Better fix for XSS in style tags (9b5eee294)

8 years ago · d6ddd31a1b
parent 9b5eee2946
commit d6ddd31a1b
1 changed files with 1 additions and 1 deletions
--- a/program/lib/Roundcube/rcube_utils.php
+++ b/program/lib/Roundcube/rcube_utils.php
@ -540,10 +540,10 @@ class rcube_utils
    public static function xss_entity_decode($content)
    {
        $out = html_entity_decode(html_entity_decode($content));
-        $out = strip_tags($out);
        $out = preg_replace_callback('/\\\([0-9a-f]{4})/i',
            array(self, 'xss_entity_decode_callback'), $out);
        $out = preg_replace('#/\*.*\*/#Ums', '', $out);
+        $out = strip_tags($out);

        return $out;
    }