vignesh/dolibarr
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Adapt phpunit to the new sanitization of restricthtml

Browse source
This commit is contained in:
Laurent Destailleur 2026-07-29 01:14:59 +02:00
parent 7bf7d71fda
commit 29c85b5eed
2 changed files with 2 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
htdocs/core/lib/functions.lib.php
View file

@ -9787,7 +9787,7 @@ function dol_htmlwithnojs($stringtoencode, $nouseofiframesandbox = 0, $check = '
// More not into the previous list
$out = preg_replace('/on(repeat|begin|finish|beforeinput)[a-z]*\s*=/i', '', $out);
// Add also a generic removal of any onxxx= attribute
$out = preg_replace('/\son[a-z]+\s*=/i', '', $out);
$out = preg_replace('/\son[a-z]+\s*=/i', ' ', $out);
} while ($oldstringtoclean != $out);
// Check the limit of external links that are automatically executed in a Rich text content. We count:

2
test/phpunit/SecurityGETPOSTTest.php
View file

@ -301,7 +301,7 @@ class SecurityGETPOSTTest extends CommonClassTest
$result = GETPOST("param15", 'restricthtml'); // param15 = <img onxxxx<=alert(document.domain)> src=>0xbeefed that is a dangerous string
print __METHOD__." result=".$result."\n";
$this->assertEquals("<img onxxxx=alert(document.domain) src=>0xbeefed", $result, 'Test 15'); // The GETPOST return a harmull string
$this->assertEquals("<img alert(document.domain) src=>0xbeefed", $result, 'Test 15'); // The GETPOST return a harmull string
$result = GETPOST("param15b", 'restricthtml'); // param15b = <img onerror<=alert(document.domain)> src=>0xbeefed that is a dangerous string
print __METHOD__." result=".$result."\n";