function_check( $tag );
-
- $extra_var = $this->var_replace( $extra_var, null, null, null, null, $loop_level );
-
-
- // check if there's an operator = in the variable tags, if there's this is an initialization so it will not output any value
- $is_init_variable = preg_match( "/^(\s*?)\=[^=](.*?)$/", $extra_var );
-
- //function associate to variable
- $function_var = ( $extra_var and $extra_var[0] == '|') ? substr( $extra_var, 1 ) : null;
-
- //variable path split array (ex. $news.title o $news[title]) or object (ex. $news->title)
- $temp = preg_split( "/\.|\[|\-\>/", $var );
-
- //variable name
- $var_name = $temp[ 0 ];
-
- //variable path
- $variable_path = substr( $var, strlen( $var_name ) );
-
- //parentesis transform [ e ] in [" e in "]
- $variable_path = str_replace( '[', '["', $variable_path );
- $variable_path = str_replace( ']', '"]', $variable_path );
-
- //transform .$variable in ["$variable"]
- $variable_path = preg_replace('/\.\$(\w+)/', '["$\\1"]', $variable_path );
-
- //transform [variable] in ["variable"]
- $variable_path = preg_replace('/\.(\w+)/', '["\\1"]', $variable_path );
-
- //if there's a function
- if( $function_var ){
-
- // check if there's a function or a static method and separate, function by parameters
- $function_var = str_replace("::", "@double_dot@", $function_var );
-
- // get the position of the first :
- if( $dot_position = strpos( $function_var, ":" ) ){
-
- // get the function and the parameters
- $function = substr( $function_var, 0, $dot_position );
- $params = substr( $function_var, $dot_position+1 );
-
- }
- else{
-
- //get the function
- $function = str_replace( "@double_dot@", "::", $function_var );
- $params = null;
-
- }
-
- // replace back the @double_dot@ with ::
- $function = str_replace( "@double_dot@", "::", $function );
- $params = str_replace( "@double_dot@", "::", $params );
-
-
- }
- else
- $function = $params = null;
-
- $php_var = $var_name . $variable_path;
-
- // compile the variable for php
- if( isset( $function ) ){
- if( $php_var )
- $php_var = $php_left_delimiter . ( !$is_init_variable && $echo ? 'echo ' : null ) . ( $params ? "( $function( $php_var, $params ) )" : "$function( $php_var )" ) . $php_right_delimiter;
- else
- $php_var = $php_left_delimiter . ( !$is_init_variable && $echo ? 'echo ' : null ) . ( $params ? "( $function( $params ) )" : "$function()" ) . $php_right_delimiter;
- }
- else
- $php_var = $php_left_delimiter . ( !$is_init_variable && $echo ? 'echo ' : null ) . $php_var . $extra_var . $php_right_delimiter;
-
- $html = str_replace( $tag, $php_var, $html );
-
- }
-
- return $html;
-
- }
-
-
-
- /**
- * replace variables
- *
- * @access public
- * @param string $html
- * @param string $tag_left_delimiter
- * @param string $tag_right_delimiter
- * @param string $php_left_delimiter (optional)
- * @param string $php_right_delimiter (optional)
- * @param string $loop_level (optional)
- * @param string $echo (optional)
- * @return string
- */
- public function var_replace( $html, $tag_left_delimiter, $tag_right_delimiter, $php_left_delimiter = null, $php_right_delimiter = null, $loop_level = null, $echo = null ){
-
- //all variables
- if( preg_match_all( '/' . $tag_left_delimiter . '\$(\w+(?:\.\${0,1}[A-Za-z0-9_]+)*(?:(?:\[\${0,1}[A-Za-z0-9_]+\])|(?:\-\>\${0,1}[A-Za-z0-9_]+))*)(.*?)' . $tag_right_delimiter . '/', $html, $matches ) ){
-
- for( $parsed=array(), $i=0, $n=count($matches[0]); $i<$n; $i++ )
- $parsed[$matches[0][$i]] = array('var'=>$matches[1][$i],'extra_var'=>$matches[2][$i]);
-
- foreach( $parsed as $tag => $array ){
-
- //variable name ex: news.title
- $var = $array['var'];
-
- //function and parameters associate to the variable ex: substr:0,100
- $extra_var = $array['extra_var'];
-
- // check if there's any function disabled by black_list
- $this->function_check( $tag );
-
- $extra_var = $this->var_replace( $extra_var, null, null, null, null, $loop_level );
-
- // check if there's an operator = in the variable tags, if there's this is an initialization so it will not output any value
- $is_init_variable = preg_match( "/^[a-z_A-Z\.\[\](\-\>)]*=[^=]*$/", $extra_var );
-
- //function associate to variable
- $function_var = ( $extra_var and $extra_var[0] == '|') ? substr( $extra_var, 1 ) : null;
-
- //variable path split array (ex. $news.title o $news[title]) or object (ex. $news->title)
- $temp = preg_split( "/\.|\[|\-\>/", $var );
-
- //variable name
- $var_name = $temp[ 0 ];
-
- //variable path
- $variable_path = substr( $var, strlen( $var_name ) );
-
- //parentesis transform [ e ] in [" e in "]
- $variable_path = str_replace( '[', '["', $variable_path );
- $variable_path = str_replace( ']', '"]', $variable_path );
-
- //transform .$variable in ["$variable"] and .variable in ["variable"]
- $variable_path = preg_replace('/\.(\${0,1}\w+)/', '["\\1"]', $variable_path );
-
- // if is an assignment also assign the variable to $this->var['value']
- if( $is_init_variable )
- $extra_var = "=\$this->var['{$var_name}']{$variable_path}" . $extra_var;
-
-
-
- //if there's a function
- if( $function_var ){
-
- // check if there's a function or a static method and separate, function by parameters
- $function_var = str_replace("::", "@double_dot@", $function_var );
-
-
- // get the position of the first :
- if( $dot_position = strpos( $function_var, ":" ) ){
-
- // get the function and the parameters
- $function = substr( $function_var, 0, $dot_position );
- $params = substr( $function_var, $dot_position+1 );
-
- }
- else{
-
- //get the function
- $function = str_replace( "@double_dot@", "::", $function_var );
- $params = null;
-
- }
-
- // replace back the @double_dot@ with ::
- $function = str_replace( "@double_dot@", "::", $function );
- $params = str_replace( "@double_dot@", "::", $params );
- }
- else
- $function = $params = null;
-
- //if it is inside a loop
- if( $loop_level ){
- //verify the variable name
- if( $var_name == 'key' )
- $php_var = '$key' . $loop_level;
- elseif( $var_name == 'value' )
- $php_var = '$value' . $loop_level . $variable_path;
- elseif( $var_name == 'counter' )
- $php_var = '$counter' . $loop_level;
- else
- $php_var = '$' . $var_name . $variable_path;
- }else
- $php_var = '$' . $var_name . $variable_path;
-
- // compile the variable for php
- if( isset( $function ) )
- $php_var = $php_left_delimiter . ( !$is_init_variable && $echo ? 'echo ' : null ) . ( $params ? "( $function( $php_var, $params ) )" : "$function( $php_var )" ) . $php_right_delimiter;
- else
- $php_var = $php_left_delimiter . ( !$is_init_variable && $echo ? 'echo ' : null ) . $php_var . $extra_var . $php_right_delimiter;
-
- $html = str_replace( $tag, $php_var, $html );
-
-
- }
- }
-
- return $html;
- }
-
-
-
- /**
- * Check if function is in black list (sandbox)
- *
- * @access protected
- * @param string $code
- * @throws RainTpl_SyntaxException
- * @return void
- */
- protected function function_check( $code ){
-
- $preg = '#(\W|\s)' . implode( '(\W|\s)|(\W|\s)', self::$black_list ) . '(\W|\s)#';
-
- // check if the function is in the black list (or not in white list)
- if( count(self::$black_list) && preg_match( $preg, $code, $match ) ){
-
- // find the line of the error
- $line = 0;
- $rows=explode("\n",$this->tpl['source']);
- while( !strpos($rows[$line],$code) )
- $line++;
-
- // stop the execution of the script
- $e = new RainTpl_SyntaxException('Unallowed syntax in ' . $this->tpl['tpl_filename'] . ' template');
- throw $e->setTemplateFile($this->tpl['tpl_filename'])
- ->setTag($code)
- ->setTemplateLine($line);
- }
-
- }
-
-
-
- /**
- * Prints debug info about exception or passes it further if debug is disabled.
- *
- * @access protected
- * @param RainTpl_Exception $e
- * @return string
- */
- protected function printDebug(RainTpl_Exception $e){
- if (!self::$debug) {
- throw $e;
- }
- $output = sprintf('Exception: %s
%s
template: %s
',
- get_class($e),
- $e->getMessage(),
- $e->getTemplateFile()
- );
- if ($e instanceof RainTpl_SyntaxException) {
- if (null !== $e->getTemplateLine()) {
- $output .= 'line: ' . $e->getTemplateLine() . '
';
- }
- if (null !== $e->getTag()) {
- $output .= 'in tag: ' . htmlspecialchars($e->getTag()) . '
';
- }
- if (null !== $e->getTemplateLine() && null !== $e->getTag()) {
- $rows=explode("\n", htmlspecialchars($this->tpl['source']));
- $rows[$e->getTemplateLine()] = '' . $rows[$e->getTemplateLine()] . '';
- $output .= 'template code
' . implode('
', $rows) . '';
- }
- }
- $output .= sprintf('trace
In %s on line %d
%s
',
- $e->getFile(), $e->getLine(),
- nl2br(htmlspecialchars($e->getTraceAsString()))
- );
- return $output;
- }
-}
-
-
-
-/**
- * Basic Rain tpl exception.
- */
-class RainTpl_Exception extends Exception{
- /**
- * Path of template file with error.
- */
- protected $templateFile = '';
-
- /**
- * Returns path of template file with error.
- *
- * @return string
- */
- public function getTemplateFile()
- {
- return $this->templateFile;
- }
-
- /**
- * Sets path of template file with error.
- *
- * @param string $templateFile
- * @return RainTpl_Exception
- */
- public function setTemplateFile($templateFile)
- {
- $this->templateFile = (string) $templateFile;
- return $this;
- }
-}
-
-
-
-/**
- * Exception thrown when template file does not exists.
- */
-class RainTpl_NotFoundException extends RainTpl_Exception{
-}
-
-/**
- * Exception thrown when syntax error occurs.
- */
-class RainTpl_SyntaxException extends RainTpl_Exception{
- /**
- * Line in template file where error has occured.
- *
- * @var int | null
- */
- protected $templateLine = null;
-
- /**
- * Tag which caused an error.
- *
- * @var string | null
- */
- protected $tag = null;
-
- /**
- * Returns line in template file where error has occured
- * or null if line is not defined.
- *
- * @return int | null
- */
- public function getTemplateLine()
- {
- return $this->templateLine;
- }
-
- /**
- * Sets line in template file where error has occured.
- *
- * @param int $templateLine
- * @return RainTpl_SyntaxException
- */
- public function setTemplateLine($templateLine)
- {
- $this->templateLine = (int) $templateLine;
- return $this;
- }
-
- /**
- * Returns tag which caused an error.
- *
- * @return string
- */
- public function getTag()
- {
- return $this->tag;
- }
-
- /**
- * Sets tag which caused an error.
- *
- * @param string $tag
- * @return RainTpl_SyntaxException
- */
- public function setTag($tag)
- {
- $this->tag = (string) $tag;
- return $this;
- }
-}
-
-// -- end
diff --git a/lib/privatebin.php b/lib/privatebin.php
index 37e79fb..afe27f2 100644
--- a/lib/privatebin.php
+++ b/lib/privatebin.php
@@ -423,10 +423,8 @@ class privatebin
setcookie('lang', $languageselection);
}
- $page = new RainTPL;
- $page::$path_replace = false;
- // we escape it here because ENT_NOQUOTES can't be used in RainTPL templates
- $page->assign('CIPHERDATA', htmlspecialchars($this->_data, ENT_NOQUOTES));
+ $page = new view;
+ $page->assign('CIPHERDATA', $this->_data);
$page->assign('ERROR', i18n::_($this->_error));
$page->assign('STATUS', i18n::_($this->_status));
$page->assign('VERSION', self::VERSION);
diff --git a/lib/view.php b/lib/view.php
new file mode 100644
index 0000000..4595200
--- /dev/null
+++ b/lib/view.php
@@ -0,0 +1,59 @@
+_variables[$name] = $value;
+ }
+
+ /**
+ * render a template
+ *
+ * @access public
+ * @param string $template
+ * @throws Exception
+ * @return void
+ */
+ public function draw($template)
+ {
+ $path = PATH . 'tpl' . DIRECTORY_SEPARATOR . $template . '.php';
+ if (!file_exists($path))
+ {
+ throw new Exception('Template ' . $template . ' not found!', 80);
+ }
+ extract($this->_variables);
+ include $path;
+ }
+}
diff --git a/tpl/bootstrap-compact.html b/tpl/bootstrap-compact.php
similarity index 50%
rename from tpl/bootstrap-compact.html
rename to tpl/bootstrap-compact.php
index eefef69..084971e 100644
--- a/tpl/bootstrap-compact.html
+++ b/tpl/bootstrap-compact.php
@@ -5,29 +5,37 @@
- {function="i18n::_('PrivateBin')"}
+ <?php echo i18n::_('PrivateBin'); ?>
- {if="$SYNTAXHIGHLIGHTING"}
- {if="strlen($SYNTAXHIGHLIGHTINGTHEME)"}
- {/if}{/if}
+
+
+
-
+
- {if="$SYNTAXHIGHLIGHTING"}
- {/if}{if="$MARKDOWN"}
- {/if}
-
+
+
+
+
-
-
-
-
-
+
+
+
+
+
@@ -37,83 +45,102 @@
-
{if="$FILEUPLOAD"}
+
{/if}{if="strlen($STATUS)"}
+
+
- {$STATUS|htmlspecialchars}
-
{/if}
- {$ERROR|htmlspecialchars}
-
- {function="i18n::_('PrivateBin requires a modern browser to work.')"}
- {function="i18n::_('Still using Internet Explorer? Do yourself a favor, switch to a modern browser:')"}
+
+
+
+
+
+
-
{if="strlen($URLSHORTENER)"}
-
- {/if}
+
+
+
-
{function="i18n::_('Discussion')"}
+
- {$CIPHERDATA}
+
+