diff options
| -rw-r--r-- | inc/DifferenceEngine.php | 58 | ||||
| -rw-r--r-- | inc/html.php | 6 |
2 files changed, 45 insertions, 19 deletions
diff --git a/inc/DifferenceEngine.php b/inc/DifferenceEngine.php index c15c8b163..f6ed9aa13 100644 --- a/inc/DifferenceEngine.php +++ b/inc/DifferenceEngine.php @@ -797,7 +797,7 @@ class DiffFormatter { function _lines($lines, $prefix = ' ') { foreach ($lines as $line) - echo "$prefix $line\n"; + echo "$prefix ".$this->_escape($line)."\n"; } function _context($lines) { @@ -816,6 +816,10 @@ class DiffFormatter { echo "---\n"; $this->_added($closing); } + + function _escape($str){ + return $str; + } } /** @@ -871,13 +875,13 @@ class _HWLDF_WordAccumulator { function _flushGroup($new_tag) { if ($this->_group !== '') { if ($this->_tag == 'mark') - $this->_line .= '<strong '.HTMLDiff::css('diff-mark').'>'.$this->_group.'</strong>'; + $this->_line .= '<strong '.HTMLDiff::css('diff-mark').'>'.$this->_escape($this->_group).'</strong>'; elseif ($this->_tag == 'add') - $this->_line .= '<span '.HTMLDiff::css('diff-addedline').'>'.$this->_group.'</span>'; + $this->_line .= '<span '.HTMLDiff::css('diff-addedline').'>'.$this->_escape($this->_group).'</span>'; elseif ($this->_tag == 'del') - $this->_line .= '<span '.HTMLDiff::css('diff-deletedline').'><del>'.$this->_group.'</del></span>'; + $this->_line .= '<span '.HTMLDiff::css('diff-deletedline').'><del>'.$this->_escape($this->_group).'</del></span>'; else - $this->_line .= $this->_group; + $this->_line .= $this->_escape($this->_group); } $this->_group = ''; $this->_tag = $new_tag; @@ -912,6 +916,10 @@ class _HWLDF_WordAccumulator { $this->_flushLine('~done'); return $this->_lines; } + + function _escape($str){ + return hsc($str); + } } class WordLevelDiff extends MappedDiff { @@ -1069,12 +1077,18 @@ class TableDiffFormatter extends DiffFormatter { function _lines($lines, $prefix=' ', $color="white") { } - function addedLine($line) { + function addedLine($line,$escaped=false) { + if (!$escaped){ + $line = $this->_escape($line); + } return '<td '.HTMLDiff::css('diff-lineheader').'>+</td>'. '<td '.HTMLDiff::css('diff-addedline').'>' . $line.'</td>'; } - function deletedLine($line) { + function deletedLine($line,$escaped=false) { + if (!$escaped){ + $line = $this->_escape($line); + } return '<td '.HTMLDiff::css('diff-lineheader').'>-</td>'. '<td '.HTMLDiff::css('diff-deletedline').'>' . $line.'</td>'; } @@ -1085,12 +1099,16 @@ class TableDiffFormatter extends DiffFormatter { function contextLine($line) { return '<td '.HTMLDiff::css('diff-lineheader').'> </td>'. - '<td '.HTMLDiff::css('diff-context').'>'.$line.'</td>'; + '<td '.HTMLDiff::css('diff-context').'>'.$this->_escape($line).'</td>'; } function _added($lines) { + $this->_addedLines($lines,false); + } + + function _addedLines($lines,$escaped=false){ foreach ($lines as $line) { - print('<tr>' . $this->emptyLine() . $this->addedLine($line) . "</tr>\n"); + print('<tr>' . $this->emptyLine() . $this->addedLine($line,$escaped) . "</tr>\n"); } } @@ -1107,15 +1125,19 @@ class TableDiffFormatter extends DiffFormatter { } function _changed($orig, $closing) { - $diff = new WordLevelDiff($orig, $closing); + $diff = new WordLevelDiff($orig, $closing); // this escapes the diff data $del = $diff->orig(); $add = $diff->closing(); while ($line = array_shift($del)) { $aline = array_shift($add); - print('<tr>' . $this->deletedLine($line) . $this->addedLine($aline) . "</tr>\n"); + print('<tr>' . $this->deletedLine($line,true) . $this->addedLine($aline,true) . "</tr>\n"); } - $this->_added($add); # If any leftovers + $this->_addedLines($add,true); # If any leftovers + } + + function _escape($str) { + return hsc($str); } } @@ -1170,29 +1192,33 @@ class InlineDiffFormatter extends DiffFormatter { function _added($lines) { foreach ($lines as $line) { - print('<tr><td '.HTMLDiff::css('diff-lineheader').'> </td><td '.HTMLDiff::css('diff-addedline').'>'. $line . "</td></tr>\n"); + print('<tr><td '.HTMLDiff::css('diff-lineheader').'> </td><td '.HTMLDiff::css('diff-addedline').'>'. $this->_escape($line) . "</td></tr>\n"); } } function _deleted($lines) { foreach ($lines as $line) { - print('<tr><td '.HTMLDiff::css('diff-lineheader').'> </td><td '.HTMLDiff::css('diff-deletedline').'><del>' . $line . "</del></td></tr>\n"); + print('<tr><td '.HTMLDiff::css('diff-lineheader').'> </td><td '.HTMLDiff::css('diff-deletedline').'><del>' . $this->_escape($line) . "</del></td></tr>\n"); } } function _context($lines) { foreach ($lines as $line) { - print('<tr><td '.HTMLDiff::css('diff-lineheader').'> </td><td '.HTMLDiff::css('diff-context').'>'.$line."</td></tr>\n"); + print('<tr><td '.HTMLDiff::css('diff-lineheader').'> </td><td '.HTMLDiff::css('diff-context').'>'. $this->_escape($line) ."</td></tr>\n"); } } function _changed($orig, $closing) { - $diff = new InlineWordLevelDiff($orig, $closing); + $diff = new InlineWordLevelDiff($orig, $closing); // this escapes the diff data $add = $diff->inline(); foreach ($add as $line) print('<tr><td '.HTMLDiff::css('diff-lineheader').'> </td><td>'.$line."</td></tr>\n"); } + + function _escape($str) { + return hsc($str); + } } diff --git a/inc/html.php b/inc/html.php index e657d2c78..59415f7da 100644 --- a/inc/html.php +++ b/inc/html.php @@ -1165,7 +1165,7 @@ function html_diff($text='',$intro=true,$type=null){ list($l_head, $r_head, $l_minor, $r_minor) = html_diff_head($l_rev, $r_rev, null, false, $type == 'inline'); } - $df = new Diff(explode("\n",hsc($l_text)),explode("\n",hsc($r_text))); + $df = new Diff(explode("\n",$l_text),explode("\n",$r_text)); if($type == 'inline'){ $tdf = new InlineDiffFormatter(); @@ -1253,8 +1253,8 @@ function html_softbreak_callback($match){ &\#?\\w{1,6};) # ... for html entities - we don't want to split them (ok to catch some invalid combinations) &\#?\\w{1,6}; # yes pattern - a quicker match for the html entity, since we know we have one | -[?/,&\#;:]+ # no pattern - any other group of 'special' characters to insert a breaking character after -) # end conditional expression +[?/,&\#;:] # no pattern - any other group of 'special' characters to insert a breaking character after +)+ # end conditional expression REGEX; return preg_replace('<'.$regex.'>xu','\0​',$match[0]); |