Merge branch 'master' of git://github.com/gallery/gallery3

1 files changed, 4 insertions, 4 deletions

diff --git a/system/libraries/Input.php b/system/libraries/Input.php
index 2bef3ff4..fa984a88 100644
--- a/system/libraries/Input.php
+++ b/system/libraries/Input.php
@@ -356,10 +356,10 @@ class Input_Core {
 			$data = preg_replace('#([a-z]*)[\x00-\x20]*=([\'"]*)[\x00-\x20]*v[\x00-\x20]*b[\x00-\x20]*s[\x00-\x20]*c[\x00-\x20]*r[\x00-\x20]*i[\x00-\x20]*p[\x00-\x20]*t[\x00-\x20]*:#iu', '$1=$2novbscript...', $data);
 			$data = preg_replace('#([a-z]*)[\x00-\x20]*=([\'"]*)[\x00-\x20]*-moz-binding[\x00-\x20]*:#u', '$1=$2nomozbinding...', $data);
 
-			// Only works in IE: <span style="width: expression(alert('Ping!'));"></span>
-			$data = preg_replace('#(<[^>]+?)style[\x00-\x20]*=[\x00-\x20]*[`\'"]*.*?expression[\x00-\x20]*\([^>]*+>#i', '$1>', $data);
-			$data = preg_replace('#(<[^>]+?)style[\x00-\x20]*=[\x00-\x20]*[`\'"]*.*?behaviour[\x00-\x20]*\([^>]*+>#i', '$1>', $data);
-			$data = preg_replace('#(<[^>]+?)style[\x00-\x20]*=[\x00-\x20]*[`\'"]*.*?s[\x00-\x20]*c[\x00-\x20]*r[\x00-\x20]*i[\x00-\x20]*p[\x00-\x20]*t[\x00-\x20]*:*[^>]*+>#iu', '$1>', $data);
+                        //remove any style attributes, IE allows too much stupid things in them, eg.
+                        //<span style="width: expression(alert('Ping!'));"></span>
+                        // and in general you really don't want style declarations in your UGC
+                        $data = preg_replace('#(<[^>]+[\x00-\x20\"\'\/])style[^>]*>#iUu', "$1>", $data);
 
 			// Remove namespaced elements (we do not need them)
 			$data = preg_replace('#</*\w+:\w[^>]*+>#i', '', $data);