Fixes #1220 XSS vulnerability on ckeditor fields is addressed

include/utils/VtlibUtils.php

@@ -722,10 +722,11 @@ function purifyHtmlEventAttributes($value,$replaceAll = false){
// remove malicious html attributes with its value.
if ($replaceAll) {
-        $regex = '\s*=\s*(?:"[^"]*"[\'"]*|\'[^\']*\'[\'"]*|[^]*[\s\/>])*/i';
+        //Handled to address multiple html entity encoding for '=' character
+        $regex = '\s*(=|=|=|=|=)\s*(?:"[^"]*"[\'"]*|\'[^\']*\'[\'"]*|[^]*[\s\/>])*/i';
$value = preg_replace("/\s*(" . $htmlEventAttributes . ")" . $regex, '', $value);
} else {
-        if (preg_match("/\s*(" . $htmlEventAttributes . ")\s*=/i", $value)) {
+        if (preg_match("/\s*(" . $htmlEventAttributes . ")\s*(=|=|=|=|=)/i", $value)) {
$value = str_replace("=", "=", $value);
}
}