From e064ae2085fc932840b3846a4ea7fa0a8e980418 Mon Sep 17 00:00:00 2001 From: Cameron Date: Wed, 1 May 2013 03:13:29 -0700 Subject: [PATCH] cleanHtml() was urlencoding {e_XXXX} paths in html. --- e107_handlers/e_parse_class.php | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/e107_handlers/e_parse_class.php b/e107_handlers/e_parse_class.php index 95cf034c8..4c0f3891f 100644 --- a/e107_handlers/e_parse_class.php +++ b/e107_handlers/e_parse_class.php @@ -487,7 +487,9 @@ class e_parse extends e_parser if (strip_tags($data) != $data) // html tags present. { + $data = $this->cleanHtml($data); // sanitize all html. + $data = urldecode($data); // symptom of cleaning the HTML - urlencodes src attributes containing { and } .eg. {e_BASE} // if ($this->htmlAbuseFilter($data)) $no_encode = FALSE; //XXX cleanHtml() is more effective. } @@ -503,7 +505,7 @@ class e_parse extends e_parser { $no_encode = TRUE; } - + if (is_numeric($original_author) && !check_class($core_pref->get('post_html'), '', $original_author)) { $no_encode = FALSE;