diff options
Diffstat (limited to 'includes')
| -rw-r--r-- | includes/common.inc | 13 |
1 files changed, 12 insertions, 1 deletions
diff --git a/includes/common.inc b/includes/common.inc index 79a3fc6fa..a70d26e93 100644 --- a/includes/common.inc +++ b/includes/common.inc @@ -1355,6 +1355,8 @@ function filter_xss($string, $allowed_tags = array('a', 'em', 'strong', 'cite', ( <(?=[^a-zA-Z!/]) # a lone < | # or + <!--.*?--> # a comment + | # or <[^>]*(>|$) # a string that starts with a <, up until the > or the end of the string | # or > # just a > @@ -1393,7 +1395,7 @@ function _filter_xss_split($m, $store = FALSE) { return '<'; } - if (!preg_match('%^<\s*(/\s*)?([a-zA-Z0-9]+)([^>]*)>?$%', $string, $matches)) { + if (!preg_match('%^<\s*(/\s*)?([a-zA-Z0-9]+)([^>]*)>?|(<!--.*?-->)$%', $string, $matches)) { // Seriously malformed return ''; } @@ -1401,12 +1403,21 @@ function _filter_xss_split($m, $store = FALSE) { $slash = trim($matches[1]); $elem = &$matches[2]; $attrlist = &$matches[3]; + $comment = &$matches[4]; + + if ($comment) { + $elem = '!--'; + } if (!isset($allowed_html[strtolower($elem)])) { // Disallowed HTML element return ''; } + if ($comment) { + return $comment; + } + if ($slash != '') { return "</$elem>"; } |