Review problem - words that contain "on" and brackets after.

[Studio 42]

Have you try to dump the $data to check what is inside the $data['comment'] or with vmdebug ?

[Ventsi Genchev]

Yes of course.

There is no change before and after the FILTER_SANITIZE_STRING. Absolutely no difference:

Code Select Expand

Array
(
    [vote] => 5
    [comment] => Welcome <script> alert(\"Hi virtuemart\")</script>
    ......
)


But if I add the following:
$data['comment'] = 'Welcome <script> alert(\"Hi virtuemart\")</script>';

before:
$data['comment'] = vRequest::filter($data['comment'],FILTER_SANITIZE_STRING, array());

The result after the FILTER_SANITIZE_STRING is:

Code Select Expand

Array
(
    [vote] => 5
    [comment] => Welcome  alert(\"Hi virtuemart\")
    ......
)


[Studio 42]

i think that you have do a mistake.
I tried this and filter is working :

Code Select Expand


// no HTML TAGS but permit all alphabet
$value = filter_var($data['comment'] , FILTER_SANITIZE_STRING);
/* $value = preg_replace('@<[\/\!]*?[^<>]*?>@si','',$data['comment']);//remove all html tags
$value = (string)preg_replace('#on[a-z](.+?)\)#si','',$value);//replace start of script onclick() onload()... */
$value = trim(str_replace('"', ' ', $value),"'") ;
$data['comment'] = (string)preg_replace('#^\'#si','',$value);//replace ' at start
$data['comment'] = nl2br($data['comment']);  // keep returns

[Ventsi Genchev]

Patrick, the last file change was made by Max in revision 10172. The purpose is to fix the old code.
http://dev.virtuemart.net/projects/virtuemart/repository/revisions/10172
I test with it and it doesn't work.

Your code doesn't work either.
Just put this in a review:

Code Select Expand

Welcome <script> alert(\"Hi virtuemart\")</script>
and post it. There is no code cleanup.

Then put the same text here and test:
https://www.w3schools.com/php/phptryit.asp?filename=tryphp_func_sanitize_string

Can you share what text you are testing?

[Studio 42]

I have done the test with input :
"test<script>my script</script>"
Result was "test my script"

[Ventsi Genchev]

Very strange. It doesn't work for me.
In all variants (yours or Max's) it doesn't change the text.

[Milbo]

To see that it got changed, you must open the source in a new tab. Then you will see that for example the < is replaced against &#60

[Ventsi Genchev]

I understand now. I was expecting it to disappear from the text. 

Would you also correct the vm_reviews_maximum_comment_length, please.
Must be reviews_maximum_comment_length.

Thank you.

[Milbo]

Please test http://dev.virtuemart.net/attachments/1204/com_virtuemart.3.6.3.10179_package_or_extract.zip