From 385067b005590c14f8f83fbda765369c9f476a5c Mon Sep 17 00:00:00 2001
From: Kijin Sung <kijin@kijinsung.com>
Date: Sat, 22 Nov 2025 21:47:25 +0900
Subject: [PATCH] Convert outdated <script language="javascript"> to <script>
 #2615

---
 classes/context/Context.class.php | 2 +-
 modules/admin/models/Utility.php  | 5 ++++-
 2 files changed, 5 insertions(+), 2 deletions(-)

diff --git a/classes/context/Context.class.php b/classes/context/Context.class.php
index 0c9f71190..a24ed24e3 100644
--- a/classes/context/Context.class.php
+++ b/classes/context/Context.class.php
@@ -139,7 +139,7 @@ class Context
 	 */
 	private static $_check_patterns = array(
 		'@<(?:\?|%)@' => 'DENY ALL',
-		'@<script\s*?language\s*?=@i' => 'DENY ALL',
+		'@<script\s*?language\s*?=\s*?(?![\'"]javascript[\'"])@i' => 'DENY ALL',
 		'@</?script@i' => 'ALLOW ADMIN ONLY',
 	);
 
diff --git a/modules/admin/models/Utility.php b/modules/admin/models/Utility.php
index d0c8edd56..b14202981 100644
--- a/modules/admin/models/Utility.php
+++ b/modules/admin/models/Utility.php
@@ -13,7 +13,10 @@ class Utility
 	public static function cleanHeaderAndFooterScripts(string $content)
 	{
 		$content = utf8_clean($content);
-		$content = preg_replace('!</?(html|head|body)[^>]*>!', '', $content);
+		$content = preg_replace('!</?(html|head|body)[^>]*>!i', '', $content);
+		$content = preg_replace_callback('!<script\b([^>]*?)language=[\'"]javascript[\'"]!i', function ($matches) {
+			return trim('<script ' . trim($matches[1]));
+		}, $content);
 		return utf8_trim($content);
 	}
 }