From 42858ad594c8ce12f338989df765662f52ae0488 Mon Sep 17 00:00:00 2001 From: "Edward Z. Yang" Date: Thu, 21 Jun 2007 00:53:09 +0000 Subject: [PATCH] Finish up with a few more files that didn't get updated. Hrmm.. git-svn-id: http://htmlpurifier.org/svnroot/htmlpurifier/branches/strict@1181 48356398-32a2-884e-a903-53898d9a118a --- INSTALL | 57 +++++++++++++++++++------------- NEWS | 61 ++++++++++++++++++++++++++++++++-- TODO | 47 ++++++++++++++++---------- release1-update.php | 95 +++++++++++++++++++++++++++++++++++++++++++++++++++++ 4 files changed, 216 insertions(+), 44 deletions(-) create mode 100644 release1-update.php diff --git a/INSTALL b/INSTALL index e80c57de..f8f137aa 100644 --- a/INSTALL +++ b/INSTALL @@ -1,4 +1,3 @@ - Install How to install HTML Purifier @@ -8,13 +7,13 @@ installation GUI, you've come to the wrong place!) The impatient can scroll down to the bottom of this INSTALL document to see the code, but you really should make sure a few things are properly done. -Todo: Convert to using the array syntax for configuration. + 1. Compatibility -HTML Purifier works in both PHP 4 and PHP 5, from PHP 4.3.9 and up. It has no -core dependencies with other libraries. (Whoopee!) +HTML Purifier works in both PHP 4 and PHP 5, from PHP 4.3.2 and up. It has no +core dependencies with other libraries. Optional extensions are iconv (usually installed) and tidy (also common). If you use UTF-8 and don't plan on pretty-printing HTML, you can get away with @@ -50,6 +49,7 @@ be standards compliant. HTML Purifier can deal with these doctypes: * XHTML 1.0 Strict * HTML 4.01 Transitional * HTML 4.01 Strict +* XHTML 1.1 sans Ruby ...and these character encodings: @@ -68,11 +68,11 @@ the doctype from this code in your HTML documents: For legacy codebases these declarations may be missing. If that is the case, -STOP, and read up on character encodings and doctypes (in that order). Here -are some links: +STOP, and read docs/enduser-utf8.html + + + -* http://www.joelonsoftware.com/articles/Unicode.html -* http://alistapart.com/stories/doctype/ You may currently be vulnerable to XSS and other security threats, and HTML Purifier won't be able to fix that. @@ -116,27 +116,30 @@ websites): Note that HTML Purifier's support for non-Unicode encodings is crippled by the fact that any character not supported by that encoding will be silently -dropped, EVEN if it is ampersand escaped. This is a current limitation of -HTML Purifier that we are NOT actively working to fix. Patches are welcome, -but there are so many other gotchas and problems in I18N for non-Unicode -encodings that this functionality is low priority. See - for a more -detailed lowdown on the topic. +dropped, EVEN if it is ampersand escaped. If you want to work around +this, you are welcome to read docs/enduser-utf8.html for a workaround, +but please be cognizant of the issues the "solution" creates. + + + 4.2. Setting a different doctype -For those of you stuck using HTML 4.01 Transitional, you can disable +For those of you using HTML 4.01 Transitional, you can disable XHTML output like this: - $config->set('Core', 'XHTML', false); + $config->set('HTML', 'Doctype', 'HTML 4.01 Transitional'); + +Other supported doctypes include: -I recommend that you use XHTML, although not as much as I recommend UTF-8. If -your HTML 4.01 page validates, good for you! -Currently, we can only guarantee transitional-complaint output, future -versions will also allow strict-compliant output. + * HTML 4.01 Strict + * HTML 4.01 Transitional + * XHTML 1.0 Strict + * XHTML 1.0 Transitional + * XHTML 1.1 @@ -184,9 +187,17 @@ If your website is in a different encoding or doctype, use this code: require_once '/path/to/htmlpurifier/library/HTMLPurifier.auto.php'; $config = HTMLPurifier_Config::createDefault(); - $config->set('Core', 'Encoding', 'ISO-8859-1'); //replace with your encoding - $config->set('Core', 'XHTML', true); //replace with false if HTML 4.01 + $config->set('Core', 'Encoding', 'ISO-8859-1'); // replace with your encoding + $config->set('HTML', 'Doctype', 'HTML 4.01 Transitional'); // replace with your doctype $purifier = new HTMLPurifier($config); $clean_html = $purifier->purify($dirty_html); -?> \ No newline at end of file +?> + + + +7. Caching + +HTML Purifier generates some cache files to speed up its execution. For +maximum performance, make sure that library/HTMLPurifier/DefinitionCache/Serializer +is writeable by the webserver. \ No newline at end of file diff --git a/NEWS b/NEWS index 7dfe3531..b13db9b2 100644 --- a/NEWS +++ b/NEWS @@ -9,7 +9,62 @@ NEWS ( CHANGELOG and HISTORY ) HTMLPurifier . Internal change ========================== -1.7.0, unknown release date +2.0.0, released 2007-06-20 +# Completely refactored HTMLModuleManager, decentralizing safety + information +# Transform modules changed to Tidy modules, which offer more flexibility + and better modularization +# Configuration object now finalizes itself when a read operation is + performed on it, ensuring that its internal state stays consistent. + To revert this behavior, you can set the $autoFinalize member variable + off, but it's not recommended. +# New compact syntax for AttrDef objects that can be used to instantiate + new objects via make() +# Definitions (esp. HTMLDefinition) are now cached for a significant + performance boost. You can disable caching by setting %Core.DefinitionCache + to null. You CANNOT edit raw definitions without setting the corresponding + DefinitionID directive (%HTML.DefinitionID for HTMLDefinition). +# Contents between