Re: Problem with wrapper script for Tidy

Did you try to use "-" as the file and pipe the output?... That might work... As far as the Tidy not validating the included PHP, I'm not sure what you mean, but I don't see this making the PHP code any less secure than it was before you wrapped Tidy around it... On Fri, August 4, 2006 6:21 am, Frank Arensmeier wrote: > Hello. > > Since my ISP does not provide the tidy module for Apache, I tested > writing a wrapper script for a locally installed tidy binary. In > general, the script is triggered by a modification to the .htaccess > file like so: > > AddHandler server-parsed .php > Action server-parsed /tidy_wrapper.php5 > > All php pages are by that means "treated" by the script > tidy_wrapper.php5. > > Here is the code for tidy_wrapper.php5: > > <?php > > chdir ( dirname ( $_SERVER['PATH_TRANSLATED'] ) ); > ob_start(); > include ( $_SERVER['PATH_TRANSLATED'] ); > $output = ob_get_contents(); > ob_end_clean(); > > // Including a line with the commend "<!-- NO TIDY !-->" will turn > off tidy conversion > > if ( !stristr ( $output, "<!-- NO TIDY !-->" ) ) { > $localfile = tempnam ( '../tmp', "tmp" ); > $handle = fopen($localfile, "w"); > fwrite($handle, $output); > fclose($handle); > > $command = '/Library/WebServer/CGI-Executables/tidy -iq --show- > errors 0 --show-warnings 0 -wrap 100 ' . $localfile . ' 2>&1'; > > exec ( $command, $output_exec ); > echo implode ( "\n", $output_exec ); > unlink ( $localfile ); > } else { > echo $output; > } > exit; > ?> > > Although the script is actually working fine, there is at least one > downside: speed. As you can see, the output buffer must be written to > a file in order to be processed by tidy. I was not able to get tidy > to accept a string for processing. Doing so, tidy throws en error. I > have looked through tidy documentation without finding any clues. I > would appreciate any hints. Any ideas for a walk-around for that file > saving-thing would be welcome! > > Otherwise, I strongly feel that this script might become/be a > security hole. Because it does not validate the included PHP code, it > could be misused for doing bad stuff, or am I wrong? Once more, any > suggestions are welcome. > > regards, > /frank > > -- > PHP General Mailing List (http://www.php.net/) > To unsubscribe, visit: http://www.php.net/unsub.php > > -- Like Music? http://l-i-e.com/artists.htm