summaryrefslogtreecommitdiff
path: root/program
diff options
context:
space:
mode:
authorthomascube <thomas@roundcube.net>2011-12-10 01:50:03 +0000
committerthomascube <thomas@roundcube.net>2011-12-10 01:50:03 +0000
commit98c2d69acf3001379dc008dc52b77b618c291140 (patch)
treea3523e1460d1e67a8152ca6b974447213ea3ec01 /program
parent854397b216463d77561b8adadf880c3fbbcb8885 (diff)
Be more strict in style attribute filtering
Diffstat (limited to 'program')
-rw-r--r--program/lib/washtml.php2
1 files changed, 1 insertions, 1 deletions
diff --git a/program/lib/washtml.php b/program/lib/washtml.php
index 8bbc136e1..f8c3251ad 100644
--- a/program/lib/washtml.php
+++ b/program/lib/washtml.php
@@ -168,7 +168,7 @@ class washtml
|| ($src = $this->config['cid_map'][$this->config['base_url'].$match[2]])) {
$value .= ' url('.htmlspecialchars($src, ENT_QUOTES) . ')';
}
- else if (preg_match('/^(http|https|ftp):.*$/i', $match[2], $url)) {
+ else if (preg_match('!^(https?:)?//[a-z0-9/._+-]+$!i', $match[2], $url)) {
if ($this->config['allow_remote'])
$value .= ' url('.htmlspecialchars($url[0], ENT_QUOTES).')';
else