diff --git a/include/utils/VtlibUtils.php b/include/utils/VtlibUtils.php index 1094542ae70fc82f32797ab0a31ea7dc3d8491e6..3f776980812190b3be4223484af6994b9fc0138a 100644 --- a/include/utils/VtlibUtils.php +++ b/include/utils/VtlibUtils.php @@ -722,6 +722,7 @@ function purifyHtmlEventAttributes($value,$replaceAll = false){ // remove malicious html attributes with its value. if ($replaceAll) { + //Handled to address multiple html entity encoding for '=' character $regex = '\s*(=|=|=|=|=)\s*(?:"[^"]*"[\'"]*|\'[^\']*\'[\'"]*|[^]*[\s\/>])*/i'; $value = preg_replace("/\s*(" . $htmlEventAttributes . ")" . $regex, '', $value); } else {