Änderungen https Andy Müller rückgängig gemacht
This commit is contained in:
aschwarz
@ -9,19 +9,19 @@ Currently, PHPExcel supports the following File Types for Reading:
|
||||
|
||||
### Excel5
|
||||
|
||||
The Microsoft Excel™ Binary file format (BIFF5 and BIFF8) is a binary file format that was used by Microsoft Excel™ between versions 95 and 2003. The format is supported (to various extents) by most spreadsheet programs. BIFF files normally have an extension of .xls. Documentation describing the format can be found online at [http://msdn.microsoft.com/en-us/library/cc313154(v=office.12).aspx][1] or from [http://download.microsoft.com/download/2/4/8/24862317-78F0-4C4B-B355-C7B2C1D997DB/[MS-XLS].pdf][2] (as a downloadable PDF).
|
||||
The Microsoft Excel™ Binary file format (BIFF5 and BIFF8) is a binary file format that was used by Microsoft Excel™ between versions 95 and 2003. The format is supported (to various extents) by most spreadsheet programs. BIFF files normally have an extension of .xls. Documentation describing the format can be found online at [https://msdn.microsoft.com/en-us/library/cc313154(v=office.12).aspx][1] or from [https://download.microsoft.com/download/2/4/8/24862317-78F0-4C4B-B355-C7B2C1D997DB/[MS-XLS].pdf][2] (as a downloadable PDF).
|
||||
|
||||
### Excel2003XML
|
||||
|
||||
Microsoft Excel™ 2003 included options for a file format called SpreadsheetML. This file is a zipped XML document. It is not very common, but its core features are supported. Documentation for the format can be found at [http://msdn.microsoft.com/en-us/library/aa140066%28office.10%29.aspx][3] though it’s sadly rather sparse in its detail.
|
||||
Microsoft Excel™ 2003 included options for a file format called SpreadsheetML. This file is a zipped XML document. It is not very common, but its core features are supported. Documentation for the format can be found at [https://msdn.microsoft.com/en-us/library/aa140066%28office.10%29.aspx][3] though it’s sadly rather sparse in its detail.
|
||||
|
||||
### Excel2007
|
||||
|
||||
Microsoft Excel™ 2007 shipped with a new file format, namely Microsoft Office Open XML SpreadsheetML, and Excel 2010 extended this still further with its new features such as sparklines. These files typically have an extension of .xlsx. This format is based around a zipped collection of eXtensible Markup Language (XML) files. Microsoft Office Open XML SpreadsheetML is mostly standardized in ECMA 376 ([http://www.ecma-international.org/news/TC45_current_work/TC45_available_docs.htm][4]) and ISO 29500.
|
||||
Microsoft Excel™ 2007 shipped with a new file format, namely Microsoft Office Open XML SpreadsheetML, and Excel 2010 extended this still further with its new features such as sparklines. These files typically have an extension of .xlsx. This format is based around a zipped collection of eXtensible Markup Language (XML) files. Microsoft Office Open XML SpreadsheetML is mostly standardized in ECMA 376 ([https://www.ecma-international.org/news/TC45_current_work/TC45_available_docs.htm][4]) and ISO 29500.
|
||||
|
||||
### OOCalc
|
||||
|
||||
aka Open Document Format (ODF) or OASIS, this is the OpenOffice.org XML File Format for spreadsheets. It comprises a zip archive including several components all of which are text files, most of these with markup in the eXtensible Markup Language (XML). It is the standard file format for OpenOffice.org Calc and StarCalc, and files typically have an extension of .ods. The published specification for the file format is available from the OASIS Open Office XML Format Technical Committee web page ([http://www.oasis-open.org/committees/tc_home.php?wg_abbrev=office#technical][5]). Other information is available from the OpenOffice.org XML File Format web page ([http://xml.openoffice.org/general.html][6]), part of the OpenOffice.org project.
|
||||
aka Open Document Format (ODF) or OASIS, this is the OpenOffice.org XML File Format for spreadsheets. It comprises a zip archive including several components all of which are text files, most of these with markup in the eXtensible Markup Language (XML). It is the standard file format for OpenOffice.org Calc and StarCalc, and files typically have an extension of .ods. The published specification for the file format is available from the OASIS Open Office XML Format Technical Committee web page ([https://www.oasis-open.org/committees/tc_home.php?wg_abbrev=office#technical][5]). Other information is available from the OpenOffice.org XML File Format web page ([https://xml.openoffice.org/general.html][6]), part of the OpenOffice.org project.
|
||||
|
||||
### SYLK
|
||||
|
||||
@ -29,7 +29,7 @@ This is the Microsoft Multiplan Symbolic Link Interchange (SYLK) file format. Mu
|
||||
|
||||
### Gnumeric
|
||||
|
||||
The Gnumeric file format is used by the Gnome Gnumeric spreadsheet application, and typically files have an extension of .gnumeric. The file contents are stored using eXtensible Markup Language (XML) markup, and the file is then compressed using the GNU project's gzip compression library. [http://projects.gnome.org/gnumeric/doc/file-format-gnumeric.shtml][7]
|
||||
The Gnumeric file format is used by the Gnome Gnumeric spreadsheet application, and typically files have an extension of .gnumeric. The file contents are stored using eXtensible Markup Language (XML) markup, and the file is then compressed using the GNU project's gzip compression library. [https://projects.gnome.org/gnumeric/doc/file-format-gnumeric.shtml][7]
|
||||
|
||||
### CSV
|
||||
|
||||
@ -51,10 +51,10 @@ HyperText Markup Language (HTML) is the main markup language for creating web pa
|
||||
|
||||
|
||||
|
||||
[1]: http://msdn.microsoft.com/en-us/library/cc313154(v=office.12).aspx
|
||||
[2]: http://download.microsoft.com/download/2/4/8/24862317-78F0-4C4B-B355-C7B2C1D997DB/%5bMS-XLS%5d.pdf
|
||||
[3]: http://msdn.microsoft.com/en-us/library/aa140066%28office.10%29.aspx
|
||||
[4]: http://www.ecma-international.org/news/TC45_current_work/TC45_available_docs.htm
|
||||
[5]: http://www.oasis-open.org/committees/tc_home.php?wg_abbrev=office
|
||||
[6]: http://xml.openoffice.org/general.html
|
||||
[7]: http://projects.gnome.org/gnumeric/doc/file-format-gnumeric.shtml
|
||||
[1]: https://msdn.microsoft.com/en-us/library/cc313154(v=office.12).aspx
|
||||
[2]: https://download.microsoft.com/download/2/4/8/24862317-78F0-4C4B-B355-C7B2C1D997DB/%5bMS-XLS%5d.pdf
|
||||
[3]: https://msdn.microsoft.com/en-us/library/aa140066%28office.10%29.aspx
|
||||
[4]: https://www.ecma-international.org/news/TC45_current_work/TC45_available_docs.htm
|
||||
[5]: https://www.oasis-open.org/committees/tc_home.php?wg_abbrev=office
|
||||
[6]: https://xml.openoffice.org/general.html
|
||||
[7]: https://projects.gnome.org/gnumeric/doc/file-format-gnumeric.shtml
|
||||
|
||||
@ -3,7 +3,7 @@
|
||||
|
||||
## Security
|
||||
|
||||
XML-based formats such as OfficeOpen XML, Excel2003 XML, OASIS and Gnumeric are susceptible to XML External Entity Processing (XXE) injection attacks (for an explanation of XXE injection see http://websec.io/2012/08/27/Preventing-XEE-in-PHP.html) when reading spreadsheet files. This can lead to:
|
||||
XML-based formats such as OfficeOpen XML, Excel2003 XML, OASIS and Gnumeric are susceptible to XML External Entity Processing (XXE) injection attacks (for an explanation of XXE injection see https://websec.io/2012/08/27/Preventing-XEE-in-PHP.html) when reading spreadsheet files. This can lead to:
|
||||
|
||||
- Disclosure whether a file is existent
|
||||
- Server Side Request Forgery
|
||||
|
||||
@ -363,7 +363,7 @@ CSV | YES | HTML | NO
|
||||
|
||||
### A Brief Word about the Advanced Value Binder
|
||||
|
||||
When loading data from a file that contains no formatting information, such as a CSV file, then data is read either as strings or numbers (float or integer). This means that PHPExcel does not automatically recognise dates/times (such as "16-Apr-2009" or "13:30"), booleans ("TRUE" or "FALSE"), percentages ("75%"), hyperlinks ("http://www.phpexcel.net"), etc as anything other than simple strings. However, you can apply additional processing that is executed against these values during the load process within a Value Binder.
|
||||
When loading data from a file that contains no formatting information, such as a CSV file, then data is read either as strings or numbers (float or integer). This means that PHPExcel does not automatically recognise dates/times (such as "16-Apr-2009" or "13:30"), booleans ("TRUE" or "FALSE"), percentages ("75%"), hyperlinks ("https://www.phpexcel.net"), etc as anything other than simple strings. However, you can apply additional processing that is executed against these values during the load process within a Value Binder.
|
||||
|
||||
A Value Binder is a class that implement the PHPExcel_Cell_IValueBinder interface. It must contain a bindValue() method that accepts a PHPExcel_Cell and a value as arguments, and return a boolean true or false that indicates whether the workbook cell has been populated with the value or not. The Advanced Value Binder implements such a class: amongst other tests, it identifies a string comprising "TRUE" or "FALSE" (based on locale settings) and sets it to a boolean; or a number in scientific format (e.g. "1.234e-5") and converts it to a float; or dates and times, converting them to their Excel timestamp value – before storing the value in the cell object. It also sets formatting for strings that are identified as dates, times or percentages. It could easily be extended to provide additional handling (including text or cell formatting) when it encountered a hyperlink, or HTML markup within a CSV file.
|
||||
|
||||
|
||||
Reference in New Issue
Block a user