// turns into a regular space followed by encoded representations of
// non-breaking spaces (" ") in the .map file which then turns
// into the following in the local variables: (" Â Â ").
// The following two options appear to convert/decode the characters
// appropriately. Leaving the lines commented out for now, as we have
// not seen a graph in the wild with multiple spaces in the label -
// just happened to stumble on the scenario.
// See http://www.php.net/manual/en/simplexmlelement.asxml.php
// and http://stackoverflow.com/questions/2050723/how-can-i-preg-replace-special-character-like-pret-a-porter
//$textValue = iconv("UTF-8", "ASCII//TRANSLIT", $textValue);
//$textValue = html_entity_decode($textValue, ENT_NOQUOTES, 'UTF-8');
// Now we need to deal with the whitespace characters like tabs and newlines
// and also deal with them correctly to replace multiple occurences.
// Unfortunately, the \n and \t values in the variable aren't actually
// tab or newline characters but literal characters '\' + 't' or '\' + 'n'.
// So the normally recommended regex '/\s+/u' to replace the whitespace
// characters does not work.
// See http://stackoverflow.com/questions/6579636/preg-replace-n-in-string
$hrefValue = preg_replace("/( |\\\\n|\\\\t)+/", ' ', $hrefValue);
$textValue = preg_replace("/( |\\\\n|\\\\t)+/", ' ', $textValue);
// check to see if the url matches any of the
// allowed protocols for external links
if ( preg_match( '/^(?:' . wfUrlProtocols() . ')/', $hrefValue ) ) {
// external link
$parser->mOutput->addExternalLink( $hrefValue );
$extHtml .= Linker::makeExternalLink( $hrefValue, $textValue ) . ', ';
}
else {
$first = substr( $hrefValue, 0, 1 );
if ( $first == '\\' || $first == '[' || $first == '/' ) {
// potential UNC path, wikilink, absolute or relative path
$hrefValue = '#InvalidLink';
$badHtml .= Linker::makeExternalLink( $hrefValue, $textValue ) . ', ';
$textValue = 'Invalid link. Check Graphviz source.';
}
else {
$title = Title::newFromText( $hrefValue );
if ( is_null( $title ) ) {
// invalid link
$hrefValue = '#InvalidLink';
$badHtml .= Linker::makeExternalLink( $hrefValue, $textValue ) . ', ';
$textValue = 'Invalid link. Check Graphviz source.';
}
else {
// internal link
$parser->mOutput->addLink( $title );
$intHtml .= Linker::link( $title, $textValue ) . ', ';
$hrefValue = $title->getFullURL();
}
}
}
$areaNode->attributes()->href = $hrefValue;
$areaNode->attributes()->title = $textValue;
}
$map = $xmlObj->asXML();
// The contents of $map, which is now XML, gets embedded
// in the HTML sent to the browser so we need to strip
// the XML version tag and we also strip the <map> because
// it will get replaced with a new one with the correct name.
$map = str_replace( '<?xml version="1.0"?>', '', $map );
$map = preg_replace( '#<ma(.*)>#', ' ', $map );
$map = str_replace( '</map>', '', $map );
// Let's see what it looks like now that we are done with it.
wfDebugLog( 'graphviz', 'map after: ' . $map . "\n" );
$txt = '' .
'<table style="background-color:#f9f9f9;border:1px solid #ddd;">' .
'<tr>' .
'<td style="border:1px solid #ddd;text-align:center;">' .
'<map name="' . $storagename . '">' . $map . '</map>' .
'<img src="' . $wgUploadPath . '/graphviz/' . $storagename . '.' . $outputType . '"' . ' usemap="#' . $storagename . '" />' .
'</td>' .
'</tr>' .
'<tr>' .
'<td style="font:10px verdana;">' .
'This Graphviz diagram links to the following pages:' .
'<br /><strong>Internal</strong>: ' . ( $intHtml != '' ? rtrim( $intHtml, ' ,' ) : '<em>none</em>' ) .
'<br /><strong>External</strong>: ' . ( $extHtml != '' ? rtrim( $extHtml, ' ,' ) : '<em>none</em>' ) .
( $badHtml != '' ? '<br /><strong>Invalid</strong>: ' . rtrim($badHtml, ' ,') .
'<br /><em>Tip: Do not use wikilinks ([]), UNC paths (\\) or relative links (/) when creating links in Graphviz diagrams.</em>' : '' ) .
'</td>' .
'</tr>' .
'</table>';
Possible enhancements:
It would be nice if the list of links below the graph were sorted and de-duped.
I currently have a PHP script which when ran outputs an XML file (however as feed.php not feed.xml) I have been told to add this to my .htaccess and it should fix it:
AddType application/x-httpd-php .xml
However for some reason that isn't working.
What I'd ideally like the script to do - when ran is to generate a feed.xml file with the output of its contents, rather than just outputting the contents on the php page.
Here is my code:
<?PHP
include("../config.php");
#// Timetable Clearup Variabls
$yesterday = strtotime('yesterday');
$yesterdow = date('l',$yesterday);
$order = "SELECT * FROM timetable WHERE day = '$yesterdow' ORDER BY time";
$result = mysql_query($order);
$yesterdayd = date('F jS, Y', time()-86400);
//SET XML HEADER
header('Content-type: text/xml');
//CONSTRUCT RSS FEED HEADERS
$output = '<rss version="2.0">';
$output .= '<channel>';
$output .= "<title>Timetable - {$yesterdayd} </title>";
$output .= '<description>Timetable.</description>';
$output .= '<link>http://site.com/</link>';
### $output .= '<copyright>Your copyright details</copyright>';
while ($row = mysql_fetch_array($result)) {
//BODY OF RSS FEED
$output .= '<item>';
$output .= "<description><td>" . htmlspecialchars($row['username']) . "</td><td>" . htmlspecialchars($row['time']) . "</td></description>";
$output .= '</item> ';
}
//CLOSE RSS FEED
$output .= '</channel>';
$output .= '</rss>';
//SEND COMPLETE RSS FEED TO BROWSER
echo($output);
?>
I would suggest not adding .xml in .htaccess to be processed using PHP compiler.
Rather use mod_rewrite to redirect requests to .xml files to php script.
For example:
RewriteEngine On
RewriteRule ^(.*)\.xml$ /rss_feed.php [L,QSA]
Need help here for the following:
Running PhP, javascript, MySQL, XML.
1) Retrieving file from MySQL and stored it onto XML file.
2) Use javascript function to load XML file (that stored those data).
3) It produces invalid characters in XML file.
STEP 1 : Sample of the code in PhP -> Loading MySQL DB to store data onto XML file
$file= fopen("MapDeals2.xml", "w");
$_xml ="<?xml version=\"1.0\" encoding=\"UTF-8\" ?>\n";
$_xml .="<MAP>\n";
while($row1_ThisWeek = mysql_fetch_array($result1_ThisWeek)) {
$rRName = $row1_ThisWeek['Retailer_Name'];
$rRAddress = $row1_ThisWeek['Retailer_Address1'];
$rRAddressPostCode = $row1_ThisWeek['Retailer_AddressPostCode1'];
//} commented out from the original
$_xml .= "<DEAL>\n";
$_xml .= "<DealDescription>" . $d_Description . "</DealDescription>\n";
$_xml .= "<DealURL>" . $d_URL . "</DealURL>\n";
$_xml .= "<DealRName>" . $rRName . "</DealRName>\n";
$_xml .= "<DealRAddress>" . $rRAddress . "</DealRAddress>\n";
$_xml .= "<DealRPostCode>" . $rRAddressPostCode . "</DealRPostCode>\n";
$_xml .= "</DEAL>\n";
}
//} commented out from the original
$_xml .="</MAP>\n";
fwrite($file, $_xml);
fclose($file);
STEP 2 : Sample of the code in Javscript -> Loading XML file
xhttp.open("GET","Test2.xml", false);
xhttp.send("");
xmlDoc=xhttp.responseXML;
var x=xmlDoc.getElementsByTagName("Employee");
parser = new DOMParser();
xmlDoc = parser.parseFromString("MapDeals2.xml", "text/xml");
for (i=0;i<x.length;i++)
{
// alert ('Generating FOR loop');
var d1 = x[i].getElementsByTagName("EmployeeDescription")[0].childNodes[0].nodeValue;
var e1 = "<br></br>";
.
.
.
}
Is there a solution for the above? Looking forward to hear from you soon.
Cheers
It probably is a charset problem. Your MySQL connection has encoding iso-8859-1 or something like that, while the XML is expected to be in UTF8. You have to convert it somewhere.