From ff5b9ac4cff1e21d8a8e4152424e71e9c8b8de59 Mon Sep 17 00:00:00 2001
From: prasad <prasad@vtiger.com>
Date: Thu, 16 Jun 2016 15:36:28 +0530
Subject: [PATCH] Tightened attribute check to cleanup.

---
 include/utils/VtlibUtils.php | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/include/utils/VtlibUtils.php b/include/utils/VtlibUtils.php
index 57852c7b..e44c1c66 100644
--- a/include/utils/VtlibUtils.php
+++ b/include/utils/VtlibUtils.php
@@ -667,8 +667,9 @@ function purifyHtmlEventAttributes($value){
                         "onreset|onsearch|onselect|onsubmit|onkeydown|onkeypress|onkeyup|".
                         "onclick|ondblclick|ondrag|ondragend|ondragenter|ondragleave|ondragover|".
                         "ondragstart|ondrop|onmousedown|onmousemove|onmouseout|onmouseover|".
-                        "onmouseup|onmousewheel|onscroll|onwheel|oncopy|oncut|onpaste";
-    if(preg_match("/\s(".$htmlEventAttributes.")\s*=/i", $value)) {
+						"onmouseup|onmousewheel|onscroll|onwheel|oncopy|oncut|onpaste|onload|".
+						"onselectionchange|onabort|onselectstart";
+    if(preg_match("/\s*(".$htmlEventAttributes.")\s*=/i", $value)) {
         $value = str_replace("=", "&equals;", $value);
     }
     return $value;
-- 
GitLab