diff --git a/docs/changelog/7.x.x.txt b/docs/changelog/7.x.x.txt index a74f8bc44..9985f6e37 100644 --- a/docs/changelog/7.x.x.txt +++ b/docs/changelog/7.x.x.txt @@ -15,6 +15,7 @@ - fixed #9920: Survey: cannot add questions in IE - fixed #10449: Undefined template - fixed: WebGUI::Search epoch maximum range error (#10288) + - fixed: Insufficient filtering in javascript filter (#10001) - fixed #10365: Head tags do not work "Use Packed Head Tags". - fixed #9927: Survey - verbatim - fixed #10352: Deleting a user does not clean up any address books diff --git a/lib/WebGUI/Asset/Wobject/Collaboration.pm b/lib/WebGUI/Asset/Wobject/Collaboration.pm index 56f04cef8..0faf8dbc5 100644 --- a/lib/WebGUI/Asset/Wobject/Collaboration.pm +++ b/lib/WebGUI/Asset/Wobject/Collaboration.pm @@ -588,14 +588,14 @@ sub definition { }, filterCode =>{ fieldType=>"filterContent", - defaultValue=>'javascript', + defaultValue=>'most', tab=>'security', label=>$i18n->get('filter code'), hoverHelp=>$i18n->get('filter code description'), }, replyFilterCode =>{ fieldType=>"filterContent", - defaultValue=>'javascript', + defaultValue=>'most', tab=>'security', label=>$i18n->get('reply filter code'), hoverHelp=>$i18n->get('reply filter code description'), diff --git a/lib/WebGUI/HTML.pm b/lib/WebGUI/HTML.pm index 1bbf97572..706c0e436 100644 --- a/lib/WebGUI/HTML.pm +++ b/lib/WebGUI/HTML.pm @@ -142,7 +142,7 @@ sub filter { $html =~ s/ / /ixsg ; WebGUI::Macro::negate(\$html); } elsif ($type eq "javascript") { - $html =~ s/\//ixsg; + $html =~ s/\<\s*script.*?\/script\s*\>//ixsg; $html =~ s/(href="??)javascript\:.*?\)/$1removed/ixsg; $html =~ s/onClick/removed/ixsg; $html =~ s/onDblClick/removed/ixsg;