diff --git a/include/class.format.php b/include/class.format.php index e3f7b415a7553f6f77e6da85b31aff4d2c2f9ba5..e48615ff71848b03b3b6fcc3cb31b15e12ea738b 100644 --- a/include/class.format.php +++ b/include/class.format.php @@ -167,7 +167,7 @@ class Format { if (isset($attributes['class'])) { $classes = explode(' ', $attributes['class']); foreach ($classes as $i=>$a) - // Unset all unsupported style classes -- anything by M$ + // Unset all unsupported style classes -- anything but M$ if (strpos($a, 'Mso') !== 0) unset($classes[$i]); if ($classes) @@ -177,14 +177,16 @@ class Format { } // Clean browser-specific style attributes if (isset($attributes['style'])) { - $styles = explode(';', $attributes['style']); - foreach ($styles as $i=>$s) { + $styles = preg_split('/;\s*/S', html_entity_decode($attributes['style'])); + foreach ($styles as $i=>&$s) { @list($prop, $val) = explode(':', $s); - if (!$val || !$prop || $prop[0] == '-') + if (!$val || !$prop || $prop[0] == '-' || substr($prop, 0, 4) == 'mso-') unset($styles[$i]); + if (!strpos($val, ' ')) + $s = str_replace('"','', $s); } if ($styles) - $attributes['style'] = implode(';', $styles); + $attributes['style'] = Format::htmlencode(implode(';', $styles)); else unset($attributes['style']); } @@ -246,7 +248,7 @@ class Format { } function htmlencode($var) { - $flags = ENT_COMPAT | ENT_QUOTES; + $flags = ENT_COMPAT; if (phpversion() >= '5.4.0') $flags |= ENT_HTML401;