*** typo3/sysext/cms/tslib/class.tslib_content.php	2014-02-16 12:02:53.000000000 +0100
--- typo3/sysext/cms/tslib/class.tslib_content.php.patched	2014-02-16 11:50:57.000000000 +0100
***************
*** 3814,3849 ****
  	}
  
  	/**
! 	 * Function for removing malicious HTML code when you want to provide some HTML code user-editable.
! 	 * The purpose is to avoid XSS attacks and the code will be continously modified to remove such code.
! 	 * For a complete reference with javascript-on-events, see http://www.wdvl.com/Authoring/JavaScript/Events/events_target.html
! 	 *
! 	 * @param	string		Input string to be cleaned.
! 	 * @param	array		TypoScript configuration.
! 	 * @return	string		Return string
! 	 * @author	Thomas Bley (all from moregroupware cvs code / readmessage.inc.php, published under gpl by Thomas)
! 	 * @author	Kasper Sk�rh�j
! 	 */
! 	function removeBadHTML($text, $conf) {
! 
! 			// Copyright 2002-2003 Thomas Bley
! 		$text = preg_replace(
! 			array(
! 				"'<script[^>]*?>.*?</script[^>]*?>'si", "'<applet[^>]*?>.*?</applet[^>]*?>'si", "'<object[^>]*?>.*?</object[^>]*?>'si", "'<iframe[^>]*?>.*?</iframe[^>]*?>'si", "'<frameset[^>]*?>.*?</frameset[^>]*?>'si", "'<style[^>]*?>.*?</style[^>]*?>'si", "'<marquee[^>]*?>.*?</marquee[^>]*?>'si", "'<script[^>]*?>'si", "'<meta[^>]*?>'si", "'<base[^>]*?>'si", "'<applet[^>]*?>'si", "'<object[^>]*?>'si", "'<link[^>]*?>'si", "'<iframe[^>]*?>'si", "'<frame[^>]*?>'si", "'<frameset[^>]*?>'si", "'<input[^>]*?>'si", "'<form[^>]*?>'si", "'<embed[^>]*?>'si", "'background-image:url'si", "'<\w+.*?(onabort|onbeforeunload|onblur|onchange|onclick|ondblclick|ondragdrop|onerror|onfilterchange|onfocus|onhelp|onkeydown|onkeypress|onkeyup|onload|onmousedown|onmousemove|onmouseout|onmouseover|onmouseup|onmove|onreadystatechange|onreset|onresize|onscroll|onselect|onselectstart|onsubmit|onunload).*?>'si"
! 			),
! 			'',
! 			$text
! 		);
! 
! 		$text = preg_replace(
! 			'/<a[^>]*href[[:space:]]*=[[:space:]]*["\']?[[:space:]]*javascript[^>]*/i',
! 			'',
! 			$text
! 		);
! 
! 			// Return clean content
! 		return $text;
! 	}
  
  	/**
  	 * Implements the stdWrap property "textStyle"; This generates a <font>-tag (and a <div>-tag for align-attributes) which is wrapped around the input value.
--- 3814,3909 ----
  	}
  
  	/**
!          * Function for removing malicious HTML code when you want to provide some HTML code user-editable.
!          * The purpose is to avoid XSS attacks and the code will be continously modified to remove such code.
!          * For a complete reference with javascript-on-events, see http://www.wdvl.com/Authoring/JavaScript/Events/events_target.html
!          *
!          * @param       string          Input string to be cleaned.
!          * @param       array           TypoScript configuration.
!          * @return      string          Return string
!          * @author      Thomas Bley (all from moregroupware cvs code / readmessage.inc.php, published under gpl by Thomas)
!          * @author      Kasper Sk�rh�j
!          * @author      Christoph Holtermann
!          */
!         function removeBadHTML($text, $conf) {
! 
!                 // Copyright 2002-2003 Thomas Bley
!                    
!                 $preg_replace_array = array(
!                                 "'<script[^>]*?>.*?</script[^>]*?>'si", 
!                                 "'<applet[^>]*?>.*?</applet[^>]*?>'si", 
!                                 "'<object[^>]*?>.*?</object[^>]*?>'si", 
!                                 "'<iframe[^>]*?>.*?</iframe[^>]*?>'si", 
!                                 "'<frameset[^>]*?>.*?</frameset[^>]*?>'si", 
!                                 "'<style[^>]*?>.*?</style[^>]*?>'si", 
!                                 "'<marquee[^>]*?>.*?</marquee[^>]*?>'si", 
!                                 "'<script[^>]*?>'si", 
!                                 "'<meta[^>]*?>'si", 
!                                 "'<base[^>]*?>'si", 
!                                 "'<applet[^>]*?>'si", 
!                                 "'<object[^>]*?>'si", 
!                                 "'<link[^>]*?>'si", 
!                                 "'<iframe[^>]*?>'si", 
!                                 "'<frame[^>]*?>'si", 
!                                 "'<frameset[^>]*?>'si", 
!                                 "'<input[^>]*?>'si", 
!                                 "'<form[^>]*?>'si", 
!                                 "'<embed[^>]*?>'si", 
!                                 "'background-image:url'si", 
!                                 "'<\w+.*?(onabort).*?>'si",
!                                 "'<\w+.*?(onbeforeunload).*?>'si",
!                                 "'<\w+.*?(onblur).*?>'si",
!                                 "'<\w+.*?(onchange).*?>'si",
!                                 "'<\w+.*?(onclick).*?>'si",
!                                 "'<\w+.*?(ondblclick).*?>'si",
!                                 "'<\w+.*?(ondragdrop).*?>'si",
!                                 "'<\w+.*?(onerror).*?>'si",
!                                 "'<\w+.*?(onfilterchange).*?>'si",
!                                 "'<\w+.*?(onfocus).*?>'si",
!                                 "'<\w+.*?(onhelp).*?>'si",
!                                 "'<\w+.*?(onkeydown).*?>'si",
!                                 "'<\w+.*?(onkeypress).*?>'si",
!                                 "'<\w+.*?(onkeyup).*?>'si",
!                                 "'<\w+.*?(onload).*?>'si",
!                                 "'<\w+.*?(onmousedown).*?>'si",
!                                 "'<\w+.*?(onmousemove).*?>'si",
!                                 "'<\w+.*?(onmouseout).*?>'si",
!                                 "'<\w+.*?(onmouseover).*?>'si",
!                                 "'<\w+.*?(onmouseup).*?>'si",
!                                 "'<\w+.*?(onmove).*?>'si",
!                                 "'<\w+.*?(onreadystatechange).*?>'si",
!                                 "'<\w+.*?(onreset).*?>'si",
!                                 "'<\w+.*?(onresize).*?>'si",
!                                 "'<\w+.*?(onscroll).*?>'si",
!                                 "'<\w+.*?(onselect).*?>'si",
!                                 "'<\w+.*?(onselectstart).*?>'si",
!                                 "'<\w+.*?(onsubmit).*?>'si",
!                                 "'<\w+.*?(onunload).*?>'si" );
! 
!                 foreach ($preg_replace_array as $preg_expression)
!                 {
!                         $text = preg_replace($preg_expression, "", $text);
!                         if( preg_last_error()== PREG_BACKTRACK_LIMIT_ERROR ) {
!                                 t3lib_div::devLog('removeBadHTML: Memory exceeded. ', $this->extKey, 2, array($preg_expression, $text));
!                                 return "removeBadHTML memory exceeded.";
!                         }
!                 }
! 
! 
!                 $text = preg_replace(
!                         '/<a[^>]*href[[:space:]]*=[[:space:]]*["\']?[[:space:]]*javascript[^>]*/i',
!                         '',
!                         $text
!                 );
! 
!                 if( preg_last_error()== PREG_BACKTRACK_LIMIT_ERROR ) {
!                         t3lib_div::devLog('removeBadHTML: Memory exceeded. ', $this->extKey, 2);
!                         return "removeBadHTML memory exceeded.";
!                         }
! 
!                         // Return clean content
!                 return $text;
!         }	
  
  	/**
  	 * Implements the stdWrap property "textStyle"; This generates a <font>-tag (and a <div>-tag for align-attributes) which is wrapped around the input value.
***************
*** 8096,8099 ****
  	include_once($GLOBALS['TYPO3_CONF_VARS'][TYPO3_MODE]['XCLASS']['tslib/class.tslib_content.php']);
  }
  
! ?>
\ No newline at end of file
--- 8156,8159 ----
  	include_once($GLOBALS['TYPO3_CONF_VARS'][TYPO3_MODE]['XCLASS']['tslib/class.tslib_content.php']);
  }
  
! ?>
