From: Magnus Manske Date: Wed, 4 Aug 2004 20:56:46 +0000 (+0000) Subject: This should fix bug 980557 X-Git-Tag: 1.5.0alpha1~2516 X-Git-Url: https://git.cyclocoop.org/%7B%7B%20url_for%28%27votes%27%2C%20votes=%27waiting%27%29%20%7D%7D?a=commitdiff_plain;h=a56f343767d26405fe04f4c5864020318827a870;p=lhc%2Fweb%2Fwiklou.git This should fix bug 980557 --- diff --git a/includes/Parser.php b/includes/Parser.php index f6b1b270f1..70fe988beb 100644 --- a/includes/Parser.php +++ b/includes/Parser.php @@ -642,6 +642,9 @@ class Parser '/(\\w+)(\\s*=\\s*([^\\s\">]+|\"[^\">]*\"))?/e', "(in_array(strtolower(\"\$1\"),\$htmlattrs)?(\"\$1\".((\"x\$3\" != \"x\")?\"=\$3\":'')):'')", $t); + + $t = str_replace ( "<>" , "" , $t ) ; # This should fix bug 980557 + # Strip javascript "expression" from stylesheets. Brute force approach: # If anythin offensive is found, all attributes of the HTML tag are dropped