MDL-22537 new html purifier

2010-05-21 10:40:56 +00:00
parent d7be65a3d5
commit 7ff7f704d1
27 changed files with 330 additions and 36 deletions
@@ -37,8 +37,14 @@ class HTMLPurifier_AttrTransform_SafeParam extends HTMLPurifier_AttrTransform
                $attr['value'] = 'window';
                break;
            case 'movie':
+            case 'src':
+                $attr['name'] = "movie";
                $attr['value'] = $this->uri->validate($attr['value'], $config, $context);
                break;
+            case 'flashvars':
+                // we're going to allow arbitrary inputs to the SWF, on
+                // the reasoning that it could only hack the SWF, not us.
+                break;
            // add other cases to support other param name/value pairs
            default:
                $attr['name'] = $attr['value'] = null;