MDL-2684: kses strips out CSS from style tags unless the first proper…

…ty is on 'allowed' list, this is silly
Mrmoodle · Dec 2, 2009 · 6c37c4c · 6c37c4c
1 parent 640bb8c
commit 6c37c4c
Showing 1 changed file with 6 additions and 1 deletion.
diff --git a/lib/kses.php b/lib/kses.php
@@ -311,7 +311,12 @@ function kses_hair($attr, $allowed_protocols)
         if (preg_match('/^"([^"]*)"(\s+|$)/', $attr, $match))
          # "value"
         {
-          $thisval = kses_bad_protocol($match[1], $allowed_protocols);
+          // MDL-2684 - kses stripping CSS styles that it thinks look like protocols
+          if ($attrname == 'style') {
+              $thisval = $match[1];
+          } else {
+              $thisval = kses_bad_protocol($match[1], $allowed_protocols);
+          }
 
           $attrarr[] = array
                         ('name'  => $attrname,