RichTextSanitiser class - Documentation for SproutCMS

Info Page:

Page options:

class RichTextSanitiser

Helper that strictly validates and sanitises user submitted HTML
Intended for use with front-end instances of TinyMCE to ensure XSS is impossible.

File: /sprout/Helpers/RichTextSanitiser.php
Namespace: Sprout\Helpers
This class is final

Variables

Name	Visibility	Description
`$default_permitted_tags`	(static)	The default set of tags (and attributes) that are permitted
`$dom_doc`
`$errors`
`$local_resources`
`$permitted_tags`

Functions

Name	Visibility	Description
__construct	public	Construct the sanitiser given a string of HTML
encodeAttributeValue	private	Encodes the value of an attribute using the correct encoding based on type
getErrors	public	Get the list of errors produced during @see RichTextSanitiser::sanitise
hasErrors	public	Checks whether any errors occurred during sanitising
sanitise	public	Gets a sanitised copy of the HTML
sanitiseNode	private	Recursively sanitises a node and its children, echoing any output in order of appearance
setLocalResources	public	Set whether to only allow local resources to be referenced by automatically fetching attributes

public __construct

void $RichTextSanitiser->__construct ( string $richtextData [, array $permitted_tags ] );

Construct the sanitiser given a string of HTML

private encodeAttributeValue

string|bool $RichTextSanitiser->encodeAttributeValue ( int $type , string $value );

Encodes the value of an attribute using the correct encoding based on type

public getErrors

array $RichTextSanitiser->getErrors ( );

Get the list of errors produced during @see RichTextSanitiser::sanitise

public hasErrors

bool $RichTextSanitiser->hasErrors ( );

Checks whether any errors occurred during sanitising

public sanitise

string $RichTextSanitiser->sanitise ( );

Gets a sanitised copy of the HTML

private sanitiseNode

void $RichTextSanitiser->sanitiseNode ( DOMNode $node );

Recursively sanitises a node and its children, echoing any output in order of appearance

public setLocalResources

void $RichTextSanitiser->setLocalResources ( bool $local );

Set whether to only allow local resources to be referenced by automatically fetching attributes
e.g. the src attribute on an <img> tag. Does not apply to the href attribute as that won't be
automatically fetched by a browser.

SproutCMS

Search documentation