MDL-2684: kses strips out CSS from style tags unless the first property is on 'allowed' list, this is silly

2009-12-02 17:59:12 +00:00
parent e7062765e0
commit d5f4161c2c
1 changed files with 6 additions and 1 deletions
@@ -243,7 +243,12 @@ function kses_hair($attr, $allowed_protocols)
        if (preg_match('/^"([^"]*)"(\s+|$)/', $attr, $match))
         # "value"
        {
-          $thisval = kses_bad_protocol($match[1], $allowed_protocols);
+          // MDL-2684 - kses stripping CSS styles that it thinks look like protocols
+          if ($attrname == 'style') {
+              $thisval = $match[1];
+          } else {
+              $thisval = kses_bad_protocol($match[1], $allowed_protocols);
+          }

          $attrarr[] = array
                        ('name'  => $attrname,