diff --git a/main/inc/lib/kses-0.2.2/kses.php b/main/inc/lib/kses-0.2.2/kses.php index 17b18fc6bc..671af327ea 100755 --- a/main/inc/lib/kses-0.2.2/kses.php +++ b/main/inc/lib/kses-0.2.2/kses.php @@ -213,6 +213,19 @@ function kses_attr($element, $attr, $allowed_html, $allowed_protocols) $currkey, $currval)) { $ok = false; break; } + if ( strtolower($arreach['name']) == 'style' ) { + $orig_value = $arreach['value']; + + $value = kses_safecss_filter_attr($orig_value); + + if ( empty($value) ) + continue; + + $arreach['value'] = $value; + + $arreach['whole'] = str_replace($orig_value, $value, $arreach['whole']); + } + if ($ok) $attr2 .= ' '.$arreach['whole']; // it passed them } // if !is_array($current) @@ -645,4 +658,53 @@ function kses_decode_entities($string) return $string; } -?> +/** + * Inline CSS filter + * + */ +function kses_safecss_filter_attr( $css ) { + + $css = kses_no_null($css); + $css = str_replace(array("\n","\r","\t"), '', $css); + + if ( preg_match( '%[\\(&=}]|/\*%', $css ) ) // remove any inline css containing \ ( & } = or comments + return ''; + + $css_array = explode( ';', trim( $css ) ); + $allowed_attr = array( 'text-align', 'margin', 'color', 'float', + 'border', 'background', 'background-color', 'border-bottom', 'border-bottom-color', + 'border-bottom-style', 'border-bottom-width', 'border-collapse', 'border-color', 'border-left', + 'border-left-color', 'border-left-style', 'border-left-width', 'border-right', 'border-right-color', + 'border-right-style', 'border-right-width', 'border-spacing', 'border-style', 'border-top', + 'border-top-color', 'border-top-style', 'border-top-width', 'border-width', 'caption-side', + 'clear', 'cursor', 'direction', 'display', 'font', 'font-family', 'font-size', 'font-style', + 'font-variant', 'font-weight', 'height', 'letter-spacing', 'line-height', 'margin-bottom', + 'margin-left', 'margin-right', 'margin-top', 'overflow', 'padding', 'padding-bottom', + 'padding-left', 'padding-right', 'padding-top', 'text-decoration', 'text-indent', 'vertical-align', + 'width' ); + + if ( empty($allowed_attr) ) + return $css; + + $css = ''; + foreach ( $css_array as $css_item ) { + if ( $css_item == '' ) + continue; + $css_item = trim( $css_item ); + $found = false; + if ( strpos( $css_item, ':' ) === false ) { + $found = true; + } else { + $parts = split( ':', $css_item ); + if ( in_array( strtolower( trim( $parts[0] ) ), $allowed_attr ) ) + $found = true; + } + if ( $found ) { + if( $css != '' ) + $css .= ';'; + $css .= $css_item; + } + } + + return $css; +}