Skip to content

Feat/shared dhtml toolbar #151

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
mambax7 merged 8 commits into from
Aug 7, 2026
Merged

Feat/shared dhtml toolbar #151

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
8 commits
Select commit Hold shift + click to select a range
8bc4854
fix(editor): repair the dhtml toolbar's no-selection actions
mambax7 Aug 1, 2026
4ce640f
refactor(editor): render one shared dhtml toolbar for every renderer
mambax7 Aug 1, 2026
425b132
fix(xoopsform): escape element values in all renderer output contexts
mambax7 Aug 3, 2026
e4c2d20
fix(imagemanager): use the core form renderer and enforce authorization
mambax7 Aug 3, 2026
903a944
test(xoopsform): cover attribute contexts on pinned methods and rende…
mambax7 Aug 3, 2026
f2adce6
fix(editor): harden toolbar override handling and attribute output
mambax7 Aug 7, 2026
2b4da55
fix(editor): tighten toolbar rendering paths from second review pass
mambax7 Aug 7, 2026
f7d13a9
fix(textsanitizer): degrade invalid UTF-8 in button JS instead of thr…
mambax7 Aug 7, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
13 changes: 7 additions & 6 deletions htdocs/class/textsanitizer/mms/mms.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -35,14 +35,15 @@ public function encode($textarea_id)
if ($config['enable_mms_entry'] === false) {
return [];
}
$code = "<button type='button' class='btn btn-default btn-sm' onclick='xoopsCodeMms(\"{$textarea_id}\",\""
. htmlspecialchars(_XOOPS_FORM_ENTERMMSURL, ENT_QUOTES | ENT_HTML5) . "\",\""
. htmlspecialchars(_XOOPS_FORM_ALT_ENTERHEIGHT, ENT_QUOTES | ENT_HTML5) . "\",\""
. htmlspecialchars(_XOOPS_FORM_ALT_ENTERWIDTH, ENT_QUOTES | ENT_HTML5)
. "\");' onmouseover='style.cursor=\"hand\"' title='" . _XOOPS_FORM_ALTMMS
$jsonFlags = JSON_HEX_TAG | JSON_HEX_AMP | JSON_HEX_APOS | JSON_HEX_QUOT | JSON_INVALID_UTF8_SUBSTITUTE;
$code = "<button type='button' class='btn btn-default btn-sm' onclick='xoopsCodeMms("
. json_encode((string) $textarea_id, $jsonFlags) . ","
. json_encode(_XOOPS_FORM_ENTERMMSURL, $jsonFlags) . ","
. json_encode(_XOOPS_FORM_ALT_ENTERHEIGHT, $jsonFlags) . ","
. json_encode(_XOOPS_FORM_ALT_ENTERWIDTH, $jsonFlags)
. ");' onmouseover='style.cursor=\"hand\"' title='" . htmlspecialchars(_XOOPS_FORM_ALTMMS, ENT_QUOTES | ENT_SUBSTITUTE, 'UTF-8')
. "'><span class='fa-solid fa-server' aria-hidden='true'></span></button>";
Comment thread
coderabbitai[bot] marked this conversation as resolved.

//$code = "<img src='{$this->image_path}/mmssrc.gif' alt='" . _XOOPS_FORM_ALTMMS . "' title='" . _XOOPS_FORM_ALTMMS . "' '". "' onclick='xoopsCodeMms(\"{$textarea_id}\",\"" . htmlspecialchars(_XOOPS_FORM_ENTERMMSURL, ENT_QUOTES | ENT_HTML5) . "\",\"" . htmlspecialchars(_XOOPS_FORM_ALT_ENTERHEIGHT, ENT_QUOTES | ENT_HTML5) . "\",\"" . htmlspecialchars(_XOOPS_FORM_ALT_ENTERWIDTH, ENT_QUOTES | ENT_HTML5) . "\");' onmouseover='style.cursor=\"hand\"'/>&nbsp;";
$javascript = <<<EOH
function xoopsCodeMms(id,enterMmsPhrase, enterMmsHeightPhrase, enterMmsWidthPhrase)
{
Expand Down
6 changes: 4 additions & 2 deletions htdocs/class/textsanitizer/mp3/mp3.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,8 +30,10 @@ class MytsMp3 extends MyTextSanitizerExtension
*/
public function encode($textarea_id)
{
$buttonHtml = "<button type='button' class='btn btn-default' onclick='xoopsCodeMp3(\"{$textarea_id}\");' title='"
. _XOOPS_FORM_ALTMP3 . "'>"
$jsonFlags = JSON_HEX_TAG | JSON_HEX_AMP | JSON_HEX_APOS | JSON_HEX_QUOT | JSON_INVALID_UTF8_SUBSTITUTE;
$buttonHtml = "<button type='button' class='btn btn-default' onclick='xoopsCodeMp3("
. json_encode((string) $textarea_id, $jsonFlags) . ");' title='"
. htmlspecialchars(_XOOPS_FORM_ALTMP3, ENT_QUOTES | ENT_SUBSTITUTE, 'UTF-8') . "'>"
. "<span class='fa-solid fa-music' aria-hidden='true'></span></button>";

$javascript = <<<EOF
Expand Down
15 changes: 14 additions & 1 deletion htdocs/class/textsanitizer/readme.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,7 +16,20 @@ class MytsMycode extends MyTextSanitizerExtension
// If the extension has config data, load it
$config = parent::loadConfig(__DIR__);
// Make sure that the icon is available /images/form/mycode.gif
$code = "<img src='{$this->image_path}/mycode.gif' alt='" . _XOOPS_FORM_ALTMYCODE . "' onclick='xoopsCodeMycode(\"{$textarea_id}\",\"" . htmlspecialchars(_XOOPS_FORM_ENTERMYCODETERM, ENT_QUOTES | ENT_HTML5) . "\");' onmouseover='style.cursor=\"hand\"'/>&nbsp;";
// Arguments crossing from PHP into a JavaScript string literal MUST be json_encode()d
// with these four flags, NOT htmlspecialchars()d. The browser decodes HTML entities
// BEFORE the JS parser runs, so an entity-escaped quote becomes a real quote and can
// close the literal. json_encode emits \uXXXX escapes, which survive that decode.
//
// The surrounding onclick attribute MUST be single-quoted: json_encode wraps its own
// output in double quotes, so onclick="..." would be closed by the first argument and
// JSON_HEX_QUOT would not help -- it escapes quotes in the VALUE, not the wrapping pair.
$jsFlags = JSON_HEX_TAG | JSON_HEX_AMP | JSON_HEX_APOS | JSON_HEX_QUOT | JSON_INVALID_UTF8_SUBSTITUTE;
$args = json_encode((string) $textarea_id, $jsFlags)
. ', ' . json_encode(_XOOPS_FORM_ENTERMYCODETERM, $jsFlags);
$code = "<img src='{$this->image_path}/mycode.gif' alt='"
. htmlspecialchars(_XOOPS_FORM_ALTMYCODE, ENT_QUOTES | ENT_HTML5, 'UTF-8')
. "' onclick='xoopsCodeMycode({$args});'/>&nbsp;";
$javascript = <<<EOH
function xoopsCodeMycode(id, enterMycodePhrase){
if (enterMycodePhrase == null) {
Expand Down
13 changes: 7 additions & 6 deletions htdocs/class/textsanitizer/rtsp/rtsp.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -35,13 +35,14 @@ public function encode($textarea_id)
if ($config['enable_rtsp_entry'] === false) {
return [];
}
$code = "<button type='button' class='btn btn-default btn-sm' onclick='xoopsCodeRtsp(\"{$textarea_id}\",\""
. htmlspecialchars(_XOOPS_FORM_ENTERRTSPURL, ENT_QUOTES | ENT_HTML5) . "\",\""
. htmlspecialchars(_XOOPS_FORM_ALT_ENTERHEIGHT, ENT_QUOTES | ENT_HTML5) . "\",\""
. htmlspecialchars(_XOOPS_FORM_ALT_ENTERWIDTH, ENT_QUOTES | ENT_HTML5)
. "\");' onmouseover='style.cursor=\"hand\"' title='" . _XOOPS_FORM_ALTRTSP
$jsonFlags = JSON_HEX_TAG | JSON_HEX_AMP | JSON_HEX_APOS | JSON_HEX_QUOT | JSON_INVALID_UTF8_SUBSTITUTE;
$code = "<button type='button' class='btn btn-default btn-sm' onclick='xoopsCodeRtsp("
. json_encode((string) $textarea_id, $jsonFlags) . ","
. json_encode(_XOOPS_FORM_ENTERRTSPURL, $jsonFlags) . ","
. json_encode(_XOOPS_FORM_ALT_ENTERHEIGHT, $jsonFlags) . ","
. json_encode(_XOOPS_FORM_ALT_ENTERWIDTH, $jsonFlags)
. ");' onmouseover='style.cursor=\"hand\"' title='" . htmlspecialchars(_XOOPS_FORM_ALTRTSP, ENT_QUOTES | ENT_SUBSTITUTE, 'UTF-8')
. "'><span class='fa-solid fa-comment' aria-hidden='true'></span></button>";
// $code = "<img src='{$this->image_path}/rtspimg.gif' alt='" . _XOOPS_FORM_ALTRTSP . "' title='" . _XOOPS_FORM_ALTRTSP . "' '" . "' onclick='xoopsCodeRtsp(\"{$textarea_id}\",\"" . htmlspecialchars(_XOOPS_FORM_ENTERRTSPURL, ENT_QUOTES | ENT_HTML5) . "\",\"" . htmlspecialchars(_XOOPS_FORM_ALT_ENTERHEIGHT, ENT_QUOTES | ENT_HTML5) . "\",\"" . htmlspecialchars(_XOOPS_FORM_ALT_ENTERWIDTH, ENT_QUOTES | ENT_HTML5) . "\");' onmouseover='style.cursor=\"hand\"'/>&nbsp;";
$javascript = <<<EOH
function xoopsCodeRtsp(id,enterRtspPhrase, enterRtspHeightPhrase, enterRtspWidthPhrase)
{
Expand Down
8 changes: 5 additions & 3 deletions htdocs/class/textsanitizer/soundcloud/soundcloud.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,9 +14,11 @@ public function encode($textarea_id)
{
// $config = parent::loadConfig(__DIR__);

$code = "<button type='button' class='btn btn-default btn-sm' onclick='xoopsCodeSoundCloud(\"{$textarea_id}\",\""
. htmlspecialchars(_XOOPS_FORM_ENTER_SOUNDCLOUD_URL, ENT_QUOTES | ENT_HTML5)
. "\");' onmouseover='style.cursor=\"hand\"' title='" . _XOOPS_FORM_ALT_SOUNDCLOUD
$jsonFlags = JSON_HEX_TAG | JSON_HEX_AMP | JSON_HEX_APOS | JSON_HEX_QUOT | JSON_INVALID_UTF8_SUBSTITUTE;
$code = "<button type='button' class='btn btn-default btn-sm' onclick='xoopsCodeSoundCloud("
. json_encode((string) $textarea_id, $jsonFlags) . ","
. json_encode(_XOOPS_FORM_ENTER_SOUNDCLOUD_URL, $jsonFlags)
. ");' onmouseover='style.cursor=\"hand\"' title='" . htmlspecialchars(_XOOPS_FORM_ALT_SOUNDCLOUD, ENT_QUOTES | ENT_SUBSTITUTE, 'UTF-8')
. "'><span class='fa-brands fa-soundcloud' aria-hidden='true'></span></button>";
$javascript = <<<EOH
function xoopsCodeSoundCloud(id, enterSoundCloud)
Expand Down
8 changes: 5 additions & 3 deletions htdocs/class/textsanitizer/wiki/wiki.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -34,9 +34,11 @@ class MytsWiki extends MyTextSanitizerExtension
public function encode($textarea_id)
{
$config = parent::loadConfig(__DIR__);
$code = "<button type='button' class='btn btn-default btn-sm' onclick='xoopsCodeWiki(\"{$textarea_id}\",\""
. htmlspecialchars(_XOOPS_FORM_ENTERWIKITERM, ENT_QUOTES | ENT_HTML5)
. "\");' onmouseover='style.cursor=\"hand\"' title='" . _XOOPS_FORM_ALTWIKI
$jsonFlags = JSON_HEX_TAG | JSON_HEX_AMP | JSON_HEX_APOS | JSON_HEX_QUOT | JSON_INVALID_UTF8_SUBSTITUTE;
$code = "<button type='button' class='btn btn-default btn-sm' onclick='xoopsCodeWiki("
. json_encode((string) $textarea_id, $jsonFlags) . ","
. json_encode(_XOOPS_FORM_ENTERWIKITERM, $jsonFlags)
. ");' onmouseover='style.cursor=\"hand\"' title='" . htmlspecialchars(_XOOPS_FORM_ALTWIKI, ENT_QUOTES | ENT_SUBSTITUTE, 'UTF-8')
. "'><span class='fa-solid fa-globe' aria-hidden='true'></span></button>";

$javascript = <<<EOH
Expand Down
13 changes: 7 additions & 6 deletions htdocs/class/textsanitizer/wmp/wmp.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -35,14 +35,15 @@ public function encode($textarea_id)
return [];
}

$code = "<button type='button' class='btn btn-default btn-sm' onclick='xoopsCodeWmp(\"{$textarea_id}\",\""
. htmlspecialchars(_XOOPS_FORM_ENTERWMPURL, ENT_QUOTES | ENT_HTML5) . "\",\""
. htmlspecialchars(_XOOPS_FORM_ALT_ENTERHEIGHT, ENT_QUOTES | ENT_HTML5) . "\",\""
. htmlspecialchars(_XOOPS_FORM_ALT_ENTERWIDTH, ENT_QUOTES | ENT_HTML5)
. "\");' onmouseover='style.cursor=\"hand\"' title='" . _XOOPS_FORM_ALTWMP
$jsonFlags = JSON_HEX_TAG | JSON_HEX_AMP | JSON_HEX_APOS | JSON_HEX_QUOT | JSON_INVALID_UTF8_SUBSTITUTE;
$code = "<button type='button' class='btn btn-default btn-sm' onclick='xoopsCodeWmp("
. json_encode((string) $textarea_id, $jsonFlags) . ","
. json_encode(_XOOPS_FORM_ENTERWMPURL, $jsonFlags) . ","
. json_encode(_XOOPS_FORM_ALT_ENTERHEIGHT, $jsonFlags) . ","
. json_encode(_XOOPS_FORM_ALT_ENTERWIDTH, $jsonFlags)
. ");' onmouseover='style.cursor=\"hand\"' title='" . htmlspecialchars(_XOOPS_FORM_ALTWMP, ENT_QUOTES | ENT_SUBSTITUTE, 'UTF-8')
. "'><span class='fa-brands fa-windows' aria-hidden='true'></span></button>";

//$code = "<img src='{$this->image_path}/wmp.gif' alt='" . _XOOPS_FORM_ALTWMP . "' title='" . _XOOPS_FORM_ALTWMP . "' '" . "' onclick='xoopsCodeWmp(\"{$textarea_id}\",\"" . htmlspecialchars(_XOOPS_FORM_ENTERWMPURL, ENT_QUOTES | ENT_HTML5) . "\",\"" . htmlspecialchars(_XOOPS_FORM_ALT_ENTERHEIGHT, ENT_QUOTES | ENT_HTML5) . "\",\"" . htmlspecialchars(_XOOPS_FORM_ALT_ENTERWIDTH, ENT_QUOTES | ENT_HTML5) . "\");' onmouseover='style.cursor=\"hand\"'/>&nbsp;";
$javascript = <<<EOH
function xoopsCodeWmp(id, enterWmpPhrase, enterWmpHeightPhrase, enterWmpWidthPhrase)
{
Expand Down
12 changes: 7 additions & 5 deletions htdocs/class/textsanitizer/youtube/youtube.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,11 +27,13 @@ class MytsYoutube extends MyTextSanitizerExtension
public function encode($textarea_id)
{
// $config = parent::loadConfig(__DIR__);
$code = "<button type='button' class='btn btn-default btn-sm' onclick='xoopsCodeYoutube(\"{$textarea_id}\",\""
. htmlspecialchars(_XOOPS_FORM_ENTERYOUTUBEURL, ENT_QUOTES | ENT_HTML5) . "\",\""
. htmlspecialchars(_XOOPS_FORM_ALT_ENTERHEIGHT, ENT_QUOTES | ENT_HTML5) . "\",\""
. htmlspecialchars(_XOOPS_FORM_ALT_ENTERWIDTH, ENT_QUOTES | ENT_HTML5)
. "\");' onmouseover='style.cursor=\"hand\"' title='" . _XOOPS_FORM_ALTYOUTUBE
$jsonFlags = JSON_HEX_TAG | JSON_HEX_AMP | JSON_HEX_APOS | JSON_HEX_QUOT | JSON_INVALID_UTF8_SUBSTITUTE;
$code = "<button type='button' class='btn btn-default btn-sm' onclick='xoopsCodeYoutube("
. json_encode((string) $textarea_id, $jsonFlags) . ","
. json_encode(_XOOPS_FORM_ENTERYOUTUBEURL, $jsonFlags) . ","
. json_encode(_XOOPS_FORM_ALT_ENTERHEIGHT, $jsonFlags) . ","
. json_encode(_XOOPS_FORM_ALT_ENTERWIDTH, $jsonFlags)
. ");' onmouseover='style.cursor=\"hand\"' title='" . htmlspecialchars(_XOOPS_FORM_ALTYOUTUBE, ENT_QUOTES | ENT_SUBSTITUTE, 'UTF-8')
. "'><span class='fa-brands fa-youtube' aria-hidden='true'></span></button>";
$javascript = <<<EOH
function xoopsCodeYoutube(id, enterYouTubePhrase, enterYouTubeHeightPhrase, enterYouTubeWidthPhrase)
Expand Down
Loading