Fixes #1220 XSS vulnerability on ckeditor fields is addressed

modules/Vtiger/actions/SaveAjax.php

@@ -106,12 +106,7 @@ class Vtiger_SaveAjax_Action extends Vtiger_Save_Action {
 				if ($fieldDataType == 'time' && $fieldValue !== null) {
 					$fieldValue = Vtiger_Time_UIType::getTimeValueWithSeconds($fieldValue);
 				}
-                $ckeditorFields = array('commentcontent', 'notecontent', 'signature');
-                if((in_array($fieldName, $ckeditorFields)) && $fieldValue !== null){
-                    $purifiedContent = vtlib_purify(decode_html($fieldValue));
-                    // Purify malicious html event attributes
-                    $fieldValue = purifyHtmlEventAttributes(decode_html($purifiedContent),true);
-                }
+                $fieldValue = $this->purifyCkeditorField($fieldName, $fieldValue);
 				if ($fieldValue !== null) {
 					if (!is_array($fieldValue)) {
 						$fieldValue = trim($fieldValue);
@@ -144,12 +139,7 @@ class Vtiger_SaveAjax_Action extends Vtiger_Save_Action {
 				if ($fieldDataType == 'time' && $fieldValue !== null) {
 					$fieldValue = Vtiger_Time_UIType::getTimeValueWithSeconds($fieldValue);
 				}
-                $ckeditorFields = array('commentcontent', 'notecontent', 'signature');
-                if((in_array($fieldName, $ckeditorFields)) && $fieldValue !== null){
-                    $purifiedContent = vtlib_purify(decode_html($fieldValue));
-                    // Purify malicious html event attributes
-                    $fieldValue = purifyHtmlEventAttributes(decode_html($purifiedContent),true);
-                }
+                $fieldValue = $this->purifyCkeditorField($fieldName, $fieldValue);
 				if ($fieldValue !== null) {
 					if (!is_array($fieldValue)) {
 						$fieldValue = trim($fieldValue);
@@ -161,4 +151,14 @@ class Vtiger_SaveAjax_Action extends Vtiger_Save_Action {
 
 		return $recordModel;
 	}
+    
+    public function purifyCkeditorField($fieldName, $fieldValue) {
+        $ckeditorFields = array('commentcontent', 'notecontent', 'signature');
+        if((in_array($fieldName, $ckeditorFields)) && $fieldValue !== null){
+            $purifiedContent = vtlib_purify(decode_html($fieldValue));
+            // Purify malicious html event attributes
+            $fieldValue = purifyHtmlEventAttributes(decode_html($purifiedContent),true);
+        }
+        return $fieldValue;
+    }
 }