L-electron-Rare/moodle
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

An improvemement, I think, in the way Javascript is stripped in clean_text

Browse Source
This commit is contained in:
moodler
2004-03-28 06:31:27 +00:00
parent dc24657f07
commit 09cbeb40a2
1 changed files with 5 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
lib/weblib.php
+5 -5
View File
@@ -666,13 +666,13 @@ function clean_text($text, $format=FORMAT_MOODLE) {
case FORMAT_MOODLE:
case FORMAT_HTML:
case FORMAT_WIKI:
/// Remove javascript: label
/// Remove tags that are not allowed
$text = strip_tags($text, $ALLOWED_TAGS);
/// Remove javascript/VBScript
$text = str_ireplace("javascript:", "xxx", $text);
/// Munge javascript: label
$text = str_ireplace("javascript:", "Xjavascript:", $text);
/// Remove script events
$text = eregi_replace("([^a-z])language([[:space:]]*)=", "xxx", $text);
$text = eregi_replace("([^a-z])on([a-z]+)([[:space:]]*)=", "xxx", $text);
$text = eregi_replace("([^a-z])language([[:space:]]*)=", "\\1Xlanguage=", $text);
$text = eregi_replace("([^a-z])on([a-z]+)([[:space:]]*)=", "\\1Xon\\2=", $text);
return $text;
case FORMAT_PLAIN: