Changeset 594

Timestamp:

12/09/2003 02:39:30 PM (21 years ago)

Author:

emc3

Message:

Fixed XSS vulnerability in comments

File:

• trunk/b2-include/b2functions.php (modified) (1 diff)

trunk/b2-include/b2functions.php

@@ -1208 +1208 @@
  **/
 function sanitise_html_attributes($text) {
-    $text = preg_replace('#( on[a-z]{1,}|style|class|id)="(.*?)"#i', '', $text);
-    $text = preg_replace('#( on[a-z]{1,}|style|class|id)=\'(.*?)\'#i', '', $text);
-    $text = preg_replace('#( on[a-z]{1,}|style|class|id)[ \t]*=[ \t]*([^ \t\>]*?)#i', '', $text);
+    $text = preg_replace('#(([\s"\'])on[a-z]{1,}|style|class|id)="(.*?)"#i', '$1', $text);
+    $text = preg_replace('#(([\s"\'])on[a-z]{1,}|style|class|id)=\'(.*?)\'#i', '$1', $text);
+    $text = preg_replace('#(([\s"\'])on[a-z]{1,}|style|class|id)[ \t]*=[ \t]*([^ \t\>]*?)#i', '$1', $text);
     $text = preg_replace('#([a-z]{1,})="(( |\t)*?)(javascript|vbscript|about):(.*?)"#i', '$1=""', $text);
     $text = preg_replace('#([a-z]{1,})=\'(( |\t)*?)(javascript|vbscript|about):(.*?)\'#i', '$1=""', $text);