Newer
Older
<?php
Dries Buytaert
committed
* Implements hook_help().
Gábor Hojtsy
committed
function filter_help($path, $arg) {
switch ($path) {
Dries Buytaert
committed
case 'admin/help#filter':
Angie Byron
committed
$output = '';
$output .= '<h3>' . t('About') . '</h3>';
$output .= '<p>' . t('The Filter module allows administrators to configure text formats. A text format defines the HTML tags, codes, and other input allowed in content and comments, and is a key feature in guarding against potentially damaging input from malicious users. For more information, see the online handbook entry for <a href="@filter">Filter module</a>.', array('@filter' => 'http://drupal.org/handbook/modules/filter/')) . '</p>';
$output .= '<h3>' . t('Uses') . '</h3>';
$output .= '<dl>';
Angie Byron
committed
$output .= '<dt>' . t('Configuring text formats') . '</dt>';
$output .= '<dd>' . t('Configure text formats on the <a href="@formats">Text formats page</a>. <strong>Improper text format configuration is a security risk</strong>. To ensure security, untrusted users should only have access to text formats that restrict them to either plain text or a safe set of HTML tags, since certain HTML tags can allow embedding malicious links or scripts in text. More trusted registered users may be granted permission to use less restrictive text formats in order to create rich content.', array('@formats' => url('admin/config/content/formats'))) . '</dd>';
Angie Byron
committed
$output .= '<dt>' . t('Applying filters to text') . '</dt>';
Angie Byron
committed
$output .= '<dd>' . t('Each text format uses filters to manipulate text, and most formats apply several different filters to text in a specific order. Each filter is designed for a specific purpose, and generally either adds, removes, or transforms elements within user-entered text before it is displayed. A filter does not change the actual content, but instead, modifies it temporarily before it is displayed. One filter may remove unapproved HTML tags, while another automatically adds HTML to make URLs display as clickable links.') . '</dd>';
Angie Byron
committed
$output .= '<dt>' . t('Defining text formats') . '</dt>';
Angie Byron
committed
$output .= '<dd>' . t('One format is included by default: <em>Plain text</em> (which removes all HTML tags). Additional formats may be created by your installation profile when you install Drupal, and more can be created by an administrator on the <a href="@text-formats">Text formats page</a>.', array('@text-formats' => url('admin/config/content/formats'))) . '</dd>';
Angie Byron
committed
$output .= '<dt>' . t('Choosing a text format') . '</dt>';
Angie Byron
committed
$output .= '<dd>' . t('Users with access to more than one text format can use the <em>Text format</em> fieldset to choose between available text formats when creating or editing multi-line content. Administrators can define the text formats available to each user role, and control the order of formats listed in the <em>Text format</em> fieldset on the <a href="@text-formats">Text formats page</a>.', array('@text-formats' => url('admin/config/content/formats'))) . '</dd>';
Angie Byron
committed
$output .= '</dl>';
Dries Buytaert
committed
return $output;
Dries Buytaert
committed
case 'admin/config/content/formats':
Angie Byron
committed
$output = '<p>' . t('Text formats define the HTML tags, code, and other formatting that can be used when entering text. <strong>Improper text format configuration is a security risk</strong>. Learn more on the <a href="@filterhelp">Filter module help page</a>.', array('@filterhelp' => url('admin/help/filter'))) . '</p>';
Dries Buytaert
committed
$output .= '<p>' . t('Text formats are presented on content editing pages in the order defined on this page. The first format available to a user will be selected by default.') . '</p>';
return $output;
Dries Buytaert
committed
case 'admin/config/content/formats/%':
Dries Buytaert
committed
$output = '<p>' . t('A text format contains filters that change the user input, for example stripping out malicious HTML or making URLs clickable. Filters are executed from top to bottom and the order is important, since one filter may prevent another filter from doing its job. For example, when URLs are converted into links before disallowed HTML tags are removed, all links may be removed. When this happens, the order of filters may need to be re-arranged.') . '</p>';
return $output;
Steven Wittens
committed
}
}
Dries Buytaert
committed
/**
Dries Buytaert
committed
* Implements hook_theme().
Dries Buytaert
committed
*/
function filter_theme() {
return array(
'filter_admin_overview' => array(
'render element' => 'form',
'file' => 'filter.admin.inc',
Dries Buytaert
committed
),
Dries Buytaert
committed
'filter_admin_format_filter_order' => array(
'render element' => 'element',
'file' => 'filter.admin.inc',
Dries Buytaert
committed
),
'filter_tips' => array(
'variables' => array('tips' => NULL, 'long' => FALSE),
'file' => 'filter.pages.inc',
Dries Buytaert
committed
),
'text_format_wrapper' => array(
'render element' => 'element',
),
Dries Buytaert
committed
'filter_tips_more_info' => array(
'variables' => array(),
Dries Buytaert
committed
),
Angie Byron
committed
'filter_guidelines' => array(
'variables' => array('format' => NULL),
Dries Buytaert
committed
);
}
/**
* Implements hook_element_info().
*
* @see filter_process_format()
*/
function filter_element_info() {
$type['text_format'] = array(
'#process' => array('filter_process_format'),
'#base_type' => 'textarea',
'#theme_wrappers' => array('text_format_wrapper'),
);
return $type;
}
Dries Buytaert
committed
* Implements hook_menu().
Dries Buytaert
committed
function filter_menu() {
Dries Buytaert
committed
$items['filter/tips'] = array(
'title' => 'Compose tips',
'page callback' => 'filter_tips_long',
'access callback' => TRUE,
'type' => MENU_SUGGESTED_ITEM,
'file' => 'filter.pages.inc',
);
$items['admin/config/content/formats'] = array(
Dries Buytaert
committed
'title' => 'Text formats',
'description' => 'Configure how content input by users is filtered, including allowed HTML tags. Also allows enabling of module-provided filters.',
Dries Buytaert
committed
'page callback' => 'drupal_get_form',
'page arguments' => array('filter_admin_overview'),
'access arguments' => array('administer filters'),
'file' => 'filter.admin.inc',
Dries Buytaert
committed
);
$items['admin/config/content/formats/list'] = array(
'title' => 'List',
Dries Buytaert
committed
'type' => MENU_DEFAULT_LOCAL_TASK,
);
$items['admin/config/content/formats/add'] = array(
Dries Buytaert
committed
'title' => 'Add text format',
Gábor Hojtsy
committed
'page callback' => 'filter_admin_format_page',
Dries Buytaert
committed
'access arguments' => array('administer filters'),
Angie Byron
committed
'type' => MENU_LOCAL_ACTION,
Dries Buytaert
committed
'weight' => 1,
'file' => 'filter.admin.inc',
Dries Buytaert
committed
);
$items['admin/config/content/formats/%filter_format'] = array(
'title callback' => 'filter_admin_format_title',
'title arguments' => array(4),
Gábor Hojtsy
committed
'page callback' => 'filter_admin_format_page',
'page arguments' => array(4),
Dries Buytaert
committed
'access arguments' => array('administer filters'),
'file' => 'filter.admin.inc',
Dries Buytaert
committed
);
Dries Buytaert
committed
$items['admin/config/content/formats/%filter_format/disable'] = array(
'title' => 'Disable text format',
Dries Buytaert
committed
'page callback' => 'drupal_get_form',
Dries Buytaert
committed
'page arguments' => array('filter_admin_disable', 4),
'access callback' => '_filter_disable_format_access',
'access arguments' => array(4),
Dries Buytaert
committed
'file' => 'filter.admin.inc',
);
return $items;
}
/**
* Access callback for deleting text formats.
*
* @param $format
* A text format object.
* @return
Dries Buytaert
committed
* TRUE if the text format can be disabled by the current user, FALSE
* otherwise.
*/
Dries Buytaert
committed
function _filter_disable_format_access($format) {
// The fallback format can never be disabled.
return user_access('administer filters') && ($format->format != filter_fallback_format());
}
Dries Buytaert
committed
/**
* Load a text format object from the database.
*
* @param $format_id
Dries Buytaert
committed
* The format ID.
*
* @return
Angie Byron
committed
* A fully-populated text format object, if the requested format exists and
* is enabled. If the format does not exist, or exists in the database but
* has been marked as disabled, FALSE is returned.
*
* @see filter_format_exists()
Dries Buytaert
committed
*/
function filter_format_load($format_id) {
$formats = filter_formats();
return isset($formats[$format_id]) ? $formats[$format_id] : FALSE;
/**
* Save a text format object to the database.
*
* @param $format
* A format object using the properties:
Angie Byron
committed
* - 'format': A machine-readable name representing the ID of the text format
* to save. If this corresponds to an existing text format, that format
* will be updated; otherwise, a new format will be created.
* - 'name': The title of the text format.
Angie Byron
committed
* - 'status': (optional) An integer indicating whether the text format is
* enabled (1) or not (0). Defaults to 1.
* - 'weight': (optional) The weight of the text format, which controls its
* placement in text format lists. If omitted, the weight is set to 0.
* - 'filters': (optional) An associative, multi-dimensional array of filters
* assigned to the text format, keyed by the name of each filter and using
* the properties:
* - 'weight': (optional) The weight of the filter in the text format. If
* omitted, either the currently stored weight is retained (if there is
* one), or the filter is assigned a weight of 10, which will usually
* put it at the bottom of the list.
* - 'status': (optional) A boolean indicating whether the filter is
* enabled in the text format. If omitted, the filter will be disabled.
* - 'settings': (optional) An array of configured settings for the filter.
* See hook_filter_info() for details.
*/
function filter_format_save($format) {
$format->name = trim($format->name);
Dries Buytaert
committed
$format->cache = _filter_format_is_cacheable($format);
if (!isset($format->status)) {
$format->status = 1;
}
if (!isset($format->weight)) {
$format->weight = 0;
}
// Insert or update the text format.
$return = db_merge('filter_format')
->key(array('format' => $format->format))
->fields(array(
'name' => $format->name,
'cache' => (int) $format->cache,
'status' => (int) $format->status,
'weight' => (int) $format->weight,
))
->execute();
Dries Buytaert
committed
// Programmatic saves may not contain any filters.
if (!isset($format->filters)) {
$format->filters = array();
}
$filter_info = filter_get_filters();
Dries Buytaert
committed
foreach ($filter_info as $name => $filter) {
Dries Buytaert
committed
// Add new filters without weight to the bottom.
Dries Buytaert
committed
if (!isset($format->filters[$name]['weight'])) {
Dries Buytaert
committed
$format->filters[$name]['weight'] = 10;
Dries Buytaert
committed
}
$format->filters[$name]['status'] = isset($format->filters[$name]['status']) ? $format->filters[$name]['status'] : 0;
$format->filters[$name]['module'] = $filter['module'];
// If settings were passed, only ensure default settings.
if (isset($format->filters[$name]['settings'])) {
if (isset($filter['default settings'])) {
$format->filters[$name]['settings'] = array_merge($filter['default settings'], $format->filters[$name]['settings']);
}
Dries Buytaert
committed
}
Dries Buytaert
committed
// Otherwise, use default settings or fall back to an empty array.
else {
$format->filters[$name]['settings'] = isset($filter['default settings']) ? $filter['default settings'] : array();
}
$fields = array();
$fields['weight'] = $format->filters[$name]['weight'];
$fields['status'] = $format->filters[$name]['status'];
$fields['module'] = $format->filters[$name]['module'];
$fields['settings'] = serialize($format->filters[$name]['settings']);
Dries Buytaert
committed
db_merge('filter')
->key(array(
'format' => $format->format,
'name' => $name,
))
->fields($fields)
->execute();
}
Dries Buytaert
committed
if ($return == SAVED_NEW) {
Dries Buytaert
committed
module_invoke_all('filter_format_insert', $format);
}
else {
module_invoke_all('filter_format_update', $format);
// Explicitly indicate that the format was updated. We need to do this
// since if the filters were updated but the format object itself was not,
// the merge query above would not return an indication that anything had
// changed.
$return = SAVED_UPDATED;
// Clear the filter cache whenever a text format is updated.
Dries Buytaert
committed
cache('filter')->deletePrefix($format->format . ':');
Dries Buytaert
committed
}
filter_formats_reset();
Dries Buytaert
committed
return $return;
}
/**
Dries Buytaert
committed
* Disable a text format.
*
* There is no core facility to re-enable a disabled format. It is not deleted
Angie Byron
committed
* to keep information for contrib and to make sure the format ID is never
* reused. As there might be content using the disabled format, this would lead
* to data corruption.
*
* @param $format
Dries Buytaert
committed
* The text format object to be disabled.
*/
Dries Buytaert
committed
function filter_format_disable($format) {
db_update('filter_format')
->fields(array('status' => 0))
Dries Buytaert
committed
->condition('format', $format->format)
->execute();
Dries Buytaert
committed
// Allow modules to react on text format deletion.
Dries Buytaert
committed
module_invoke_all('filter_format_disable', $format);
Dries Buytaert
committed
// Clear the filter cache whenever a text format is disabled.
filter_formats_reset();
Dries Buytaert
committed
cache('filter')->deletePrefix($format->format . ':');
}
Angie Byron
committed
/**
* Determines if a text format exists.
*
* @param $format_id
* The ID of the text format to check.
*
* @return
* TRUE if the text format exists, FALSE otherwise. Note that for disabled
* formats filter_format_exists() will return TRUE while filter_format_load()
* will return FALSE.
*
* @see filter_format_load()
*/
function filter_format_exists($format_id) {
return (bool) db_query_range('SELECT 1 FROM {filter_format} WHERE format = :format', 0, 1, array(':format' => $format_id))->fetchField();
}
/**
Dries Buytaert
committed
* Display a text format form title.
*/
function filter_admin_format_title($format) {
return $format->name;
}
Dries Buytaert
committed
* Implements hook_permission().
function filter_permission() {
$perms['administer filters'] = array(
Dries Buytaert
committed
'title' => t('Administer text formats and filters'),
Dries Buytaert
committed
'restrict access' => TRUE,
);
// Generate permissions for each text format. Warn the administrator that any
// of them are potentially unsafe.
foreach (filter_formats() as $format) {
$permission = filter_permission_name($format);
if (!empty($permission)) {
// Only link to the text format configuration page if the user who is
// viewing this will have access to that page.
Dries Buytaert
committed
$format_name_replacement = user_access('administer filters') ? l($format->name, 'admin/config/content/formats/' . $format->format) : drupal_placeholder($format->name);
$perms[$permission] = array(
'title' => t("Use the !text_format text format", array('!text_format' => $format_name_replacement,)),
Dries Buytaert
committed
'description' => drupal_placeholder(t('Warning: This permission may have security implications depending on how the text format is configured.')),
);
}
}
return $perms;
}
/**
* Returns the machine-readable permission name for a provided text format.
*
* @param $format
* An object representing a text format.
* @return
* The machine-readable permission name, or FALSE if the provided text format
* is malformed or is the fallback format (which is available to all users).
*/
function filter_permission_name($format) {
if (isset($format->format) && $format->format != filter_fallback_format()) {
return 'use text format ' . $format->format;
}
return FALSE;
/**
* Implements hook_modules_enabled().
*/
function filter_modules_enabled($modules) {
// Reset the static cache of module-provided filters, in case any of the
// newly enabled modules defines a new filter or alters existing ones.
drupal_static_reset('filter_get_filters');
}
/**
* Implements hook_modules_disabled().
*/
function filter_modules_disabled($modules) {
// Reset the static cache of module-provided filters, in case any of the
// newly disabled modules defined or altered any filters.
drupal_static_reset('filter_get_filters');
}
* Retrieve a list of text formats, ordered by weight.
Dries Buytaert
committed
*
* @param $account
* (optional) If provided, only those formats that are allowed for this user
* account will be returned. All formats will be returned otherwise.
Dries Buytaert
committed
* @return
* An array of text format objects, keyed by the format ID and ordered by
* weight.
*
* @see filter_formats_reset()
function filter_formats($account = NULL) {
global $language;
Dries Buytaert
committed
$formats = &drupal_static(__FUNCTION__, array());
Steven Wittens
committed
// All available formats are cached for performance.
if (!isset($formats['all'])) {
Dries Buytaert
committed
if ($cache = cache()->get("filter_formats:{$language->language}")) {
$formats['all'] = $cache->data;
}
else {
$formats['all'] = db_select('filter_format', 'ff')
->addTag('translatable')
->fields('ff')
->condition('status', 1)
->orderBy('weight')
->execute()
->fetchAllAssoc('format');
Dries Buytaert
committed
cache()->set("filter_formats:{$language->language}", $formats['all']);
Dries Buytaert
committed
}
Steven Wittens
committed
// Build a list of user-specific formats.
if (isset($account) && !isset($formats['user'][$account->uid])) {
$formats['user'][$account->uid] = array();
foreach ($formats['all'] as $format) {
if (filter_access($format, $account)) {
$formats['user'][$account->uid][$format->format] = $format;
Steven Wittens
committed
}
}
}
return isset($account) ? $formats['user'][$account->uid] : $formats['all'];
}
Steven Wittens
committed
/**
* Resets text format caches.
*
* @see filter_formats()
*/
function filter_formats_reset() {
Dries Buytaert
committed
cache()->deletePrefix('filter_formats');
cache()->deletePrefix('filter_list_format');
drupal_static_reset('filter_list_format');
drupal_static_reset('filter_formats');
}
/**
* Retrieves a list of roles that are allowed to use a given text format.
*
* @param $format
* An object representing the text format.
* @return
* An array of role names, keyed by role ID.
*/
function filter_get_roles_by_format($format) {
// Handle the fallback format upfront (all roles have access to this format).
if ($format->format == filter_fallback_format()) {
return user_roles();
Steven Wittens
committed
}
// Do not list any roles if the permission does not exist.
$permission = filter_permission_name($format);
return !empty($permission) ? user_roles(FALSE, $permission) : array();
}
/**
* Retrieves a list of text formats that are allowed for a given role.
*
* @param $rid
* The user role ID to retrieve text formats for.
* @return
* An array of text format objects that are allowed for the role, keyed by
* the text format ID and ordered by weight.
*/
function filter_get_formats_by_role($rid) {
$formats = array();
foreach (filter_formats() as $format) {
$roles = filter_get_roles_by_format($format);
if (isset($roles[$rid])) {
$formats[$format->format] = $format;
}
Dries Buytaert
committed
}
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
return $formats;
}
/**
* Returns the ID of the default text format for a particular user.
*
* The default text format is the first available format that the user is
* allowed to access, when the formats are ordered by weight. It should
* generally be used as a default choice when presenting the user with a list
* of possible text formats (for example, in a node creation form).
*
* Conversely, when existing content that does not have an assigned text format
* needs to be filtered for display, the default text format is the wrong
* choice, because it is not guaranteed to be consistent from user to user, and
* some trusted users may have an unsafe text format set by default, which
* should not be used on text of unknown origin. Instead, the fallback format
* returned by filter_fallback_format() should be used, since that is intended
* to be a safe, consistent format that is always available to all users.
*
* @param $account
* (optional) The user account to check. Defaults to the currently logged-in
* user.
* @return
* The ID of the user's default text format.
*
* @see filter_fallback_format()
*/
function filter_default_format($account = NULL) {
global $user;
if (!isset($account)) {
$account = $user;
}
// Get a list of formats for this user, ordered by weight. The first one
// available is the user's default format.
$formats = filter_formats($account);
$format = reset($formats);
return $format->format;
}
/**
* Returns the ID of the fallback text format that all users have access to.
*
* The fallback text format is a regular text format in every respect, except
* it does not participate in the filter permission system and cannot be
Dries Buytaert
committed
* disabled. It needs to exist because any user who has permission to create
* formatted content must always have at least one text format they can use.
*
* Because the fallback format is available to all users, it should always be
* configured securely. For example, when the Filter module is installed, this
* format is initialized to output plain text. Installation profiles and site
* administrators have the freedom to configure it further.
*
* Note that the fallback format is completely distinct from the default
* format, which differs per user and is simply the first format which that
* user has access to. The default and fallback formats are only guaranteed to
* be the same for users who do not have access to any other format; otherwise,
* the fallback format's weight determines its placement with respect to the
* user's other formats.
*
Dries Buytaert
committed
* Any modules implementing a format deletion functionality must not delete
* this format.
*
* @see hook_filter_format_disable()
* @see filter_default_format()
*/
function filter_fallback_format() {
// This variable is automatically set in the database for all installations
Dries Buytaert
committed
// of Drupal. In the event that it gets disabled or deleted somehow, there
Angie Byron
committed
// is no safe default to return, since we do not want to risk making an
Dries Buytaert
committed
// existing (and potentially unsafe) text format on the site automatically
// available to all users. Returning NULL at least guarantees that this
// cannot happen.
return variable_get('filter_fallback_format');
}
/**
* Returns the title of the fallback text format.
*/
function filter_fallback_format_title() {
$fallback_format = filter_format_load(filter_fallback_format());
return filter_admin_format_title($fallback_format);
Steven Wittens
committed
}
Steven Wittens
committed
/**
Dries Buytaert
committed
* Return a list of all filters provided by modules.
Steven Wittens
committed
*/
Dries Buytaert
committed
function filter_get_filters() {
$filters = &drupal_static(__FUNCTION__, array());
if (empty($filters)) {
foreach (module_implements('filter_info') as $module) {
$info = module_invoke($module, 'filter_info');
if (isset($info) && is_array($info)) {
Dries Buytaert
committed
// Assign the name of the module implementing the filters and ensure
// default values.
foreach (array_keys($info) as $name) {
$info[$name]['module'] = $module;
Dries Buytaert
committed
$info[$name] += array(
'description' => '',
'weight' => 0,
);
}
Dries Buytaert
committed
$filters = array_merge($filters, $info);
Steven Wittens
committed
}
Dries Buytaert
committed
// Allow modules to alter filter definitions.
drupal_alter('filter_info', $filters);
Dries Buytaert
committed
uasort($filters, '_filter_list_cmp');
}
Steven Wittens
committed
return $filters;
}
/**
* Helper function for sorting the filter list by filter name.
*/
function _filter_list_cmp($a, $b) {
Dries Buytaert
committed
return strcmp($a['title'], $b['title']);
Dries Buytaert
committed
* Check if text in a certain text format is allowed to be cached.
Dries Buytaert
committed
*
* This function can be used to check whether the result of the filtering
* process can be cached. A text format may allow caching depending on the
* filters enabled.
*
* @param $format_id
* The text format ID to check.
* @return
* TRUE if the given text format allows caching, FALSE otherwise.
function filter_format_allowcache($format_id) {
Dries Buytaert
committed
$format = filter_format_load($format_id);
return !empty($format->cache);
}
/**
* Helper function to determine whether the output of a given text format can be cached.
*
* The output of a given text format can be cached when all enabled filters in
* the text format allow caching.
*
* @param $format
* The text format object to check.
* @return
* TRUE if all the filters enabled in the given text format allow caching,
* FALSE otherwise.
*
* @see filter_format_save()
*/
function _filter_format_is_cacheable($format) {
if (empty($format->filters)) {
return TRUE;
}
$filter_info = filter_get_filters();
foreach ($format->filters as $name => $filter) {
// By default, 'cache' is TRUE for all filters unless specified otherwise.
Dries Buytaert
committed
if (!empty($filter['status']) && isset($filter_info[$name]['cache']) && !$filter_info[$name]['cache']) {
Dries Buytaert
committed
return FALSE;
}
Steven Wittens
committed
}
Dries Buytaert
committed
return TRUE;
Steven Wittens
committed
}
/**
Dries Buytaert
committed
* Retrieve a list of filters for a given text format.
Dries Buytaert
committed
*
Dries Buytaert
committed
* Note that this function returns all associated filters regardless of whether
* they are enabled or disabled. All functions working with the filter
* information outside of filter administration should test for $filter->status
* before performing actions with the filter.
*
* @param $format_id
Dries Buytaert
committed
* The format ID to retrieve filters for.
Dries Buytaert
committed
* @return
Dries Buytaert
committed
* An array of filter objects associated to the given text format, keyed by
* filter name.
Steven Wittens
committed
*/
function filter_list_format($format_id) {
Dries Buytaert
committed
$filters = &drupal_static(__FUNCTION__, array());
Dries Buytaert
committed
$filter_info = filter_get_filters();
Steven Wittens
committed
Dries Buytaert
committed
if (!isset($filters['all'])) {
Dries Buytaert
committed
if ($cache = cache()->get('filter_list_format')) {
$filters['all'] = $cache->data;
}
else {
$result = db_query('SELECT * FROM {filter} ORDER BY weight, module, name');
foreach ($result as $record) {
$filters['all'][$record->format][$record->name] = $record;
}
Dries Buytaert
committed
cache()->set('filter_list_format', $filters['all']);
Dries Buytaert
committed
}
}
if (!isset($filters[$format_id])) {
Dries Buytaert
committed
$format_filters = array();
Angie Byron
committed
$filter_map = isset($filters['all'][$format_id]) ? $filters['all'][$format_id] : array();
foreach ($filter_map as $name => $filter) {
Dries Buytaert
committed
if (isset($filter_info[$name])) {
$filter->title = $filter_info[$name]['title'];
Dries Buytaert
committed
// Unpack stored filter settings.
Dries Buytaert
committed
$filter->settings = (isset($filter->settings) ? unserialize($filter->settings) : array());
// Merge in default settings.
if (isset($filter_info[$name]['default settings'])) {
$filter->settings += $filter_info[$name]['default settings'];
}
Dries Buytaert
committed
Dries Buytaert
committed
$format_filters[$name] = $filter;
$filters[$format_id] = $format_filters;
return isset($filters[$format_id]) ? $filters[$format_id] : array();
}
Steven Wittens
committed
/**
* Run all the enabled filters on a piece of text.
*
* Note: Because filters can inject JavaScript or execute PHP code, security is
* vital here. When a user supplies a text format, you should validate it using
* filter_access() before accepting/using it. This is normally done in the
* validation stage of the Form API. You should for example never make a preview
* of content in a disallowed format.
*
* @param $text
* @param $format_id
* The format id of the text to be filtered. If no format is assigned, the
* fallback format will be used.
Dries Buytaert
committed
* @param $langcode
* Optional: the language code of the text to be filtered, e.g. 'en' for
* English. This allows filters to be language aware so language specific
* text replacement can be implemented.
Dries Buytaert
committed
* @param $cache
* Boolean whether to cache the filtered output in the {cache_filter} table.
* The caller may set this to FALSE when the output is already cached
* elsewhere to avoid duplicate cache lookups and storage.
Dries Buytaert
committed
*
* @ingroup sanitization
function check_markup($text, $format_id = NULL, $langcode = '', $cache = FALSE) {
if (!isset($format_id)) {
$format_id = filter_fallback_format();
}
Dries Buytaert
committed
// If the requested text format does not exist, the text cannot be filtered.
if (!$format = filter_format_load($format_id)) {
Angie Byron
committed
watchdog('filter', 'Missing text format: %format.', array('%format' => $format_id), WATCHDOG_ALERT);
Dries Buytaert
committed
return '';
}
Steven Wittens
committed
Angie Byron
committed
// Check for a cached version of this piece of text.
Dries Buytaert
committed
$cache = $cache && !empty($format->cache);
Angie Byron
committed
if ($cache) {
Dries Buytaert
committed
$cache_id = $format->format . ':' . $langcode . ':' . hash('sha256', $text);
Dries Buytaert
committed
if ($cached = cache('filter')->get($cache_id)) {
Angie Byron
committed
return $cached->data;
}
Angie Byron
committed
}
Dries Buytaert
committed
Angie Byron
committed
// Convert all Windows and Mac newlines to a single newline, so filters only
// need to deal with one possibility.
$text = str_replace(array("\r\n", "\r"), "\n", $text);
Angie Byron
committed
// Get a complete list of filters, ordered properly.
$filters = filter_list_format($format->format);
Dries Buytaert
committed
$filter_info = filter_get_filters();
Angie Byron
committed
// Give filters the chance to escape HTML-like data such as code or formulas.
Dries Buytaert
committed
foreach ($filters as $name => $filter) {
if ($filter->status && isset($filter_info[$name]['prepare callback']) && function_exists($filter_info[$name]['prepare callback'])) {
$function = $filter_info[$name]['prepare callback'];
$text = $function($text, $filter, $format, $langcode, $cache, $cache_id);
}
Angie Byron
committed
}
Angie Byron
committed
// Perform filtering.
Dries Buytaert
committed
foreach ($filters as $name => $filter) {
if ($filter->status && isset($filter_info[$name]['process callback']) && function_exists($filter_info[$name]['process callback'])) {
$function = $filter_info[$name]['process callback'];
$text = $function($text, $filter, $format, $langcode, $cache, $cache_id);
Angie Byron
committed
Dries Buytaert
committed
// Cache the filtered text. This cache is infinitely valid. It becomes
// obsolete when $text changes (which leads to a new $cache_id). It is
// automatically flushed when the text format is updated.
// @see filter_format_save()
Angie Byron
committed
if ($cache) {
Dries Buytaert
committed
cache('filter')->set($cache_id, $text);
* Expands an element into a base element with text format selector attached.
*
* The form element will be expanded into two separate form elements, one
* holding the original element, and the other holding the text format selector:
* - value: Holds the original element, having its #type changed to the value of
* #base_type or 'textarea' by default.
* - format: Holds the text format fieldset and the text format selection, using
* the text format id specified in #format or the user's default format by
* default, if NULL.
*
Dries Buytaert
committed
* The resulting value for the element will be an array holding the value and the
* format. For example, the value for the body element will be:
* @code
Dries Buytaert
committed
* $form_state['values']['body']['value'] = 'foo';
* $form_state['values']['body']['format'] = 'foo';
* @endcode
*
* @param $element
* The form element to process. Properties used:
* - #base_type: The form element #type to use for the 'value' element.
* 'textarea' by default.
Angie Byron
committed
* - #format: (optional) The text format id to preselect. If NULL or not set,
* the default format for the current user will be used.
Dries Buytaert
committed
*
* The expanded element.
function filter_process_format($element) {
global $user;
// Ensure that children appear as subkeys of this element.
$element['#tree'] = TRUE;
$blacklist = array(
// Make form_builder() regenerate child properties.
'#parents',
'#id',
'#name',
// Do not copy this #process function to prevent form_builder() from
// recursing infinitely.
'#process',
// Description is handled by theme_text_format_wrapper().
'#description',
// Ensure proper ordering of children.
'#weight',
// Properties already processed for the parent element.
'#prefix',
'#suffix',
'#attached',
'#processed',
'#theme_wrappers',
);
// Move this element into sub-element 'value'.
unset($element['value']);
foreach (element_properties($element) as $key) {
if (!in_array($key, $blacklist)) {
$element['value'][$key] = $element[$key];
}
}
$element['value']['#type'] = $element['#base_type'];
$element['value'] += element_info($element['#base_type']);
// Turn original element into a text format wrapper.
$path = drupal_get_path('module', 'filter');
$element['#attached']['js'][] = $path . '/filter.js';
$element['#attached']['css'][] = $path . '/filter.css';
// Setup child container for the text format widget.
$element['format'] = array(
'#type' => 'fieldset',
'#attributes' => array('class' => array('filter-wrapper')),
Angie Byron
committed
);
// Prepare text format guidelines.
$element['format']['guidelines'] = array(
'#type' => 'container',
'#attributes' => array('class' => array('filter-guidelines')),
'#weight' => 20,
// Get a list of formats that the current user has access to.
$formats = filter_formats($user);
foreach ($formats as $format) {
$options[$format->format] = $format->name;
$element['format']['guidelines'][$format->format] = array(
'#theme' => 'filter_guidelines',
'#format' => $format,
Angie Byron
committed
);
// Use the default format for this user if none was selected.
Angie Byron
committed
if (!isset($element['#format'])) {
$element['#format'] = filter_default_format($user);
}
Angie Byron
committed
$element['format']['format'] = array(
'#type' => 'select',
'#title' => t('Text format'),
'#options' => $options,
'#default_value' => $element['#format'],
'#access' => count($formats) > 1,
'#weight' => 10,
'#attributes' => array('class' => array('filter-list')),
'#parents' => array_merge($element['#parents'], array('format')),
$element['format']['help'] = array(
'#type' => 'container',
'#theme' => 'filter_tips_more_info',
'#attributes' => array('class' => array('filter-help')),
'#weight' => 0,
Dries Buytaert
committed
$all_formats = filter_formats();
Angie Byron
committed
$format_exists = isset($all_formats[$element['#format']]);
$user_has_access = isset($formats[$element['#format']]);
$user_is_admin = user_access('administer filters');
// If the stored format does not exist, administrators have to assign a new
// format.
if (!$format_exists && $user_is_admin) {
Dries Buytaert
committed
$element['format']['format']['#required'] = TRUE;
Angie Byron
committed
$element['format']['format']['#default_value'] = NULL;
// Force access to the format selector (it may have been denied above if
// the user only has access to a single format).
$element['format']['format']['#access'] = TRUE;
}
// Disable this widget, if the user is not allowed to use the stored format,
// or if the stored format does not exist. The 'administer filters' permission
// only grants access to the filter administration, not to all formats.
elseif (!$user_has_access || !$format_exists) {
Dries Buytaert
committed
// Overload default values into #value to make them unalterable.
$element['value']['#value'] = $element['value']['#default_value'];
$element['format']['format']['#value'] = $element['format']['format']['#default_value'];
// Prepend #pre_render callback to replace field value with user notice
// prior to rendering.
Angie Byron
committed
$element['value'] += array('#pre_render' => array());
Dries Buytaert
committed
array_unshift($element['value']['#pre_render'], 'filter_form_access_denied');
// Cosmetic adjustments.
if (isset($element['value']['#rows'])) {
$element['value']['#rows'] = 3;
}
$element['value']['#disabled'] = TRUE;
$element['value']['#resizable'] = FALSE;
// Hide the text format selector and any other child element (such as text
// field's summary).
foreach (element_children($element) as $key) {
if ($key != 'value') {
$element[$key]['#access'] = FALSE;
}
}
}
return $element;
}
Dries Buytaert
committed
/**
* #pre_render callback for #type 'text_format' to hide field value from prying eyes.
*
* To not break form processing and previews if a user does not have access to a
* stored text format, the expanded form elements in filter_process_format() are
* forced to take over the stored #default_values for 'value' and 'format'.
* However, to prevent the unfiltered, original #value from being displayed to
* the user, we replace it with a friendly notice here.
*
* @see filter_process_format()
*/
function filter_form_access_denied($element) {
$element['#value'] = t('This field has been disabled because you do not have sufficient permissions to edit it.');
return $element;
}
/**
* Returns HTML for a text format-enabled form element.
*
* @param $variables
* An associative array containing:
* - element: A render element containing #children and #description.
*
* @ingroup themeable
*/
function theme_text_format_wrapper($variables) {
$element = $variables['element'];
$output = '<div class="text-format-wrapper">';
$output .= $element['#children'];
if (!empty($element['#description'])) {
$output .= '<div class="description">' . $element['#description'] . '</div>';
}
$output .= "</div>\n";
return $output;
* Checks if a user has access to a particular text format.
Dries Buytaert
committed
*
* @param $format
* An object representing the text format.
Dries Buytaert
committed
* @param $account
* (optional) The user account to check access for; if omitted, the currently
* logged-in user is used.
*
* @return
* Boolean TRUE if the user is allowed to access the given format.
Dries Buytaert
committed
function filter_access($format, $account = NULL) {
global $user;
if (!isset($account)) {
$account = $user;
// Handle special cases up front. All users have access to the fallback
Dries Buytaert
committed
// format.
if ($format->format == filter_fallback_format()) {
return TRUE;
// Check the permission if one exists; otherwise, we have a non-existent
// format so we return FALSE.
$permission = filter_permission_name($format);
return !empty($permission) && user_access($permission, $account);
Dries Buytaert
committed
/**
* Helper function for fetching filter tips.
*/