fix wysiwyg xss

2018-09-13 14:03:01 +03:00
parent eabd52b186
commit be62caef2b
1 changed files with 1 additions and 0 deletions
@@ -148,6 +148,7 @@ Espo.define('views/fields/wysiwyg', ['views/fields/text', 'lib!Summernote'], fun
            if (value) {
                value = value.replace(/<[\/]{0,1}(base)[^><]*>/gi, '');
                value = value.replace(/<[\/]{0,1}(script)[^><]*>/gi, '');
+                value = value.replace(/<[^><]*(onerror|onclick|onmouseover|onmousedown|onmouseenter|onmouseout|mouseleave|onchange|onblur)=[^><]*>/gi, '');
            }
            return value || '';
        },