diff --git a/include/utils/VtlibUtils.php b/include/utils/VtlibUtils.php index 57852c7b8120d1e55b178771f301839d28c0c80d..e44c1c66de4e0731b16c3ccf2eb24bbbefedf270 100644 --- a/include/utils/VtlibUtils.php +++ b/include/utils/VtlibUtils.php @@ -667,8 +667,9 @@ function purifyHtmlEventAttributes($value){ "onreset|onsearch|onselect|onsubmit|onkeydown|onkeypress|onkeyup|". "onclick|ondblclick|ondrag|ondragend|ondragenter|ondragleave|ondragover|". "ondragstart|ondrop|onmousedown|onmousemove|onmouseout|onmouseover|". - "onmouseup|onmousewheel|onscroll|onwheel|oncopy|oncut|onpaste"; - if(preg_match("/\s(".$htmlEventAttributes.")\s*=/i", $value)) { + "onmouseup|onmousewheel|onscroll|onwheel|oncopy|oncut|onpaste|onload|". + "onselectionchange|onabort|onselectstart"; + if(preg_match("/\s*(".$htmlEventAttributes.")\s*=/i", $value)) { $value = str_replace("=", "=", $value); } return $value;