From df85f2625e42c9dbb3bcb0a1a6d1bbc49d100b00 Mon Sep 17 00:00:00 2001 From: wangyidong Date: Tue, 8 Mar 2016 11:32:48 +0800 Subject: [PATCH] * finish task #2474 and fix bug. --- config/config.php | 1 + framework/helper.class.php | 15 +++++++++++- lib/filter/filter.class.php | 36 ++++++++++++++++++++--------- lib/front/front.class.php | 1 + module/product/css/browse.css | 1 + module/product/view/browse.html.php | 2 +- module/task/lang/en.php | 2 +- module/task/lang/zh-cn.php | 2 +- module/task/model.php | 2 +- www/js/my.full.js | 4 ++-- 10 files changed, 48 insertions(+), 18 deletions(-) diff --git a/config/config.php b/config/config.php index 4a18c538ba..7dab5bd382 100644 --- a/config/config.php +++ b/config/config.php @@ -110,6 +110,7 @@ $config->framework = new stdclass(); $config->framework->jsWithPrefix = false; $config->framework->autoRepairTable = true; $config->framework->logDays = 14; +$config->framework->purifier = true; /* Include the custom config file. */ $configRoot = dirname(__FILE__) . DIRECTORY_SEPARATOR; diff --git a/framework/helper.class.php b/framework/helper.class.php index 8f0e2734fc..7a18028526 100644 --- a/framework/helper.class.php +++ b/framework/helper.class.php @@ -1204,12 +1204,25 @@ function header301($url) */ function processEvil($value) { + global $config; if(strpos(htmlspecialchars_decode($value), 'framework->stripXSS) and $config->framework->stripXSS) + { + if(stripos($value, 'loadClass('purifier', true); - $config = HTMLPurifier_Config::createDefault(); - $config->set('Filter.YouTube', 1); + global $app, $config; + if(empty($allowedTags) and isset($config->allowedTags)) $allowedTags = $config->allowedTags; + $usePurifier = isset($config->framework->purifier) ? $config->framework->purifier : false; + if($usePurifier) + { + $app->loadClass('purifier', true); + $purifierConfig = HTMLPurifier_Config::createDefault(); + $purifierConfig->set('Filter.YouTube', 1); - /* Disable caching. */ - $config->set('Cache.DefinitionImpl', null); + /* Disable caching. */ + $purifierConfig->set('Cache.DefinitionImpl', null); - $purifier = new HTMLPurifier($config); - $def = $config->getHTMLDefinition(true); - $def->addAttribute('a', 'target', 'Enum#_blank,_self,_target,_top'); + $purifier = new HTMLPurifier($purifierConfig); + $def = $purifierConfig->getHTMLDefinition(true); + $def->addAttribute('a', 'target', 'Enum#_blank,_self,_target,_top'); + } $fields = $this->processFields($fieldName); foreach($fields as $fieldName) @@ -717,7 +722,16 @@ class fixer if(!in_array($fieldName, $this->stripedFields)) { - if(!defined('RUN_MODE') or RUN_MODE != 'admin') $this->data->$fieldName = $purifier->purify($this->data->$fieldName); + if(!defined('RUN_MODE') or RUN_MODE != 'admin') + { + /* + * purifier会把 替换空格，kindeditor在会吧行首的空格去掉。 + * purifier will change   to ' ', and edit it will no space in line head use kindeditor. + **/ + if($usePurifier) $this->data->$fieldName = str_replace(' ', '&spnb;', $this->data->$fieldName); + $this->data->$fieldName = $usePurifier ? $purifier->purify($this->data->$fieldName) : strip_tags($this->data->$fieldName, $allowedTags); + if($usePurifier) $this->data->$fieldName = str_replace('&spnb;', ' ', $this->data->$fieldName); + } } $this->stripedFields[] = $fieldName; } diff --git a/lib/front/front.class.php b/lib/front/front.class.php index 108b8816f4..8a643f1fc1 100644 --- a/lib/front/front.class.php +++ b/lib/front/front.class.php @@ -317,6 +317,7 @@ class html { $id = "id='$name'"; if(strpos($attrib, 'id=') !== false) $id = ''; + $value = str_replace("'", ''', $value); return "\n"; } diff --git a/module/product/css/browse.css b/module/product/css/browse.css index 0b1dda3c8f..09631780c1 100644 --- a/module/product/css/browse.css +++ b/module/product/css/browse.css @@ -2,3 +2,4 @@ .dropdown-menu > .menu-search {padding: 0; position: absolute; z-index: 0; bottom: 0; left: 0; right: 0} .dropdown-menu > .menu-search .input-group {width:100%;} .dropdown-menu > .menu-search .input-group-addon {position: absolute; right: 10px; top: 0; z-index: 10; background: none; border: none; color: #666} +.pl-5px{padding-left:5px;} diff --git a/module/product/view/browse.html.php b/module/product/view/browse.html.php index 96235f0c42..44fcfebf0e 100644 --- a/module/product/view/browse.html.php +++ b/module/product/view/browse.html.php @@ -113,7 +113,7 @@ id]) ? " class='popoverStage' data-toggle='popover' data-placement='bottom' data-target='\$next'" : '') . "'>"; echo $lang->story->stageList[$story->stage]; - if(isset($storyStages[$story->id])) echo ""; + if(isset($storyStages[$story->id])) echo ""; echo ''; if(isset($storyStages[$story->id])) { diff --git a/module/task/lang/en.php b/module/task/lang/en.php index 8095db46df..639395d114 100644 --- a/module/task/lang/en.php +++ b/module/task/lang/en.php @@ -163,7 +163,7 @@ $lang->task->error->consumedThisTime = 'Please input "hours"'; $lang->task->error->left = 'Please input "left"'; $lang->task->error->work = '"Comment" must be less than 255 characters'; $lang->task->error->skipClose = 'The status of Tasks : %s are not finished or canceled, can not close.'; -$lang->task->error->consumed = 'The consumed of task %s is less than zero, ignore it.'; +$lang->task->error->consumed = 'The estimate of task %s is less than zero, ignore it.'; /* Report. */ $lang->task->report = new stdclass(); diff --git a/module/task/lang/zh-cn.php b/module/task/lang/zh-cn.php index be32be06fd..ff08972915 100644 --- a/module/task/lang/zh-cn.php +++ b/module/task/lang/zh-cn.php @@ -163,7 +163,7 @@ $lang->task->error->consumedThisTime = '请填写"工时"'; $lang->task->error->left = '请填写"剩余"'; $lang->task->error->work = '"备注"必须小于255个字符'; $lang->task->error->skipClose = '任务：%s 不是“已完成”或“已取消”状态，不能关闭！'; -$lang->task->error->consumed = '任务：%s总消耗小于0，忽略该任务工时的改动'; +$lang->task->error->consumed = '任务：%s工时不能小于0，忽略该任务工时的改动'; /* 统计报表。*/ $lang->task->report = new stdclass(); diff --git a/module/task/model.php b/module/task/model.php index 64f7baa943..8ad94b5941 100644 --- a/module/task/model.php +++ b/module/task/model.php @@ -313,7 +313,7 @@ class taskModel extends model if($data->consumeds[$taskID]) { - if(($oldTask->consumed + $data->consumeds[$taskID]) < 0) + if($data->consumeds[$taskID] < 0) { echo js::alert(sprintf($this->lang->task->error->consumed, $taskID)); } diff --git a/www/js/my.full.js b/www/js/my.full.js index 90ca60414b..3906d8a8a6 100644 --- a/www/js/my.full.js +++ b/www/js/my.full.js @@ -1375,10 +1375,10 @@ function fixedTfootAction(formID) if($inputgroup.size() > 0)var $inputwidth = $inputgroup.width(); - var tfootOffset = $tfoot.offset().top + 30; + var tfootOffset = $tfoot.offset().top + $tfoot.height() + 20; var windowH = $(window).height(); var tableWidth = $table.width(); - if(tfootOffset > windowH + $(window).scrollTop()) + if(tfootOffset >= windowH + $(window).scrollTop()) { $tfoot.addClass('fixedTfootAction'); $tfoot.width(tableWidth);