decided just to kill all on*= event handlers, rather than trying to keep up with (and require users to do the same) with a blacklist.

1 files changed, 2 insertions, 2 deletions

diff --git a/system/libraries/Input.php b/system/libraries/Input.php
index 5f066cc5e..b111108eb 100644
--- a/system/libraries/Input.php
+++ b/system/libraries/Input.php
@@ -757,7 +757,7 @@ class CI_Input {
 		 * but it's unlikely to be a problem.

 		 *

 		 */

-		$event_handlers = array('onblur','onchange','onclick','ondblclick','onended','onerror','onfocus','onkeydown','onkeypress','onkeyup','onload','onmousedown','onmousemove','onmouseover','onmouseout','onmouseup','onresize','onselect','onsubmit','onunload','xmlns');

+		$event_handlers = array('xmlns');

 

 		if ($is_image === TRUE)

 		{

@@ -768,7 +768,7 @@ class CI_Input {
 			unset($event_handlers[array_search('xmlns', $event_handlers)]);

 		}

 		

-		$str = preg_replace("#<([^><]+)(".implode('|', $event_handlers).")(\s*=\s*[^><]*)([><]*)#i", "<\\1\\4", $str);

+		$str = preg_replace("#<([^><]+)((?=on\w*)|".implode('|', $event_handlers).")(\s*=\s*[^><]*)([><]*)#i", "<\\1\\4", $str);

 

 		/*

 		 * Sanitize naughty HTML elements