diff --git a/libraries/Message.class.php b/libraries/Message.class.php
index 1248acd61..6a4df5b86 100644
--- a/libraries/Message.class.php
+++ b/libraries/Message.class.php
@@ -647,69 +647,14 @@ class PMA_Message
* for formatting
*
* @static
- * @uses PREG_SET_ORDER
- * @uses in_array()
- * @uses preg_match_all()
- * @uses preg_match()
- * @uses preg_replace()
- * @uses substr()
- * @uses strtr()
+ * @uses PMA_sanitize
* @param string $message the message
* @return string the decoded message
* @access public
*/
static public function decodeBB($message)
{
- $replace_pairs = array(
- '[i]' => '', // deprecated by em
- '[/i]' => '', // deprecated by em
- '[em]' => '',
- '[/em]' => '',
- '[b]' => '', // deprecated by strong
- '[/b]' => '', // deprecated by strong
- '[strong]' => '',
- '[/strong]' => '',
- '[tt]' => '', // deprecated by CODE or KBD
- '[/tt]' => '
', // deprecated by CODE or KBD
- '[code]' => '',
- '[/code]' => '
',
- '[kbd]' => '',
- '[/kbd]' => '',
- '[br]' => '
',
- '[/a]' => '',
- '[sup]' => '',
- '[/sup]' => '',
- );
-
- $message = strtr($message, $replace_pairs);
-
- $pattern = '/\[a@([^"@]*)@([^]"]*)\]/';
-
- if (preg_match_all($pattern, $message, $founds, PREG_SET_ORDER)) {
- $valid_links = array(
- 'http', // default http:// links (and https://)
- './Do', // ./Documentation
- );
-
- foreach ($founds as $found) {
- // only http... and ./Do... allowed
- if (! in_array(substr($found[1], 0, 4), $valid_links)) {
- return $message;
- }
- // a-z and _ allowed in target
- if (! empty($found[2]) && preg_match('/[^a-z_]+/i', $found[2])) {
- return $message;
- }
- }
-
- if (substr($found[1], 0, 4) == 'http') {
- $message = preg_replace($pattern, '', $message);
- } else {
- $message = preg_replace($pattern, '', $message);
- }
- }
-
- return $message;
+ return PMA_sanitize($message, false);
}
/**
diff --git a/libraries/sanitizing.lib.php b/libraries/sanitizing.lib.php
index eb8696d95..606c730a1 100644
--- a/libraries/sanitizing.lib.php
+++ b/libraries/sanitizing.lib.php
@@ -72,7 +72,11 @@ function PMA_sanitize($message, $escape = false)
}
}
- $message = preg_replace($pattern, '', $message);
+ if (substr($found[1], 0, 4) == 'http') {
+ $message = preg_replace($pattern, '', $message);
+ } else {
+ $message = preg_replace($pattern, '', $message);
+ }
}
if ($escape) {