From a56f343767d26405fe04f4c5864020318827a870 Mon Sep 17 00:00:00 2001 From: Magnus Manske Date: Wed, 4 Aug 2004 20:56:46 +0000 Subject: [PATCH] This should fix bug 980557 --- includes/Parser.php | 3 +++ 1 file changed, 3 insertions(+) diff --git a/includes/Parser.php b/includes/Parser.php index f6b1b270f1..70fe988beb 100644 --- a/includes/Parser.php +++ b/includes/Parser.php @@ -642,6 +642,9 @@ class Parser '/(\\w+)(\\s*=\\s*([^\\s\">]+|\"[^\">]*\"))?/e', "(in_array(strtolower(\"\$1\"),\$htmlattrs)?(\"\$1\".((\"x\$3\" != \"x\")?\"=\$3\":'')):'')", $t); + + $t = str_replace ( "<>" , "" , $t ) ; # This should fix bug 980557 + # Strip javascript "expression" from stylesheets. Brute force approach: # If anythin offensive is found, all attributes of the HTML tag are dropped -- 2.20.1