edit/page: disable image size attributes in editor

[minimedit.git] / article.inc.php

diff --git a/article.inc.php b/article.inc.php
index 7f8e622cde5297f5d71523a42b106a14983f09eb..f56b2bedd27439e40e001e2141fbbdf2e9d5ca80 100644 (file)
--- a/article.inc.php
+++ b/article.inc.php
@@ -7,9 +7,9 @@ class ArchiveArticle
 
        function __construct($path)
        {
-               $this->page = preg_replace('{^\.(?:/|$)}', '', $path);
-               $this->link = preg_replace('{(?:(?:/|^)index)?\.html$}', '', $this->page);
-               $this->raw($this->page);
+               $this->file = preg_replace('{^\.(?:/|$)}', '', $path);
+               $this->link = preg_replace('{(?:(?:/|^)index)?\.html$}', '', $this->file);
+               $this->raw($this->file);
        }
 
        function raw($page)
@@ -89,12 +89,12 @@ class ArchiveArticle
        }
        function name()
        {
-               return $this->safetitle ?: $this->link;
+               return $this->safetitle ?: htmlspecialchars($this->link);
        }
 
        function last()
        {
-               return filemtime($this->page);
+               return filemtime($this->file);
        }
        function lastiso()
        {
@@ -103,7 +103,7 @@ class ArchiveArticle
 
        function dateparts()
        {
-               preg_match('< / (\d{4}) [/-] (\d{2}) (?:- (\d{2}) )? - >x', $this->page, $ymd);
+               preg_match('< / (\d{4}) [/-] (\d{2}) (?:- (\d{2}) )? - >x', $this->file, $ymd);
                array_shift($ymd);
                return $ymd;
        }
@@ -220,8 +220,13 @@ class ArchiveArticle
 
                # keep either login or logout parts depending on user level
                global $User;
-               $hideclass = $User && property_exists($User, 'login') && $User->login ? 'logout' : 'login';
-               $doc = preg_replace('{\s*<([a-z]+) class="'.$hideclass.'">.*?</\1>}s', '', $doc);
+               $userexists = $User && property_exists($User, 'login') && $User->login;
+               if (! ($userexists and $User->admin("edit {$this->link}")) ) {
+                       # remove matching elements until first corresponding closing tag
+                       $hideclass = $userexists ? 'logout' : 'login';
+                       $tagmatch = '<([a-z]+) class="'.$hideclass.'"[^>]*>';
+                       $doc = preg_replace("{\s*{$tagmatch}.*?</\\1>}s", '', $doc);
+               }
 
                return preg_replace_callback(
                        '{ \[\[ ([^] ]+) ([^]]*) \]\] }x',