From 00572749829e7c6363684f5692af3930aa955d8e Mon Sep 17 00:00:00 2001
From: thomasb <thomasb@208e9e7b-5314-0410-a742-e7e81cd9613c>
Date: Sat, 10 Dec 2011 01:50:03 +0000
Subject: Be more strict in style attribute filtering

git-svn-id: https://svn.roundcube.net/trunk@5590 208e9e7b-5314-0410-a742-e7e81cd9613c
---
 roundcubemail/program/lib/washtml.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'roundcubemail/program/lib')

diff --git a/roundcubemail/program/lib/washtml.php b/roundcubemail/program/lib/washtml.php
index 8bbc136e1..f8c3251ad 100644
--- a/roundcubemail/program/lib/washtml.php
+++ b/roundcubemail/program/lib/washtml.php
@@ -168,7 +168,7 @@ class washtml
                 || ($src = $this->config['cid_map'][$this->config['base_url'].$match[2]])) {
               $value .= ' url('.htmlspecialchars($src, ENT_QUOTES) . ')';
             }
-            else if (preg_match('/^(http|https|ftp):.*$/i', $match[2], $url)) {
+            else if (preg_match('!^(https?:)?//[a-z0-9/._+-]+$!i', $match[2], $url)) {
               if ($this->config['allow_remote'])
                 $value .= ' url('.htmlspecialchars($url[0], ENT_QUOTES).')';
               else
-- 
cgit v1.2.3