Re: HTMLPurifier and the "Input" class

Hey everyone,

Updates - in short, I think we're at the end of major hostilities on
the Input/XSS/Purifier battle front.
- Finished up the purifier module based on Bharat's feedback (and a
couple other thoughts I had)
- Added XSS cleaning to the bootstrap
- Removed all other instances of HTTP_POST in the code (notably in the
comment module)
- Moved around Session::instance(), Gallery::ready(), and Request in
the bootstrap
- Revised Theme::load_themes() to use Request::$initial (with note
about why it's not $current)
- Revised Theme::load_themes() to stop using kohana_uri (no longer in K3)
- Removed all remaining instances of "Input::" or "Input->"

... barring the inevitable debugging down the read, I think that wraps
this topic up!

A fresh installation of the kohana_3 branch will now go cleanly all
the way through the bootstrap, through starting the session and
request, though loading the user, and into checking permissions with
the root item.  Looks like the next step is finishing the K2->K3 ORM
translation...

Take care,
Shad



On 7 April 2013 20:23, Bharat Mediratta <[email protected]> wrote:
> On Sun, Apr 7, 2013 at 1:04 AM, Shad Laws <shad-xpYdmXCiSuZWk0Htik3J/[email protected]> wrote:
>>
>> Hey Bharat,
>>
>> A thought on Gallery::ready() - it seems like it'd be a lot more
>> straightforward if it had access to the request.  In addition to the
>> reasons you give below, it also calls Request::user_agent().
>>
>> Two other possibilities:
>> - build the request, call Gallery::ready(), then execute the request
>> - make Gallery_Controller() that overrides Kohana_Controller() and
>> adds a before() function that calls Gallery::ready()
>>
>
> I originally tried to do this by calling Request::factory() twice - once in
> bootstrap and once in index.  That didn't work - I can't remember the exact
> details but it was challenging to debug.  However, I think it's reasonable
> to move gallery::ready into index.php so the code would be:
>
> $request = Request::factory(...);
> Gallery::ready();
> $request->execute(...);
>
> Kohana 2's "system.post_routing" concept is difficult to access because that
> happens inside of execute() - but I think it's fair to say that
> "system.ready" can happen right before we call execute().
>
> Want to try that and see if it works?
>

------------------------------------------------------------------------------
Minimize network downtime and maximize team effectiveness.
Reduce network management and security costs.Learn how to hire 
the most talented Cisco Certified professionals. Visit the 
Employer Resources Portal
http://www.cisco.com/web/learning/employer_resources/index.html
__[ g a l l e r y - d e v e l ]_________________________

[ list info/archive --> http://gallery.sf.net/lists.php ]
[ gallery info/FAQ/download --> http://gallery.sf.net ]