diff options
| author | Andrey Andreev <narf@devilix.net> | 2016-03-07 09:52:15 +0100 |
|---|---|---|
| committer | Andrey Andreev <narf@devilix.net> | 2016-03-07 09:52:15 +0100 |
| commit | 3c0d8da56b8535bb3ab563256e221c81a4a96e4a (patch) | |
| tree | 9311d70eb4dda8a29391eb3261de50693fec9688 /system/core | |
| parent | 8108b612fb80327215ae66b53c75c158d6f07e62 (diff) | |
Fix #4475
Diffstat (limited to 'system/core')
| -rw-r--r-- | system/core/Security.php | 9 |
1 files changed, 8 insertions, 1 deletions
diff --git a/system/core/Security.php b/system/core/Security.php index bad511dd3..d5305d1ca 100644 --- a/system/core/Security.php +++ b/system/core/Security.php @@ -762,7 +762,14 @@ class CI_Security { */ public function strip_image_tags($str) { - return preg_replace(array('#<img[\s/]+.*?src\s*=\s*["\'](.+?)["\'].*?\>#', '#<img[\s/]+.*?src\s*=\s*(.+?).*?\>#'), '\\1', $str); + return preg_replace( + array( + '#<img[\s/]+.*?src\s*=\s*(["\'])([^\\1]+?)\\1.*?\>#i', + '#<img[\s/]+.*?src\s*=\s*?(([^\s"\'=<>`]+)).*?\>#i' + ), + '\\2', + $str + ); } // ---------------------------------------------------------------- |