From e4be0eb7e849ea9d132a2bcf1a4ee5087db8bf75 Mon Sep 17 00:00:00 2001
From: Dries Buytaert <dries@buytaert.net>
Date: Thu, 1 Jul 2010 19:41:18 +0000
Subject: - Patch #327331 by mr.baileys, wrwrwr: fix filter_xss() to not allow
 empty style/on* attributes at end of opening tag.

---
 includes/common.inc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'includes')

diff --git a/includes/common.inc b/includes/common.inc
index fdd5f64d6..3cd3fa149 100644
--- a/includes/common.inc
+++ b/includes/common.inc
@@ -1441,7 +1441,7 @@ function _filter_xss_attributes($attr) {
   }
 
   // The attribute list ends with a valueless attribute like "selected".
-  if ($mode == 1) {
+  if ($mode == 1 && !$skip) {
     $attrarr[] = $attrname;
   }
   return $attrarr;
-- 
cgit v1.2.3