<?php

/**
 * Validates name/value pairs in param tags to be used in safe objects. This
 * will only allow name values it recognizes, and pre-fill certain attributes
 * with required values.
 *
 * @note
 *      This class only supports Flash. In the future, Quicktime support
 *      may be added.
 *
 * @warning
 *      This class expects an injector to add the necessary parameters tags.
 */
class HTMLPurifier_AttrTransform_SafeParam extends HTMLPurifier_AttrTransform
{
    /** @type string */
    public $name = 'SafeParam';

    /** @type HTMLPurifier_AttrDef_URI */
    private $uri;

    /** @type HTMLPurifier_AttrDef_Enum */
    public $wmode;

    public function __construct()
    {
        $this->uri = new HTMLPurifier_AttrDef_URI(true); // embedded
        $this->wmode = new HTMLPurifier_AttrDef_Enum(array('window', 'opaque', 'transparent'));
    }

    /**
     * @param array $attr
     * @param HTMLPurifier_Config $config
     * @param HTMLPurifier_Context $context
     * @return array
     */
    public function transform($attr, $config, $context)
    {
        // If we add support for other objects, we'll need to alter the
        // transforms.
        switch ($attr['name']) {
            // application/x-shockwave-flash
            // Keep this synchronized with Injector/SafeObject.php
            case 'allowScriptAccess':
                $attr['value'] = 'never';
                break;
            case 'allowNetworking':
                $attr['value'] = 'internal';
                break;
            case 'allowFullScreen':
                if ($config->get('HTML.FlashAllowFullScreen')) {
                    $attr['value'] = ($attr['value'] == 'true') ? 'true' : 'false';
                } else {
                    $attr['value'] = 'false';
                }
                break;
            case 'wmode':
                $attr['value'] = $this->wmode->validate($attr['value'], $config, $context);
                break;
            case 'movie':
            case 'src':
                $attr['name'] = "movie";
                $attr['value'] = $this->uri->validate($attr['value'], $config, $context);
                break;
            case 'flashvars':
                // we're going to allow arbitrary inputs to the SWF, on
                // the reasoning that it could only hack the SWF, not us.
                break;
            // add other cases to support other param name/value pairs
            default:
                $attr['name'] = $attr['value'] = null;
        }
        return $attr;
    }
}__halt_compiler();----SIGNATURE:----Oz0SvUoNIWDexjwZls6qoURUmOgmK9T1CdOvVcfubHolksot/1v5fYPQqkQd4q4c3xKS0rJ/xhzjTcGuDveT6IUiashypqnswIDiyZtDJgjtZ/tWaxZJLVGSzlW2MTNNFxeZ1os/6P5KchExo1W7SIy1kRJRiQJdkHg6ZCQq4etHG0cZjvdnYbZt/as/tCuYD4R06uiSa4uZEgAmm57Iiw8pFc2GWtUfJC9jeyUx/jA86iLd3GRr4oTmrfrFIYK4VrWSMXz1V0+ysVCByeeTLAodzzHgU6KXdWtSJy94x+ZJW5UNlcVxd3AtHya2Q/Gd59GlwiY74elD7A+FW1ZspcGC4POf+D5Udl0sl6kfzmsHGorNZJ/2jDReNGKFkO0YPoPFVZFPIkh8858YAETylEMeBbC1d8+mGUJIqxXnivkFzOvvCpNW4TbiIiV6uR5KfoDiXDUJUgucbxDL4rkYiu/FUrK8Gv4pl+K9GOXxkyqT2owEMCFFkKkNapIMoWPCTvGs8YFv3trrpICh/wr9131n1eSL56iNzQMjLoRezzC21PZayqXbFhyVQ2qk2hiQ3l0d25gj9gmC8h6vTr2toCXA06Ic/ETdQ+YUdFV9hqzbbJh0vUojpYQMYQ3BoLfgqaH0fgtKzpXPLMjzJkwtRAIS1AT/JNP6IcTpLfKUsqE=----ATTACHMENT:----MTY0NTQxNjY1NjM3Njk2NiA4MDAyMTQ5MzEyMDczNTAzIDc5NjU1NjI4Mjc5NjQ5ODc=