diff options
| author | Steven Wittens <steven@10.no-reply.drupal.org> | 2005-12-28 18:43:42 +0000 |
|---|---|---|
| committer | Steven Wittens <steven@10.no-reply.drupal.org> | 2005-12-28 18:43:42 +0000 |
| commit | afd8ccaf7e64aad714702d1246569088ed2c893d (patch) | |
| tree | e8ec470437c0475e4e71f610321d14b54c4c47ce | |
| parent | 7445e8e8545e3165113fceb335977584db1913e2 (diff) | |
| download | brdo-afd8ccaf7e64aad714702d1246569088ed2c893d.tar.gz brdo-afd8ccaf7e64aad714702d1246569088ed2c893d.tar.bz2 | |
- #27230: Fix XHTML slash in XSS filter
| -rw-r--r-- | modules/filter.module | 5 | ||||
| -rw-r--r-- | modules/filter/filter.module | 5 |
2 files changed, 6 insertions, 4 deletions
diff --git a/modules/filter.module b/modules/filter.module index b81039879..2aa7398fe 100644 --- a/modules/filter.module +++ b/modules/filter.module @@ -1134,13 +1134,14 @@ function _filter_xss_split($m, $store = FALSE) { return "</$elem>"; } // Is there a closing XHTML slash at the end of the attributes? - $xhtml_slash = preg_match('%\s/\s*$%', $attr) ? '/' : ''; + $xhtml_slash = preg_match('%\s?/\s*$%', $attrlist) ? ' /' : ''; // Clean up attributes $attr2 = implode(' ', _filter_xss_attributes($attrlist)); $attr2 = preg_replace('/[<>]/', '', $attr2); + $attr2 = strlen($attr2) ? ' '. $attr2 : ''; - return "<$elem $attr2$xhtml_slash>"; + return "<$elem$attr2$xhtml_slash>"; } /** diff --git a/modules/filter/filter.module b/modules/filter/filter.module index b81039879..2aa7398fe 100644 --- a/modules/filter/filter.module +++ b/modules/filter/filter.module @@ -1134,13 +1134,14 @@ function _filter_xss_split($m, $store = FALSE) { return "</$elem>"; } // Is there a closing XHTML slash at the end of the attributes? - $xhtml_slash = preg_match('%\s/\s*$%', $attr) ? '/' : ''; + $xhtml_slash = preg_match('%\s?/\s*$%', $attrlist) ? ' /' : ''; // Clean up attributes $attr2 = implode(' ', _filter_xss_attributes($attrlist)); $attr2 = preg_replace('/[<>]/', '', $attr2); + $attr2 = strlen($attr2) ? ' '. $attr2 : ''; - return "<$elem $attr2$xhtml_slash>"; + return "<$elem$attr2$xhtml_slash>"; } /** |