diff --git a/modules/node.module b/modules/node.module index e9bdb3d1757fbecfbafb3ed7eec7a43967a6ecbd..9aaf8a0e3282b44705398c0a3876b8e4f0dbf7a5 100644 --- a/modules/node.module +++ b/modules/node.module @@ -300,8 +300,6 @@ function node_conf_filters() { } function node_filter_html($text) { - $text = eregi_replace("([ \f\r\t\n\'\"])style=[^>]+>", "\\1", $text); - $text = eregi_replace("([ \f\r\t\n\'\"])on[a-z]+=[^>]+>", "\\1", $text); $text = strip_tags($text, variable_get("allowed_html", "")); return $text; } @@ -370,6 +368,11 @@ function node_comment_mode($nid) { } function node_filter($text) { + $text = preg_replace("/\Wstyle\s*=[^>]+?>/i", ">", $text); + $text = preg_replace("/\Won[a-z]+\s*=[^>]+?>/i", ">", $text); + $text = preg_replace("/\Wsrc\s*=[\s'\"]*javascript[^>]+?>/i", ">", $text); + $text = preg_replace("/\Whref\s*=[\s'\"]*javascript:[^>]+?>/i", ">", $text); + if (variable_get("filter_html", 0)) $text = node_filter_html($text); if (variable_get("filter_link", 0)) $text = node_filter_link($text); return node_filter_line($text); diff --git a/modules/node/node.module b/modules/node/node.module index e9bdb3d1757fbecfbafb3ed7eec7a43967a6ecbd..9aaf8a0e3282b44705398c0a3876b8e4f0dbf7a5 100644 --- a/modules/node/node.module +++ b/modules/node/node.module @@ -300,8 +300,6 @@ function node_conf_filters() { } function node_filter_html($text) { - $text = eregi_replace("([ \f\r\t\n\'\"])style=[^>]+>", "\\1", $text); - $text = eregi_replace("([ \f\r\t\n\'\"])on[a-z]+=[^>]+>", "\\1", $text); $text = strip_tags($text, variable_get("allowed_html", "")); return $text; } @@ -370,6 +368,11 @@ function node_comment_mode($nid) { } function node_filter($text) { + $text = preg_replace("/\Wstyle\s*=[^>]+?>/i", ">", $text); + $text = preg_replace("/\Won[a-z]+\s*=[^>]+?>/i", ">", $text); + $text = preg_replace("/\Wsrc\s*=[\s'\"]*javascript[^>]+?>/i", ">", $text); + $text = preg_replace("/\Whref\s*=[\s'\"]*javascript:[^>]+?>/i", ">", $text); + if (variable_get("filter_html", 0)) $text = node_filter_html($text); if (variable_get("filter_link", 0)) $text = node_filter_link($text); return node_filter_line($text);