vendor/contao/core-bundle/src/Resources/contao/library/Contao/InsertTags.php line 1058

Open in your IDE?
  1. <?php
  3. /*
  4.  * This file is part of Contao.
  5.  *
  6.  * (c) Leo Feyer
  7.  *
  8.  * @license LGPL-3.0-or-later
  9.  */
  11. namespace Contao;
  13. use Contao\CoreBundle\Controller\InsertTagsController;
  14. use Contao\CoreBundle\Image\Studio\FigureRenderer;
  15. use Contao\CoreBundle\Intl\Countries;
  16. use Contao\CoreBundle\Intl\Locales;
  17. use Contao\CoreBundle\Routing\ResponseContext\HtmlHeadBag\HtmlHeadBag;
  18. use Contao\CoreBundle\Routing\ResponseContext\ResponseContextAccessor;
  19. use Contao\CoreBundle\Util\LocaleUtil;
  20. use Symfony\Component\HttpFoundation\Request;
  21. use Symfony\Component\HttpKernel\Controller\ControllerReference;
  22. use Symfony\Component\HttpKernel\Fragment\FragmentHandler;
  23. use Webmozart\PathUtil\Path;
  25. /**
  26.  * A static class to replace insert tags
  27.  *
  28.  * Usage:
  29.  *
  30.  *     $it = new InsertTags();
  31.  *     echo $it->replace($text);
  32.  *
  33.  * @author Leo Feyer <https://github.com/leofeyer>
  34.  */
  35. class InsertTags extends Controller
  36. {
  37.     /**
  38.      * @var array
  39.      */
  40.     protected static $arrItCache = array();
  42.     /**
  43.      * Make the constructor public
  44.      */
  45.     public function __construct()
  46.     {
  47.         parent::__construct();
  48.     }
  50.     /**
  51.      * Recursively replace insert tags with their values
  52.      *
  53.      * @param string  $strBuffer The text with the tags to be replaced
  54.      * @param boolean $blnCache  If false, non-cacheable tags will be replaced
  55.      *
  56.      * @return string The text with the replaced tags
  57.      */
  58.     public function replace($strBuffer, $blnCache=true)
  59.     {
  60.         $strBuffer = $this->doReplace($strBuffer, $blnCache);
  62.         // Run the replacement recursively (see #8172)
  63.         while (strpos($strBuffer, '{{') !== false && ($strTmp = $this->doReplace($strBuffer, $blnCache)) != $strBuffer)
  64.         {
  65.             $strBuffer = $strTmp;
  66.         }
  68.         return $strBuffer;
  69.     }
  71.     /**
  72.      * Reset the insert tag cache
  73.      */
  74.     public static function reset()
  75.     {
  76.         static::$arrItCache = array();
  77.     }
  79.     /**
  80.      * Replace insert tags with their values
  81.      *
  82.      * @param string  $strBuffer The text with the tags to be replaced
  83.      * @param boolean $blnCache  If false, non-cacheable tags will be replaced
  84.      *
  85.      * @return string The text with the replaced tags
  86.      */
  87.     protected function doReplace($strBuffer, $blnCache)
  88.     {
  89.         /** @var PageModel $objPage */
  90.         global $objPage;
  92.         // Preserve insert tags
  93.         if (Config::get('disableInsertTags'))
  94.         {
  95.             return StringUtil::restoreBasicEntities($strBuffer);
  96.         }
  98.         $strBuffer = self::encodeHtmlAttributes($strBuffer);
  100.         // The first letter must not be a reserved character of Twig, Mustache or similar template engines (see #805)
  101.         $tags = preg_split('~{{([a-zA-Z0-9\x80-\xFF][^{}]*)}}~', $strBuffer, -1, PREG_SPLIT_DELIM_CAPTURE);
  103.         if (\count($tags) < 2)
  104.         {
  105.             return StringUtil::restoreBasicEntities($strBuffer);
  106.         }
  108.         $strBuffer = '';
  109.         $container = System::getContainer();
  110.         $blnFeUserLoggedIn = $container->get('contao.security.token_checker')->hasFrontendUser();
  112.         // Create one cache per cache setting (see #7700)
  113.         $arrCache = &static::$arrItCache[$blnCache];
  115.         for ($_rit=0, $_cnt=\count($tags); $_rit<$_cnt; $_rit+=2)
  116.         {
  117.             $strBuffer .= $tags[$_rit];
  119.             // Skip empty tags
  120.             if (empty($tags[$_rit+1]))
  121.             {
  122.                 continue;
  123.             }
  125.             $strTag = $tags[$_rit+1];
  126.             $flags = explode('|', $strTag);
  127.             $tag = array_shift($flags);
  128.             $elements = explode('::', $tag);
  130.             // Load the value from cache
  131.             if (isset($arrCache[$strTag]) && $elements[0] != 'page' && !\in_array('refresh', $flags))
  132.             {
  133.                 $strBuffer .= $arrCache[$strTag];
  134.                 continue;
  135.             }
  137.             // Skip certain elements if the output will be cached
  138.             if ($blnCache)
  139.             {
  140.                 if ($elements[0] == 'date' || $elements[0] == 'ua' || $elements[0] == 'post' || ($elements[1] ?? null) == 'back' || ($elements[1] ?? null) == 'referer' || \in_array('uncached', $flags) || strncmp($elements[0], 'cache_', 6) === 0)
  141.                 {
  142.                     /** @var FragmentHandler $fragmentHandler */
  143.                     $fragmentHandler = $container->get('fragment.handler');
  145.                     $attributes = array('insertTag' => '{{' . $strTag . '}}');
  147.                     /** @var Request|null $request */
  148.                     $request = $container->get('request_stack')->getCurrentRequest();
  150.                     if (null !== $request && ($scope = $request->attributes->get('_scope')))
  151.                     {
  152.                         $attributes['_scope'] = $scope;
  153.                     }
  155.                     $strBuffer .= $fragmentHandler->render(
  156.                         new ControllerReference(
  157.                             InsertTagsController::class . '::renderAction',
  158.                             $attributes,
  159.                             array('clientCache' => (int) $objPage->clientCache, 'pageId' => $objPage->id, 'request' => Environment::get('request'))
  160.                         ),
  161.                         'esi',
  162.                         array('ignore_errors'=>false) // see #48
  163.                     );
  165.                     continue;
  166.                 }
  167.             }
  169.             $arrCache[$strTag] = '';
  171.             // Replace the tag
  172.             switch (strtolower($elements[0]))
  173.             {
  174.                 // Date
  175.                 case 'date':
  176.                     $flags[] = 'attr';
  177.                     $arrCache[$strTag] = Date::parse($elements[1] ?: $objPage->dateFormat);
  178.                     break;
  180.                 // Accessibility tags
  181.                 case 'lang':
  182.                     if (empty($elements[1]))
  183.                     {
  184.                         $arrCache[$strTag] = '</span>';
  185.                     }
  186.                     else
  187.                     {
  188.                         $arrCache[$strTag] = $arrCache[$strTag] = '<span lang="' . StringUtil::specialchars($elements[1]) . '">';
  189.                     }
  190.                     break;
  192.                 // Line break
  193.                 case 'br':
  194.                     $arrCache[$strTag] = '<br>';
  195.                     break;
  197.                 // E-mail addresses
  198.                 case 'email':
  199.                 case 'email_open':
  200.                 case 'email_url':
  201.                     if (empty($elements[1]))
  202.                     {
  203.                         $arrCache[$strTag] = '';
  204.                         break;
  205.                     }
  207.                     $strEmail = StringUtil::specialcharsUrl(StringUtil::encodeEmail($elements[1]));
  209.                     // Replace the tag
  210.                     switch (strtolower($elements[0]))
  211.                     {
  212.                         case 'email':
  213.                             $arrCache[$strTag] = '<a href="&#109;&#97;&#105;&#108;&#116;&#111;&#58;' . $strEmail . '" class="email">' . preg_replace('/\?.*$/', '', $strEmail) . '</a>';
  214.                             break;
  216.                         case 'email_open':
  217.                             $arrCache[$strTag] = '<a href="&#109;&#97;&#105;&#108;&#116;&#111;&#58;' . $strEmail . '" title="' . $strEmail . '" class="email">';
  218.                             break;
  220.                         case 'email_url':
  221.                             $arrCache[$strTag] = $strEmail;
  222.                             break;
  223.                     }
  224.                     break;
  226.                 // Label tags
  227.                 case 'label':
  228.                     $flags[] = 'attr';
  229.                     $keys = explode(':', $elements[1]);
  231.                     if (\count($keys) < 2)
  232.                     {
  233.                         $arrCache[$strTag] = '';
  234.                         break;
  235.                     }
  237.                     if ($keys[0] == 'LNG' && \count($keys) == 2)
  238.                     {
  239.                         try
  240.                         {
  241.                             $arrCache[$strTag] = System::getContainer()->get(Locales::class)->getDisplayNames(array($keys[1]))[$keys[1]];
  242.                             break;
  243.                         }
  244.                         catch (\Throwable $exception)
  245.                         {
  246.                             // Fall back to loading the label via $GLOBALS['TL_LANG']
  247.                         }
  248.                     }
  250.                     if ($keys[0] == 'CNT' && \count($keys) == 2)
  251.                     {
  252.                         try
  253.                         {
  254.                             $arrCache[$strTag] = System::getContainer()->get(Countries::class)->getCountries()[strtoupper($keys[1])] ?? '';
  255.                             break;
  256.                         }
  257.                         catch (\Throwable $exception)
  258.                         {
  259.                             // Fall back to loading the label via $GLOBALS['TL_LANG']
  260.                         }
  261.                     }
  263.                     $file = $keys[0];
  265.                     // Map the key (see #7217)
  266.                     switch ($file)
  267.                     {
  268.                         case 'CNT':
  269.                             $file = 'countries';
  270.                             break;
  272.                         case 'LNG':
  273.                             $file = 'languages';
  274.                             break;
  276.                         case 'MOD':
  277.                         case 'FMD':
  278.                             $file = 'modules';
  279.                             break;
  281.                         case 'FFL':
  282.                             $file = 'tl_form_field';
  283.                             break;
  285.                         case 'CACHE':
  286.                             $file = 'tl_page';
  287.                             break;
  289.                         case 'XPL':
  290.                             $file = 'explain';
  291.                             break;
  293.                         case 'XPT':
  294.                             $file = 'exception';
  295.                             break;
  297.                         case 'MSC':
  298.                         case 'ERR':
  299.                         case 'CTE':
  300.                         case 'PTY':
  301.                         case 'FOP':
  302.                         case 'CHMOD':
  303.                         case 'DAYS':
  304.                         case 'MONTHS':
  305.                         case 'UNITS':
  306.                         case 'CONFIRM':
  307.                         case 'DP':
  308.                         case 'COLS':
  309.                         case 'SECTIONS':
  310.                         case 'DCA':
  311.                         case 'CRAWL':
  312.                             $file = 'default';
  313.                             break;
  314.                     }
  316.                     try
  317.                     {
  318.                         System::loadLanguageFile($file);
  319.                     }
  320.                     catch (\InvalidArgumentException $exception)
  321.                     {
  322.                         $this->log('Invalid label insert tag {{' . $strTag . '}} on page ' . Environment::get('uri') . ': ' . $exception->getMessage(), __METHOD__, TL_ERROR);
  323.                     }
  325.                     if (\count($keys) == 2)
  326.                     {
  327.                         $arrCache[$strTag] = $GLOBALS['TL_LANG'][$keys[0]][$keys[1]];
  328.                     }
  329.                     else
  330.                     {
  331.                         $arrCache[$strTag] = $GLOBALS['TL_LANG'][$keys[0]][$keys[1]][$keys[2]];
  332.                     }
  333.                     break;
  335.                 // Front end user
  336.                 case 'user':
  337.                     if ($blnFeUserLoggedIn)
  338.                     {
  339.                         $flags[] = 'attr';
  340.                         $this->import(FrontendUser::class, 'User');
  341.                         $value = $this->User->{$elements[1]};
  343.                         if (!$value)
  344.                         {
  345.                             $arrCache[$strTag] = $value;
  346.                             break;
  347.                         }
  349.                         $this->loadDataContainer('tl_member');
  351.                         if (($GLOBALS['TL_DCA']['tl_member']['fields'][$elements[1]]['inputType'] ?? null) == 'password')
  352.                         {
  353.                             $arrCache[$strTag] = '';
  354.                             break;
  355.                         }
  357.                         $value = StringUtil::deserialize($value);
  359.                         // Decrypt the value
  360.                         if ($GLOBALS['TL_DCA']['tl_member']['fields'][$elements[1]]['eval']['encrypt'] ?? null)
  361.                         {
  362.                             $value = Encryption::decrypt($value);
  363.                         }
  365.                         $rgxp = $GLOBALS['TL_DCA']['tl_member']['fields'][$elements[1]]['eval']['rgxp'] ?? null;
  366.                         $opts = $GLOBALS['TL_DCA']['tl_member']['fields'][$elements[1]]['options'] ?? null;
  367.                         $rfrc = $GLOBALS['TL_DCA']['tl_member']['fields'][$elements[1]]['reference'] ?? null;
  369.                         if ($rgxp == 'date')
  370.                         {
  371.                             $arrCache[$strTag] = Date::parse($objPage->dateFormat, $value);
  372.                         }
  373.                         elseif ($rgxp == 'time')
  374.                         {
  375.                             $arrCache[$strTag] = Date::parse($objPage->timeFormat, $value);
  376.                         }
  377.                         elseif ($rgxp == 'datim')
  378.                         {
  379.                             $arrCache[$strTag] = Date::parse($objPage->datimFormat, $value);
  380.                         }
  381.                         elseif (\is_array($value))
  382.                         {
  383.                             $arrCache[$strTag] = implode(', ', $value);
  384.                         }
  385.                         elseif (\is_array($opts) && ArrayUtil::isAssoc($opts))
  386.                         {
  387.                             $arrCache[$strTag] = $opts[$value] ?? $value;
  388.                         }
  389.                         elseif (\is_array($rfrc))
  390.                         {
  391.                             $arrCache[$strTag] = isset($rfrc[$value]) ? ((\is_array($rfrc[$value])) ? $rfrc[$value][0] : $rfrc[$value]) : $value;
  392.                         }
  393.                         else
  394.                         {
  395.                             $arrCache[$strTag] = $value;
  396.                         }
  398.                         // Convert special characters (see #1890)
  399.                         $arrCache[$strTag] = StringUtil::specialchars($arrCache[$strTag]);
  400.                     }
  401.                     break;
  403.                 // Link
  404.                 case 'link':
  405.                 case 'link_open':
  406.                 case 'link_url':
  407.                 case 'link_title':
  408.                 case 'link_target':
  409.                 case 'link_name':
  410.                     $strTarget = null;
  411.                     $strClass = '';
  413.                     // Back link
  414.                     if ($elements[1] == 'back')
  415.                     {
  416.                         @trigger_error('Using the link::back insert tag has been deprecated and will no longer work in Contao 5.0.', E_USER_DEPRECATED);
  418.                         $strUrl = 'javascript:history.go(-1)';
  419.                         $strTitle = $GLOBALS['TL_LANG']['MSC']['goBack'] ?? null;
  421.                         // No language files if the page is cached
  422.                         if (!$strTitle)
  423.                         {
  424.                             $strTitle = 'Go back';
  425.                         }
  427.                         $strName = $strTitle;
  428.                     }
  430.                     // External links
  431.                     elseif (strncmp($elements[1], 'http://', 7) === 0 || strncmp($elements[1], 'https://', 8) === 0)
  432.                     {
  433.                         $strUrl = StringUtil::specialcharsUrl($elements[1]);
  434.                         $strTitle = $elements[1];
  435.                         $strName = str_replace(array('http://', 'https://'), '', $strUrl);
  436.                     }
  438.                     // Regular link
  439.                     else
  440.                     {
  441.                         // User login page
  442.                         if ($elements[1] == 'login')
  443.                         {
  444.                             if (!$blnFeUserLoggedIn)
  445.                             {
  446.                                 break;
  447.                             }
  449.                             $this->import(FrontendUser::class, 'User');
  450.                             $elements[1] = $this->User->loginPage;
  451.                         }
  453.                         $objNextPage = PageModel::findByIdOrAlias($elements[1]);
  455.                         if ($objNextPage === null)
  456.                         {
  457.                             // Prevent broken markup with link_open and link_close (see #92)
  458.                             if (strtolower($elements[0]) == 'link_open')
  459.                             {
  460.                                 $arrCache[$strTag] = '<a>';
  461.                             }
  463.                             break;
  464.                         }
  466.                         // Page type specific settings (thanks to Andreas Schempp)
  467.                         switch ($objNextPage->type)
  468.                         {
  469.                             case 'redirect':
  470.                                 $strUrl = $objNextPage->url;
  472.                                 if (strncasecmp($strUrl, 'mailto:', 7) === 0)
  473.                                 {
  474.                                     $strUrl = StringUtil::encodeEmail($strUrl);
  475.                                 }
  476.                                 break;
  478.                             case 'forward':
  479.                                 if ($objNextPage->jumpTo)
  480.                                 {
  481.                                     $objNext = PageModel::findPublishedById($objNextPage->jumpTo);
  482.                                 }
  483.                                 else
  484.                                 {
  485.                                     $objNext = PageModel::findFirstPublishedRegularByPid($objNextPage->id);
  486.                                 }
  488.                                 if ($objNext instanceof PageModel)
  489.                                 {
  490.                                     $strUrl = \in_array('absolute', \array_slice($elements, 2), true) || \in_array('absolute', $flags, true) ? $objNext->getAbsoluteUrl() : $objNext->getFrontendUrl();
  491.                                     break;
  492.                                 }
  493.                                 // no break
  495.                             default:
  496.                                 $strUrl = \in_array('absolute', \array_slice($elements, 2), true) || \in_array('absolute', $flags, true) ? $objNextPage->getAbsoluteUrl() : $objNextPage->getFrontendUrl();
  497.                                 break;
  498.                         }
  500.                         $strName = $objNextPage->title;
  501.                         $strTarget = $objNextPage->target ? ' target="_blank" rel="noreferrer noopener"' : '';
  502.                         $strClass = $objNextPage->cssClass ? sprintf(' class="%s"', $objNextPage->cssClass) : '';
  503.                         $strTitle = $objNextPage->pageTitle ?: $objNextPage->title;
  504.                     }
  506.                     // Replace the tag
  507.                     switch (strtolower($elements[0]))
  508.                     {
  509.                         case 'link':
  510.                             $arrCache[$strTag] = sprintf('<a href="%s" title="%s"%s%s>%s</a>', $strUrl ?: './', StringUtil::specialcharsAttribute($strTitle), $strClass, $strTarget, $strName);
  511.                             break;
  513.                         case 'link_open':
  514.                             $arrCache[$strTag] = sprintf('<a href="%s" title="%s"%s%s>', $strUrl ?: './', StringUtil::specialcharsAttribute($strTitle), $strClass, $strTarget);
  515.                             break;
  517.                         case 'link_url':
  518.                             $arrCache[$strTag] = $strUrl ?: './';
  519.                             break;
  521.                         case 'link_title':
  522.                             $arrCache[$strTag] = StringUtil::specialcharsAttribute($strTitle);
  523.                             break;
  525.                         case 'link_target':
  526.                             trigger_deprecation('contao/core-bundle', '4.4', 'Using the link_target insert tag has been deprecated and will no longer work in Contao 5.0.');
  527.                             $arrCache[$strTag] = $strTarget ? ' target=_blank rel=noreferrer&#32;noopener' : $strTarget;
  528.                             break;
  530.                         case 'link_name':
  531.                             $arrCache[$strTag] = StringUtil::specialcharsAttribute($strName);
  532.                             break;
  533.                     }
  534.                     break;
  536.                 // Closing link tag
  537.                 case 'link_close':
  538.                 case 'email_close':
  539.                     $arrCache[$strTag] = '</a>';
  540.                     break;
  542.                 // Insert article
  543.                 case 'insert_article':
  544.                     if (($strOutput = $this->getArticle($elements[1], false, true)) !== false)
  545.                     {
  546.                         $arrCache[$strTag] = ltrim($strOutput);
  547.                     }
  548.                     else
  549.                     {
  550.                         $arrCache[$strTag] = '<p class="error">' . sprintf($GLOBALS['TL_LANG']['MSC']['invalidPage'], $elements[1]) . '</p>';
  551.                     }
  552.                     break;
  554.                 // Insert content element
  555.                 case 'insert_content':
  556.                     $arrCache[$strTag] = $this->getContentElement($elements[1]);
  557.                     break;
  559.                 // Insert module
  560.                 case 'insert_module':
  561.                     $arrCache[$strTag] = $this->getFrontendModule($elements[1]);
  562.                     break;
  564.                 // Insert form
  565.                 case 'insert_form':
  566.                     $arrCache[$strTag] = $this->getForm($elements[1]);
  567.                     break;
  569.                 // Article
  570.                 case 'article':
  571.                 case 'article_open':
  572.                 case 'article_url':
  573.                 case 'article_title':
  574.                     if (!(($objArticle = ArticleModel::findByIdOrAlias($elements[1])) instanceof ArticleModel) || !(($objPid = $objArticle->getRelated('pid')) instanceof PageModel))
  575.                     {
  576.                         break;
  577.                     }
  579.                     /** @var PageModel $objPid */
  580.                     $params = '/articles/' . ($objArticle->alias ?: $objArticle->id);
  581.                     $strUrl = \in_array('absolute', \array_slice($elements, 2), true) || \in_array('absolute', $flags, true) ? $objPid->getAbsoluteUrl($params) : $objPid->getFrontendUrl($params);
  583.                     // Replace the tag
  584.                     switch (strtolower($elements[0]))
  585.                     {
  586.                         case 'article':
  587.                             $arrCache[$strTag] = sprintf('<a href="%s" title="%s">%s</a>', $strUrl, StringUtil::specialcharsAttribute($objArticle->title), $objArticle->title);
  588.                             break;
  590.                         case 'article_open':
  591.                             $arrCache[$strTag] = sprintf('<a href="%s" title="%s">', $strUrl, StringUtil::specialcharsAttribute($objArticle->title));
  592.                             break;
  594.                         case 'article_url':
  595.                             $arrCache[$strTag] = $strUrl;
  596.                             break;
  598.                         case 'article_title':
  599.                             $arrCache[$strTag] = StringUtil::specialcharsAttribute($objArticle->title);
  600.                             break;
  601.                     }
  602.                     break;
  604.                 // Article teaser
  605.                 case 'article_teaser':
  606.                     $objTeaser = ArticleModel::findByIdOrAlias($elements[1]);
  608.                     if ($objTeaser !== null)
  609.                     {
  610.                         $arrCache[$strTag] = StringUtil::toHtml5($objTeaser->teaser);
  611.                     }
  612.                     break;
  614.                 // Last update
  615.                 case 'last_update':
  616.                     $flags[] = 'attr';
  618.                     $strQuery = "SELECT MAX(tstamp) AS tc";
  619.                     $bundles = $container->getParameter('kernel.bundles');
  621.                     if (isset($bundles['ContaoNewsBundle']))
  622.                     {
  623.                         $strQuery .= ", (SELECT MAX(tstamp) FROM tl_news) AS tn";
  624.                     }
  626.                     if (isset($bundles['ContaoCalendarBundle']))
  627.                     {
  628.                         $strQuery .= ", (SELECT MAX(tstamp) FROM tl_calendar_events) AS te";
  629.                     }
  631.                     $strQuery .= " FROM tl_content";
  632.                     $objUpdate = Database::getInstance()->query($strQuery);
  634.                     if ($objUpdate->numRows)
  635.                     {
  636.                         $arrCache[$strTag] = Date::parse($elements[1] ?: $objPage->datimFormat, max($objUpdate->tc, $objUpdate->tn, $objUpdate->te));
  637.                     }
  638.                     break;
  640.                 // Version
  641.                 case 'version':
  642.                     $arrCache[$strTag] = VERSION . '.' . BUILD;
  643.                     break;
  645.                 // Request token
  646.                 case 'request_token':
  647.                     $arrCache[$strTag] = REQUEST_TOKEN;
  648.                     break;
  650.                 // POST data
  651.                 case 'post':
  652.                     $flags[] = 'attr';
  653.                     $arrCache[$strTag] = Input::post($elements[1]);
  654.                     break;
  656.                 // Conditional tags (if, if not)
  657.                 case 'iflng':
  658.                 case 'ifnlng':
  659.                     if (!empty($elements[1]) && $this->languageMatches($elements[1]) === (strtolower($elements[0]) === 'ifnlng'))
  660.                     {
  661.                         // Skip everything until the next tag
  662.                         for (; $_rit<$_cnt; $_rit+=2)
  663.                         {
  664.                             // Case insensitive match for iflng/ifnlng optionally followed by "::" or "|"
  665.                             if (1 === preg_match('/^' . preg_quote($elements[0], '/') . '(?:$|::|\|)/i', $tags[$_rit+3] ?? ''))
  666.                             {
  667.                                 $tags[$_rit+2] = '';
  668.                                 break;
  669.                             }
  670.                         }
  671.                     }
  673.                     // Does not output anything and the cache must not be used
  674.                     unset($arrCache[$strTag]);
  675.                     continue 2;
  677.                 // Environment
  678.                 case 'env':
  679.                     $flags[] = 'urlattr';
  681.                     switch ($elements[1])
  682.                     {
  683.                         case 'host':
  684.                             $arrCache[$strTag] = Idna::decode(Environment::get('host'));
  685.                             break;
  687.                         case 'http_host':
  688.                             $arrCache[$strTag] = Idna::decode(Environment::get('httpHost'));
  689.                             break;
  691.                         case 'url':
  692.                             $arrCache[$strTag] = Idna::decode(Environment::get('url'));
  693.                             break;
  695.                         case 'path':
  696.                             $arrCache[$strTag] = Idna::decode(Environment::get('base'));
  697.                             break;
  699.                         case 'request':
  700.                             $arrCache[$strTag] = Environment::get('indexFreeRequest');
  701.                             break;
  703.                         case 'ip':
  704.                             $arrCache[$strTag] = Environment::get('ip');
  705.                             break;
  707.                         case 'referer':
  708.                             $arrCache[$strTag] = $this->getReferer(true);
  709.                             break;
  711.                         case 'files_url':
  712.                             $arrCache[$strTag] = $container->get('contao.assets.files_context')->getStaticUrl();
  713.                             break;
  715.                         case 'assets_url':
  716.                         case 'plugins_url':
  717.                         case 'script_url':
  718.                             $arrCache[$strTag] = $container->get('contao.assets.assets_context')->getStaticUrl();
  719.                             break;
  721.                         case 'base_url':
  722.                             $arrCache[$strTag] = $container->get('request_stack')->getCurrentRequest()->getBaseUrl();
  723.                             break;
  724.                     }
  725.                     break;
  727.                 // Page
  728.                 case 'page':
  729.                     if (!$objPage->parentPageTitle && $elements[1] == 'parentPageTitle')
  730.                     {
  731.                         $elements[1] = 'parentTitle';
  732.                     }
  733.                     elseif (!$objPage->mainPageTitle && $elements[1] == 'mainPageTitle')
  734.                     {
  735.                         $elements[1] = 'mainTitle';
  736.                     }
  738.                     $responseContext = System::getContainer()->get(ResponseContextAccessor::class)->getResponseContext();
  740.                     if ($responseContext && $responseContext->has(HtmlHeadBag::class) && \in_array($elements[1], array('pageTitle', 'description'), true))
  741.                     {
  742.                         /** @var HtmlHeadBag $htmlHeadBag */
  743.                         $htmlHeadBag = $responseContext->get(HtmlHeadBag::class);
  745.                         switch ($elements[1])
  746.                         {
  747.                             case 'pageTitle':
  748.                                 $arrCache[$strTag] = htmlspecialchars($htmlHeadBag->getTitle());
  749.                                 break;
  751.                             case 'description':
  752.                                 $arrCache[$strTag] = htmlspecialchars($htmlHeadBag->getMetaDescription());
  753.                                 break;
  754.                         }
  755.                     }
  756.                     else
  757.                     {
  758.                         // Do not use StringUtil::specialchars() here (see #4687)
  759.                         if (!\in_array($elements[1], array('title', 'parentTitle', 'mainTitle', 'rootTitle', 'pageTitle', 'parentPageTitle', 'mainPageTitle', 'rootPageTitle'), true))
  760.                         {
  761.                             $flags[] = 'attr';
  762.                         }
  764.                         $arrCache[$strTag] = $objPage->{$elements[1]};
  765.                     }
  766.                     break;
  768.                 // User agent
  769.                 case 'ua':
  770.                     $flags[] = 'attr';
  771.                     $ua = Environment::get('agent');
  773.                     if (!empty($elements[1]))
  774.                     {
  775.                         $arrCache[$strTag] = $ua->{$elements[1]};
  776.                     }
  777.                     else
  778.                     {
  779.                         $arrCache[$strTag] = '';
  780.                     }
  781.                     break;
  783.                 // Abbreviations
  784.                 case 'abbr':
  785.                 case 'acronym':
  786.                     if (!empty($elements[1]))
  787.                     {
  788.                         $arrCache[$strTag] = '<abbr title="' . StringUtil::specialchars($elements[1]) . '">';
  789.                     }
  790.                     else
  791.                     {
  792.                         $arrCache[$strTag] = '</abbr>';
  793.                     }
  794.                     break;
  796.                 // Images
  797.                 case 'figure':
  798.                     // Expected format: {{figure::<from>[?<key>=<value>,[&<key>=<value>]*]}}
  799.                     list($from, $configuration) = $this->parseUrlWithQueryString($elements[1] ?? '');
  801.                     if (null === $from || 2 !== \count($elements) || Validator::isInsecurePath($from) || Path::isAbsolute($from))
  802.                     {
  803.                         $arrCache[$strTag] = '';
  804.                         break;
  805.                     }
  807.                     $size = $configuration['size'] ?? null;
  808.                     $template = $configuration['template'] ?? '@ContaoCore/Image/Studio/figure.html.twig';
  810.                     unset($configuration['size'], $configuration['template']);
  812.                     // Render the figure
  813.                     $figureRenderer = $container->get(FigureRenderer::class);
  815.                     try
  816.                     {
  817.                         $arrCache[$strTag] = $figureRenderer->render($from, $size, $configuration, $template) ?? '';
  818.                     }
  819.                     catch (\Throwable $e)
  820.                     {
  821.                         $arrCache[$strTag] = '';
  822.                     }
  823.                     break;
  825.                 case 'image':
  826.                 case 'picture':
  827.                     $width = null;
  828.                     $height = null;
  829.                     $alt = '';
  830.                     $class = '';
  831.                     $rel = '';
  832.                     $strFile = $elements[1];
  833.                     $mode = '';
  834.                     $size = null;
  835.                     $strTemplate = 'picture_default';
  837.                     // Take arguments
  838.                     if (strpos($elements[1], '?') !== false)
  839.                     {
  840.                         $arrChunks = explode('?', urldecode($elements[1]), 2);
  841.                         $strSource = StringUtil::decodeEntities($arrChunks[1]);
  842.                         $strSource = str_replace('[&]', '&', $strSource);
  843.                         $arrParams = explode('&', $strSource);
  845.                         foreach ($arrParams as $strParam)
  846.                         {
  847.                             list($key, $value) = explode('=', $strParam);
  849.                             switch ($key)
  850.                             {
  851.                                 case 'width':
  852.                                     $width = (int) $value;
  853.                                     break;
  855.                                 case 'height':
  856.                                     $height = (int) $value;
  857.                                     break;
  859.                                 case 'alt':
  860.                                     $alt = $value;
  861.                                     break;
  863.                                 case 'class':
  864.                                     $class = $value;
  865.                                     break;
  867.                                 case 'rel':
  868.                                     $rel = $value;
  869.                                     break;
  871.                                 case 'mode':
  872.                                     $mode = $value;
  873.                                     break;
  875.                                 case 'size':
  876.                                     $size = is_numeric($value) ? (int) $value : $value;
  877.                                     break;
  879.                                 case 'template':
  880.                                     $strTemplate = preg_replace('/[^a-z0-9_]/i', '', $value);
  881.                                     break;
  882.                             }
  883.                         }
  885.                         $strFile = $arrChunks[0];
  886.                     }
  888.                     if (Validator::isUuid($strFile))
  889.                     {
  890.                         // Handle UUIDs
  891.                         $objFile = FilesModel::findByUuid($strFile);
  893.                         if ($objFile === null)
  894.                         {
  895.                             $arrCache[$strTag] = '';
  896.                             break;
  897.                         }
  899.                         $strFile = $objFile->path;
  900.                     }
  901.                     elseif (is_numeric($strFile))
  902.                     {
  903.                         // Handle numeric IDs (see #4805)
  904.                         $objFile = FilesModel::findByPk($strFile);
  906.                         if ($objFile === null)
  907.                         {
  908.                             $arrCache[$strTag] = '';
  909.                             break;
  910.                         }
  912.                         $strFile = $objFile->path;
  913.                     }
  914.                     elseif (Validator::isInsecurePath($strFile))
  915.                     {
  916.                         throw new \RuntimeException('Invalid path ' . $strFile);
  917.                     }
  919.                     $maxImageWidth = Config::get('maxImageWidth');
  921.                     // Check the maximum image width
  922.                     if ($maxImageWidth > 0 && $width > $maxImageWidth)
  923.                     {
  924.                         trigger_deprecation('contao/core-bundle', '4.0', 'Using a maximum front end width has been deprecated and will no longer work in Contao 5.0. Remove the "maxImageWidth" configuration and use responsive images instead.');
  926.                         $width = $maxImageWidth;
  927.                         $height = null;
  928.                     }
  930.                     // Use the alternative text from the image metadata if none is given
  931.                     if (!$alt && ($objFile = FilesModel::findByPath($strFile)))
  932.                     {
  933.                         $arrMeta = Frontend::getMetaData($objFile->meta, $objPage->language);
  935.                         if (isset($arrMeta['alt']))
  936.                         {
  937.                             $alt = $arrMeta['alt'];
  938.                         }
  939.                     }
  941.                     // Generate the thumbnail image
  942.                     try
  943.                     {
  944.                         // Image
  945.                         if (strtolower($elements[0]) == 'image')
  946.                         {
  947.                             $dimensions = '';
  948.                             $src = $container->get('contao.image.image_factory')->create($container->getParameter('kernel.project_dir') . '/' . rawurldecode($strFile), array($width, $height, $mode))->getUrl($container->getParameter('kernel.project_dir'));
  949.                             $objFile = new File(rawurldecode($src));
  951.                             // Add the image dimensions
  952.                             if (isset($objFile->imageSize[0], $objFile->imageSize[1]))
  953.                             {
  954.                                 $dimensions = ' width="' . $objFile->imageSize[0] . '" height="' . $objFile->imageSize[1] . '"';
  955.                             }
  957.                             $arrCache[$strTag] = '<img src="' . StringUtil::specialcharsUrl(Controller::addFilesUrlTo($src)) . '" ' . $dimensions . ' alt="' . StringUtil::specialcharsAttribute($alt) . '"' . ($class ? ' class="' . StringUtil::specialcharsAttribute($class) . '"' : '') . '>';
  958.                         }
  960.                         // Picture
  961.                         else
  962.                         {
  963.                             $staticUrl = $container->get('contao.assets.files_context')->getStaticUrl();
  964.                             $picture = $container->get('contao.image.picture_factory')->create($container->getParameter('kernel.project_dir') . '/' . $strFile, $size);
  966.                             $picture = array
  967.                             (
  968.                                 'img' => $picture->getImg($container->getParameter('kernel.project_dir'), $staticUrl),
  969.                                 'sources' => $picture->getSources($container->getParameter('kernel.project_dir'), $staticUrl)
  970.                             );
  972.                             $picture['alt'] = StringUtil::specialcharsAttribute($alt);
  973.                             $picture['class'] = StringUtil::specialcharsAttribute($class);
  974.                             $pictureTemplate = new FrontendTemplate($strTemplate);
  975.                             $pictureTemplate->setData($picture);
  976.                             $arrCache[$strTag] = $pictureTemplate->parse();
  977.                         }
  979.                         // Add a lightbox link
  980.                         if ($rel)
  981.                         {
  982.                             $arrCache[$strTag] = '<a href="' . StringUtil::specialcharsUrl(Controller::addFilesUrlTo($strFile)) . '"' . ($alt ? ' title="' . StringUtil::specialcharsAttribute($alt) . '"' : '') . ' data-lightbox="' . StringUtil::specialcharsAttribute($rel) . '">' . $arrCache[$strTag] . '</a>';
  983.                         }
  984.                     }
  985.                     catch (\Exception $e)
  986.                     {
  987.                         $arrCache[$strTag] = '';
  988.                     }
  989.                     break;
  991.                 // Files (UUID or template path)
  992.                 case 'file':
  993.                     if (Validator::isUuid($elements[1]))
  994.                     {
  995.                         $objFile = FilesModel::findByUuid($elements[1]);
  997.                         if ($objFile !== null)
  998.                         {
  999.                             $arrCache[$strTag] = System::urlEncode($objFile->path);
  1000.                             break;
  1001.                         }
  1002.                     }
  1004.                     $arrGet = $_GET;
  1005.                     Input::resetCache();
  1006.                     $strFile = $elements[1];
  1008.                     // Take arguments and add them to the $_GET array
  1009.                     if (strpos($elements[1], '?') !== false)
  1010.                     {
  1011.                         $arrChunks = explode('?', urldecode($elements[1]));
  1012.                         $strSource = StringUtil::decodeEntities($arrChunks[1]);
  1013.                         $strSource = str_replace('[&]', '&', $strSource);
  1014.                         $arrParams = explode('&', $strSource);
  1016.                         foreach ($arrParams as $strParam)
  1017.                         {
  1018.                             $arrParam = explode('=', $strParam);
  1019.                             $_GET[$arrParam[0]] = $arrParam[1];
  1020.                         }
  1022.                         $strFile = $arrChunks[0];
  1023.                     }
  1025.                     // Check the path
  1026.                     if (Validator::isInsecurePath($strFile))
  1027.                     {
  1028.                         throw new \RuntimeException('Invalid path ' . $strFile);
  1029.                     }
  1031.                     // Include .php, .tpl, .xhtml and .html5 files
  1032.                     if (preg_match('/\.(php|tpl|xhtml|html5)$/', $strFile) && file_exists($container->getParameter('kernel.project_dir') . '/templates/' . $strFile))
  1033.                     {
  1034.                         ob_start();
  1036.                         try
  1037.                         {
  1038.                             include $container->getParameter('kernel.project_dir') . '/templates/' . $strFile;
  1039.                             $arrCache[$strTag] = ob_get_contents();
  1040.                         }
  1041.                         finally
  1042.                         {
  1043.                             ob_end_clean();
  1044.                         }
  1045.                     }
  1047.                     $_GET = $arrGet;
  1048.                     Input::resetCache();
  1049.                     break;
  1051.                 // HOOK: pass unknown tags to callback functions
  1052.                 default:
  1053.                     if (isset($GLOBALS['TL_HOOKS']['replaceInsertTags']) && \is_array($GLOBALS['TL_HOOKS']['replaceInsertTags']))
  1054.                     {
  1055.                         foreach ($GLOBALS['TL_HOOKS']['replaceInsertTags'] as $callback)
  1056.                         {
  1057.                             $this->import($callback[0]);
  1058.                             $varValue = $this->{$callback[0]}->{$callback[1]}($tag, $blnCache, $arrCache[$strTag], $flags, $tags, $arrCache, $_rit, $_cnt); // see #6672
  1060.                             // Replace the tag and stop the loop
  1061.                             if ($varValue !== false)
  1062.                             {
  1063.                                 $arrCache[$strTag] = $varValue;
  1064.                                 break 2;
  1065.                             }
  1066.                         }
  1067.                     }
  1069.                     $this->log('Unknown insert tag {{' . $strTag . '}} on page ' . Environment::get('uri'), __METHOD__, TL_ERROR);
  1070.                     break;
  1071.             }
  1073.             // Handle the flags
  1074.             if (!empty($flags))
  1075.             {
  1076.                 foreach ($flags as $flag)
  1077.                 {
  1078.                     switch ($flag)
  1079.                     {
  1080.                         case 'addslashes':
  1081.                         case 'standardize':
  1082.                         case 'ampersand':
  1083.                         case 'specialchars':
  1084.                         case 'strtolower':
  1085.                         case 'utf8_strtolower':
  1086.                         case 'strtoupper':
  1087.                         case 'utf8_strtoupper':
  1088.                         case 'ucfirst':
  1089.                         case 'lcfirst':
  1090.                         case 'ucwords':
  1091.                         case 'trim':
  1092.                         case 'rtrim':
  1093.                         case 'ltrim':
  1094.                         case 'utf8_romanize':
  1095.                         case 'urlencode':
  1096.                         case 'rawurlencode':
  1097.                             $arrCache[$strTag] = $flag($arrCache[$strTag]);
  1098.                             break;
  1100.                         case 'attr':
  1101.                             $arrCache[$strTag] = StringUtil::specialcharsAttribute($arrCache[$strTag]);
  1102.                             break;
  1104.                         case 'urlattr':
  1105.                             $arrCache[$strTag] = StringUtil::specialcharsUrl($arrCache[$strTag]);
  1106.                             break;
  1108.                         case 'nl2br_pre':
  1109.                             trigger_deprecation('contao/core-bundle', '4.0', 'Using nl2br_pre() has been deprecated and will no longer work in Contao 5.0.');
  1110.                             // no break
  1112.                         case 'nl2br':
  1113.                             $arrCache[$strTag] = preg_replace('/\r?\n/', '<br>', $arrCache[$strTag]);
  1114.                             break;
  1116.                         case 'encodeEmail':
  1117.                             $arrCache[$strTag] = StringUtil::$flag($arrCache[$strTag]);
  1118.                             break;
  1120.                         case 'number_format':
  1121.                             $arrCache[$strTag] = System::getFormattedNumber($arrCache[$strTag], 0);
  1122.                             break;
  1124.                         case 'currency_format':
  1125.                             $arrCache[$strTag] = System::getFormattedNumber($arrCache[$strTag]);
  1126.                             break;
  1128.                         case 'readable_size':
  1129.                             $arrCache[$strTag] = System::getReadableSize($arrCache[$strTag]);
  1130.                             break;
  1132.                         case 'flatten':
  1133.                             if (!\is_array($arrCache[$strTag]))
  1134.                             {
  1135.                                 break;
  1136.                             }
  1138.                             $it = new \RecursiveIteratorIterator(new \RecursiveArrayIterator($arrCache[$strTag]));
  1139.                             $result = array();
  1141.                             foreach ($it as $leafValue)
  1142.                             {
  1143.                                 $keys = array();
  1145.                                 foreach (range(0, $it->getDepth()) as $depth)
  1146.                                 {
  1147.                                     $keys[] = $it->getSubIterator($depth)->key();
  1148.                                 }
  1150.                                 $result[] = implode('.', $keys) . ': ' . $leafValue;
  1151.                             }
  1153.                             $arrCache[$strTag] = implode(', ', $result);
  1154.                             break;
  1156.                         case 'absolute':
  1157.                             trigger_deprecation('contao/core-bundle', '4.12', 'The insert tag flag "|absolute" has been deprecated and will no longer work in Contao 5.0. use "::absolute" instead.');
  1158.                             // ignore
  1159.                             break;
  1161.                         case 'refresh':
  1162.                         case 'uncached':
  1163.                             // ignore
  1164.                             break;
  1166.                         // HOOK: pass unknown flags to callback functions
  1167.                         default:
  1168.                             if (isset($GLOBALS['TL_HOOKS']['insertTagFlags']) && \is_array($GLOBALS['TL_HOOKS']['insertTagFlags']))
  1169.                             {
  1170.                                 foreach ($GLOBALS['TL_HOOKS']['insertTagFlags'] as $callback)
  1171.                                 {
  1172.                                     $this->import($callback[0]);
  1173.                                     $varValue = $this->{$callback[0]}->{$callback[1]}($flag, $tag, $arrCache[$strTag], $flags, $blnCache, $tags, $arrCache, $_rit, $_cnt); // see #5806
  1175.                                     // Replace the tag and stop the loop
  1176.                                     if ($varValue !== false)
  1177.                                     {
  1178.                                         $arrCache[$strTag] = $varValue;
  1179.                                         break 2;
  1180.                                     }
  1181.                                 }
  1182.                             }
  1184.                             $this->log('Unknown insert tag flag "' . $flag . '" in {{' . $strTag . '}} on page ' . Environment::get('uri'), __METHOD__, TL_ERROR);
  1185.                             break;
  1186.                     }
  1187.                 }
  1188.             }
  1190.             $strBuffer .= $arrCache[$strTag] ?? '';
  1191.         }
  1193.         return StringUtil::restoreBasicEntities($strBuffer);
  1194.     }
  1196.     /**
  1197.      * @return array<string|null, array>
  1198.      */
  1199.     private function parseUrlWithQueryString(string $url): array
  1200.     {
  1201.         // Restore [&]
  1202.         $url = str_replace('[&]', '&', $url);
  1204.         $base = parse_url($url, PHP_URL_PATH) ?: null;
  1205.         $query = parse_url($url, PHP_URL_QUERY) ?: '';
  1207.         parse_str($query, $attributes);
  1209.         // Cast and encode values
  1210.         array_walk_recursive($attributes, static function (&$value)
  1211.         {
  1212.             if (is_numeric($value))
  1213.             {
  1214.                 $value = (int) $value;
  1216.                 return;
  1217.             }
  1219.             $value = StringUtil::specialcharsAttribute($value);
  1220.         });
  1222.         return array($base, $attributes);
  1223.     }
  1225.     /**
  1226.      * Add the specialchars flag to all insert tags used in HTML attributes
  1227.      *
  1228.      * @param string $html
  1229.      *
  1230.      * @return string The html with the encoded insert tags
  1231.      */
  1232.     private function encodeHtmlAttributes($html)
  1233.     {
  1234.         // Regular expression to match tags according to https://html.spec.whatwg.org/#tag-open-state
  1235.         $tagRegEx = '('
  1236.             . '<'                         // Tag start
  1237.             . '/?'                        // Optional slash for closing element
  1238.             . '([a-z][^\s/>]*+)'          // Tag name
  1239.             . '(?:'                       // Attribute
  1240.                 . '[\s/]*+'               // Optional white space including slash
  1241.                 . '[^>\s/][^>\s/=]*+'     // Attribute name
  1242.                 . '[\s]*+'                // Optional white space
  1243.                 . '(?:='                  // Assignment
  1244.                     . '[\s]*+'            // Optional white space
  1245.                     . '(?:'               // Value
  1246.                         . '"[^"]*"'       // Double quoted value
  1247.                         . '|\'[^\']*\''   // Or single quoted value
  1248.                         . '|[^>][^\s>]*+' // Or unquoted value
  1249.                     . ')?+'               // Value is optional
  1250.                 . ')?+'                   // Assignment is optional
  1251.             . ')*+'                       // Attributes may occur zero or more times
  1252.             . '[\s/]*+'                   // Optional white space including slash
  1253.             . '>?'                        // Tag end (optional if EOF)
  1254.             . '|<!--'                     // Or comment
  1255.             . '|<!'                       // Or bogus ! comment
  1256.             . '|<\?'                      // Or bogus ? comment
  1257.             . '|</(?![a-z])'              // Or bogus / comment
  1258.         . ')i';
  1260.         $htmlResult = '';
  1261.         $offset = 0;
  1263.         while (preg_match($tagRegEx, $html, $matches, PREG_OFFSET_CAPTURE, $offset))
  1264.         {
  1265.             $htmlResult .= substr($html, $offset, $matches[0][1] - $offset);
  1267.             // Skip comments
  1268.             if ($matches[0][0] === '<!--' || $matches[0][0] === '<!' || $matches[0][0] === '</' || $matches[0][0] === '<?')
  1269.             {
  1270.                 $commentCloseString = $matches[0][0] === '<!--' ? '-->' : '>';
  1271.                 $commentClosePos = strpos($html, $commentCloseString, $offset);
  1272.                 $offset = $commentClosePos ? $commentClosePos + \strlen($commentCloseString) : \strlen($html);
  1274.                 // Encode insert tags in comments
  1275.                 $htmlResult .= str_replace(array('{{', '}}'), array('[{]', '[}]'), substr($html, $matches[0][1], $offset - $matches[0][1]));
  1276.                 continue;
  1277.             }
  1279.             $tag = $matches[0][0];
  1281.             // Encode insert tags
  1282.             $tagPrefix = substr($tag, 0, $matches[1][1] - $matches[0][1] + \strlen($matches[1][0]));
  1283.             $tag = $tagPrefix . $this->fixUnclosedTagsAndUrlAttributes(substr($tag, \strlen($tagPrefix)));
  1284.             $tag = preg_replace('/(?:\|attr)?}}/', '|attr}}', $tag);
  1285.             $tag = str_replace('|urlattr|attr}}', '|urlattr}}', $tag);
  1287.             $offset = $matches[0][1] + \strlen($matches[0][0]);
  1288.             $htmlResult .= $tag;
  1290.             // Skip RCDATA and RAWTEXT elements https://html.spec.whatwg.org/#rcdata-state
  1291.             if (
  1292.                 \in_array(strtolower($matches[1][0]), array('script', 'title', 'textarea', 'style', 'xmp', 'iframe', 'noembed', 'noframes', 'noscript'))
  1293.                 && preg_match('(</' . preg_quote($matches[1][0]) . '[\s/>])i', $html, $endTagMatches, PREG_OFFSET_CAPTURE, $offset)
  1294.             ) {
  1295.                 $offset = $endTagMatches[0][1] + \strlen($endTagMatches[0][0]);
  1296.                 $htmlResult .= substr($html, $matches[0][1] + \strlen($matches[0][0]), $offset - $matches[0][1] - \strlen($matches[0][0]));
  1297.             }
  1298.         }
  1300.         $htmlResult .= substr($html, $offset);
  1302.         return $htmlResult;
  1303.     }
  1305.     /**
  1306.      * Detect strip and encode unclosed insert tags and add the urlattr flag to
  1307.      * all insert tags used in URL attributes
  1308.      *
  1309.      * @param string $attributes
  1310.      *
  1311.      * @return string The attributes html with the encoded insert tags
  1312.      */
  1313.     private function fixUnclosedTagsAndUrlAttributes($attributes)
  1314.     {
  1315.         $attrRegEx = '('
  1316.             . '[\s/]*+'               // Optional white space including slash
  1317.             . '([^>\s/][^>\s/=]*+)'   // Attribute name
  1318.             . '[\s]*+'                // Optional white space
  1319.             . '(?:='                  // Assignment
  1320.                 . '[\s]*+'            // Optional white space
  1321.                 . '(?:'               // Value
  1322.                     . '"[^"]*"'       // Double quoted value
  1323.                     . '|\'[^\']*\''   // Or single quoted value
  1324.                     . '|[^>][^\s>]*+' // Or unquoted value
  1325.                 . ')?+'               // Value is optional
  1326.             . ')?+'                   // Assignment is optional
  1327.         . ')i';
  1329.         $attributesResult = '';
  1330.         $offset = 0;
  1332.         while (preg_match($attrRegEx, $attributes, $matches, PREG_OFFSET_CAPTURE, $offset))
  1333.         {
  1334.             $attributesResult .= substr($attributes, $offset, $matches[0][1] - $offset);
  1335.             $offset = $matches[0][1] + \strlen($matches[0][0]);
  1337.             // Strip unclosed iflng tags
  1338.             $intLastIflng = strripos($matches[0][0], '{{iflng');
  1340.             if (
  1341.                 $intLastIflng !== strripos($matches[0][0], '{{iflng}}')
  1342.                 && $intLastIflng !== strripos($matches[0][0], '{{iflng|urlattr}}')
  1343.                 && $intLastIflng !== strripos($matches[0][0], '{{iflng|attr}}')
  1344.             ) {
  1345.                 $matches[0][0] = StringUtil::stripInsertTags($matches[0][0]);
  1346.             }
  1348.             // Strip unclosed ifnlng tags
  1349.             $intLastIfnlng = strripos($matches[0][0], '{{ifnlng');
  1351.             if (
  1352.                 $intLastIfnlng !== strripos($matches[0][0], '{{ifnlng}}')
  1353.                 && $intLastIfnlng !== strripos($matches[0][0], '{{ifnlng|urlattr}}')
  1354.                 && $intLastIfnlng !== strripos($matches[0][0], '{{ifnlng|attr}}')
  1355.             ) {
  1356.                 $matches[0][0] = StringUtil::stripInsertTags($matches[0][0]);
  1357.             }
  1359.             // Strip unclosed insert tags
  1360.             $intLastOpen = strrpos($matches[0][0], '{{');
  1361.             $intLastClose = strrpos($matches[0][0], '}}');
  1363.             if ($intLastOpen !== false && ($intLastClose === false || $intLastClose < $intLastOpen))
  1364.             {
  1365.                 $matches[0][0] = StringUtil::stripInsertTags($matches[0][0]);
  1366.                 $matches[0][0] = str_replace(array('{{', '}}'), array('[{]', '[}]'), $matches[0][0]);
  1367.             }
  1368.             elseif ($intLastOpen === false && $intLastClose !== false)
  1369.             {
  1370.                 // Improve compatibility with JSON in attributes
  1371.                 $matches[0][0] = str_replace('}}', '&#125;&#125;', $matches[0][0]);
  1372.             }
  1374.             // Add the urlattr insert tags flag in URL attributes
  1375.             if (\in_array(strtolower($matches[1][0]), array('src', 'srcset', 'href', 'action', 'formaction', 'codebase', 'cite', 'background', 'longdesc', 'profile', 'usemap', 'classid', 'data', 'icon', 'manifest', 'poster', 'archive'), true))
  1376.             {
  1377.                 $matches[0][0] = preg_replace('/(?:\|(?:url)?attr)?}}/', '|urlattr}}', $matches[0][0]);
  1379.                 // Backwards compatibility
  1380.                 if (trim($matches[0][0]) === 'href="{{link_url::back|urlattr}}"')
  1381.                 {
  1382.                     $matches[0][0] = str_replace('{{link_url::back|urlattr}}', '{{link_url::back}}', $matches[0][0]);
  1383.                 }
  1384.             }
  1386.             $attributesResult .= $matches[0][0];
  1387.         }
  1389.         $attributesResult .= substr($attributes, $offset);
  1391.         return $attributesResult;
  1392.     }
  1394.     /**
  1395.      * Check if the language matches
  1396.      *
  1397.      * @param string $language
  1398.      *
  1399.      * @return boolean
  1400.      */
  1401.     private function languageMatches($language)
  1402.     {
  1403.         $pageLanguage = LocaleUtil::formatAsLocale($GLOBALS['objPage']->language);
  1405.         foreach (StringUtil::trimsplit(',', $language) as $lang)
  1406.         {
  1407.             if ($pageLanguage === LocaleUtil::formatAsLocale($lang))
  1408.             {
  1409.                 return true;
  1410.             }
  1412.             if (substr($lang, -1) === '*' && 0 === strncmp($pageLanguage, $lang, \strlen($lang) - 1))
  1413.             {
  1414.                 return true;
  1415.             }
  1416.         }
  1418.         return false;
  1419.     }
  1420. }
  1422. class_alias(InsertTags::class, 'InsertTags');