/**
* Check against XSS
*
* @access public
* @param string Original string
* @param boolean Fix script HTML tags
* @return string "Cleaned" text
*/
public function checkXss( $txt='', $fixScript=false, $tag='' )
{
//-----------------------------------------
// Opening script tags...
// Check for spaces and new lines...
//-----------------------------------------
if ( $fixScript )
{
$txt = preg_replace( "#<(\s+?)?s(\s+?)?c(\s+?)?r(\s+?)?i(\s+?)?p(\s+?)?t#is" , "<script" , $txt );
$txt = preg_replace( "#<(\s+?)?/(\s+?)?s(\s+?)?c(\s+?)?r(\s+?)?i(\s+?)?p(\s+?)?t#is", "</script", $txt );
}
if ( $tag )
{
switch ($tag)
{
case 'entry':
case 'blog':
case 'topic':
case 'post':
$txt = intval( str_ireplace( array( "\n", "\r", "<br>", "<br />", "<br>" ), "", $txt ) );
break;
case 'acronym':
$txt = preg_replace( "/s((\\\|\)*)t((\\\|\)*)y((\\\|\)*)l((\\\|\)*)e((\\\|\)*)=/is", "st yle=", $txt );
$txt = str_replace( array( ':', ';' ), '', $txt );
break;
}
}
//-----------------------------------------
// Here we can do some generic checking for XSS
// This should not be considered fool proof, though can provide
// a centralized point for maintenance and checking
//-----------------------------------------
$txt = preg_replace( "/(j)avascript/i" , "\\1avascript", $txt );
//$txt = str_ireplace( "alert" , "alert" , $txt );
$txt = str_ireplace( "behavior" , "behavior" , $txt );
$txt = preg_replace( "/(e)((\/\*.*?\*\/)*)x((\/\*.*?\*\/)*)p((\/\*.*?\*\/)*)r((\/\*.*?\*\/)*)e((\/\*.*?\*\/)*)s((\/\*.*?\*\/)*)s((\/\*.*?\*\/)*)i((\/\*.*?\*\/)*)o((\/\*.*?\*\/)*)n/is" , "\\1xp<b></b>ression" , $txt );
$txt = preg_replace( "/(e)((\\\|\)*)x((\\\|\)*)p((\\\|\)*)r((\\\|\)*)e((\\\|\)*)s((\\\|\)*)s((\\\|\)*)i((\\\|\)*)o((\\\|\)*)n/is" , "\\1xp<b></b>ression" , $txt );
$txt = preg_replace( "/m((\\\|\)*)o((\\\|\)*)z((\\\|\)*)\-((\\\|\)*)b((\\\|\)*)i((\\\|\)*)n((\\\|\)*)d((\\\|\)*)i((\\\|\)*)n((\\\|\)*)g/is" , "moz-<b></b>binding" , $txt );
$txt = str_ireplace( "about:" , "about:" , $txt );
$txt = str_ireplace( "<body" , "<body" , $txt );
$txt = str_ireplace( "<html" , "<html" , $txt );
$txt = str_ireplace( "document." , "document." , $txt );
$txt = str_ireplace( "window." , "window." , $txt );
$event_handlers = array( 'mouseover', 'mouseout', 'mouseup', 'mousemove', 'mousedown', 'mouseenter', 'mouseleave', 'mousewheel',
'contextmenu', 'click', 'dblclick', 'load', 'unload', 'submit', 'blur', 'focus', 'resize', 'scroll',
'change', 'reset', 'select', 'selectionchange', 'selectstart', 'start', 'stop', 'keydown', 'keyup',
'keypress', 'abort', 'error', 'dragdrop', 'move', 'moveend', 'movestart', 'activate', 'afterprint',
'afterupdate', 'beforeactivate', 'beforecopy', 'beforecut', 'beforedeactivate', 'beforeeditfocus',
'beforepaste', 'beforeprint', 'beforeunload', 'begin', 'bounce', 'cellchange', 'controlselect',
'copy', 'cut', 'paste', 'dataavailable', 'datasetchanged', 'datasetcomplete', 'deactivate', 'drag',
'dragend', 'dragleave', 'dragenter', 'dragover', 'drop', 'end', 'errorupdate', 'filterchange', 'finish',
'focusin', 'focusout', 'help', 'layoutcomplete', 'losecapture', 'mediacomplete', 'mediaerror', 'outofsync',
'pause', 'propertychange', 'progress', 'readystatechange', 'repeat', 'resizeend', 'resizestart', 'resume',
'reverse', 'rowsenter', 'rowexit', 'rowdelete', 'rowinserted', 'seek', 'syncrestored', 'timeerror',
'trackchange', 'urlflip',
);
foreach( $event_handlers as $handler )
{
$txt = str_ireplace( 'on' . $handler, 'on' . $handler, $txt );
}
return $txt;
}
ipsRegistry->setUpSettings() #1 W:\home\localhost\www\admin\sources\base\ipsController.php(75
