commit adf3bde5f8a196013acc615e5bfeedd0ef6417b8
author Andrey Andreev <narf@devilix.net> Sat Jan 25 16:59:17 2014 +0200
committer Andrey Andreev <narf@devilix.net> Sat Jan 25 16:59:17 2014 +0200
tree eacb94ef4bbb385972a8f94f0ecf02202d864ae3
parent 12445caa95a62842f726212aaa09f897f9018f11

Re-add 'on\w*' to evil attributes (rel #2667)

system/core/Security.php

diff --git a/system/core/Security.php b/system/core/Security.php
index 95f65e5..93613cc 100644
--- a/system/core/Security.php
+++ b/system/core/Security.php
@@ -667,8 +667,7 @@
 	 */
 	protected function _remove_evil_attributes($str, $is_image)
 	{
-		// Formaction, style, and xmlns
-		$evil_attributes = array('style', 'xmlns', 'formaction', 'form', 'xlink:href');
+		$evil_attributes = array('on\w*', 'style', 'xmlns', 'formaction', 'form', 'xlink:href');
 
 		if ($is_image === TRUE)
 		{