Bump to 1.5alpha2

[lhc/web/wiklou.git] / includes / Sanitizer.php

diff --git a/includes/Sanitizer.php b/includes/Sanitizer.php
index 40016d9..9f05ed8 100644 (file)
--- a/includes/Sanitizer.php
+++ b/includes/Sanitizer.php
@@ -539,6 +539,20 @@ class Sanitizer {
                                continue;
                        }
                        
+                       # Templates and links may be expanded in later parsing,
+                       # creating invalid or dangerous output. Suppress this.
+                       $value = strtr( $value, array(
+                               '{'    => '{',
+                               '['    => '[',
+                               "''"   => '''',
+                               'ISBN' => 'ISBN',
+                               'RFC'  => 'RFC',
+                               'PMID' => 'PMID',
+                       ) );
+                       $value = preg_replace(
+                               '/(' . URL_PROTOCOLS . '):/',
+                               '\\1:', $value );
+                       
                        if( !isset( $attribs[$attribute] ) ) {
                                $attribs[$attribute] = "$attribute=\"$value\"";
                        }