diff --git a/include/utils/VtlibUtils.php b/include/utils/VtlibUtils.php index bc2233942ef6c127cdcd59588cac13129aa79297..9d8122d193749b57b48f786ae1ce579ec1fa6b26 100644 --- a/include/utils/VtlibUtils.php +++ b/include/utils/VtlibUtils.php @@ -807,11 +807,11 @@ function purifyJavascriptAlert($value){ // skip javascript: contents check if tag is not available,as javascript: regex will cause performace issue if the contents will be large if (preg_match_all('/(&.*?lt;|<)'.$tag.'[^>]*?(>|&.*?gt;)/i', $value,$matches)) { - $javaScriptRegex = '/(&.*?lt;|<).?'.$tag.' [^>]*(j[\s]?a[\s]?v[\s]?a[\s]?s[\s]?c[\s]?r[\s]?i[\s]?p[\s]?t[\s]*[=&%#:])[^>]*?(>|&.*?gt;)/i'; + $javaScriptRegex = '/(&.*?lt;|<).?'.$tag.'[^>]*(j[\s]?a[\s]?v[\s]?a[\s]?s[\s]?c[\s]?r[\s]?i[\s]?p[\s]?t[\s]*[=&%#:])[^>]*?(>|&.*?gt;)/i'; foreach($matches[0] as $matchedValue){ //strict check addded - if &tab;/&newLine added in the above tags we are replacing it to spaces. - $purifyContent = preg_replace('/
|&NewLine;|	|&Tab;|\t/i',' ',$matchedValue); - $purifyContent = preg_replace($javaScriptRegex,"<$tag>",$purifyContent); + $purifyContent = preg_replace('/
|&NewLine;|	|&Tab;|\t/i',' ',$purifyContent); + $purifyContent = preg_replace($javaScriptRegex,"<$tag>",decode_html($matchedValue)); $value = str_replace($matchedValue, $purifyContent, $value); /*