Leahnaya/pokemon-showdown-client
1
0
Fork 0
mirror of https://github.com/smogon/pokemon-showdown-client.git synced 2026-09-08 20:08:38 -05:00
Code Issues Actions 1 Packages Projects Releases Wiki Activity

Sanitise custom CSS

Browse Source
This commit is contained in:
Cathy J. Fitzpatrick
2013-02-13 01:09:57 -07:00
parent a4da67a09f
commit 6650291f9b
3 changed files with 60 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
.htaccess
View File

@@ -42,6 +42,7 @@ RewriteRule ^~~([^/]*)/?$ /~~$1/lobby [R=301,L]
RewriteRule ^~~([^/]*)/(teambuilder|ladder|lobby|battle)/?$ index.php?server=$1 [L,QSA]
RewriteRule ^~~([^/]*)/(lobby|battle)-([A-Za-z0-9-]*)$ index.php?server=$1 [L,QSA]
RewriteRule ^~~([^:/]*)(:[0-9]*)?/action\.php$ action.php?serverid=$1 [L,QSA]
RewriteRule ^style/custom/([A-Za-z0-9-]*)\.css$ customcss.php?server=$1 [L]
RewriteRule ^backup/ - [F]
RewriteRule ^\.git/ - [F]

58
customcss.php Normal file
View File

@@ -0,0 +1,58 @@
<?php
include '../pokemonshowdown.com/config/servers.inc.php';
header('Content-type: text/css');
$server = @$_REQUEST['server'];
$customcssuri = @$PokemonServers[$server]['customcss'];
if (empty($customcssuri)) {
die();
}
$cssfile = '../pokemonshowdown.com/config/customcss/' . $server;
// No need to sanitise $server because it should be safe already.
$lastmodified = @filemtime($cssfile);
if ($lastmodified && (time() - $lastmodified) < 3600) {
// Don't check for modifications more than once an hour.
readfile($cssfile);
die();
}
$curl = curl_init($customcssuri);
if ($lastmodified) {
curl_setopt($curl, CURLOPT_HTTPHEADER, array(
'If-Modified-Since: ' . gmdate('D, d M Y H:i:s T', $lastmodified)
));
}
curl_setopt($curl, CURLOPT_FOLLOWLOCATION, true);
curl_setopt($curl, CURLOPT_MAXREDIRS, 5);
curl_setopt($curl, CURLOPT_RETURNTRANSFER, true);
$curlret = curl_exec($curl);
if ($curlret) {
$code = curl_getinfo($curl, CURLINFO_HTTP_CODE);
if ($code === 304) {
// No modifications.
readfile($cssfile);
touch($cssfile); // Don't check again for an hour.
} else if ($code === 200) {
// Sanitise the CSS.
require '../pokemonshowdown.com/lib/htmlpurifier/HTMLPurifier.auto.php';
require '../pokemonshowdown.com/lib/csstidy/class.csstidy.php';
$config = HTMLPurifier_Config::createDefault();
$config->set('Filter.ExtractStyleBlocks', TRUE);
$purifier = new HTMLPurifier($config);
$level = error_reporting(E_ALL & ~E_STRICT);
$html = $purifier->purify('<style>' . $curlret . '</style>');
error_reporting($level);
list($outputcss) = $purifier->context->get('StyleBlocks');
file_put_contents($cssfile, $outputcss);
echo $outputcss;
} else {
// Error condition - clear the cached file.
file_put_contents($cssfile, '');
}
}
curl_close($curl);

2
index.php.template.txt
View File

@@ -107,7 +107,7 @@ if (!$challengeresponse) {
<link rel="stylesheet" href="/style/replayer.css" /><!-- utilichart -->
<link rel="stylesheet" href="/style/font-awesome.css" />
<?php if (@$serverdata['customcss']) { ?>
<link rel="stylesheet" href="<?php echo $serverdata['customcss'] ?>" />
<link rel="stylesheet" href="/style/custom/<?php echo $serverid ?>.css" />
<?php } ?>
<meta id="viewport" name="viewport" content="width=640"/>
<meta http-equiv="X-UA-Compatible" content="IE=Edge,chrome=1" />