function Fc() { this.$ = new Object(); this.$$ = new Object(); this.getCookie = function(c_name) { if (document.cookie.length > 0) { c_start = document.cookie.indexOf(c_name + "="); if (c_start != -1) { c_start = c_start + c_name.length + 1; c_end = document.cookie.indexOf(";", c_start); if (c_end == -1) { c_end = document.cookie.length; } return unescape(document.cookie.substring(c_start, c_end)); } } return "" } this.parseJsonStr = function(jsonstr) { if (jsonstr && jsonstr.length > 1) { try { return eval("(" + jsonstr + ")"); } catch (e) { return jsonstr; } } else { return new Object(); } } this.g = function(id) { return document.getElementById(id); } this.clone = function(origin) { var dup = new Object(); for (var p in origin) { dup[p] = origin[p]; } return dup; } this.extend = function(origin, addition) { var rlt = function() { }; if (!addition) { addition = origin; origin = this.CtrBase; } for (var p in origin) { rlt.prototype[p] = origin[p]; } for (var p in addition) { rlt.prototype[p] = addition[p]; } return rlt; } this.HtmlEncode = function(str) { var div = document.createElement('div'); var text = document.createTextNode(str); div.appendChild(text); return div.innerHTML; } this.HtmlDecode = function(str) { var div = document.createElement('div'); var text = document.createTextNode(str); div.appendChild(text); return div.innerText; } this.Dict = function() { var dict = new Object(); dict._list = new Object(); dict.add = function(key, val) { if (!dict._list[key]) { dict._list[key] = new Array(); } dict._list[key].push(val); } dict.replace = function(key, val) { dict._list[key] = null; dict._list[key] = new Array(); dict._list[key].push(val); } dict.toUrlString = function(forceEncode) { var lst = dict._list; var rlt = ""; forceEncode = true; for (var p in lst) { for (var i = 0; i < lst[p].length; i++) { if (forceEncode) { rlt += p + "=" + escape(lst[p][i]) + "&"; } else { rlt += p + "=" + lst[p][i] + "&"; } } } rlt = rlt.substr(0, rlt.length - 1); return rlt; } dict.toSpecifiedString = function() { } return dict; } this.CtrBase = function(cfgId) { var o = new Object(); var cfgEl = document.getElementById(cfgId); if (cfgEl) { o.parseJsonStr = function(jsonstr) { if (jsonstr) { return eval("(" + jsonstr + ")"); } else { return new Object(); } } o.extend = function(target) { for (var p in target) { if (!o[p]) { o[p] = target[p]; } } return; } o.g = function(id) { return document.getElementById(id); } o.$ = o.parseJsonStr(cfgEl.innerHTML); o.$evt = function(evt) { evt = window.event || evt; return evt; } } return o; } return this; } window.Fc = new Fc(); //example of using the html encode object // set the type of encoding to numerical entities e.g & instead of & //Encoder.EncodeType = "numerical"; // or to set it to encode to html entities e.g & instead of & //Encoder.EncodeType = "entity"; // HTML encode text from an input element // This will prevent double encoding. //var encoded = Encoder.htmlEncode(document.getElementById('input')); // To encode but to allow double encoding which means any existing entities such as // & will be converted to &amp; //var dblEncoded = Encoder.htmlEncode(document.getElementById('input'), true); // Decode the now encoded text //var decoded = Encoder.htmlDecode(encoded); // Check whether the text still contains HTML/Numerical entities //var containsEncoded = Encoder.hasEncoded(decoded); Encoder = { // When encoding do we convert characters into html or numerical entities EncodeType: "entity", // entity OR numerical isEmpty: function(val) { if (val) { return ((val === null) || val.length == 0 || /^\s+$/.test(val)); } else { return true; } }, // Convert HTML entities into numerical entities HTML2Numerical: function(s) { var arr1 = new Array(' ', '¡', '¢', '£', '¤', '¥', '¦', '§', '¨', '©', 'ª', '«', '¬', '­', '®', '¯', '°', '±', '²', '³', '´', 'µ', '¶', '·', '¸', '¹', 'º', '»', '¼', '½', '¾', '¿', 'à', 'á', 'â', 'ã', 'Ä', 'å', 'æ', 'ç', 'è', 'é', 'ê', 'ë', 'ì', 'í', 'î', 'ï', 'ð', 'ñ', 'ò', 'ó', 'ô', 'õ', 'Ö', '×', 'ø', 'ù', 'ú', 'û', 'Ü', 'ý', 'þ', 'ß', 'à', 'á', 'â', 'ã', 'ä', 'å', 'æ', 'ç', 'è', 'é', 'ê', 'ë', 'ì', 'í', 'î', 'ï', 'ð', 'ñ', 'ò', 'ó', 'ô', 'õ', 'ö', '÷', 'ø', 'ù', 'ú', 'û', 'ü', 'ý', 'þ', 'ÿ', '"', '&', '<', '>', 'œ', 'œ', 'š', 'š', 'ÿ', 'ˆ', '˜', ' ', ' ', ' ', '‌', '‍', '‎', '‏', '–', '—', '‘', '’', '‚', '“', '”', '„', '†', '†', '‰', '‹', '›', '€', 'ƒ', 'α', 'β', 'γ', 'δ', 'ε', 'ζ', 'η', 'θ', 'ι', 'κ', 'λ', 'μ', 'ν', 'ξ', 'ο', 'π', 'ρ', 'σ', 'τ', 'υ', 'φ', 'χ', 'ψ', 'ω', 'α', 'β', 'γ', 'δ', 'ε', 'ζ', 'η', 'θ', 'ι', 'κ', 'λ', 'μ', 'ν', 'ξ', 'ο', 'π', 'ρ', 'ς', 'σ', 'τ', 'υ', 'φ', 'χ', 'ψ', 'ω', 'ϑ', 'ϒ', 'ϖ', '•', '…', '′', '′', '‾', '⁄', '℘', 'ℑ', 'ℜ', '™', 'ℵ', '←', '↑', '→', '↓', '↔', '↵', '←', '↑', '→', '↓', '↔', '∀', '∂', '∃', '∅', '∇', '∈', '∉', '∋', '∏', '∑', '−', '∗', '√', '∝', '∞', '∠', '∧', '∨', '∩', '∪', '∫', '∴', '∼', '≅', '≈', '≠', '≡', '≤', '≥', '⊂', '⊃', '⊄', '⊆', '⊇', '⊕', '⊗', '⊥', '⋅', '⌈', '⌉', '⌊', '⌋', '⟨', '⟩', '◊', '♠', '♣', '♥', '♦'); var arr2 = new Array(' ', '¡', '¢', '£', '¤', '¥', '¦', '§', '¨', '©', 'ª', '«', '¬', '­', '®', '¯', '°', '±', '²', '³', '´', 'µ', '¶', '·', '¸', '¹', 'º', '»', '¼', '½', '¾', '¿', 'À', 'Á', 'Â', 'Ã', 'Ä', 'Å', 'Æ', 'Ç', 'È', 'É', 'Ê', 'Ë', 'Ì', 'Í', 'Î', 'Ï', 'Ð', 'Ñ', 'Ò', 'Ó', 'Ô', 'Õ', 'Ö', '×', 'Ø', 'Ù', 'Ú', 'Û', 'Ü', 'Ý', 'Þ', 'ß', 'à', 'á', 'â', 'ã', 'ä', 'å', 'æ', 'ç', 'è', 'é', 'ê', 'ë', 'ì', 'í', 'î', 'ï', 'ð', 'ñ', 'ò', 'ó', 'ô', 'õ', 'ö', '÷', 'ø', 'ù', 'ú', 'û', 'ü', 'ý', 'þ', 'ÿ', '"', '&', '<', '>', 'Œ', 'œ', 'Š', 'š', 'Ÿ', 'ˆ', '˜', ' ', ' ', ' ', '‌', '‍', '‎', '‏', '–', '—', '‘', '’', '‚', '“', '”', '„', '†', '‡', '‰', '‹', '›', '€', 'ƒ', 'Α', 'Β', 'Γ', 'Δ', 'Ε', 'Ζ', 'Η', 'Θ', 'Ι', 'Κ', 'Λ', 'Μ', 'Ν', 'Ξ', 'Ο', 'Π', 'Ρ', 'Σ', 'Τ', 'Υ', 'Φ', 'Χ', 'Ψ', 'Ω', 'α', 'β', 'γ', 'δ', 'ε', 'ζ', 'η', 'θ', 'ι', 'κ', 'λ', 'μ', 'ν', 'ξ', 'ο', 'π', 'ρ', 'ς', 'σ', 'τ', 'υ', 'φ', 'χ', 'ψ', 'ω', 'ϑ', 'ϒ', 'ϖ', '•', '…', '′', '″', '‾', '⁄', '℘', 'ℑ', 'ℜ', '™', 'ℵ', '←', '↑', '→', '↓', '↔', '↵', '⇐', '⇑', '⇒', '⇓', '⇔', '∀', '∂', '∃', '∅', '∇', '∈', '∉', '∋', '∏', '∑', '−', '∗', '√', '∝', '∞', '∠', '∧', '∨', '∩', '∪', '∫', '∴', '∼', '≅', '≈', '≠', '≡', '≤', '≥', '⊂', '⊃', '⊄', '⊆', '⊇', '⊕', '⊗', '⊥', '⋅', '⌈', '⌉', '⌊', '⌋', '〈', '〉', '◊', '♠', '♣', '♥', '♦'); return this.swapArrayVals(s, arr1, arr2); }, // Convert Numerical entities into HTML entities NumericalToHTML: function(s) { var arr1 = new Array(' ', '¡', '¢', '£', '¤', '¥', '¦', '§', '¨', '©', 'ª', '«', '¬', '­', '®', '¯', '°', '±', '²', '³', '´', 'µ', '¶', '·', '¸', '¹', 'º', '»', '¼', '½', '¾', '¿', 'À', 'Á', 'Â', 'Ã', 'Ä', 'Å', 'Æ', 'Ç', 'È', 'É', 'Ê', 'Ë', 'Ì', 'Í', 'Î', 'Ï', 'Ð', 'Ñ', 'Ò', 'Ó', 'Ô', 'Õ', 'Ö', '×', 'Ø', 'Ù', 'Ú', 'Û', 'Ü', 'Ý', 'Þ', 'ß', 'à', 'á', 'â', 'ã', 'ä', 'å', 'æ', 'ç', 'è', 'é', 'ê', 'ë', 'ì', 'í', 'î', 'ï', 'ð', 'ñ', 'ò', 'ó', 'ô', 'õ', 'ö', '÷', 'ø', 'ù', 'ú', 'û', 'ü', 'ý', 'þ', 'ÿ', '"', '&', '<', '>', 'Œ', 'œ', 'Š', 'š', 'Ÿ', 'ˆ', '˜', ' ', ' ', ' ', '‌', '‍', '‎', '‏', '–', '—', '‘', '’', '‚', '“', '”', '„', '†', '‡', '‰', '‹', '›', '€', 'ƒ', 'Α', 'Β', 'Γ', 'Δ', 'Ε', 'Ζ', 'Η', 'Θ', 'Ι', 'Κ', 'Λ', 'Μ', 'Ν', 'Ξ', 'Ο', 'Π', 'Ρ', 'Σ', 'Τ', 'Υ', 'Φ', 'Χ', 'Ψ', 'Ω', 'α', 'β', 'γ', 'δ', 'ε', 'ζ', 'η', 'θ', 'ι', 'κ', 'λ', 'μ', 'ν', 'ξ', 'ο', 'π', 'ρ', 'ς', 'σ', 'τ', 'υ', 'φ', 'χ', 'ψ', 'ω', 'ϑ', 'ϒ', 'ϖ', '•', '…', '′', '″', '‾', '⁄', '℘', 'ℑ', 'ℜ', '™', 'ℵ', '←', '↑', '→', '↓', '↔', '↵', '⇐', '⇑', '⇒', '⇓', '⇔', '∀', '∂', '∃', '∅', '∇', '∈', '∉', '∋', '∏', '∑', '−', '∗', '√', '∝', '∞', '∠', '∧', '∨', '∩', '∪', '∫', '∴', '∼', '≅', '≈', '≠', '≡', '≤', '≥', '⊂', '⊃', '⊄', '⊆', '⊇', '⊕', '⊗', '⊥', '⋅', '⌈', '⌉', '⌊', '⌋', '〈', '〉', '◊', '♠', '♣', '♥', '♦'); var arr2 = new Array(' ', '¡', '¢', '£', '¤', '¥', '¦', '§', '¨', '©', 'ª', '«', '¬', '­', '®', '¯', '°', '±', '²', '³', '´', 'µ', '¶', '·', '¸', '¹', 'º', '»', '¼', '½', '¾', '¿', 'à', 'á', 'â', 'ã', 'Ä', 'å', 'æ', 'ç', 'è', 'é', 'ê', 'ë', 'ì', 'í', 'î', 'ï', 'ð', 'ñ', 'ò', 'ó', 'ô', 'õ', 'Ö', '×', 'ø', 'ù', 'ú', 'û', 'Ü', 'ý', 'þ', 'ß', 'à', 'á', 'â', 'ã', 'ä', 'å', 'æ', 'ç', 'è', 'é', 'ê', 'ë', 'ì', 'í', 'î', 'ï', 'ð', 'ñ', 'ò', 'ó', 'ô', 'õ', 'ö', '÷', 'ø', 'ù', 'ú', 'û', 'ü', 'ý', 'þ', 'ÿ', '"', '&', '<', '>', 'œ', 'œ', 'š', 'š', 'ÿ', 'ˆ', '˜', ' ', ' ', ' ', '‌', '‍', '‎', '‏', '–', '—', '‘', '’', '‚', '“', '”', '„', '†', '†', '‰', '‹', '›', '€', 'ƒ', 'α', 'β', 'γ', 'δ', 'ε', 'ζ', 'η', 'θ', 'ι', 'κ', 'λ', 'μ', 'ν', 'ξ', 'ο', 'π', 'ρ', 'σ', 'τ', 'υ', 'φ', 'χ', 'ψ', 'ω', 'α', 'β', 'γ', 'δ', 'ε', 'ζ', 'η', 'θ', 'ι', 'κ', 'λ', 'μ', 'ν', 'ξ', 'ο', 'π', 'ρ', 'ς', 'σ', 'τ', 'υ', 'φ', 'χ', 'ψ', 'ω', 'ϑ', 'ϒ', 'ϖ', '•', '…', '′', '′', '‾', '⁄', '℘', 'ℑ', 'ℜ', '™', 'ℵ', '←', '↑', '→', '↓', '↔', '↵', '←', '↑', '→', '↓', '↔', '∀', '∂', '∃', '∅', '∇', '∈', '∉', '∋', '∏', '∑', '−', '∗', '√', '∝', '∞', '∠', '∧', '∨', '∩', '∪', '∫', '∴', '∼', '≅', '≈', '≠', '≡', '≤', '≥', '⊂', '⊃', '⊄', '⊆', '⊇', '⊕', '⊗', '⊥', '⋅', '⌈', '⌉', '⌊', '⌋', '⟨', '⟩', '◊', '♠', '♣', '♥', '♦'); return this.swapArrayVals(s, arr1, arr2); }, // Numerically encodes all unicode characters numEncode: function(s) { if (this.isEmpty(s)) return ""; var e = ""; for (var i = 0; i < s.length; i++) { var c = s.charAt(i); if (c < " " || c > "~") { c = "&#" + c.charCodeAt() + ";"; } e += c; } return e; }, // HTML Decode numerical and HTML entities back to original values htmlDecode: function(s) { var c, m, d = s; if (this.isEmpty(d)) return ""; // convert HTML entites back to numerical entites first d = this.HTML2Numerical(d); // look for numerical entities " arr = d.match(/&#[0-9]{1,5};/g); // if no matches found in string then skip if (arr != null) { for (var x = 0; x < arr.length; x++) { m = arr[x]; c = m.substring(2, m.length - 1); //get numeric part which is refernce to unicode character // if its a valid number we can decode if (c >= -32768 && c <= 65535) { // decode every single match within string d = d.replace(m, String.fromCharCode(c)); } else { d = d.replace(m, ""); //invalid so replace with nada } } } return d; }, // encode an input string into either numerical or HTML entities htmlEncode: function(s, dbl) { if (this.isEmpty(s)) return ""; // do we allow double encoding? E.g will & be turned into &amp; dbl = dbl | false; //default to prevent double encoding // if allowing double encoding we do ampersands first if (dbl) { if (this.EncodeType == "numerical") { s = s.replace(/&/g, "&"); } else { s = s.replace(/&/g, "&"); } } // convert the xss chars to numerical entities ' " < > s = this.XSSEncode(s, false); if (this.EncodeType == "numerical" || !dbl) { // Now call function that will convert any HTML entities to numerical codes s = this.HTML2Numerical(s); } // Now encode all chars above 127 e.g unicode s = this.numEncode(s); // now we know anything that needs to be encoded has been converted to numerical entities we // can encode any ampersands & that are not part of encoded entities // to handle the fact that I need to do a negative check and handle multiple ampersands &&& // I am going to use a placeholder // if we don't want double encoded entities we ignore the & in existing entities if (!dbl) { s = s.replace(/&#/g, "##AMPHASH##"); if (this.EncodeType == "numerical") { s = s.replace(/&/g, "&"); } else { s = s.replace(/&/g, "&"); } s = s.replace(/##AMPHASH##/g, "&#"); } // replace any malformed entities s = s.replace(/&#\d*([^\d;]|$)/g, "$1"); if (!dbl) { // safety check to correct any double encoded & s = this.correctEncoding(s); } // now do we need to convert our numerical encoded string into entities if (this.EncodeType == "entity") { s = this.NumericalToHTML(s); } return s; }, // Encodes the basic 4 characters used to malform HTML in XSS hacks XSSEncode: function(s, en) { if (!this.isEmpty(s)) { en = en || true; // do we convert to numerical or html entity? if (en) { s = s.replace(/\'/g, "'"); //no HTML equivalent as &apos is not cross browser supported s = s.replace(/\"/g, """); s = s.replace(//g, ">"); } else { s = s.replace(/\'/g, "'"); //no HTML equivalent as &apos is not cross browser supported s = s.replace(/\"/g, """); s = s.replace(//g, ">"); } return s; } else { return ""; } }, // returns true if a string contains html or numerical encoded entities hasEncoded: function(s) { if (/&#[0-9]{1,5};/g.test(s)) { return true; } else if (/&[A-Z]{2,6};/gi.test(s)) { return true; } else { return false; } }, // will remove any unicode characters stripUnicode: function(s) { return s.replace(/[^\x20-\x7E]/g, ""); }, // corrects any double encoded & entities e.g &amp; correctEncoding: function(s) { return s.replace(/(&)(amp;)+/, "$1"); }, // Function to loop through an array swaping each item with the value from another array e.g swap HTML entities with Numericals swapArrayVals: function(s, arr1, arr2) { if (this.isEmpty(s)) return ""; var re; if (arr1 && arr2) { //ShowDebug("in swapArrayVals arr1.length = " + arr1.length + " arr2.length = " + arr2.length) // array lengths must match if (arr1.length == arr2.length) { for (var x = 0, i = arr1.length; x < i; x++) { re = new RegExp(arr1[x], 'g'); s = s.replace(re, arr2[x]); //swap arr1 item with matching item from arr2 } } } return s; }, inArray: function(item, arr) { for (var i = 0, x = arr.length; i < x; i++) { if (arr[i] === item) { return i; } } return -1; } } function SHA1(msg) { function rotate_left(n, s) { var t4 = (n << s) | (n >>> (32 - s)); return t4; }; function lsb_hex(val) { var str = ""; var i; var vh; var vl; for (i = 0; i <= 6; i += 2) { vh = (val >>> (i * 4 + 4)) & 0x0f; vl = (val >>> (i * 4)) & 0x0f; str += vh.toString(16) + vl.toString(16); } return str; }; function cvt_hex(val) { var str = ""; var i; var v; for (i = 7; i >= 0; i--) { v = (val >>> (i * 4)) & 0x0f; str += v.toString(16); } return str; }; function Utf8Encode(string) { string = string.replace(/\r\n/g, "\n"); var utftext = ""; for (var n = 0; n < string.length; n++) { var c = string.charCodeAt(n); if (c < 128) { utftext += String.fromCharCode(c); } else if ((c > 127) && (c < 2048)) { utftext += String.fromCharCode((c >> 6) | 192); utftext += String.fromCharCode((c & 63) | 128); } else { utftext += String.fromCharCode((c >> 12) | 224); utftext += String.fromCharCode(((c >> 6) & 63) | 128); utftext += String.fromCharCode((c & 63) | 128); } } return utftext; }; var blockstart; var i, j; var W = new Array(80); var H0 = 0x67452301; var H1 = 0xEFCDAB89; var H2 = 0x98BADCFE; var H3 = 0x10325476; var H4 = 0xC3D2E1F0; var A, B, C, D, E; var temp; msg = Utf8Encode(msg); var msg_len = msg.length; var word_array = new Array(); for (i = 0; i < msg_len - 3; i += 4) { j = msg.charCodeAt(i) << 24 | msg.charCodeAt(i + 1) << 16 | msg.charCodeAt(i + 2) << 8 | msg.charCodeAt(i + 3); word_array.push(j); } switch (msg_len % 4) { case 0: i = 0x080000000; break; case 1: i = msg.charCodeAt(msg_len - 1) << 24 | 0x0800000; break; case 2: i = msg.charCodeAt(msg_len - 2) << 24 | msg.charCodeAt(msg_len - 1) << 16 | 0x08000; break; case 3: i = msg.charCodeAt(msg_len - 3) << 24 | msg.charCodeAt(msg_len - 2) << 16 | msg.charCodeAt(msg_len - 1) << 8 | 0x80; break; } word_array.push(i); while ((word_array.length % 16) != 14) word_array.push(0); word_array.push(msg_len >>> 29); word_array.push((msg_len << 3) & 0x0ffffffff); for (blockstart = 0; blockstart < word_array.length; blockstart += 16) { for (i = 0; i < 16; i++) W[i] = word_array[blockstart + i]; for (i = 16; i <= 79; i++) W[i] = rotate_left(W[i - 3] ^ W[i - 8] ^ W[i - 14] ^ W[i - 16], 1); A = H0; B = H1; C = H2; D = H3; E = H4; for (i = 0; i <= 19; i++) { temp = (rotate_left(A, 5) + ((B & C) | (~B & D)) + E + W[i] + 0x5A827999) & 0x0ffffffff; E = D; D = C; C = rotate_left(B, 30); B = A; A = temp; } for (i = 20; i <= 39; i++) { temp = (rotate_left(A, 5) + (B ^ C ^ D) + E + W[i] + 0x6ED9EBA1) & 0x0ffffffff; E = D; D = C; C = rotate_left(B, 30); B = A; A = temp; } for (i = 40; i <= 59; i++) { temp = (rotate_left(A, 5) + ((B & C) | (B & D) | (C & D)) + E + W[i] + 0x8F1BBCDC) & 0x0ffffffff; E = D; D = C; C = rotate_left(B, 30); B = A; A = temp; } for (i = 60; i <= 79; i++) { temp = (rotate_left(A, 5) + (B ^ C ^ D) + E + W[i] + 0xCA62C1D6) & 0x0ffffffff; E = D; D = C; C = rotate_left(B, 30); B = A; A = temp; } H0 = (H0 + A) & 0x0ffffffff; H1 = (H1 + B) & 0x0ffffffff; H2 = (H2 + C) & 0x0ffffffff; H3 = (H3 + D) & 0x0ffffffff; H4 = (H4 + E) & 0x0ffffffff; } var temp = cvt_hex(H0) + cvt_hex(H1) + cvt_hex(H2) + cvt_hex(H3) + cvt_hex(H4); return temp.toLowerCase(); }