diff --git a/libraries/Message.class.php b/libraries/Message.class.php index 1248acd61..6a4df5b86 100644 --- a/libraries/Message.class.php +++ b/libraries/Message.class.php @@ -647,69 +647,14 @@ class PMA_Message * for formatting * * @static - * @uses PREG_SET_ORDER - * @uses in_array() - * @uses preg_match_all() - * @uses preg_match() - * @uses preg_replace() - * @uses substr() - * @uses strtr() + * @uses PMA_sanitize * @param string $message the message * @return string the decoded message * @access public */ static public function decodeBB($message) { - $replace_pairs = array( - '[i]' => '', // deprecated by em - '[/i]' => '', // deprecated by em - '[em]' => '', - '[/em]' => '', - '[b]' => '', // deprecated by strong - '[/b]' => '', // deprecated by strong - '[strong]' => '', - '[/strong]' => '', - '[tt]' => '', // deprecated by CODE or KBD - '[/tt]' => '', // deprecated by CODE or KBD - '[code]' => '', - '[/code]' => '', - '[kbd]' => '', - '[/kbd]' => '', - '[br]' => '
', - '[/a]' => '', - '[sup]' => '', - '[/sup]' => '', - ); - - $message = strtr($message, $replace_pairs); - - $pattern = '/\[a@([^"@]*)@([^]"]*)\]/'; - - if (preg_match_all($pattern, $message, $founds, PREG_SET_ORDER)) { - $valid_links = array( - 'http', // default http:// links (and https://) - './Do', // ./Documentation - ); - - foreach ($founds as $found) { - // only http... and ./Do... allowed - if (! in_array(substr($found[1], 0, 4), $valid_links)) { - return $message; - } - // a-z and _ allowed in target - if (! empty($found[2]) && preg_match('/[^a-z_]+/i', $found[2])) { - return $message; - } - } - - if (substr($found[1], 0, 4) == 'http') { - $message = preg_replace($pattern, '', $message); - } else { - $message = preg_replace($pattern, '', $message); - } - } - - return $message; + return PMA_sanitize($message, false); } /** diff --git a/libraries/sanitizing.lib.php b/libraries/sanitizing.lib.php index eb8696d95..606c730a1 100644 --- a/libraries/sanitizing.lib.php +++ b/libraries/sanitizing.lib.php @@ -72,7 +72,11 @@ function PMA_sanitize($message, $escape = false) } } - $message = preg_replace($pattern, '', $message); + if (substr($found[1], 0, 4) == 'http') { + $message = preg_replace($pattern, '', $message); + } else { + $message = preg_replace($pattern, '', $message); + } } if ($escape) {