<?php

@( (bool)FALSE === strpos( $_SERVER['REQUEST_URI'], basename( __FILE__ ) ) ) OR exit( '!! ACCESS DENIED !!' );
error_reporting( _E_VALUE );

/* vim: set expandtab tabstop=4 shiftwidth=4: */

// ***** BEGIN LICENSE BLOCK ( DO NOT REMOVE ) *****

// +----------------------------------------------------------------------+
// | WebSanitizer For MPN 188_8                                           |
// |                                                                      |
// | -> Default Administrative Sainitizing Parameters                     |
// +----------------------------------------------------------------------+
// | VERSION: 0.3 Alpha                                                   |
// +----------------------------------------------------------------------+
// | LICENSE: GPL 2.0 (see docs/LICENSE_GPL)                              |
// |                                                                      |
// | This file is part of WebSanitizer For MPN 188_8.                     |
// |                                                                      |
// | WebSanitizer For MPN 188_8 is free software; you can redistribute it |
// | and/or modify it under the terms of the GNU General Public License   |
// | as published by the Free Software Foundation; either version 2       |
// | of the License, or (at your option) any later version.               |
// |                                                                      |
// | WebSanitizer For MPN 188_8 is distributed in the hope that it        |
// | will be useful, but WITHOUT ANY WARRANTY; without even the implied   |
// | warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.     |
// | See the GNU General Public License for more details.                 |
// |                                                                      |
// | You should have received a copy of the GNU General Public License    |
// | along with WebSanitizer For MPN 188_8; if not, write to the          |
// | Free Software Foundation, Inc.,                                      |
// | 59 Temple Place, Suite 330, Boston, MA 02111-1307  USA               |
// +----------------------------------------------------------------------+
// | AUTHOR(s):                                                           |
// |                                                                      |
// | The Original Code is the WebSanitizer For MPN 188_8.                 |
// | The Initial Developer of the Original Code is Eric Haddix.           |
// |                                                                      |
// | Portions created by Eric Haddix or Kiril Threndor                    |
// | <support@websanitizer.illearth.net> are                              |
// | Copyright (C) 2003 Eric Haddix.  All Rights Reserved.                |
// |                                                                      |
// | Portions from htmlfilter.inc v. 1.1, created by                      |
// | Konstantin Riabitsev <icon@linux.duke.edu> are                       |
// | Copyright (C) 2002-2003 by Duke University.  All Rights Reserved.    |
// +----------------------------------------------------------------------+
// | CONTRIBUTOR(s):                                                      |
// |                                                                      |
// |                                                                      |
// +----------------------------------------------------------------------+
// | MODIFICATIONS:                                                       |
// |                                                                      |
// |                                                                      |
// +----------------------------------------------------------------------+
// | REQUIRED FILES: core_Sanitize.param.php                              |
// |                 core_AllowArrays.param.php ( Optional )              |
// +----------------------------------------------------------------------+
// | NOTES:                                                               |
// |   These are the default sanitizing parameters for ADMINISTRATORS     |
// |   ONLY.  It is highly recommended you leave these settings           |
// |   at the default values however you can adjust them to allow for a   |
// |   wider range of allowed content posting by admins.                  |
// |                                                                      |
// |   The oringal htmlfilter source code can be found at:                |
// |   http://linux.duke.edu/projects/mini/htmlfilter/                    |
// +----------------------------------------------------------------------+
// | SUPPORT:                                                             |
// |   WEB:   http://myphpnuke.com/                                       |
// |   EMAIL: support@websanitizer.illearth.net                           |
// +----------------------------------------------------------------------+
// $Id: core_SanitizeAdmin.param.php,v 1.1.2.6 2004/08/15 12:58:24 kirilt Exp $

// ***** END LICENSE BLOCK ( DO NOT REMOVE ) *****

/**
 * The Array Comments Below Taken Directly From htmlfilter.inc
 *
 * $tag_list
 * ----------
 * This is a simple one-dimentional array of strings, except for the
 * very first one. The first member should be einter false or true.
 * In case it's FALSE, the following list will be considered a list of
 * tags that should be explicitly REMOVED from the body, and all
 * others that did not match the list will be allowed.  If the first
 * member is TRUE, then the list is the list of tags that should be
 * explicitly ALLOWED -- any tag not matching this list will be
 * discarded.
 *
 * Examples:
 * $tag_list = Array(
 *                   false,
 *                   "blink",
 *                   "link",
 *                   "object",
 *                   "meta",
 *                   "marquee",
 *                   "html"
 *                  );
 *
 * This will allow all tags except for blink, link, object, meta, marquee,
 * and html.
 *
 * $tag_list = Array(
 *                   true,
 *                   "b",
 *                   "a",
 *                   "i",
 *                   "img",
 *                   "strong",
 *                   "em",
 *                   "p"
 *                  );
 *
 * This will remove all tags from the body except b, a, i, img, strong, em and
 * p.
 *
 * $rm_tags_with_content
 * ---------------------
 * This is a simple one-dimentional array of strings, which specifies the
 * tags to be removed with any and all content between the beginning and
 * the end of the tag.
 * Example:
 * $rm_tags_with_content = Array(
 *                               "script",
 *                               "style",
 *                               "applet",
 *                               "embed"
 *                              );
 *
 * This will remove the following structure:
 * <script>
 *  window.alert("Isn't cross-site-scripting fun?!");
 * </script>
 *
 * $self_closing_tags
 * ------------------
 * This is a simple one-dimentional array of strings, which specifies which
 * tags contain no content and should not be forcefully closed if this option
 * is turned on (see further).
 * Example:
 * $self_closing_tags =  Array(
 *                             "img",
 *                             "br",
 *                             "hr",
 *                             "input"
 *                            );
 *
 * $force_tag_closing
 * ------------------
 * Set it to true to forcefully close any tags opened within the document.
 * This is good if you want to take care of people who like to screw up
 * the pages by leaving unclosed tags like <a>, <b>, <i>, etc.
 *
 * $rm_attnames
 * -------------
 * Now we come to parameters that are more obscure. This parameter is
 * a nested array which is used to specify which attributes should be
 * removed. It goes like so:
 *
 * $rm_attnames = Array(
 *   "PCRE regex to match tag name" =>
 *     Array(
 *           "PCRE regex to match attribute name"
 *           )
 *   );
 *
 * Example:
 * $rm_attnames = Array(
 *   "|.*|" =>
 *     Array(
 *           "|target|i",
 *           "|^on.*|i"
 *          )
 *   );
 *
 * This will match all attributes (.*), and specify that all attributes
 * named "target" and starting with "on" should be removed. This will take
 * care of the following problem:
 * <em onmouseover="window.alert('muahahahaha')">
 * The "onmouseover" will be removed.
 *
 * $bad_attvals
 * ------------
 * This is where it gets ugly. This is a nested array with many levels.
 * It goes like so:
 *
 * $bad_attvals = Array(
 *   "pcre regex to match tag name" =>
 *     Array(
 *           "pcre regex to match attribute name" =>
 *             Array(
 *                   "pcre regex to match attribute value"
 *                  )
 *             Array(
 *                   "pcre regex replace a match from above with"
 *                  )
 *          )
 *   );
 *
 * An extensive example:
 *
 * $bad_attvals = Array(
 *   "|.*|" =>
 *      Array(
 *            "/^src|background|href|action/i" =>
 *                Array(
 *                      Array(
 *                            "/^([\'\"])\s*\S+script\s*:.*([\'\"])/si"
 *                            ),
 *                      Array(
 *                            "\\1http://veryfunny.com/\\2"
 *                            )
 *                      ),
 *            "/^style/i" =>
 *                Array(
 *                      Array(
 *                            "/expression/si",
 *                            "/url\(([\'\"])\s*https*:.*([\'\"])\)/si",
 *                            "/url\(([\'\"])\s*\S+script:.*([\'\"])\)/si"
 *                           ),
 *                      Array(
 *                            "idiocy",
 *                            "url(\\1http://veryfunny.com/\\2)",
 *                            "url(\\1http://veryfynny.com/\\2)"
 *                           )
 *                      )
 *            )
 *  );
 *
 * This will take care of nearly all known cross-site scripting exploits,
 * plus some (see my filter sample at
 * http://www.mricon.com/html/phpfilter.html for a working version).
 *
 * $add_attr_to_tag
 * ----------------
 * This is a useful little feature which lets you add attributes to
 * certain tags. It is a nested array as well, but not at all like
 * the previous one. It goes like so:
 *
 * $add_attr_to_tag = Array(
 *   "PCRE regex to match tag name" =>
 *     Array(
 *           "attribute name"=>'"attribute value"'
 *          )
 *   );
 *
 * Note: don't forget quotes around attribute value.
 *
 * Example:
 *
 * $add_attr_to_tag = Array(
 *   "/^a$/si" =>
 *     Array(
 *           'target'=>'"_new"'
 *          )
 *   );
 *
 * This will change all <a> tags and add target="_new" to them so all links
 * open in a new window.
 *
 */

// WARNING: CHANGE THESE VALUES ONLY WITH EXTREME CAUTION
// AS YOU MAY COMPROMISE THE SECURITY OF YOUR SITE

// ANY CHANGES TO THIS FILE WILL NOT BE SUPPORTED BY THE MPN DEVTEAM
// AND ARE INTENDED FOR ADVANCED USERS ONLY



// Allowed / Disallowed Tags

// ( DO NOT CHANGE THIS ARRAY )

// If you need to modify the allow tags please do it in
// ./classes/subs/sanitizer/core_AllowArrays.param.php
// Changes to this array will be overridden by the settings in the above file
// and is only here to provide for a failsafe default.

$tag_list = array
(
      FALSE
    , 'html'
    , 'head'
    , 'meta'
    , 'link'
    , 'body'
    , 'frameset'
    , 'frame'
    , 'blink'
    , 'object'
    , 'font'
    , 'iframe'
    , 'layer'
    , 'ilayer'
    , 'form'
    , 'script'
    , 'plaintext'
);

// Cleanup Tags Unconditionally

// This array will remove all the tags listed AND the content contained
// within those tags.  If the HTML is poorly coded and one of these tags is not
// closed properly, then ALL content from the point the tag was opened to the end
// of the content body will be stripped.

$rm_tags_with_content = array
(
      'script'
    , 'style'
    , 'applet'
    , 'embed'
    , 'head'
    , 'frameset'
    , 'frame'
    , 'xml'
    , 'form'
);

// Remove All Attributes From These Tags Unconditionally
// This array should contain tags that are allowed, but you want
// the attributes to go away

$rm_all_att = array
(
      'script'
    , 'style'
    , 'applet'
    , 'embed'
    , 'head'
    , 'frameset'
    , 'xml'
    , 'form'
);

// Fix Bad HTML (automaticlly close tags that are parsed as "self closing" )

$self_closing_tags = array
(
      'br'
    , 'hr'
    , 'input'
    , 'li'
    , 'addsig'
    , 'img'
);


// Disallowed Attributes

$rm_attnames = array
(
    '/.*/' => array
    (
          '/target/i'
        , '/^on.*/i'
        , '/^dynsrc/i'
        , '/^datasrc/i'
        , '/^data.*/i'
        , '/^lowsrc/i'
    )
);

$bad_attvals = array
(
    '/.*/' => array
    (
        '/.*/' => array
        (
            array
            (
                  '/^([\'\"])\s*\S+\s*script\s*:*(.*)([\'\"])/si'
                , '/^([\'\"])\s*https*\s*:(.*)([\'\"])/si'
                , '/^([\'\"])\s*mocha\s*:*(.*)([\'\"])/si'
                , '/^([\'\"])\s*about\s*:(.*)([\'\"])/si'
            )

            ,array
            (
                  '\\1oddjob:\\2\\1'
                , '\\1uucp:\\2\\1'
                , '\\1amaretto:\\2\\1'
                , '\\1round:\\2\\1'
            )
        )

        ,'/^style/i' => array
        (
            array
            (
                  '/expression/i'
                , '/behaviou*r/i'
                , '/binding/i'
                , '/include-source/i'
                , '/url\s*\(\s*([\'\"]*)\s*https*:.*([\'\"]*)\s*\)/si'
                , '/url\s*\(\s*([\'\"]*)\s*\S+\s*script:.*([\'\"]*)\s*\)/si'
            )

            ,array
            (
                  'idiocy'
                , 'idiocy'
                , 'idiocy'
                , 'idiocy'
                , 'url(\\1http://securityfocus.com/\\1)'
                , 'url(\\1http://securityfocus.com/\\1)'
            )
        )
    )
);

// Add Attributes To Tags

$add_attr_to_tag = array
(
    'a' => array( 'target' => '"_new"' )
);

// Allowed Http Type Attribute Values Tags
// Tagname => attribute name

$allow_http_attr_vals = array
(
      'a'   => array( 'href', 'alt' )
    , 'uri' => array( 'href', 'alt' )
    , 'img' => array( 'src', 'alt' )
    , 'area' => array( 'href', 'alt' )
);

?>