diff --git a/modules/Vtiger/actions/SaveAjax.php b/modules/Vtiger/actions/SaveAjax.php index 3473c929fe5a5783dc27cff9aeac2e20f2a38396..e8a8618d8cd34ecfa804945a49f2ebea04d4fc8a 100644 --- a/modules/Vtiger/actions/SaveAjax.php +++ b/modules/Vtiger/actions/SaveAjax.php @@ -106,12 +106,7 @@ class Vtiger_SaveAjax_Action extends Vtiger_Save_Action { if ($fieldDataType == 'time' && $fieldValue !== null) { $fieldValue = Vtiger_Time_UIType::getTimeValueWithSeconds($fieldValue); } - $ckeditorFields = array('commentcontent', 'notecontent', 'signature'); - if((in_array($fieldName, $ckeditorFields)) && $fieldValue !== null){ - $purifiedContent = vtlib_purify(decode_html($fieldValue)); - // Purify malicious html event attributes - $fieldValue = purifyHtmlEventAttributes(decode_html($purifiedContent),true); - } + $fieldValue = $this->purifyCkeditorField($fieldName, $fieldValue); if ($fieldValue !== null) { if (!is_array($fieldValue)) { $fieldValue = trim($fieldValue); @@ -144,12 +139,7 @@ class Vtiger_SaveAjax_Action extends Vtiger_Save_Action { if ($fieldDataType == 'time' && $fieldValue !== null) { $fieldValue = Vtiger_Time_UIType::getTimeValueWithSeconds($fieldValue); } - $ckeditorFields = array('commentcontent', 'notecontent', 'signature'); - if((in_array($fieldName, $ckeditorFields)) && $fieldValue !== null){ - $purifiedContent = vtlib_purify(decode_html($fieldValue)); - // Purify malicious html event attributes - $fieldValue = purifyHtmlEventAttributes(decode_html($purifiedContent),true); - } + $fieldValue = $this->purifyCkeditorField($fieldName, $fieldValue); if ($fieldValue !== null) { if (!is_array($fieldValue)) { $fieldValue = trim($fieldValue); @@ -161,4 +151,14 @@ class Vtiger_SaveAjax_Action extends Vtiger_Save_Action { return $recordModel; } + + public function purifyCkeditorField($fieldName, $fieldValue) { + $ckeditorFields = array('commentcontent', 'notecontent', 'signature'); + if((in_array($fieldName, $ckeditorFields)) && $fieldValue !== null){ + $purifiedContent = vtlib_purify(decode_html($fieldValue)); + // Purify malicious html event attributes + $fieldValue = purifyHtmlEventAttributes(decode_html($purifiedContent),true); + } + return $fieldValue; + } }