/**
* Applies the global text filters to arbitrary text as per settings for current user groups
*
* @param string $text The string to filter
*
* @return string The filtered string
*
* @since 2.5
*/
public static function filterText($text)
{
// Punyencoding utf8 email addresses
$text = InputFilter::getInstance()->emailToPunycode($text);
// Filter settings
$config = static::getParams('com_config');
$user = Factory::getUser();
$userGroups = Access::getGroupsByUser($user->get('id'));
$filters = $config->get('filters');
$forbiddenListTags = array();
$forbiddenListAttributes = array();
$customListTags = array();
$customListAttributes = array();
$allowedListTags = array();
$allowedListAttributes = array();
$allowedList = false;
$forbiddenList = false;
$customList = false;
$unfiltered = false;
// Cycle through each of the user groups the user is in.
// Remember they are included in the Public group as well.
foreach ($userGroups as $groupId) {
// May have added a group by not saved the filters.
if (!isset($filters->{$groupId})) {
continue;
}
// Each group the user is in could have different filtering properties.
$filterData = $filters->{$groupId};
$filterType = strtoupper($filterData->filter_type);
if ($filterType === 'NH') {
// Maximum HTML filtering.
} elseif ($filterType === 'NONE') {
// No HTML filtering.
$unfiltered = true;
} else {
// Forbidden list or allowed list.
// Preprocess the tags and attributes.
$tags = explode(',', $filterData->filter_tags);
$attributes = explode(',', $filterData->filter_attributes);
$tempTags = array();
$tempAttributes = array();
foreach ($tags as $tag) {
$tag = trim($tag);
if ($tag) {
$tempTags[] = $tag;
}
}
foreach ($attributes as $attribute) {
$attribute = trim($attribute);
if ($attribute) {
$tempAttributes[] = $attribute;
}
}
// Collect the forbidden list or allowed list tags and attributes.
// Each list is cumulative.
if ($filterType === 'BL') {
$forbiddenList = true;
$forbiddenListTags = array_merge($forbiddenListTags, $tempTags);
$forbiddenListAttributes = array_merge($forbiddenListAttributes, $tempAttributes);
} elseif ($filterType === 'CBL') {
// Only set to true if Tags or Attributes were added
if ($tempTags || $tempAttributes) {
$customList = true;
$customListTags = array_merge($customListTags, $tempTags);
$customListAttributes = array_merge($customListAttributes, $tempAttributes);
}
} elseif ($filterType === 'WL') {
$allowedList = true;
$allowedListTags = array_merge($allowedListTags, $tempTags);
$allowedListAttributes = array_merge($allowedListAttributes, $tempAttributes);
}
}
}
// Remove duplicates before processing (because the forbidden list uses both sets of arrays).
$forbiddenListTags = array_unique($forbiddenListTags);
$forbiddenListAttributes = array_unique($forbiddenListAttributes);
$customListTags = array_unique($customListTags);
$customListAttributes = array_unique($customListAttributes);
$allowedListTags = array_unique($allowedListTags);
$allowedListAttributes = array_unique($allowedListAttributes);
if (!$unfiltered) {
// Custom Forbidden list precedes Default forbidden list.
if ($customList) {
$filter = InputFilter::getInstance(array(), array(), 1, 1);
// Override filter's default forbidden tags and attributes
if ($customListTags) {
$filter->blockedTags = $customListTags;
}
if ($customListAttributes) {
$filter->blockedAttributes = $customListAttributes;
}
} elseif ($forbiddenList) {
// Remove the allowed tags and attributes from the forbidden list.
$forbiddenListTags = array_diff($forbiddenListTags, $allowedListTags);
$forbiddenListAttributes = array_diff($forbiddenListAttributes, $allowedListAttributes);
$filter = InputFilter::getInstance($forbiddenListTags, $forbiddenListAttributes, InputFilter::ONLY_BLOCK_DEFINED_TAGS, InputFilter::ONLY_BLOCK_DEFINED_ATTRIBUTES);
// Remove the allowed tags from filter's default forbidden list.
if ($allowedListTags) {
$filter->blockedTags = array_diff($filter->blockedTags, $allowedListTags);
}
// Remove the allowed attributes from filter's default forbidden list.
if ($allowedListAttributes) {
$filter->blockedAttributes = array_diff($filter->blockedAttributes, $allowedListAttributes);
}
} elseif ($allowedList) {
// Turn off XSS auto clean
$filter = InputFilter::getInstance($allowedListTags, $allowedListAttributes, 0, 0, 0);
} else {
$filter = InputFilter::getInstance();
}
$text = $filter->clean($text, 'html');
}
return $text;
}