diff --git a/include/utils/VtlibUtils.php b/include/utils/VtlibUtils.php index d2ee7d15c715283859ea7ae1705334cf91089468..1094542ae70fc82f32797ab0a31ea7dc3d8491e6 100644 --- a/include/utils/VtlibUtils.php +++ b/include/utils/VtlibUtils.php @@ -698,10 +698,6 @@ function vtlib_purify($input, $ignore=false) { } } else { // Simple type $value = $__htmlpurifier_instance->purify($input); - global $log; - $log->fatal('else loop call to purifyHtmlEventAttributes'); - $log->fatal('$value passed => '); - $log->fatal($value); $value = purifyHtmlEventAttributes($value); } } @@ -725,23 +721,14 @@ function purifyHtmlEventAttributes($value,$replaceAll = false){ "onselectionchange|onabort|onselectstart|onstart|onfinish|onloadstart|onshow"; // remove malicious html attributes with its value. - global $log; - $log->fatal('$replaceAll value is => '); - $log->fatal($replaceAll); - $log->fatal('$value => '); - $log->fatal($value); if ($replaceAll) { - $log->fatal('if loop'); $regex = '\s*(=|=|=|=|=)\s*(?:"[^"]*"[\'"]*|\'[^\']*\'[\'"]*|[^]*[\s\/>])*/i'; $value = preg_replace("/\s*(" . $htmlEventAttributes . ")" . $regex, '', $value); } else { - $log->fatal('else loop'); if (preg_match("/\s*(" . $htmlEventAttributes . ")\s*(=|=|=|=|=)/i", $value)) { $value = str_replace("=", "=", $value); } } - $log->fatal('Final value => '); - $log->fatal($value); return $value; } diff --git a/modules/Vtiger/actions/SaveAjax.php b/modules/Vtiger/actions/SaveAjax.php index ca95ff928a7933de0ebe1c44912f79292291c82b..3473c929fe5a5783dc27cff9aeac2e20f2a38396 100644 --- a/modules/Vtiger/actions/SaveAjax.php +++ b/modules/Vtiger/actions/SaveAjax.php @@ -144,7 +144,8 @@ class Vtiger_SaveAjax_Action extends Vtiger_Save_Action { if ($fieldDataType == 'time' && $fieldValue !== null) { $fieldValue = Vtiger_Time_UIType::getTimeValueWithSeconds($fieldValue); } - if($fieldName == 'notecontent' && $fieldValue !== null){ + $ckeditorFields = array('commentcontent', 'notecontent', 'signature'); + if((in_array($fieldName, $ckeditorFields)) && $fieldValue !== null){ $purifiedContent = vtlib_purify(decode_html($fieldValue)); // Purify malicious html event attributes $fieldValue = purifyHtmlEventAttributes(decode_html($purifiedContent),true);