commit 1bbc5644b0c306ff72dc1228b169db56902fc031
author Andrey Andreev <narf@devilix.net> Tue Jan 07 12:45:27 2014 +0200
committer Andrey Andreev <narf@devilix.net> Tue Jan 07 12:45:27 2014 +0200
tree 2741549bddcfec682d6e05f402f825c1d3fa1c61
parent dc53d7b68adc6fdc8d0917ee2d29f5670ff82b45

Fix #2268 (manually implementing PR #2269)

system/core/Security.php

diff --git a/system/core/Security.php b/system/core/Security.php
index 9423f82..0944fef 100644
--- a/system/core/Security.php
+++ b/system/core/Security.php
@@ -117,7 +117,6 @@
 		'document.write'	=> '[removed]',
 		'.parentNode'		=> '[removed]',
 		'.innerHTML'		=> '[removed]',
-		'window.location'	=> '[removed]',
 		'-moz-binding'		=> '[removed]',
 		'<!--'				=> '&lt;!--',
 		'-->'				=> '--&gt;',
@@ -132,6 +131,7 @@
 	 */
 	protected $_never_allowed_regex = array(
 		'javascript\s*:',
+		'(document|(document\.)?window)\.(location|on\w*)',
 		'expression\s*(\(|&\#40;)', // CSS and IE
 		'vbscript\s*:', // IE, surprise!
 		'Redirect\s+302',
@@ -648,8 +648,8 @@
 	 */
 	protected function _remove_evil_attributes($str, $is_image)
 	{
-		// All javascript event handlers (e.g. onload, onclick, onmouseover), style, and xmlns
-		$evil_attributes = array('on\w*', 'style', 'xmlns', 'formaction');
+		// Formaction, style, and xmlns
+		$evil_attributes = array('style', 'xmlns', 'formaction');
 
 		if ($is_image === TRUE)
 		{