diff options
Diffstat (limited to 'vendors/kses/oop/oop.kses.changelog.txt')
| -rw-r--r-- | vendors/kses/oop/oop.kses.changelog.txt | 204 |
1 files changed, 204 insertions, 0 deletions
diff --git a/vendors/kses/oop/oop.kses.changelog.txt b/vendors/kses/oop/oop.kses.changelog.txt new file mode 100644 index 000000000..a82daf4fe --- /dev/null +++ b/vendors/kses/oop/oop.kses.changelog.txt @@ -0,0 +1,204 @@ +kses ChangeLog
+==============
+
+KSES5
+ * 1.0.2
+KSES4
+ * 0.2.2
+ - Folded in code from kses 0.2.2.
+
+KSES5
+ * 1.0.1rc
+KSES4
+ * 0.2.2rc
+ - Added SetProtocols() to make protocol replacement a single step
+ to fully answer concerns in bug #892477
+
+KSES5
+ * 1.0.0
+ - Turned many methods private
+
+ - Now using __construct default constructor
+
+ - Only runs in PHP5 or better
+
+ - All method names changed to reflect verb status
+
+ - Folded sinlge line functions into calling methods
+
+ - Deprecated _hook(), Protocols()
+
+ - Added AddProtocols() to replace Protocols()
+
+ - Added filterKsesTextHook() to replace _hook()
+
+ - Added RemoveProtocol() and RemoveProtocols() to remove protocols
+ singly, or batch. This should clear bug #892477
+
+ - Version number is 1.0.0
+
+KSES4
+ * 0.2.1
+ - Synced version number to procedural code
+
+ - Deprecated _hook(), Protocols()
+
+ - Added AddProtocols() to replace Protocols()
+
+ - Added filterKsesTextHook() to replace _hook()
+
+ - Added RemoveProtocol() and RemoveProtocols() to remove protocols singly,
+ or batch. This should clear bug #892477
+
+OOP
+ - Forked code into PHP4 and PHP5 versions. Use '$myKses = new kses[45]'
+ from now on.
+
+ - Modified code to run in E_STRICT. This should clear bug #918493
+
+ - Added phpDoc commenting
+
+OOP
+ * 0.0.2
+ - Fixed a bug in AddProtocol that wasn't adding new protocols to
+ $this->allowed_protocols
+
+ - Modified internal methods to correspond to kses 0.2.1 modifications.
+
+ - Created a basic test suite that can be run via web or CLI.
+
+ - Started CVSing the code.
+
+OOP
+ * 0.0.1
+ - Turned all the kses_function_name functions to _function_name methods.
+
+ - Added a couple of properties (allowed_protocols, allowed_html) with
+ $this->allowed_protocols defaulting to the lion's share of usual
+ protocols.
+
+ - Modified the applicable use of preg_replace() functions to point to
+ internal class methods.
+
+ - Reduced the parameter list of some methods since internal properties
+ are now being used.
+
+ - Added "public" methods to set up the allowed protocols and HTML.
+
+Procedural
+ * 0.2.1
+
+ 0.2.1 was released on the 29th of September 2003.
+ It has the following changes:
+
+ - There is now an additional version of kses, using the object-oriented
+ paradigm. Thanks a lot to Richard R. Vasquez, Jr., who created it!
+ Anyone who wants to make functional programming, logical programming or
+ spaghetti programming versions of kses as well (or any other programming
+ paradigm that you like), go ahead! All the people who like old
+ procedural programming for web applications shouldn't despair, though,
+ as both versions will be maintained with each release.
+
+ - kses now has some new attribute value checks: minlen, minval and
+ valueless. See docs/attribute-value-checks for an explanation.
+
+ - For some reason, the Opera developers decided to make chr(173) a
+ whitespace character in URL protocols, both when it occurs raw and in an
+ entity. kses now handles this.
+
+ - The URL protocol whitelisting system now decodes entities before
+ removing NULLs and whitespaces.
+
+Procedural
+ * 0.2.0
+
+ 0.2.0 was released on the 25th of July 2003.
+ It has the following changes:
+
+ - kses now supports checking of attribute values, and not just element
+ names and attribute names. The attribute value checks that exist so far
+ are 'maxlen' (checks how long attribute values are, to avoid Buffer
+ Overflows) and 'maxval' (checks how big an integer value is, to avoid
+ Denial of Service attacks).
+
+ Buffer Overflows could both be a problem for WWW clients and different
+ servers on the Internet that an HTML document links to. One example is
+ <frame src="ftp://ftp.v1ct1m.com/AAAAAA..thousands_of_A's...">.
+
+ Denial of Service attacks can take the form of too big sizes of iframes
+ or other things. One example is <iframe src="http://some.web.server/"
+ width="20000" height="2000">, which makes some client machines
+ completely overloaded.
+
+ - kses' old feature of removing "javascript:" from attribute values has
+ been improved. It now has a whole system for white listing of URL
+ protocols, so you can specify that it's acceptable with http:, https:,
+ ftp: and gopher:, but no other protocols in attribute values. The system
+ tries pretty hard to do the right thing with whitespace, upper/lower
+ case, HTML entities ("javascript:") and repeated entries
+ ("javascript:javascript:alert(57)").
+
+ - kses now supports both HTML and XHTML code, by allowing " /" at the end
+ of tags.
+
+ - kses now removes Netscape 4's JavaScript entities, having the form
+ "&{alert(57)};". They don't even seem to work on all versions of
+ Netscape 4, but for completeness' sake it seemed like a good feature to
+ add.
+
+ - A bug with NULLs in javascript: URLs was fixed.
+ (Reported by Simon Cornelius P. Umacob - thanks!)
+
+ - As a nice side effect of the white listing of URL protocols, kses now
+ also normalizes all HTML entities in documents. It will change HTML code
+ with bad entities to the right form, for example "AT&T" will be
+ converted to "AT&T" and "<a href='lyrics.php?band=ladytron&lyrics=
+ playgirl'>" will be converted to "<a href='lyrics.php?band=
+ ladytron&lyrics=playgirl'>". ":" will be converted to
+ ":", "&#XYZZY;" will be converted to "&#XYZZY;", "ä!;" will
+ be converted to "&auml!;" and so on.
+
+ As shown above, it will process HTML entities that it doesn't
+ understand. It will also deal with too big numbers in numeric HTML
+ entities, which is helpful as many browsers seem to wrap them around at
+ 2 ** 32, so the characters 58, 58 + (2 ** 32), 58 + (2 ** 64) etcetera
+ are all colons to the web browser.
+
+ - You can now use upper case letters in your $allowed_html array, in
+ element names, attribute names and attribute value check names. Version
+ 0.1.0 required everything in that array to be in lower case, but that's
+ not necessary any more. You can also use upper case letters in
+ $allowed_protocols.
+
+ - The "Really malformed thing" bug from the TODO file was fixed.
+ It used to convert this string:
+ x > 5 <a href="blah">
+ to:
+ x > 5 <a href="blah">
+ and now it converts it to:
+ x > 5 <a href="blah">
+
+ - The "Weird malformed thing" bug from the TODO file was fixed.
+ It used to convert this string:
+ <a href="5 href=6>
+ to:
+ <a href="6">
+ because of the way kses restarts after a parse error in kses_hair().
+ Now it converts it to:
+ <a>
+
+ - A problem with slashes in HTML tags was fixed.
+
+ - examples/filter.php used to use $SCRIPT_NAME, which doesn't work on
+ Windows.
+ (Reported by Simon Cornelius P. Umacob - thanks!)
+
+ - kses now allows dashes in attribute names, for things like
+ <meta http-equiv=..>.
+
+Procedural
+ * 0.1.0, first public version
+
+ 0.1.0 was released on the 9th of June 2003.
+ It was announced on three security related mailing lists on Friday the
+ 13th of June (nothing bad happened to it though).
|