summaryrefslogtreecommitdiffstats
path: root/system/core
diff options
context:
space:
mode:
authorAndrey Andreev <narf@devilix.net>2014-03-18 17:44:53 +0100
committerAndrey Andreev <narf@devilix.net>2014-03-18 17:44:53 +0100
commite7a2aa09df05547211776bf493adb6da476f3858 (patch)
tree84f104c1e2079a22fb5409a517986ae44d4ee4f3 /system/core
parent1394304472f1c917b8f6680c57bf50c780744f2d (diff)
xss_clean() improvement
Fixes this: https://github.com/EllisLab/CodeIgniter/issues/2667#issuecomment-37819186
Diffstat (limited to 'system/core')
-rw-r--r--system/core/Security.php8
1 files changed, 4 insertions, 4 deletions
diff --git a/system/core/Security.php b/system/core/Security.php
index faa52d746..1dfea18f8 100644
--- a/system/core/Security.php
+++ b/system/core/Security.php
@@ -578,13 +578,13 @@ class CI_Security {
do
{
- $m1 = $m2 = 0;
+ $str_compare = $str;
- $str = preg_replace('/(&#x0*[0-9a-f]{2,5})(?![0-9a-f;])/iS', '$1;', $str, -1, $m1);
- $str = preg_replace('/(&#\d{2,4})(?![0-9;])/S', '$1;', $str, -1, $m2);
+ $str = preg_replace('/(&#x0*[0-9a-f]{2,5})(?![0-9a-f;])/iS', '$1;', $str);
+ $str = preg_replace('/(&#\d{2,4})(?![0-9;])/S', '$1;', $str);
$str = html_entity_decode($str, ENT_COMPAT, $charset);
}
- while ($m1 OR $m2);
+ while ($str_compare !== $str);
return $str;
}