Changeset 1866 in ExiteCMS for trunk/includes/core_functions.php

Timestamp:

10/18/08 10:52:43 (4 years ago)

Author:

hverton

Message:

updated the xss_clean() filtered text

File:

• trunk/includes/core_functions.php (modified) (3 diffs)

trunk/includes/core_functions.php

@@ -764 +764 @@
     if (!isset($never_allowed_str)) {
         $never_allowed_str = array(
-            'document.cookie'   => '[removed]',
-            'document.write'    => '[removed]',
-            '.parentNode'       => '[removed]',
-            '.innerHTML'        => '[removed]',
-            'window.location'   => '[removed]',
-            '-moz-binding'      => '[removed]',
+            'document.cookie'   => '[--XSS--]',
+            'document.write'    => '[--XSS--]',
+            '.parentNode'       => '[--XSS--]',
+            '.innerHTML'        => '[--XSS--]',
+            'window.location'   => '[--XSS--]',
+            '-moz-binding'      => '[--XSS--]',
             '<!--'              => '&lt;!--',
             '-->'               => '--&gt;',
@@ -779 +779 @@
     if (!isset($never_allowed_regex)) {
         $never_allowed_regex = array(
-            "javascript\s*:"    => '[removed]',
-            "expression\s*\("   => '[removed]', // CSS and IE
-            "Redirect\s+302"    => '[removed]'
+            "javascript\s*:"    => '[--XSS--]',
+            "expression\s*\("   => '[--XSS--]', // CSS and IE
+            "Redirect\s+302"    => '[--XSS--]'
         );
     }
@@ -876 +876 @@
         }
         if (preg_match("/script/i", $str) OR preg_match("/xss/i", $str)) {
-            $str = preg_replace("#<(/*)(script|xss)(.*?)\>#si", '[removed]', $str);
+            $str = preg_replace("#<(/*)(script|xss)(.*?)\>#si", '[--XSS--]', $str);
         }
     }