diff options
Diffstat (limited to 'includes')
| -rw-r--r-- | includes/Sanitizer.php | 16 |
1 files changed, 12 insertions, 4 deletions
diff --git a/includes/Sanitizer.php b/includes/Sanitizer.php index 785e2ec9c15c..eb8710866aad 100644 --- a/includes/Sanitizer.php +++ b/includes/Sanitizer.php @@ -564,16 +564,24 @@ class Sanitizer { preg_match( '/^(\\/?)(\\w+)([^>]*?)(\\/{0,1}>)([^<]*)$/', $x, $regs ); @list( /* $qbar */, $slash, $t, $params, $brace, $rest ) = $regs; + $badtag = false; if ( isset( $htmlelements[$t = strtolower( $t )] ) ) { if( is_callable( $processCallback ) ) { call_user_func_array( $processCallback, array( &$params, $args ) ); } + + if ( !Sanitizer::validateTag( $params, $t ) ) { + $badtag = true; + } + $newparams = Sanitizer::fixTagAttributes( $params, $t ); - $rest = str_replace( '>', '>', $rest ); - $text .= "<$slash$t$newparams$brace$rest"; - } else { - $text .= '<' . str_replace( '>', '>', $x); + if ( !$badtag ) { + $rest = str_replace( '>', '>', $rest ); + $text .= "<$slash$t$newparams$brace$rest"; + continue; + } } + $text .= '<' . str_replace( '>', '>', $x); } } wfProfileOut( __METHOD__ ); |