group each plugin in its own folder

src/editor/extensions/ext-server_opensave/allowedMimeTypes.php

@@ -0,0 +1,12 @@
+<?php
+
+$allowedMimeTypesBySuffix = array(
+  'svg' => 'image/svg+xml;charset=UTF-8',
+  'png' => 'image/png',
+  'jpeg' => 'image/jpeg',
+  'bmp' => 'image/bmp',
+  'webp' => 'image/webp',
+  'pdf' => 'application/pdf'
+);
+
+?>

src/editor/extensions/ext-server_opensave/ext-php_savefile.js

@@ -0,0 +1,30 @@
+// TODO: Might add support for "exportImage" custom
+//   handler as in "ext-server_opensave.js" (and in savefile.php)
+
+export default {
+  name: 'php_savefile',
+  init ({$}) {
+    const svgEditor = this;
+    const {
+      curConfig: {extPath},
+      canvas: svgCanvas
+    } = svgEditor;
+    /**
+     * Get file name out of SVGEdit document title.
+     * @returns {string}
+     */
+    function getFileNameFromTitle () {
+      const title = svgCanvas.getDocumentTitle();
+      return title.trim();
+    }
+    const saveSvgAction = extPath + 'savefile.php';
+    svgEditor.setCustomHandlers({
+      save (win, data) {
+        const svg = '<?xml version="1.0" encoding="UTF-8"?>\n' + data,
+          filename = getFileNameFromTitle();
+
+        $.post(saveSvgAction, {output_svg: svg, filename});
+      }
+    });
+  }
+};

src/editor/extensions/ext-server_opensave/ext-server_opensave.js

@@ -0,0 +1,270 @@
+/**
+ * @file ext-server_opensave.js
+ *
+ * @license MIT
+ *
+ * @copyright 2010 Alexis Deveria
+ *
+ */
+import {canvg} from '../../../external/canvg/canvg.js';
+
+export default {
+  name: 'server_opensave',
+  async init ({$, decode64, encode64}) {
+    const svgEditor = this;
+    // eslint-disable-next-line node/no-unsupported-features/es-syntax
+    const {default: strings} = await import(`./locale/${svgEditor.curPrefs.lang}.js`);
+    const {
+      curConfig: {
+        extPath,
+        avoidClientSide, // Deprecated
+        avoidClientSideDownload, avoidClientSideOpen
+      },
+      canvas: svgCanvas
+    } = svgEditor;
+
+    /**
+     *
+     * @returns {string}
+     */
+    function getFileNameFromTitle () {
+      const title = svgCanvas.getDocumentTitle();
+      // We convert (to underscore) only those disallowed Win7 file name characters
+      return title.trim().replace(/[/\\:*?"<>|]/g, '_');
+    }
+    /**
+     * Escapes XML predefined entities for quoted attributes.
+     * @param {string} str
+     * @returns {string}
+     */
+    function xhtmlEscape (str) {
+      return str.replace(/&(?!amp;)/g, '&amp;').replace(/"/g, '&quot;').replace(/</g, '&lt;'); // < is actually disallowed above anyways
+    }
+
+    /**
+     *
+     * @param {string} [filename='image']
+     * @param {string} suffix To add to file name
+     * @param {string} uri
+     * @returns {boolean}
+     */
+    function clientDownloadSupport (filename, suffix, uri) {
+      if (avoidClientSide || avoidClientSideDownload) {
+        return false;
+      }
+      const support = $('<a>')[0].download === '';
+      let a;
+      if (support) {
+        a = $('<a>hidden</a>').attr({
+          download: (filename || 'image') + suffix,
+          href: uri
+        }).css('display', 'none').appendTo('body');
+        a[0].click();
+        return true;
+      }
+      return false;
+    }
+    const
+      saveSvgAction = extPath + 'filesave.php',
+      saveImgAction = extPath + 'filesave.php';
+      // Create upload target (hidden iframe)
+
+    let cancelled = false;
+
+    //  Hiding by size instead of display to avoid FF console errors
+    //    with `getBBox` in browser.js `supportsPathBBox_`)
+    $(
+      `<iframe name="output_frame" title="${strings.hiddenframe}"
+          style="width: 0; height: 0;" src="data:text/html;base64,PGh0bWw+"/>`
+    ).appendTo('body');
+    svgEditor.setCustomHandlers({
+      save (win, data) {
+        const svg = '<?xml version="1.0" encoding="UTF-8"?>\n' + data, // Firefox doesn't seem to know it is UTF-8 (no matter whether we use or skip the clientDownload code) despite the Content-Disposition header containing UTF-8, but adding the encoding works
+          filename = getFileNameFromTitle();
+
+        if (clientDownloadSupport(filename, '.svg', 'data:image/svg+xml;charset=UTF-8;base64,' + encode64(svg))) {
+          return;
+        }
+
+        $('<form>').attr({
+          method: 'post',
+          action: saveSvgAction,
+          target: 'output_frame'
+        }).append(`
+          <input type="hidden" name="output_svg" value="${xhtmlEscape(svg)}">
+          <input type="hidden" name="filename" value="${xhtmlEscape(filename)}">
+        `).appendTo('body')
+          .submit().remove();
+      },
+      exportPDF (win, data) {
+        const filename = getFileNameFromTitle(),
+          datauri = data.output;
+        if (clientDownloadSupport(filename, '.pdf', datauri)) {
+          return;
+        }
+        $('<form>').attr({
+          method: 'post',
+          action: saveImgAction,
+          target: 'output_frame'
+        }).append(`
+          <input type="hidden" name="output_img" value="${datauri}">
+          <input type="hidden" name="mime" value="application/pdf">
+          <input type="hidden" name="filename" value="${xhtmlEscape(filename)}">
+        `).appendTo('body')
+          .submit().remove();
+      },
+      // Todo: Integrate this extension with a new built-in exportWindowType, "download"
+      async exportImage (win, data) {
+        const {issues, mimeType, quality} = data;
+
+        if (!$('#export_canvas').length) {
+          $('<canvas>', {id: 'export_canvas'}).hide().appendTo('body');
+        }
+        const c = $('#export_canvas')[0];
+
+        c.width = svgCanvas.contentW;
+        c.height = svgCanvas.contentH;
+        await canvg(c, data.svg);
+        const datauri = quality ? c.toDataURL(mimeType, quality) : c.toDataURL(mimeType);
+        // {uiStrings} = svgEditor;
+
+        // Check if there are issues
+        let pre, note = '';
+        if (issues.length) {
+          pre = '\n \u2022 '; // Bullet
+          note += ('\n\n' + pre + issues.join(pre));
+        }
+
+        if (note.length) {
+          await $.alert(note);
+        }
+
+        const filename = getFileNameFromTitle();
+        const suffix = '.' + data.type.toLowerCase();
+
+        if (clientDownloadSupport(filename, suffix, datauri)) {
+          return;
+        }
+
+        $('<form>').attr({
+          method: 'post',
+          action: saveImgAction,
+          target: 'output_frame'
+        }).append(`
+          <input type="hidden" name="output_img" value="${datauri}">
+          <input type="hidden" name="mime" value="${mimeType}">
+          <input type="hidden" name="filename" value="${xhtmlEscape(filename)}">
+        `).appendTo('body')
+          .submit().remove();
+      }
+    });
+
+    // Do nothing if client support is found
+    if (window.FileReader && !avoidClientSideOpen) { return; }
+
+    // Change these to appropriate script file
+    const openSvgAction = extPath + 'fileopen.php?type=load_svg';
+    const importSvgAction = extPath + 'fileopen.php?type=import_svg';
+    const importImgAction = extPath + 'fileopen.php?type=import_img';
+
+    // Set up function for PHP uploader to use
+    svgEditor.processFile = function (str64, type) {
+      let xmlstr;
+      if (cancelled) {
+        cancelled = false;
+        return;
+      }
+
+      $('#dialog_box').hide();
+
+      if (type !== 'import_img') {
+        xmlstr = decode64(str64);
+      }
+
+      switch (type) {
+      case 'load_svg':
+        svgCanvas.clear();
+        svgCanvas.setSvgString(xmlstr);
+        svgEditor.updateCanvas();
+        break;
+      case 'import_svg':
+        svgCanvas.importSvgString(xmlstr);
+        svgEditor.updateCanvas();
+        break;
+      case 'import_img':
+        svgCanvas.setGoodImage(str64);
+        break;
+      }
+    };
+
+    // Create upload form
+    const openSvgForm = $('<form>');
+    openSvgForm.attr({
+      enctype: 'multipart/form-data',
+      method: 'post',
+      action: openSvgAction,
+      target: 'output_frame'
+    });
+
+    // Create import form
+    const importSvgForm = openSvgForm.clone().attr('action', importSvgAction);
+
+    // Create image form
+    const importImgForm = openSvgForm.clone().attr('action', importImgAction);
+
+    // It appears necessary to rebuild this input every time a file is
+    // selected so the same file can be picked and the change event can fire.
+
+    /**
+     *
+     * @param {external:jQuery} form
+     * @returns {void}
+     */
+    function rebuildInput (form) {
+      form.empty();
+      const inp = $('<input type="file" name="svg_file">').appendTo(form);
+
+      /**
+       * Submit the form, empty its contents for reuse and show
+       *   uploading message.
+       * @returns {Promise<void>}
+       */
+      async function submit () {
+        // This submits the form, which returns the file data using `svgEditor.processFile()`
+        form.submit();
+
+        rebuildInput(form);
+        await $.process_cancel(strings.uploading);
+        cancelled = true;
+        $('#dialog_box').hide();
+      }
+
+      if (form[0] === openSvgForm[0]) {
+        inp.change(async function () {
+          // This takes care of the "are you sure" dialog box
+          const ok = await svgEditor.openPrep();
+          if (!ok) {
+            rebuildInput(form);
+            return;
+          }
+          await submit();
+        });
+      } else {
+        inp.change(async function () {
+          // This submits the form, which returns the file data using svgEditor.processFile()
+          await submit();
+        });
+      }
+    }
+
+    // Create the input elements
+    rebuildInput(openSvgForm);
+    rebuildInput(importSvgForm);
+    rebuildInput(importImgForm);
+
+    // Add forms to buttons
+    $('#tool_open').show().prepend(openSvgForm);
+    $('#tool_import').show().prepend(importSvgForm);
+    $('#tool_image').prepend(importImgForm);
+  }
+};

src/editor/extensions/ext-server_opensave/fileopen.php

@@ -0,0 +1,58 @@
+<!DOCTYPE html>
+<?php
+/*
+ * fileopen.php
+ * To be used with ext-server_opensave.js for SVG-edit
+ *
+ * Licensed under the MIT License
+ *
+ * Copyright(c) 2010 Alexis Deveria
+ *
+ */
+  // Very minimal PHP file, all we do is Base64 encode the uploaded file and
+  // return it to the editor
+
+  if (!isset($_REQUEST['type'])) {
+    echo 'No type given';
+    exit;
+  }
+  $type = $_REQUEST['type'];
+  if (!in_array($type, array('load_svg', 'import_svg', 'import_img'))) {
+    echo 'Not a recognized type';
+    exit;
+  }
+
+  require('allowedMimeTypes.php');
+
+  $file = $_FILES['svg_file']['tmp_name'];
+
+  $output = file_get_contents($file);
+
+  $prefix = '';
+
+  // Make Data URL prefix for import image
+  if ($type == 'import_img') {
+    $info = getimagesize($file);
+    if (!in_array($info['mime'], $allowedMimeTypesBySuffix)) {
+      echo 'Disallowed MIME for supplied file';
+      exit;
+    }
+    $prefix = 'data:' . $info['mime'] . ';base64,';
+  }
+?>
+<html>
+  <head>
+  <meta charset="utf-8" />
+  <title>-</title>
+  <script>
+
+top.svgEditor.processFile("<?php
+
+// This should be safe since SVG edit does its own filtering (e.g., if an SVG file contains scripts)
+echo $prefix . base64_encode($output);
+
+?>", "<?php echo $type; ?>");
+  </script>
+</head>
+<body></body>
+</html>

src/editor/extensions/ext-server_opensave/filesave.php

@@ -0,0 +1,60 @@
+<?php
+/*
+ * filesave.php
+ * To be used with ext-server_opensave.js for SVG-edit
+ *
+ * Licensed under the MIT License
+ *
+ * Copyright(c) 2010 Alexis Deveria
+ *
+ */
+
+function encodeRFC5987ValueChars ($str) {
+  // See https://tools.ietf.org/html/rfc5987#section-3.2.1
+  // For better readability within headers, add back the characters escaped by rawurlencode but still allowable
+  // Although RFC3986 reserves "!" (%21), RFC5987 does not
+  return preg_replace_callback('@%(2[1346B]|5E|60|7C)@', function ($matches) {
+    return chr('0x' . $matches[1]);
+  }, rawurlencode($str));
+}
+
+require('allowedMimeTypes.php');
+
+$mime = (!isset($_POST['mime']) || !in_array($_POST['mime'], $allowedMimeTypesBySuffix)) ? 'image/svg+xml;charset=UTF-8' : $_POST['mime'];
+
+if (!isset($_POST['output_svg']) && !isset($_POST['output_img'])) {
+  die('post fail');
+}
+
+$file = '';
+
+$suffix = '.' . array_search($mime, $allowedMimeTypesBySuffix);
+
+if (isset($_POST['filename']) && strlen($_POST['filename']) > 0) {
+  $file = $_POST['filename'] . $suffix;
+} else {
+  $file = 'image' . $suffix;
+}
+
+if ($suffix == '.svg') {
+  $contents = $_POST['output_svg'];
+} else {
+  $contents = $_POST['output_img'];
+  $pos = (strpos($contents, 'base64,') + 7);
+  $contents = base64_decode(substr($contents, $pos));
+}
+
+header('Cache-Control: public');
+header('Content-Description: File Transfer');
+
+// See https://tools.ietf.org/html/rfc6266#section-4.1
+header("Content-Disposition: attachment; filename*=UTF-8''" . encodeRFC5987ValueChars(
+  // preg_replace('@[\\\\/:*?"<>|]@', '', $file) // If we wanted to strip Windows-disallowed characters server-side (but not a security issue, so we can strip client-side instead)
+  $file
+));
+header('Content-Type: ' .  $mime);
+header('Content-Transfer-Encoding: binary');
+
+echo $contents;
+
+?>

src/editor/extensions/ext-server_opensave/locale/en.js

@@ -0,0 +1,4 @@
+export default {
+  uploading: 'Uploading...',
+  hiddenframe: 'Opensave frame to store hidden values'
+};

src/editor/extensions/ext-server_opensave/locale/zh-CN.js

@@ -0,0 +1,4 @@
+export default {
+  uploading: '正在上传...',
+  hiddenframe: 'Opensave frame to store hidden values'
+};

src/editor/extensions/ext-server_opensave/savefile.php

@@ -0,0 +1,16 @@
+<?php
+  // You must first create a file "savefile_config.php" in this extensions directory and do whatever
+  //   checking of user credentials, etc. that you wish; otherwise anyone will be able to post SVG
+  //   files to your server which may cause disk space or possibly security problems
+  require('savefile_config.php');
+  if (!isset($_POST['output_svg'])) {
+    print 'You must supply output_svg';
+    exit;
+  }
+  $svg = $_POST['output_svg'];
+  $filename = (isset($_POST['filename']) && !empty($_POST['filename']) ? preg_replace('@[\\\\/:*?"<>|]@u', '_', $_POST['filename']) : 'saved') . '.svg'; // These characters are indicated as prohibited by Windows
+
+  $fh = fopen($filename, 'w') or die("Can't open file");
+  fwrite($fh, $svg);
+  fclose($fh);
+?>