From 29c85b5eedeecaee33e9251be32badff356f3894 Mon Sep 17 00:00:00 2001 From: Laurent Destailleur Date: Wed, 29 Jul 2026 01:14:59 +0200 Subject: [PATCH] Adapt phpunit to the new sanitization of restricthtml --- htdocs/core/lib/functions.lib.php | 2 +- test/phpunit/SecurityGETPOSTTest.php | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/htdocs/core/lib/functions.lib.php b/htdocs/core/lib/functions.lib.php index 5e6ca6ab477..4d72af75d5b 100644 --- a/htdocs/core/lib/functions.lib.php +++ b/htdocs/core/lib/functions.lib.php @@ -9787,7 +9787,7 @@ function dol_htmlwithnojs($stringtoencode, $nouseofiframesandbox = 0, $check = ' // More not into the previous list $out = preg_replace('/on(repeat|begin|finish|beforeinput)[a-z]*\s*=/i', '', $out); // Add also a generic removal of any onxxx= attribute - $out = preg_replace('/\son[a-z]+\s*=/i', '', $out); + $out = preg_replace('/\son[a-z]+\s*=/i', ' ', $out); } while ($oldstringtoclean != $out); // Check the limit of external links that are automatically executed in a Rich text content. We count: diff --git a/test/phpunit/SecurityGETPOSTTest.php b/test/phpunit/SecurityGETPOSTTest.php index fd4531684c7..aba20111eae 100644 --- a/test/phpunit/SecurityGETPOSTTest.php +++ b/test/phpunit/SecurityGETPOSTTest.php @@ -301,7 +301,7 @@ class SecurityGETPOSTTest extends CommonClassTest $result = GETPOST("param15", 'restricthtml'); // param15 = src=>0xbeefed that is a dangerous string print __METHOD__." result=".$result."\n"; - $this->assertEquals("0xbeefed", $result, 'Test 15'); // The GETPOST return a harmull string + $this->assertEquals("0xbeefed", $result, 'Test 15'); // The GETPOST return a harmull string $result = GETPOST("param15b", 'restricthtml'); // param15b = src=>0xbeefed that is a dangerous string print __METHOD__." result=".$result."\n";