update

microweber · May 4, 2022 · 527abd1 · 527abd1
1 parent e9bd4f8
commit 527abd1
Show file tree

Hide file tree

Showing 2 changed files with 5 additions and 0 deletions.
diff --git a/src/MicroweberPackages/App/Http/Controllers/ApiController.php b/src/MicroweberPackages/App/Http/Controllers/ApiController.php
@@ -616,6 +616,8 @@ public function module()
                 if(is_string($v)) {
                     $v = str_replace('<', '-', $v);
                     $v = str_replace('>', '-', $v);
+                    $v = str_replace('"', '-', $v);
+                    $v = str_replace("'", '-', $v);
                 }
                 if(is_array($v)) {
                     $v = $xssClean->cleanArray($v);
@@ -626,6 +628,8 @@ public function module()
                 if(is_string($k)){
                     $k = str_replace('<', '-', $k);
                     $k = str_replace('>', '-', $k);
+                    $k = str_replace('"', '-', $k);
+                    $k = str_replace("'", '-', $k);
 
                     $k = $xssClean->clean($k);
                     if($k){

diff --git a/src/MicroweberPackages/Helper/XSSClean.php b/src/MicroweberPackages/Helper/XSSClean.php
@@ -99,6 +99,7 @@ public function clean($html)
             'ondragleave',
             'ondragover',
             'ondragstart',
+            'ondragexit',
             'ondrop',
             'onfocusout',
             'onfullscreenchange',