Actualización

main/inc/lib/kses-0.2.2/oop/oop.kses.changelog.txt

@@ -0,0 +1,204 @@
+kses ChangeLog
+==============
+
+KSES5
+	* 1.0.2
+KSES4
+	* 0.2.2
+	- Folded in code from kses 0.2.2.
+
+KSES5
+	* 1.0.1rc
+KSES4
+	* 0.2.2rc
+	- Added SetProtocols() to make protocol replacement a single step
+	  to fully answer concerns in bug #892477
+
+KSES5
+	* 1.0.0
+	- Turned many methods private
+
+	- Now using __construct default constructor
+
+	- Only runs in PHP5 or better
+
+	- All method names changed to reflect verb status
+
+	- Folded sinlge line functions into calling methods
+
+	- Deprecated _hook(), Protocols()
+
+	- Added AddProtocols() to replace Protocols()
+
+	- Added filterKsesTextHook() to replace _hook()
+
+	- Added RemoveProtocol() and RemoveProtocols() to remove protocols
+	  singly, or batch.  This should clear bug #892477
+
+	- Version number is 1.0.0
+
+KSES4
+	* 0.2.1
+	- Synced version number to procedural code
+
+	- Deprecated _hook(), Protocols()
+
+	- Added AddProtocols() to replace Protocols()
+
+	- Added filterKsesTextHook() to replace _hook()
+
+	- Added RemoveProtocol() and RemoveProtocols() to remove protocols singly,
+	  or batch.  This should clear bug #892477
+
+OOP
+	- Forked code into PHP4 and PHP5 versions.  Use '$myKses = new kses[45]'
+	  from now on.
+
+	- Modified code to run in E_STRICT.  This should clear bug #918493
+
+	- Added phpDoc commenting
+
+OOP
+	* 0.0.2
+	- Fixed a bug in AddProtocol that wasn't adding new protocols to
+	  $this->allowed_protocols
+
+	- Modified internal methods to correspond to kses 0.2.1 modifications.
+
+	- Created a basic test suite that can be run via web or CLI.
+
+	- Started CVSing the code.
+
+OOP
+	* 0.0.1
+	- Turned all the kses_function_name functions to _function_name methods.
+
+	- Added a couple of properties (allowed_protocols, allowed_html) with
+	  $this->allowed_protocols defaulting to the lion's share of usual
+	  protocols.
+
+	- Modified the applicable use of preg_replace() functions to point to
+	  internal class methods.
+
+	- Reduced the parameter list of some methods since internal properties
+	  are now being used.
+
+	- Added "public" methods to set up the allowed protocols and HTML.
+
+Procedural
+	* 0.2.1
+
+	0.2.1 was released on the 29th of September 2003.
+	It has the following changes:
+
+	- There is now an additional version of kses, using the object-oriented
+	  paradigm. Thanks a lot to Richard R. Vasquez, Jr., who created it!
+	  Anyone who wants to make functional programming, logical programming or
+	  spaghetti programming versions of kses as well (or any other programming
+	  paradigm that you like), go ahead! All the people who like old
+	  procedural programming for web applications shouldn't despair, though,
+	  as both versions will be maintained with each release.
+
+	- kses now has some new attribute value checks: minlen, minval and
+	  valueless.  See docs/attribute-value-checks for an explanation.
+
+	- For some reason, the Opera developers decided to make chr(173) a
+	  whitespace character in URL protocols, both when it occurs raw and in an
+	  entity. kses now handles this.
+
+	- The URL protocol whitelisting system now decodes entities before
+	  removing NULLs and whitespaces.
+
+Procedural
+	* 0.2.0
+
+	0.2.0 was released on the 25th of July 2003.
+	It has the following changes:
+
+	- kses now supports checking of attribute values, and not just element
+	  names and attribute names. The attribute value checks that exist so far
+	  are 'maxlen' (checks how long attribute values are, to avoid Buffer
+	  Overflows) and 'maxval' (checks how big an integer value is, to avoid
+	  Denial of Service attacks).
+
+	  Buffer Overflows could both be a problem for WWW clients and different
+	  servers on the Internet that an HTML document links to. One example is
+	  <frame src="ftp://ftp.v1ct1m.com/AAAAAA..thousands_of_A's...">.
+
+	  Denial of Service attacks can take the form of too big sizes of iframes
+	  or other things. One example is <iframe src="http://some.web.server/"
+	  width="20000" height="2000">, which makes some client machines
+	  completely overloaded.
+
+	- kses' old feature of removing "javascript:" from attribute values has
+	  been improved. It now has a whole system for white listing of URL
+	  protocols, so you can specify that it's acceptable with http:, https:,
+	  ftp: and gopher:, but no other protocols in attribute values. The system
+	  tries pretty hard to do the right thing with whitespace, upper/lower
+	  case, HTML entities ("jav&#97;script:") and repeated entries
+	  ("javascript:javascript:alert(57)").
+
+	- kses now supports both HTML and XHTML code, by allowing " /" at the end
+	  of tags.
+
+	- kses now removes Netscape 4's JavaScript entities, having the form
+	  "&{alert(57)};". They don't even seem to work on all versions of
+	  Netscape 4, but for completeness' sake it seemed like a good feature to
+	  add.
+
+	- A bug with NULLs in javascript: URLs was fixed.
+	  (Reported by Simon Cornelius P. Umacob - thanks!)
+
+	- As a nice side effect of the white listing of URL protocols, kses now
+	  also normalizes all HTML entities in documents. It will change HTML code
+	  with bad entities to the right form, for example "AT&T" will be
+	  converted to "AT&amp;T" and "<a href='lyrics.php?band=ladytron&lyrics=
+	  playgirl'>" will be converted to "<a href='lyrics.php?band=
+	  ladytron&amp;lyrics=playgirl'>". "&#000058;" will be converted to
+	  "&#58;", "&#XYZZY;" will be converted to "&amp;#XYZZY;", "&auml!;" will
+	  be converted to "&amp;auml!;" and so on.
+
+	  As shown above, it will process HTML entities that it doesn't
+	  understand.  It will also deal with too big numbers in numeric HTML
+	  entities, which is helpful as many browsers seem to wrap them around at
+	  2 ** 32, so the characters 58, 58 + (2 ** 32), 58 + (2 ** 64) etcetera
+	  are all colons to the web browser.
+
+	- You can now use upper case letters in your $allowed_html array, in
+	  element names, attribute names and attribute value check names. Version
+	  0.1.0 required everything in that array to be in lower case, but that's
+	  not necessary any more. You can also use upper case letters in
+	  $allowed_protocols.
+
+	- The "Really malformed thing" bug from the TODO file was fixed.
+	  It used to convert this string:
+	  x > 5 <a href="blah">
+	  to:
+	  x &gt; 5 &lt;a href=&quot;blah&quot;&gt;
+	  and now it converts it to:
+	  x &gt; 5 <a href="blah">
+
+	- The "Weird malformed thing" bug from the TODO file was fixed.
+	  It used to convert this string:
+	  <a href="5 href=6>
+	  to:
+	  <a href="6">
+	  because of the way kses restarts after a parse error in kses_hair().
+	  Now it converts it to:
+	  <a>
+
+	- A problem with slashes in HTML tags was fixed.
+
+	- examples/filter.php used to use $SCRIPT_NAME, which doesn't work on
+	  Windows.
+	  (Reported by Simon Cornelius P. Umacob - thanks!)
+
+	- kses now allows dashes in attribute names, for things like
+	  <meta http-equiv=..>.
+
+Procedural
+	* 0.1.0, first public version
+
+	0.1.0 was released on the 9th of June 2003.
+	It was announced on three security related mailing lists on Friday the
+	13th of June (nothing bad happened to it though).