# HG changeset patch
# User Dan
# Date 1232209938 18000
# Node ID 42419c99471c899d8a4eabe22f3035b55506d72d
# Parent  01e7206b4441ef95b21c9ef2d6bd5e85601e609d
SECURITY: Fix XSS under IE in closing tags (shared sanitizer)

diff -r 01e7206b4441 -r 42419c99471c includes/functions.php
--- a/includes/functions.php	Sat Jan 17 11:31:45 2009 -0500
+++ b/includes/functions.php	Sat Jan 17 11:32:18 2009 -0500
@@ -1854,6 +1854,11 @@
   // <
   // The rule is so specific because everything else will have been filtered by now
   $html = preg_replace('/<(script|iframe)(.+?)src=([^>]*)</i', '&lt;\\1\\2src=\\3&lt;', $html);
+  
+  // Vulnerability reported by fuzion from nukeit.org:
+  // XSS in closing HTML tag style attribute
+  // Fix: escape all closing tags with non-whitelisted characters
+  $html = preg_replace('!</((?:.*)([^a-z0-9-_:]+)(?:.*))>!', '&lt;/\\1&gt;', $html);
 
   // Restore stripped comments
   $i = 0;