diff options
| author | thomasb <thomasb@208e9e7b-5314-0410-a742-e7e81cd9613c> | 2011-12-10 01:50:03 +0000 |
|---|---|---|
| committer | thomasb <thomasb@208e9e7b-5314-0410-a742-e7e81cd9613c> | 2011-12-10 01:50:03 +0000 |
| commit | 00572749829e7c6363684f5692af3930aa955d8e (patch) | |
| tree | 27af3250ecf70458a9cd8e820930b4c6b351a3a0 /roundcubemail/program/lib | |
| parent | 787cc568ceab1a97db843cf001ddb612ce2b3f9e (diff) | |
Be more strict in style attribute filtering
git-svn-id: https://svn.roundcube.net/trunk@5590 208e9e7b-5314-0410-a742-e7e81cd9613c
Diffstat (limited to 'roundcubemail/program/lib')
| -rw-r--r-- | roundcubemail/program/lib/washtml.php | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/roundcubemail/program/lib/washtml.php b/roundcubemail/program/lib/washtml.php index 8bbc136e1..f8c3251ad 100644 --- a/roundcubemail/program/lib/washtml.php +++ b/roundcubemail/program/lib/washtml.php @@ -168,7 +168,7 @@ class washtml || ($src = $this->config['cid_map'][$this->config['base_url'].$match[2]])) { $value .= ' url('.htmlspecialchars($src, ENT_QUOTES) . ')'; } - else if (preg_match('/^(http|https|ftp):.*$/i', $match[2], $url)) { + else if (preg_match('!^(https?:)?//[a-z0-9/._+-]+$!i', $match[2], $url)) { if ($this->config['allow_remote']) $value .= ' url('.htmlspecialchars($url[0], ENT_QUOTES).')'; else |