fanbinit/rhymix
1
0
Fork 0
mirror of https://github.com/Lastorder-DC/rhymix.git synced 2026-01-06 18:21:39 +09:00
Code Issues Projects Releases Packages Wiki Activity

SECISSUE

Browse source
This commit is contained in:
bnu 2014-01-03 20:19:07 +09:00
parent bff1217303
commit 072f0ff1ce
1 changed files with 3 additions and 18 deletions
Download patch file Download diff file Expand all files Collapse all files

21
classes/security/EmbedFilter.class.php
View file

@ -347,12 +347,7 @@ class EmbedFilter
}
}
if($isWhiteDomain && $isWhiteMimetype && $ext)
{
$isWhiteExt = $this->isWhiteExt($ext);
}
if(!$isWhiteDomain || !$isWhiteMimetype || !$isWhiteExt)
if(!$isWhiteDomain || !$isWhiteMimetype)
{
$content = str_replace($objectTag, htmlspecialchars($objectTag, ENT_COMPAT, 'UTF-8', false), $content);
}
@ -400,12 +395,7 @@ class EmbedFilter
}
}
if($isWhiteDomain && $isWhiteMimetype && $ext)
{
$isWhiteExt = $this->isWhiteExt($ext);
}
if(!$isWhiteDomain || !$isWhiteMimetype || !$isWhiteExt)
if(!$isWhiteDomain || !$isWhiteMimetype)
{
$content = str_replace($embedTag, htmlspecialchars($embedTag, ENT_COMPAT, 'UTF-8', false), $content);
}
@ -483,12 +473,7 @@ class EmbedFilter
$ext = strtolower(substr(strrchr($parser->iNodeAttributes['value'], "."), 1));
$isWhiteDomain = $this->isWhiteDomain($parser->iNodeAttributes['value']);
if($isWhiteDomain && $ext)
{
$isWhiteExt = $this->isWhiteExt($ext);
}
if(!$isWhiteDomain || !$isWhiteExt)
if(!$isWhiteDomain)
{
$content = str_replace($paramTag, htmlspecialchars($paramTag, ENT_COMPAT, 'UTF-8', false), $content);
}