From 4d0571666d03511ac5b4a1f2a6882ccb1509a209 Mon Sep 17 00:00:00 2001 From: Andrey Andreev Date: Mon, 20 Jan 2014 11:17:34 +0200 Subject: Fix #2729 --- system/core/Security.php | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) (limited to 'system') diff --git a/system/core/Security.php b/system/core/Security.php index 4c01da2b8..95957a3d8 100644 --- a/system/core/Security.php +++ b/system/core/Security.php @@ -837,14 +837,15 @@ class CI_Security { * Add a semicolon if missing. We do this to enable * the conversion of entities to ASCII later. */ - $str = preg_replace('#(&\#?[0-9a-z]{2,})([\x00-\x20])*;?#i', '\\1;\\2', $str); + $str = preg_replace('/(&#\d{2,4})(?![0-9;])/', '$1;', $str); + $str = preg_replace('/(&[a-z]{2,})(?![a-z;])/i', '$1;', $str); /* * Validate UTF16 two byte encoding (x00) * * Just as above, adds a semicolon if missing. */ - $str = preg_replace('#(&\#x?)([0-9A-F]+);?#i', '\\1\\2;', $str); + $str = preg_replace('/(�*[0-9a-f]{2,5})(?![0-9a-f;])/i', '$1;', $str); /* * Un-Protect GET variables in URLs -- cgit v1.2.3-24-g4f1b